titan/atlas-iac
3
0
Fork 0
Code Issues Pull Requests 9 Actions Packages Projects Releases Wiki Activity
atlas-iac/docs/hermes_webui_release.md
Hermes Agent 35e47479cc Add reviewed Hermes WebUI release lane
2026-08-23 01:32:05 +00:00

1.9 KiB
Raw Blame History

Hermes WebUI release lane

Hermes WebUI has a release lane separate from hermes-agent-image. The lane builds dockerfiles/Dockerfile.hermes-webui from one exact reviewed main commit, publishes a unique immutable Harbor tag, independently verifies the Harbor digest, and renders a review-only Flux patch. It never writes Git and it never reconciles or restarts a workload.

Release sequence

  1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
  2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins JCasC from reviewed main.
  3. Open the manual Jenkins job hermes-webui-image and set:
    • PUBLISH_IMAGE=true
    • EXPECTED_SOURCE_REVISION to the full 40-character main commit
    • CONFIRM_PUBLISH=PUBLISH HERMES WEBUI
  4. Retain the fingerprinted seven-file artifact set. In particular, compare hermes-webui-image.json with Harbor and review hermes-webui-image-update.patch.
  5. Apply that patch on a fresh branch and open a separate review. The patch is constrained to the webui container in:
    • StatefulSet/hermes-chat-tenant
    • Deployment/hermes
  6. Merge the digest-only review to let Flux roll out desired state. Do not use a manual kubectl set image, restart, or reconcile as a release substitute.

The release fails closed when the requested revision is not the checked-out origin/main, the unique Harbor tag already exists, the exact WebUI immutable tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux workload changes identity/image shape, or the evidence archive is incomplete.

PWA identity source

The installed application uses the tracked canonical persona at dockerfiles/hermes-webui-assets/hermes-agent.ico. Provenance, the canonical SHA-256, and derivation details for the required 192px/512px PNGs are recorded beside the asset in SOURCE.md; the image build never reads an icon from a running coordinator.