Git of record moves to git.hanzo.ai; GitHub becomes a mirror.
- .gitea/workflows/{ci,publish}.yml — native pipeline on hanzo-build-linux-amd64
act_runners. publish.yml pulls Chrome Web Store + Firefox AMO + npm creds from
KMS via the machine identity (no store cred in any Actions secret store).
- deploy/kms/extension-publish-kms-sync.yaml — KMSSecret CR; canonical KMS path
hanzo:/extension-publish (env prod) for the store creds.
- .github/workflows/sync.yml — mirror main+tags to git.hanzo.ai (the only thing
GitHub does as system of record; no-op until HANZO_GIT_TOKEN seeded).
- .github/workflows/publish.yml — remove store-publish steps (CWS/AMO/VSCE/OVSX/
JetBrains — all no-ops today, those secrets never existed on GitHub). Keep the
live npm publish (interim) + the downloadable GitHub Release.
- docs: PUBLISHING.md + LLM.md rewritten to the native topology.
Non-breaking: npm publish (@hanzo/browser-extension) untouched. No store publish
in this pass. Gated on operator: seed KMS store values, Gitea secrets, mirror.
- Add publish.yml workflow for automated publishing
- Publish to VS Code Marketplace and Open VSX
- Publish @hanzo/mcp to npm
- Publish JetBrains plugin to JetBrains Marketplace
- Package browser extension for Chrome/Firefox stores
- Add PUBLISHING.md with setup instructions and secrets
Hanzo AI