ci: native .hanzo/workflows build + git.hanzo.ai sync (additive)
This commit is contained in:
hanzo-dev
@@ -0,0 +1,44 @@
|
||||
name: Sync to git.hanzo.ai
|
||||
# hanzoai/world is NATIVE on git.hanzo.ai (hanzoai/git) — canonical repo + where CI/CD
|
||||
# runs: build/test/release from .hanzo/workflows/ on the Hanzo git-runner. GitHub is the
|
||||
# DOWNSTREAM MIRROR. The mirror App already syncs on push; this is the explicit,
|
||||
# self-documenting belt-and-suspenders — its presence in .github/ signals
|
||||
# "this repo migrated to git.hanzo.ai."
|
||||
#
|
||||
# IDEMPOTENT: mirror-sync just tells Gitea to pull HEAD, so N nudges == 1 (same latest
|
||||
# state); concurrency coalesces a burst of pushes to a single in-flight sync. FAST: no
|
||||
# checkout, one bounded curl, hard timeouts. FAIL-SOFT: a missing token or hiccup never
|
||||
# fails the push (the App webhook still mirrors). Set HANZO_GIT_TOKEN to enable the nudge.
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
workflow_dispatch:
|
||||
|
||||
# Only the newest push's sync needs to run — cancel any older in-flight one (it would
|
||||
# pull a now-stale HEAD). This is what makes rapid pushes idempotent + cheap.
|
||||
concurrency:
|
||||
group: sync-git-hanzo-ai
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
sync:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 2
|
||||
steps:
|
||||
- name: Nudge git.hanzo.ai to pull HEAD (mirror-sync)
|
||||
continue-on-error: true
|
||||
env:
|
||||
HANZO_GIT_TOKEN: ${{ secrets.HANZO_GIT_TOKEN }}
|
||||
run: |
|
||||
set -u
|
||||
if [ -z "${HANZO_GIT_TOKEN:-}" ]; then
|
||||
echo "HANZO_GIT_TOKEN not set — relying on the mirror App webhook. Skipping nudge."
|
||||
exit 0
|
||||
fi
|
||||
if curl -fsS --max-time 20 --retry 2 --retry-delay 2 -X POST \
|
||||
-H "Authorization: token ${HANZO_GIT_TOKEN}" \
|
||||
"https://git.hanzo.ai/api/v1/repos/hanzoai/world/mirror-sync"; then
|
||||
echo "git.hanzo.ai mirror-sync triggered"
|
||||
else
|
||||
echo "mirror-sync nudge failed (non-fatal) — the App webhook still mirrors"
|
||||
fi
|
||||
@@ -0,0 +1,116 @@
|
||||
name: Release
|
||||
# Cuts a release of ghcr.io/hanzoai/world — the static SPA frontend image (Vite ->
|
||||
# hanzoai/static) the operator CR pins. Mirrors hanzoai/app/release.yml:
|
||||
# a git tag v<X.Y.Z> ⇔ an image ghcr.io/hanzoai/world:v<X.Y.Z>
|
||||
# Builds on the git.hanzo.ai native runner (git-runner). ghcr auth via GH_PAT / user
|
||||
# hanzo-dev.
|
||||
#
|
||||
# ADDITIVE MIGRATION NOTE: the legacy .github lane (docker-build.yml) does NOT cut
|
||||
# v-tags — it only REACTS to `tags: ['v*']` to build+deploy. So there is no
|
||||
# competing tag-cutter and no version runaway. paths-ignore below keeps this native
|
||||
# release from re-firing on .github/** or doc-only edits.
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
# Workflow/doc-only edits must NOT cut a release. Real code changes on main still
|
||||
# trigger; use workflow_dispatch to force.
|
||||
paths-ignore:
|
||||
- '.github/**'
|
||||
- '**.md'
|
||||
workflow_dispatch:
|
||||
permissions:
|
||||
contents: write
|
||||
packages: write
|
||||
id-token: write
|
||||
concurrency:
|
||||
group: release-world
|
||||
cancel-in-progress: false
|
||||
jobs:
|
||||
build-amd64:
|
||||
runs-on: [hanzo-build-linux-amd64]
|
||||
steps:
|
||||
- name: Checkout (full history + tags — version floor read from tags)
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
fetch-tags: true
|
||||
- name: Compute next version (monotonic patch bump over the 2.4.x deploy line)
|
||||
id: ver
|
||||
env:
|
||||
GH_PAT: ${{ secrets.GH_PAT }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git fetch --tags --force --quiet
|
||||
# The deployed lineage is 2.4.x: the newest-by-date tags on main are v2.4.48,
|
||||
# v2.4.47, ... (HEAD is "release: v2.4.48") and every recent release commit is
|
||||
# on it. Stray tags exist off that line — notably v2.9.32 (a July-9 relic,
|
||||
# numerically largest but OLDER than the active 2.4 stream) and the 2.5.x
|
||||
# cluster. `sort -V` is purely numeric, so an UNCONSTRAINED scan lets the
|
||||
# v2.9.32 orphan hijack the floor and cut a v2.9.33 the deploy stream can't
|
||||
# follow. Pin the scan to the 2.4. line so the bump stays monotonic over the
|
||||
# ACTUAL deploy stream, not the numerically-largest orphan tag.
|
||||
LINE='2.4.'
|
||||
git_max="$(git tag -l "v${LINE}[0-9]*" \
|
||||
| sed 's/^v//' | grep -E "^${LINE//./\\.}[0-9]+$" | sort -V | tail -1 || true)"
|
||||
# Fold in ALREADY-PUSHED container tags on the same line, so a number that has
|
||||
# an image (even from a run that died before git-tagging) is never reused.
|
||||
# Best-effort — never fails the run if the API is down. Use curl (universally
|
||||
# present) NOT gh. Fold BOTH v-prefixed and legacy non-v 2.9.x image tags.
|
||||
cont_max=""
|
||||
if [ -n "${GH_PAT:-}" ]; then
|
||||
_pkgjson="$(curl -fsSL -H "Authorization: Bearer $GH_PAT" \
|
||||
-H "Accept: application/vnd.github+json" \
|
||||
'https://api.github.com/orgs/hanzoai/packages/container/world/versions?per_page=100' 2>/dev/null || true)"
|
||||
cont_max="$(printf '%s' "$_pkgjson" \
|
||||
| { jq -r '.[].metadata.container.tags[]?' 2>/dev/null || grep -oE '"v?[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"'; } \
|
||||
| sed 's/^v//' | grep -E "^${LINE//./\\.}[0-9]+$" | sort -V | tail -1 || true)"
|
||||
fi
|
||||
max="$(printf '%s\n%s\n%s\n' "${LINE}0" "$git_max" "$cont_max" \
|
||||
| grep -E "^${LINE//./\\.}[0-9]+$" | sort -V | tail -1)"
|
||||
major="${max%%.*}"; rest="${max#*.}"; minor="${rest%%.*}"; patch="${rest##*.}"
|
||||
version="${major}.${minor}.$((patch + 1))"
|
||||
if git rev-parse -q --verify "refs/tags/v${version}" >/dev/null; then
|
||||
echo "::error::computed v${version} already exists — aborting to avoid collision"; exit 1
|
||||
fi
|
||||
echo "version_v=v${version}" >> "$GITHUB_OUTPUT"
|
||||
echo "Next release: v${version} (git_max='${git_max:-none}' container_max='${cont_max:-none}')"
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
with:
|
||||
driver: docker-container
|
||||
driver-opts: network=host
|
||||
- name: Log in to ghcr.io (GH_PAT, write:packages)
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: hanzo-dev
|
||||
password: ${{ secrets.GH_PAT }}
|
||||
- name: Build + push ghcr.io/hanzoai/world
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: ./Dockerfile
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
tags: ghcr.io/hanzoai/world:${{ steps.ver.outputs.version_v }}
|
||||
provenance: false
|
||||
- name: Verify the pushed image is pullable (guard the image ⇔ tag invariant)
|
||||
# build-push-action can exit 0 while the manifest isn't yet resolvable at the
|
||||
# registry. Prove the image resolves BEFORE creating the git tag, so a bad push
|
||||
# fails the run instead of leaving a phantom tag → ImagePullBackOff.
|
||||
run: |
|
||||
set -euo pipefail
|
||||
v="${{ steps.ver.outputs.version_v }}"
|
||||
for i in 1 2 3 4 5 6; do
|
||||
if docker manifest inspect "ghcr.io/hanzoai/world:${v}" >/dev/null 2>&1; then
|
||||
echo "image ${v} is resolvable — safe to tag"; exit 0
|
||||
fi
|
||||
echo "ghcr manifest ${v} not visible yet (attempt ${i}/6) — retrying"; sleep 5
|
||||
done
|
||||
echo "::error::image ${v} not pullable after push — refusing to tag git (prevents ImagePullBackOff)"; exit 1
|
||||
- name: Tag the release (image ⇔ tag invariant)
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git tag "${{ steps.ver.outputs.version_v }}"
|
||||
git push origin "${{ steps.ver.outputs.version_v }}"
|
||||
echo "Pushed image + tag ${{ steps.ver.outputs.version_v }} — bump the operator CR to deploy."
|
||||
Reference in New Issue
Block a user