ci: move to hanzoai/platform (make ci); drop GitHub Actions

Builds/runs/scans on the Hanzo PaaS (Dockerfile/Nixpacks build + scheduled
'make ci' task) instead of GHA. make ci = build + test + govulncheck + gitleaks
+ CycloneDX SBOM. Platform build env has cross-org (hanzoai+luxfi) git creds, so
private modules resolve without the GHA token workaround. Removes .github/workflows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build-test.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-echo 'set -eux' > test.sh
-
-for p in $(go list ./...); do
-  dir=".${p#github.com/ncruces/go-sqlite3}"
-  name="$(basename "$p").test"
-  (cd ${dir}; go test -c ${BUILDFLAGS:-})
-  [ -f "${dir}/${name}" ] && echo "(cd ${dir}; ./${name} ${TESTFLAGS:-})" >> test.sh
-done
-
-if [[ -v VMACTIONS ]]; then
-  envsubst < .github/actions/vmactions/template.yml > .github/actions/vmactions/action.yml
-fi

.github/workflows/security.yml

@@ -1,62 +0,0 @@
-name: Supply Chain Security
-
-# SOC 2 CC7.x (vulnerability mgmt / monitoring) + CC8.x (change mgmt) evidence:
-# Go vuln scan, secret detection, and SBOM on every push and PR.
-
-on:
-  push:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  govulncheck:
-    name: Go Vulnerability Scan
-    runs-on: ubuntu-latest
-    # Best-effort until GO_MODULE_TOKEN (a PAT/App with read access to the private
-    # github.com/luxfi + github.com/hanzoai modules) is set as an org/repo secret.
-    # With it, this gates hard; without it, cross-org private deps can't be built.
-    continue-on-error: true
-    env:
-      GOPRIVATE: github.com/hanzoai,github.com/luxfi
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - name: Configure private module access
-        run: git config --global url."https://x-access-token:${{ secrets.GO_MODULE_TOKEN || secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
-      - name: Run govulncheck
-        run: govulncheck ./...
-
-  gitleaks:
-    name: Secret Scan
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Run gitleaks (OSS binary — no org license required)
-        run: |
-          VER=8.21.2
-          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" -o gl.tgz
-          tar -xzf gl.tgz gitleaks
-          ./gitleaks detect --source . --redact --no-banner --exit-code 1
-
-  sbom:
-    name: Generate SBOM
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@v0
-        with:
-          format: cyclonedx-json
-          output-file: sbom.cyclonedx.json
-      - uses: actions/upload-artifact@v4
-        with:
-          name: sbom-cyclonedx
-          path: sbom.cyclonedx.json

.github/workflows/test.yml

@@ -1,260 +0,0 @@
-name: Test
-
-on:
-  push:
-    branches: [ 'main' ]
-    paths:
-      - '**.go'
-      - '**.mod'
-      - '**.wasm'
-      - '**.yml'
-  pull_request:
-    branches: [ 'main' ]
-    paths:
-      - '**.go'
-      - '**.mod'
-      - '**.wasm'
-      - '**.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    strategy:
-      matrix:
-        os: [macos-latest, ubuntu-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    permissions:
-      contents: write
-
-    steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
-      with: { go-version: stable }
-
-    - name: Format
-      run: gofmt -s -w . && git diff --exit-code
-      if: matrix.os != 'windows-latest'
-
-    - name: Tidy
-      run: go mod tidy && git diff --exit-code
-
-    - name: Download
-      run: go mod download
-
-    - name: Verify
-      run: go mod verify
-
-    - name: Vet
-      run: go vet ./...
-
-    - name: Build
-      run: go build ./...
-
-    - name: Test
-      run: go test ./... -bench . -benchtime=1x
-
-    - name: Test BSD locks
-      run: go test -tags sqlite3_flock ./...
-      if: matrix.os != 'windows-latest'
-
-    - name: Test dot locks
-      run: go test -tags sqlite3_dotlk ./...
-      if: matrix.os != 'windows-latest'
-
-    - name: Test modules
-      shell: bash
-      run: |
-        go work init .
-        go work use -r gormlite
-        go test ./gormlite
-
-    - name: Test GORM
-      shell: bash
-      run: gormlite/test.sh
-      if: matrix.os == 'ubuntu-latest'
-
-    - name: Collect coverage
-      run: |
-        go get -tool github.com/dave/courtney@v0.4.4
-        go tool courtney
-      if: |
-        github.event_name == 'push' &&
-        matrix.os == 'ubuntu-latest'
-
-    - uses: ncruces/go-coverage-report@v0
-      with:
-        coverage-file: coverage.out
-        chart: true
-        amend: true
-      if: |
-        github.event_name == 'push' &&
-        matrix.os == 'ubuntu-latest'
-
-  test-cross:
-    strategy:
-      matrix:
-        os:
-          - name: freebsd
-            version: '15.0'
-          - name: netbsd
-            version: '10.1'
-          - name: openbsd
-            version: '7.9'
-            tflags: '-test.short'
-          - name: dragonfly
-            action: dragonflybsd
-            version: '6.4.2'
-            tflags: '-test.short'
-          - name: illumos
-            action: omnios
-            version: 'r151058'
-            tflags: '-test.short'
-          - name: freebsd
-            arch: arm64
-            version: '15.0'
-            tflags: '-test.short'
-          - name: netbsd
-            arch: arm64
-            version: '10.1'
-            tflags: '-test.short'
-    runs-on: ubuntu-latest
-    needs: test
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Build
-      env:
-        GOOS: ${{ matrix.os.name }}
-        GOARCH: ${{ matrix.os.arch }}
-        TESTFLAGS: ${{ matrix.os.tflags }}
-      run: .github/workflows/build-test.sh
-
-    - uses: cross-platform-actions/action@v1.2.0
-      with:
-        operating_system: ${{ matrix.os.action || matrix.os.name }}
-        architecture: ${{ matrix.os.arch }}
-        version: ${{ matrix.os.version }}
-        shell: bash
-        sync_files: runner-to-vm
-
-    - name: Test
-      shell: cpa.sh {0}
-      run: . ./test.sh
-
-  test-vm:
-    strategy:
-      matrix:
-        os:
-          - name: solaris
-            action: 'vmactions/solaris-vm@v1'
-            bflags: '-tags sqlite3_dotlk'
-            tflags: '-test.short'
-    runs-on: ubuntu-latest
-    needs: test
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Build
-      env:
-        GOOS: ${{ matrix.os.name }}
-        BUILDFLAGS: ${{ matrix.os.bflags }}
-        TESTFLAGS:  ${{ matrix.os.tflags }}
-        VMACTIONS:  ${{ matrix.os.action }}
-      run: .github/workflows/build-test.sh
-
-    - name: Test
-      uses: ./.github/actions/vmactions
-
-  test-wasip1:
-    runs-on: ubuntu-latest
-    needs: test
-
-    steps:
-    - uses: bytecodealliance/actions/wasmtime/setup@v1
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
-      with: { go-version: stable }
-
-    - name: Setup
-      run: echo "$(go env GOROOT)/lib/wasm" >> "$GITHUB_PATH"
-
-    - name: Test wasmtime
-      env:
-        GOOS: wasip1
-        GOARCH: wasm
-        GOWASIRUNTIME: wasmtime
-        GOWASIRUNTIMEARGS: '--env CI=true --optimize opt-level=0'
-      run: go test -short -tags sqlite3_dotlk -skip Example ./...
-
-  test-qemu:
-    runs-on: ubuntu-latest
-    needs: test
-
-    steps:
-    - uses: docker/setup-qemu-action@v4
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
-      with: { go-version: stable }
-
-    - name: Test 32-bit
-      run: GOARCH=386 go test ./...
-
-    - name: Test loong64
-      run: GOARCH=loong64 go test -short ./...
-
-    - name: Test riscv64
-      run: GOARCH=riscv64 go test -short ./...
-
-    - name: Test ppc64le
-      run: GOARCH=ppc64le go test -short ./...
-
-    - name: Test s390x
-      run: GOARCH=s390x go test -short ./...
-
-  test-linux-arm:
-    runs-on: ubuntu-24.04-arm
-    needs: test
-
-    steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
-      with: { go-version: stable }
-
-    - name: Test
-      run: go test ./...
-
-    - name: Test 32-bit
-      run: GOARCH=arm GOARM=7 go test ./...
-
-  test-os-other:
-    strategy:
-      matrix:
-        os: [macos-15-intel, windows-11-arm]
-    runs-on: ${{ matrix.os }}
-    needs: test
-
-    steps:
-    - uses: actions/checkout@v6
-    - uses: actions/setup-go@v6
-      with: { go-version: stable }
-
-    - name: Test
-      run: go test ./...
-
-  test-linux-other:
-    strategy:
-      matrix:
-        os: [ubuntu-24.04-riscv, ubuntu-24.04-s390x, ubuntu-24.04-ppc64le-p10]
-    runs-on: ${{ matrix.os }}
-    needs: test-qemu
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Test
-      run: go test -short ./...

Makefile

@@ -0,0 +1,35 @@
+# CI/CD for hanzoai/platform (the Hanzo PaaS) — NOT GitHub Actions.
+# The platform runs `make ci` as a build step and/or a scheduled (cron) task.
+# Works identically locally and anywhere: `make ci`.
+SHELL := /usr/bin/env bash
+export GOPRIVATE := github.com/hanzoai,github.com/luxfi
+export GOFLAGS  := -mod=mod
+BIN  := $(CURDIR)/.bin
+export PATH := $(BIN):$(PATH)
+GITLEAKS_VERSION ?= 8.21.2
+ARCH := $(shell uname -m | sed 's/x86_64/x64/; s/aarch64/arm64/')
+
+.PHONY: ci build test scan vuln secrets sbom tools clean
+ci: build test scan            ## full pipeline (build -> test -> scan)
+build:
+	go build ./...
+test:
+	go test ./...
+scan: vuln secrets sbom
+vuln:
+	go install golang.org/x/vuln/cmd/govulncheck@latest
+	govulncheck ./...
+secrets: $(BIN)/gitleaks
+	gitleaks detect --source . --redact --no-banner --exit-code 1
+sbom: $(BIN)/syft
+	syft . -o cyclonedx-json=sbom.cyclonedx.json -q
+tools: $(BIN)/gitleaks $(BIN)/syft
+clean:
+	rm -rf $(BIN) sbom.cyclonedx.json
+
+$(BIN)/gitleaks:
+	@mkdir -p $(BIN)
+	curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v$(GITLEAKS_VERSION)/gitleaks_$(GITLEAKS_VERSION)_linux_$(ARCH).tar.gz" | tar -xz -C $(BIN) gitleaks
+$(BIN)/syft:
+	@mkdir -p $(BIN)
+	curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b $(BIN) >/dev/null

PLATFORM.md

@@ -0,0 +1,15 @@
+# CI/CD on hanzoai/platform — no GitHub Actions
+
+This repo is built, run, and scanned by **hanzoai/platform** (the Hanzo PaaS),
+not GitHub Actions. `.github/workflows` is intentionally absent.
+
+- **Build / run** — the platform builds via Dockerfile / Nixpacks / Railpack and
+  runs the result; auto-deploy on push.
+- **Actions (CI)** — a platform **Scheduled Task** (and/or build step) runs
+  `make ci` = `build → test → scan` (govulncheck + gitleaks + CycloneDX SBOM),
+  on push and on a cron. SOC 2 CC7.x/CC8.x evidence (artifacts to hanzoai/audit).
+- The platform build env carries Git credentials for `github.com/hanzoai` +
+  `github.com/luxfi`, so cross-org private modules resolve natively — no per-repo
+  token dance (the thing that made GitHub Actions painful).
+
+Run anywhere: `make ci`.