4 Commits
Author SHA1 Message Date
zeekayandHanzo Dev 2a5df6dad1 Workflows ask for the runner label that exists
One label per runner, spelled <os>-<arch>. The aliases these jobs named
were removed, and a job naming a label no runner carries waits instead of
failing.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-16 01:54:56 -07:00
zeekayandHanzo Dev 889ee1871c ci: tag releases as Zach Kelling
Release tags were made by the automation address as tagger instead of the owner.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-10 14:06:26 -07:00
zeekayandHanzo Dev 54daac0463 ci: the smoke rejected basePath apps for an asset that was present
A Next.js app served at /forum emits /forum/_next/... into index.html while the
image holds /_next/... — the prefix is added by the router, not by the layer. The
check resolved only the literal path, so it failed forum and help on assets that
were in the image all along, and it also asserted that a bare href="/forum" — a
navigation link, not a file — existed on disk.

Now: only references naming a file are checked, and each resolves either
directly or with the leading basePath segment stripped. A genuinely absent
chunk still fails, which was the point of the check.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-06 18:10:49 -07:00
zeekayandHanzo Dev 260abb43ba ci: build on our own runners — this workflow ran nowhere at all
publish.yml asked for `runs-on: ubuntu-latest`. The git-runner behind
git.hanzo.ai advertises ~28 labels and that is not one of them, so the job was
never picked up here — it is one of 44 jobs sitting in `waiting` for exactly
that label. On GitHub it was equally stuck, because the luxfi org has zero
registered runners. Addressed to a runner that exists in neither place, it was
not a build; it was a queue entry.

Also removed, both GitHub-only assumptions:
  - ghcr login via github.actor + secrets.GITHUB_TOKEN. On this forge
    GITHUB_TOKEN is minted by git.hanzo.ai and ghcr.io answers `denied: denied`.
    GHCR_USER/GHCR_TOKEN are luxfi org-level secrets here.
  - cache-from/to: type=gha, which addresses the GitHub Actions cache service.

The v1.x.x bump is untouched: feat/BREAKING/type! to minor, else patch, never
a major. What changes is that the tag push now goes to github.com rather than
to the forge — this repo is a pull-mirror here and refuses receive-pack, so the
old `|| echo "tag push skipped"` had been silently tagging nothing.

Adds the checks node's release.yml learned the hard way: smoke the image before
it is allowed to exist at the registry, prove the pushed manifest resolves, and
stamp revision/ref/source labels. The smoke checks what a static-server image
cannot check itself — index.html exists and every asset it references is really
in the layer — so a hollow build cannot serve a white page with a 200.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-06 17:51:14 -07:00