From 36d181a100609e44d80779cd3cfb398915f59eca Mon Sep 17 00:00:00 2001 From: hanzo-dev Date: Thu, 6 Aug 2026 02:36:28 -0700 Subject: [PATCH] =?UTF-8?q?ci:=20canonical=20pair=20=E2=80=94=20hanzo.yml?= =?UTF-8?q?=20+=20forge=20caller?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit github.com has no runner for hanzo-build-linux-amd64, so a caller under .github/workflows is a gate that can never be scheduled. This is the ~7-line caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1. Co-authored-by: Hanzo Dev --- .hanzo/workflows/cicd.yml | 15 +++++++++++++++ hanzo.yml | 17 +++++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 .hanzo/workflows/cicd.yml create mode 100644 hanzo.yml diff --git a/.hanzo/workflows/cicd.yml b/.hanzo/workflows/cicd.yml new file mode 100644 index 00000000..1600c8df --- /dev/null +++ b/.hanzo/workflows/cicd.yml @@ -0,0 +1,15 @@ +# Canonical caller — every knob lives in /hanzo.yml, none here. +# Runs on the git-runner fleet at git.hanzo.ai, the only pool serving these +# labels. github.com resolves only .github/workflows and has no runner for +# them, so a caller placed there is a gate that cannot be scheduled. +name: CI/CD +on: + push: + branches: [master] + tags: ['v*'] + pull_request: + workflow_dispatch: +jobs: + cicd: + uses: hanzoai/ci/.hanzo/workflows/build.yml@v1 + secrets: inherit diff --git a/hanzo.yml b/hanzo.yml new file mode 100644 index 00000000..d3dc5f3f --- /dev/null +++ b/hanzo.yml @@ -0,0 +1,17 @@ +# Canonical CI/CD config for hanzoai/session (express-session) — read by the +# hanzoai/ci reusable workflow (.hanzo/workflows/cicd.yml) and by +# platform.hanzo.ai. +# +# LIBRARY: Express session middleware. No image, no deploy — it ships from a tag. +# +# The gate is the mocha suite. It is worth stating what it covers, because this +# is session middleware and the failure mode is not "throws": the suite asserts +# cookie attributes (secure, httpOnly, sameSite, domain, path, expiry), session +# regeneration and destruction, the trust-proxy path, and the rolling/resave/ +# saveUninitialized matrix. Every one of those is a security property that a +# lint or a build would sail straight past. +# +# `npm install`, not `npm ci`: this repo ships no package-lock.json. +test: + - name: test + run: npm install && npm test