imran-siddique
diff --git a/‎.github/workflows/publish-containers.yml‎
Lines changed: 130 additions & 0 deletions b/‎.github/workflows/publish-containers.yml‎
Lines changed: 130 additions & 0 deletions
diff --git a/‎packages/agent-mesh/charts/agentmesh/README.md‎
Lines changed: 4 additions & 4 deletions b/‎packages/agent-mesh/charts/agentmesh/README.md‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎packages/agent-mesh/charts/agentmesh/values.yaml‎
Lines changed: 4 additions & 4 deletions b/‎packages/agent-mesh/charts/agentmesh/values.yaml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎packages/agent-mesh/docker/.dockerignore‎
Lines changed: 46 additions & 0 deletions b/‎packages/agent-mesh/docker/.dockerignore‎
Lines changed: 46 additions & 0 deletions
diff --git a/‎packages/agent-mesh/docker/Dockerfile‎
Lines changed: 59 additions & 0 deletions b/‎packages/agent-mesh/docker/Dockerfile‎
Lines changed: 59 additions & 0 deletions
diff --git a/‎packages/agent-mesh/src/agentmesh/server/__init__.py‎
Lines changed: 67 additions & 0 deletions b/‎packages/agent-mesh/src/agentmesh/server/__init__.py‎
Lines changed: 67 additions & 0 deletions
@@ -0,0 +1,130 @@
+name: Publish Container Images
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      component:
+        description: "Component to build and publish"
+        required: true
+        type: choice
+        options:
+          - trust-engine
+          - policy-server
+          - audit-collector
+          - api-gateway
+          - governance-sidecar
+          - all
+      tag:
+        description: "Image tag (default: latest)"
+        required: false
+        default: "latest"
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+  attestations: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_PREFIX: ghcr.io/microsoft/agentmesh
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - component: trust-engine
+            dockerfile: packages/agent-mesh/docker/Dockerfile
+            context: .
+            port: 8443
+          - component: policy-server
+            dockerfile: packages/agent-mesh/docker/Dockerfile
+            context: .
+            port: 8444
+          - component: audit-collector
+            dockerfile: packages/agent-mesh/docker/Dockerfile
+            context: .
+            port: 8445
+          - component: api-gateway
+            dockerfile: packages/agent-mesh/docker/Dockerfile
+            context: .
+            port: 8446
+          - component: governance-sidecar
+            dockerfile: packages/agent-os/Dockerfile.sidecar
+            context: packages/agent-os
+            port: 8081
+
+    # Filter: build all on release, or only the selected component on dispatch
+    if: >-
+      github.event_name == 'release' ||
+      github.event.inputs.component == 'all' ||
+      github.event.inputs.component == matrix.component
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set image tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "release" ]; then
+            # Strip 'v' prefix from release tag (v3.2.0 → 3.2.0)
+            TAG="${{ github.event.release.tag_name }}"
+            TAG="${TAG#v}"
+          else
+            TAG="${{ github.event.inputs.tag || 'latest' }}"
+          fi
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "Image tag: $TAG"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        with:
+          images: ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}
+          tags: |
+            type=raw,value=${{ steps.tag.outputs.tag }}
+            type=raw,value=latest,enable=${{ github.event_name == 'release' }}
+            type=sha,prefix=
+
+      - name: Build and push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198e19c816612b # v6.18.0
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            COMPONENT=${{ matrix.component }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-name: ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}
+          subject-digest: ${{ steps.meta.outputs.digest || '' }}
+          push-to-registry: true
+        continue-on-error: true
+
+      - name: Verify image
+        run: |
+          echo "=== Verifying ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}:${{ steps.tag.outputs.tag }} ==="
+          docker pull ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}:${{ steps.tag.outputs.tag }}
+          docker run --rm ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}:${{ steps.tag.outputs.tag }} python -c "print('Image OK')"
@@ -52,7 +52,7 @@ The chart deploys four core components:
 | Parameter                          | Description            | Default                    |
 |------------------------------------|------------------------|----------------------------|
 | `trustEngine.replicas`             | Replica count          | `2`                        |
-| `trustEngine.image.repository`     | Image repository       | `agentmesh/trust-engine`   |
+| `trustEngine.image.repository`     | Image repository       | `ghcr.io/microsoft/agentmesh/trust-engine`   |
 | `trustEngine.service.port`         | Service port           | `8443`                     |
 | `trustEngine.resources.requests.cpu` | CPU request          | `100m`                     |
 | `trustEngine.resources.requests.memory` | Memory request    | `256Mi`                    |
@@ -64,7 +64,7 @@ The chart deploys four core components:
 | Parameter                           | Description                 | Default                    |
 |-------------------------------------|-----------------------------|----------------------------|
 | `policyServer.replicas`             | Replica count               | `2`                        |
-| `policyServer.image.repository`     | Image repository            | `agentmesh/policy-server`  |
+| `policyServer.image.repository`     | Image repository            | `ghcr.io/microsoft/agentmesh/policy-server`  |
 | `policyServer.service.port`         | Service port                | `8444`                     |
 | `policyServer.policyMountPath`      | Policy YAML mount path      | `/etc/agentmesh/policies`  |
 
@@ -73,7 +73,7 @@ The chart deploys four core components:
 | Parameter                              | Description             | Default                        |
 |----------------------------------------|-------------------------|--------------------------------|
 | `auditCollector.replicas`              | Replica count           | `1`                            |
-| `auditCollector.image.repository`      | Image repository        | `agentmesh/audit-collector`    |
+| `auditCollector.image.repository`      | Image repository        | `ghcr.io/microsoft/agentmesh/audit-collector`    |
 | `auditCollector.service.port`          | Service port            | `8445`                         |
 | `auditCollector.persistence.enabled`   | Enable persistent storage | `true`                       |
 | `auditCollector.persistence.size`      | PVC size                | `10Gi`                         |
@@ -84,7 +84,7 @@ The chart deploys four core components:
 | Parameter                          | Description             | Default                    |
 |------------------------------------|-------------------------|----------------------------|
 | `apiGateway.replicas`              | Replica count           | `2`                        |
-| `apiGateway.image.repository`      | Image repository        | `agentmesh/api-gateway`    |
+| `apiGateway.image.repository`      | Image repository        | `ghcr.io/microsoft/agentmesh/api-gateway`    |
 | `apiGateway.service.type`          | Service type            | `LoadBalancer`             |
 | `apiGateway.service.port`          | Service port            | `443`                      |
 | `apiGateway.rateLimitPerMinute`    | Rate limit (req/min)    | `1000`                     |
 
@@ -67,7 +67,7 @@ trustEngine:
   replicas: 2
   image:
     # -- Container image repository (string)
-    repository: agentmesh/trust-engine
+    repository: ghcr.io/microsoft/agentmesh/trust-engine
     # -- Image tag; defaults to global.imageTag when empty (string)
     tag: ""
     # -- Image pull policy: Always, IfNotPresent, or Never (string)
@@ -129,7 +129,7 @@ policyServer:
   replicas: 2
   image:
     # -- Container image repository (string)
-    repository: agentmesh/policy-server
+    repository: ghcr.io/microsoft/agentmesh/policy-server
     # -- Image tag; defaults to global.imageTag when empty (string)
     tag: ""
     # -- Image pull policy: Always, IfNotPresent, or Never (string)
@@ -193,7 +193,7 @@ auditCollector:
   replicas: 1
   image:
     # -- Container image repository (string)
-    repository: agentmesh/audit-collector
+    repository: ghcr.io/microsoft/agentmesh/audit-collector
     # -- Image tag; defaults to global.imageTag when empty (string)
     tag: ""
     # -- Image pull policy: Always, IfNotPresent, or Never (string)
@@ -267,7 +267,7 @@ apiGateway:
   replicas: 2
   image:
     # -- Container image repository (string)
-    repository: agentmesh/api-gateway
+    repository: ghcr.io/microsoft/agentmesh/api-gateway
     # -- Image tag; defaults to global.imageTag when empty (string)
     tag: ""
     # -- Image pull policy: Always, IfNotPresent, or Never (string)
 
@@ -0,0 +1,46 @@
+# Ignore Python bytecode, test artifacts, dev tools
+__pycache__/
+*.pyc
+*.pyo
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.hypothesis/
+
+# Ignore non-Python packages
+packages/agent-mesh/sdks/
+packages/agent-mesh/packages/
+packages/agent-mesh/services/
+packages/agent-mesh/charts/
+packages/agent-mesh/dashboards/
+packages/agent-mesh/deployments/
+packages/agent-mesh/notebooks/
+packages/agent-mesh/tutorials/
+packages/agent-mesh/examples/
+packages/agent-mesh/docs/
+packages/agent-mesh/proto/
+packages/agent-mesh/integrations/
+packages/agent-mesh/assets/
+packages/agent-mesh/dist/
+packages/agent-mesh/tests/
+
+# Ignore other top-level packages (only agent-mesh needed)
+packages/agent-os/
+packages/agent-hypervisor/
+packages/agent-sre/
+packages/agent-compliance/
+packages/agent-runtime/
+packages/agent-lightning/
+packages/agent-governance-dotnet/
+packages/agentmesh-integrations/
+
+# Ignore repo metadata
+.git/
+.github/
+docs/
+examples/
+pipelines/
+research/
+node_modules/
+*.md
+LICENSE
@@ -0,0 +1,59 @@
+# AgentMesh Component Dockerfile
+# Single Dockerfile for all four AgentMesh components:
+#   trust-engine, policy-server, audit-collector, api-gateway
+#
+# Build:
+#   docker build --build-arg COMPONENT=trust-engine \
+#     -t ghcr.io/microsoft/agentmesh/trust-engine:0.3.0 \
+#     -f packages/agent-mesh/docker/Dockerfile .
+#
+# Run:
+#   docker run -p 8443:8443 ghcr.io/microsoft/agentmesh/trust-engine:0.3.0
+
+ARG PYTHON_VERSION=3.11
+
+FROM python:${PYTHON_VERSION}-slim AS base
+
+LABEL maintainer="Microsoft Corporation"
+LABEL org.opencontainers.image.source="https://github.com/microsoft/agent-governance-toolkit"
+LABEL org.opencontainers.image.description="Agent Governance Toolkit — AgentMesh component"
+LABEL org.opencontainers.image.licenses="MIT"
+
+# Component to run: trust-engine | policy-server | audit-collector | api-gateway
+ARG COMPONENT=trust-engine
+ENV AGENTMESH_COMPONENT=${COMPONENT}
+
+WORKDIR /app
+
+# Install system dependencies (none needed beyond slim base)
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    tini \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy package source from repo root context
+COPY packages/agent-mesh/pyproject.toml ./
+COPY packages/agent-mesh/src/ ./src/
+
+# Install the package with server extras (fastapi + uvicorn)
+RUN pip install --no-cache-dir -e ".[server]" && \
+    rm -rf /root/.cache
+
+# Create non-root user
+RUN useradd -m -s /bin/bash -u 1000 agentmesh
+USER agentmesh
+
+# Environment defaults
+ENV PYTHONUNBUFFERED=1
+ENV LOG_LEVEL=info
+ENV HOST=0.0.0.0
+
+# Component-specific defaults
+# trust-engine: 8443, policy-server: 8444, audit-collector: 8445, api-gateway: 8446
+EXPOSE 8443 8444 8445 8446
+
+# Use tini as PID 1 for proper signal handling
+ENTRYPOINT ["tini", "--"]
+CMD ["python", "-m", "agentmesh.server"]
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import os,urllib.request; port=os.getenv('PORT','8443'); urllib.request.urlopen(f'http://localhost:{port}/healthz')" || exit 1
@@ -0,0 +1,67 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+"""
+AgentMesh Component Servers
+
+FastAPI-based HTTP servers for the four AgentMesh components:
+- trust-engine: Agent identity verification and trust token issuance
+- policy-server: Governance policy evaluation
+- audit-collector: Append-only audit log with Merkle integrity
+- api-gateway: Reverse proxy with rate limiting
+"""
+
+from __future__ import annotations
+
+import os
+import time
+from typing import Any
+
+from fastapi import FastAPI
+from fastapi.responses import JSONResponse
+
+COMPONENT = os.getenv("AGENTMESH_COMPONENT", "unknown")
+VERSION = "0.3.0"
+_start_time: float = 0.0
+
+
+def create_base_app(component: str, description: str) -> FastAPI:
+    """Create a FastAPI app with standard health/metrics endpoints."""
+    global _start_time
+    _start_time = time.monotonic()
+
+    app = FastAPI(
+        title=f"AgentMesh {component}",
+        description=description,
+        version=VERSION,
+        docs_url="/docs",
+        redoc_url=None,
+    )
+
+    @app.get("/healthz", tags=["health"])
+    async def healthz() -> dict[str, str]:
+        return {"status": "ok", "component": component}
+
+    @app.get("/readyz", tags=["health"])
+    async def readyz() -> dict[str, str]:
+        return {"status": "ready", "component": component}
+
+    @app.get("/metrics", tags=["observability"])
+    async def metrics() -> dict[str, Any]:
+        uptime = time.monotonic() - _start_time
+        return {
+            "component": component,
+            "version": VERSION,
+            "uptime_seconds": round(uptime, 2),
+        }
+
+    return app
+
+
+def run_server(app: FastAPI, default_port: int) -> None:
+    """Run uvicorn with env-configurable host/port."""
+    import uvicorn
+
+    host = os.getenv("HOST", "0.0.0.0")
+    port = int(os.getenv("PORT", str(default_port)))
+    log_level = os.getenv("LOG_LEVEL", "info").lower()
+    uvicorn.run(app, host=host, port=port, log_level=log_level)