From 4696fd68337f20b5b2d3ef38bd68a559820eea70 Mon Sep 17 00:00:00 2001
From: Will Anderson <will.anderson@neurontechnologies.ai>
Date: Wed, 15 Jul 2026 11:33:37 -0500
Subject: [PATCH] ci(dev): make SDK publish fail loudly, decouple ci-base
 rebuild

The dev push build went green-then-red while nothing published: the
Publish step had no set -e, so an auth/upload failure exited 0 (silent
no-publish), while the ci-base rebuild (set -euo pipefail + Docker on the
host-mode runner) hard-failed the job. Add set -euo pipefail + an empty-key
guard + active-account echo to the Publish step so failures surface with a
retrievable log, and mark the ci-base cache rebuild continue-on-error so
the fragile Docker step can never block the actual SDK artifact publish.
---
 .gitea/workflows/ci-dev.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.gitea/workflows/ci-dev.yaml b/.gitea/workflows/ci-dev.yaml
index f788d8b..092a80e 100644
--- a/.gitea/workflows/ci-dev.yaml
+++ b/.gitea/workflows/ci-dev.yaml
@@ -214,9 +214,18 @@ jobs:
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
         run: |
+          # Fail loudly: previously this step had no `set -e`, so an auth or
+          # upload failure was swallowed (step exited 0 on the trailing echo)
+          # and the SDK silently never published. Surface failures now.
+          set -euo pipefail
+          if [ -z "${GCP_SA_KEY:-}" ]; then
+            echo "FATAL: GCP_SA_KEY secret is empty — cannot authenticate to publish" >&2
+            exit 1
+          fi
           echo "${GCP_SA_KEY}" > /tmp/gcp-key.json
           gcloud auth activate-service-account --key-file=/tmp/gcp-key.json
           gcloud config set project neuron-785695
+          echo "Publishing as active account: $(gcloud config get-value account 2>/dev/null)"
 
           VERSION="${GITHUB_SHA:0:8}"
 
@@ -268,6 +277,12 @@ jobs:
         # Patches ci-base:dev in-place: pulls the existing image (which has all
         # system deps — Node, Go, gcloud, Docker CLI, etc.) and overlays the freshly
         # built El SDK on top. Keeps the full ci-base rebuild fast and incremental.
+        #
+        # continue-on-error: this is a CI-cache optimization, NOT the release
+        # artifact. It runs Docker (pull/build/push ~600MB) on the host-mode GCE
+        # runner where DinD/Docker availability is fragile. A failure here must
+        # never block or redden the job — the SDK publish above is the deliverable.
+        continue-on-error: true
         if: github.event_name == 'push'
         env:
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}