dao/.github/workflows/vote.yml at d307e2dd7f99890e9998a5e1828e5b9eedd56d04

luxfi/dao

mirror of https://github.com/luxfi/dao.git synced 2026-07-27 02:51:24 +00:00

Files

T

zeekayandClaude d307e2dd7f ci(vote): bump app to 813ad9b (0-console-error load + per-brand head/manifest white-label)

app 813ad9b: stop the eth-mainnet ENS flood (disable ENS on non-ENS chains instead of
falling back to chain 1's empty-key Alchemy RPC) + honest safe-cgw /multisig-transactions
404 (no console.error on the expected missing route) → lux.vote loads with 0 console errors.
Head + PWA manifest are now white-labelled purely via build-args; wire the new
VITE_APP_FAVICON_SVG per brand (lux=/lux-triangle.svg, zoo=/images/dao/zoo-labs.svg) so
zoo.vote no longer leaks /lux-triangle.svg or 'Lux DAO' in its head.

Co-Authored-By: Claude <noreply@anthropic.com>

2026-07-18 23:40:24 -07:00

139 lines

6.2 KiB

YAML

Raw Blame History

 name: Vote
 # Build the lux.vote / zoo.vote governance images on luxfi's in-cluster ARC pool
 # and push them to GHCR. Same in-org self-hosted pattern proven green by
 # luxfi/work-board · luxfi/node · luxfi/dex.
 #
 # ONE source (luxdao/app) white-labels per tenant PURELY via build-args, so the
 # same tree builds every brand from app/Dockerfile.k8s. The build CONTEXT is the
 # repo root so BOTH sibling submodules are present:
 #   app/        (luxdao/app        — the governance SPA)
 #   contracts/  (luxdao/contracts  — the "@luxdao/contracts": "file:../contracts" dep)
 # Both are PUBLIC. The dao tree ALSO gitlinks sdk/stack/subgraph/ui-automation,
 # which the image does not use — so we do NOT checkout recursively (that fatals on
 # the unmapped ones). Instead init ONLY app + contracts, with a full (non-shallow)
 # clone so the recorded contracts SHA (an ancestor of main, not its tip) resolves.
 #
 #   lux -> ghcr.io/luxfi/dao-vote:lux-<sha>   (lux.vote  · chain 96369)
 #   zoo -> ghcr.io/luxfi/dao-vote:zoo-<sha>   (zoo.vote  · chain 200200)
 # Immutable per-commit tag, one per brand; never :latest / :main. The image org
 # follows the repo org (luxfi); the brand lives in the tag — no cross-org mixing.
 # VITE_APP_GOV_EXECUTE_ENABLED is deliberately UNSET so treasury-moving proposal
 # execution stays GATED on mainnet.
 #
 # NOTE: the org-canonical reusable `hanzoai/.github/.../docker-build.yml@main` is
 # NOT usable from luxfi — hanzoai/.github is PRIVATE and cross-org `uses:` is
 # blocked at parse time. This workflow builds entirely within the luxfi org, on the
 # luxfi-scoped `lux-build-amd64` ARC pool, so it actually runs and the default
 # GITHUB_TOKEN can push to ghcr.io/luxfi. Same DinD buildx pattern proven green on
 # luxfi/work-board.
 on:
   workflow_dispatch:
   push:
     branches: [main]
 permissions:
   contents: read
   packages: write
 jobs:
   build:
     # lux-build-amd64: in-cluster ARC scale-set (lux-k8s, amd64 DOKS, DinD).
     # amd64-only — the deploy target (hanzo-k8s) is amd64; a static SPA needs no arm64.
     runs-on: lux-build-amd64
     strategy:
       fail-fast: false
       matrix:
         include:
           - brand: lux
             app_name: Lux DAO
             chain_id: "96369"
             site_url: https://lux.vote
             overrides: '{"96369":{"rpc":"https://api.lux.network/v1/bc/C/rpc"}}'
             # White-label favicon (the SVG in the <head>). Per-brand asset shipped in public/.
             favicon_svg: /lux-triangle.svg
             # WalletConnect Cloud project id for the Lux DAO (origin-allowlisted to lux.vote).
             # This is a PUBLIC client identifier (ships in the bundle), not a secret. Was wrongly
             # sharing the Pars id, which is allowlisted for pars.vote -> connect verify mismatch.
             wc_project_id: "22b98f00bd4572e2a42773ad82b329b0"
           - brand: zoo
             app_name: Zoo DAO
             chain_id: "200200"
             site_url: https://zoo.vote
             overrides: '{"200200":{"rpc":"https://api.zoo.network/v1/bc/C/rpc"}}'
             favicon_svg: /images/dao/zoo-labs.svg
             wc_project_id: "e89228fed40d4c6e9520912214dfd68b"
     steps:
       - uses: actions/checkout@v4
       - name: Init the app + contracts submodules (the only two the image needs)
         # dao also gitlinks sdk/stack/subgraph/ui-automation (unused by the build and
         # not mapped in .gitmodules); a recursive checkout would fatal on them. Init
         # exactly the two the Dockerfile copies. Default full clone => the behind-tip
         # contracts gitlink resolves.
         run: git submodule update --init app contracts
       - name: Resolve local-dev file links to their published npm packages
         # app/package.json links two deps to sibling monorepos that are absent in a
         # clean CI checkout, so pnpm/vite can't resolve them:
         #   @luxfi/ui         -> file:../../ui/pkg/ui  (the @hanzo/ui components;
         #                        DECLARED-BUT-UNUSED — no `from '@luxfi/ui'` in app src)
         #   @luxdao/contracts -> file:../contracts     (governance ABIs, imported 53x;
         #                        its main is publish/index.js, an unbuilt artifact)
         # Redirect BOTH to the published packages they mirror at the SAME versions, so
         # the container build resolves against real, reproducible npm packages.
         # Ephemeral build-input rewrite ONLY — never committed to luxdao/app; the app
         # stays pristine at its pinned gitlink.
         run: |
           sed -i \
             -e 's#"@luxfi/ui": "file:../../ui/pkg/ui"#"@luxfi/ui": "npm:@hanzo/ui@8.0.2"#' \
             -e 's#"@luxdao/contracts": "file:../contracts"#"@luxdao/contracts": "2.0.0"#' \
             app/package.json
           grep -nE '"@luxfi/ui"|"@luxdao/contracts"' app/package.json
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
           driver: docker-container
           driver-opts: |
             network=host
       - name: Login to GHCR
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Image metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/luxfi/dao-vote
           flavor: |
             latest=false
           tags: |
             type=sha,format=short,prefix=${{ matrix.brand }}-
       - name: Build & push
         uses: docker/build-push-action@v6
         with:
           context: .
           file: app/Dockerfile.k8s
           platforms: linux/amd64
           push: true
           # White-label PURELY via build-args. VITE_APP_GOV_EXECUTE_ENABLED is left
           # unset on purpose (execution stays gated on mainnet).
           build-args: |
             VITE_APP_NAME=${{ matrix.app_name }}
             VITE_APP_DEFAULT_CHAIN_ID=${{ matrix.chain_id }}
             VITE_APP_SITE_URL=${{ matrix.site_url }}
             VITE_APP_WALLET_CONNECT_PROJECT_ID=${{ matrix.wc_project_id }}
             VITE_APP_NETWORK_OVERRIDES=${{ matrix.overrides }}
             VITE_APP_FAVICON_SVG=${{ matrix.favicon_svg }}
             VITE_APP_GIT_HASH=${{ matrix.brand }}-vote
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false

139 lines 6.2 KiB YAML Raw Blame History

139 lines

6.2 KiB

YAML

Raw Blame History