40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# Hermes WebUI release lane
|
|
|
|
Hermes WebUI has a release lane separate from `hermes-agent-image`. The lane
|
|
builds `dockerfiles/Dockerfile.hermes-webui` from one exact reviewed `main`
|
|
commit, publishes a unique immutable Harbor tag, independently verifies the
|
|
Harbor digest, and renders a review-only Flux patch. It never writes Git and it
|
|
never reconciles or restarts a workload.
|
|
|
|
## Release sequence
|
|
|
|
1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
|
|
2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins
|
|
JCasC from reviewed `main`.
|
|
3. Open the manual Jenkins job `hermes-webui-image` and set:
|
|
- `PUBLISH_IMAGE=true`
|
|
- `EXPECTED_SOURCE_REVISION` to the full 40-character `main` commit
|
|
- `CONFIRM_PUBLISH=PUBLISH HERMES WEBUI`
|
|
4. Retain the fingerprinted seven-file artifact set. In particular, compare
|
|
`hermes-webui-image.json` with Harbor and review
|
|
`hermes-webui-image-update.patch`.
|
|
5. Apply that patch on a fresh branch and open a separate review. The patch is
|
|
constrained to the `webui` container in:
|
|
- `StatefulSet/hermes-chat-tenant`
|
|
- `Deployment/hermes`
|
|
6. Merge the digest-only review to let Flux roll out desired state. Do not use a
|
|
manual `kubectl set image`, restart, or reconcile as a release substitute.
|
|
|
|
The release fails closed when the requested revision is not the checked-out
|
|
`origin/main`, the unique Harbor tag already exists, the exact WebUI immutable
|
|
tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux
|
|
workload changes identity/image shape, or the evidence archive is incomplete.
|
|
|
|
## PWA identity source
|
|
|
|
The installed application uses the tracked canonical persona at
|
|
`dockerfiles/hermes-webui-assets/hermes-agent.ico`. Provenance, the canonical
|
|
SHA-256, and derivation details for the required 192px/512px PNGs are recorded
|
|
beside the asset in `SOURCE.md`; the image build never reads an icon from a
|
|
running coordinator.
|