CI builder for the self-hosted Paseo Hub image (upstream artifacts lag the CLI protocol)
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
2026-09-02 12:29:19 +00:00
.forgejo/workflows build: fetch upstream via codeload tarball (git-over-HTTPS gets a credential prompt from the runner egress) 2026-09-02 12:29:19 +00:00
README.md docs: why this builder exists and how to operate it 2026-09-02 12:14:08 +00:00

paseo-hub-image

CI builder for our self-hosted Paseo Hub (paseo-hub.podesta.ai). Builds unmodified upstream main weekly and on dispatch, pushes code.podesta.ai/public/paseo-hub:main plus a dated :YYYYMMDD-<sha> tag.

Why this exists

Both upstream distributions lag the paseo CLI's daemon-enrollment protocol (diagnosed 2026-09-02):

  • npm @getpaseo/hub 0.8.0 (2026-08-25) predates CLI 0.7.x (2026-08-31+)
  • ghcr.io/getpaseo/hub:latest also rejects the CLI's permissions field (strict zod schema → HTTP 400 on /api/daemons/enroll)

Building from main keeps hub and CLI in protocol lockstep. Delete this repo and switch the deployment back to an upstream image once their artifacts catch up.

Consumers

  • PodestaAI/infra → apps/paseo-hub/deployment.yaml (imagePullPolicy: Always; kubectl rollout restart -n paseo-hub deploy/paseo-hub to adopt a rebuild)

Operations

  • Rebuild now: Actions → build → Run workflow (or fgj workflow dispatch build.yml -R public/paseo-hub-image)
  • Pin a known-good build: point the deployment at a dated tag
  • Secrets: org-level PUSH_USER/PUSH_TOKEN (same as public/runner-image)