hermes-agent/.github/workflows
ethernet bf80508d65 ci: split docker-publish into per-arch native runners
Build amd64 and arm64 natively on their own GitHub runners in
parallel, then stitch the per-arch digests into a tagged multi-arch
manifest.  Replaces the previous single-runner pattern which rebuilt
arm64 from scratch on every run because QEMU emulation + unscoped GHA
cache meant no layer reuse across invocations.

Jobs:
  build-amd64 — ubuntu-latest, native, runs smoke tests, pushes by
digest
  build-arm64 — ubuntu-24.04-arm, native (no QEMU), pushes by digest
  merge       — stitches both digests into :sha-<sha> (main) or
:<release>
  move-latest — unchanged ancestor-check logic, now needs: merge

Preserved:
  - per-commit sha-<sha> tags on main (immutable, race-free)
  - org.opencontainers.image.revision label on each per-arch image
  - dashboard subcommand smoke test (#9153 guard)
  - race-safe :latest advancement via move-latest
  - top-level cancel-in-progress: false

Changed behavior:
  - move-latest flipped to cancel-in-progress: false for
defense-in-depth.
    Top-level concurrency already serializes runs for the ref, so the
old
    cancel=true on move-latest was dead code.  Flipping to false
prevents
    any starvation mode if top-level is ever loosened.

Cache scopes separated per-arch (scope=docker-amd64 /
scope=docker-arm64)
so the two runners don't clobber each other in the gha cache backend.
2026-05-08 18:46:34 -04:00
..
contributor-check.yml security: supply chain hardening — CI pinning, dep pinning, and code fixes (#9801) 2026-04-14 14:23:37 -07:00
deploy-site.yml docs: publish llms.txt and llms-full.txt for agent-friendly ingestion (#18276) 2026-04-30 23:17:14 -07:00
docker-publish.yml ci: split docker-publish into per-arch native runners 2026-05-08 18:46:34 -04:00
docs-site-checks.yml docs(website): dedicated page per bundled + optional skill (#14929) 2026-04-23 22:22:11 -07:00
lint.yml ci(lint): add blocking ruff-check + windows-footguns jobs to lint.yml 2026-05-08 14:27:40 -07:00
nix-lockfile-fix.yml change(nix): dedupe nix lockfile checking scripts in ci (#18000) 2026-04-30 22:52:30 +05:30
nix.yml change(nix): dedupe nix lockfile checking scripts in ci (#18000) 2026-04-30 22:52:30 +05:30
osv-scanner.yml chore(security): add OSV-Scanner CI + Dependabot for github-actions only (#20037) 2026-05-04 20:58:21 -07:00
skills-index.yml security: supply chain hardening — CI pinning, dep pinning, and code fixes (#9801) 2026-04-14 14:23:37 -07:00
supply-chain-audit.yml ci(security): narrow supply-chain-audit to high-signal patterns only 2026-04-19 16:25:21 -07:00
tests.yml ci: bump test-job timeout from 10m to 20m (#12718) 2026-04-19 16:28:13 -07:00