Resolution strategy: Hanzo (kv) is on the upstream 'unstable' branch
which has more features than the 9.0.4-lts release. For all 114 conflict
files, take HEAD verbatim to preserve Hanzo's feature set and rebrand.
CVE security fixes from 9.0.4 will be cherry-picked separately:
- CVE-2026-23479 (UAF in unblockClientOnKey)
- CVE-2026-25243 (RESTORE malformed zipmap)
- CVE-2026-23631 (Lua script full sync UAF)
Required for hanzoai/.github/.github/workflows/docker-build.yml@main —
without it the workflow_call dies as startup_failure with no jobs
dispatched. Caller permissions are a CEILING.
Replace bespoke 59-line docker build with the 10-line canonical caller
that uses hanzoai/.github/.github/workflows/docker-build.yml@main.
Native amd64+arm64 ARC runners, semver + branch tags, multi-arch manifest
via the one shared workflow path. Cache-key preserved for scope=kv.
Co-authored-by: Hanzo AI <dev@hanzo.ai>
Required for hanzoai/.github/.github/workflows/docker-build.yml@main —
without it the workflow_call dies as startup_failure with no jobs
dispatched. Caller permissions are a CEILING.
Replace bespoke 59-line docker build with the 10-line canonical caller
that uses hanzoai/.github/.github/workflows/docker-build.yml@main.
Native amd64+arm64 ARC runners, semver + branch tags, multi-arch manifest
via the one shared workflow path. Cache-key preserved for scope=kv.
Co-authored-by: Hanzo AI <dev@hanzo.ai>
Replace bespoke 59-line docker build with the 10-line canonical caller
that uses hanzoai/.github/.github/workflows/docker-build.yml@main.
Native amd64+arm64 ARC runners, semver + branch tags, multi-arch manifest
via the one shared workflow path. Cache-key preserved for scope=kv.
Fetch DOCKERHUB_USERNAME, DOCKERHUB_TOKEN, and DIGITALOCEAN_ACCESS_TOKEN
from kms.hanzo.ai at runtime via Universal Auth. Re-enable deploy-hanzo
job targeting statefulset/redis-master container kv on hanzo-k8s cluster.
Split Docker Hub push as continue-on-error with GHCR as primary registry.
Production redis uses bitnami/redis via Helm chart. The hanzoai/kv
image has a different entrypoint and is not a drop-in replacement.
Build+push to GHCR still works. Deploy will be re-enabled once K8s
manifests are migrated to use hanzoai/kv natively.
Replace direct GitHub secrets (DOCKERHUB_USERNAME, DOCKERHUB_TOKEN,
DIGITALOCEAN_ACCESS_TOKEN) with KMS Universal Auth fetch at runtime.
Only KMS_CLIENT_ID and KMS_CLIENT_SECRET remain as GitHub secrets.
Hanzo Dev
