50 lines
2.6 KiB
Markdown
50 lines
2.6 KiB
Markdown
# Hermes WebUI release lane
|
|
|
|
Hermes WebUI has a release lane separate from `hermes-agent-image`. The lane
|
|
builds `dockerfiles/Dockerfile.hermes-webui` from one exact reviewed `main`
|
|
commit, publishes a unique immutable Harbor tag, independently verifies the
|
|
Harbor digest, and renders a review-only Flux patch. It never writes Git and it
|
|
never reconciles or restarts a workload.
|
|
|
|
## Release sequence
|
|
|
|
1. Merge and review all WebUI source, patch, theme, and PWA asset changes.
|
|
2. Wait for Flux to complete both Harbor immutability Jobs and refresh Jenkins
|
|
JCasC from reviewed `main`.
|
|
3. Open the manual Jenkins job `hermes-webui-image` and set:
|
|
- `PUBLISH_IMAGE=true`
|
|
- `EXPECTED_SOURCE_REVISION` to the full 40-character `main` commit
|
|
- `CONFIRM_PUBLISH=PUBLISH HERMES WEBUI`
|
|
4. Retain the fingerprinted seven-file artifact set. In particular, compare
|
|
`hermes-webui-image.json` with Harbor and review
|
|
`hermes-webui-image-update.patch`.
|
|
5. Apply that patch on a fresh branch and open a separate review. The patch is
|
|
constrained to the `webui` container in:
|
|
- `StatefulSet/hermes-chat-tenant`
|
|
- `Deployment/hermes`
|
|
6. Merge the digest-only review to let Flux roll out desired state. Do not use a
|
|
manual `kubectl set image`, restart, or reconcile as a release substitute.
|
|
|
|
The release fails closed when the requested revision is not the checked-out
|
|
`origin/main`, the unique Harbor tag already exists, the exact WebUI immutable
|
|
tag policy is absent, Kaniko and Harbor disagree on the digest, either Flux
|
|
workload changes identity/image shape, or the evidence archive is incomplete.
|
|
|
|
Harbor policy bootstrap has an intentional ordering dependency. The existing
|
|
`harbor-hermes-agent-immutability-ensure-1` Job grants the shared Jenkins
|
|
publisher only the read-only `immutable-tag:list` permission; the WebUI policy
|
|
Job creates and verifies the separate `hermes-webui` rule but does not edit the
|
|
publisher robot. Flux must therefore complete the existing Hermes agent policy
|
|
bootstrap before the WebUI Job and Jenkins release verification. This successor
|
|
does not include a WebUI image digest: until its WebUI publisher job and policy
|
|
are merged to `main` and bootstrapped, no image can be legitimately published
|
|
and independently verified through this lane.
|
|
|
|
## PWA identity source
|
|
|
|
The installed application uses the tracked canonical persona at
|
|
`dockerfiles/hermes-webui-assets/hermes-agent.ico`. Provenance, the canonical
|
|
SHA-256, and derivation details for the required 192px/512px PNGs are recorded
|
|
beside the asset in `SOURCE.md`; the image build never reads an icon from a
|
|
running coordinator.
|