agent-image.yaml

# .github/workflows/agent-image.yaml
#
# Builds and publishes ghcr.io/paperclipinc/hermes-agent. The image is
# `FROM nousresearch/hermes-agent` (pinned by digest in the Dockerfile) plus
# operator metadata, so this workflow re-tags + re-labels + signs the upstream
# runtime — it does not rebuild a Python env. Triggered:
#   - Manually via workflow_dispatch (engineer picks the published tag).
#   - On every push of a tag matching `agent/vX.Y.Z`.
#
# Cosign-signed (keyless OIDC) and SBOM via Syft.
name: agent-image

on:
  workflow_dispatch:
    inputs:
      hermes_version:
        description: "Published image tag (e.g. v0.16.0). Bump the FROM digest + HERMES_VERSION default in images/hermes-agent/Dockerfile to change the underlying upstream release."
        required: true
        type: string
  push:
    tags:
      - 'agent/v*'

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7

      - name: Resolve HERMES_VERSION
        id: ver
        run: |
          set -eux
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            v="${{ inputs.hermes_version }}"
          else
            v="${GITHUB_REF#refs/tags/agent/}"
          fi
          # Strip any leading "v" for the bare package version, keep the tag form too.
          bare="${v#v}"
          echo "tag=${v}" >> "$GITHUB_OUTPUT"
          echo "bare=${bare}" >> "$GITHUB_OUTPUT"

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: build
        uses: docker/build-push-action@v7
        with:
          context: images/hermes-agent
          file: images/hermes-agent/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: |
            ghcr.io/paperclipinc/hermes-agent:${{ steps.ver.outputs.tag }}
            ghcr.io/paperclipinc/hermes-agent:latest
          build-args: |
            HERMES_VERSION=${{ steps.ver.outputs.tag }}
          provenance: true
          sbom: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      # cosign sign/attest upload to the public Rekor transparency log, which has
      # intermittent outages. Retry to ride out transient rekor.sigstore.dev 5xx /
      # timeouts instead of failing an otherwise-good publish.
      - name: Sign image (keyless OIDC)
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          for attempt in 1 2 3 4 5; do
            if cosign sign --yes "ghcr.io/paperclipinc/hermes-agent@${DIGEST}"; then exit 0; fi
            echo "cosign sign attempt ${attempt} failed (likely transient rekor); retrying in $((attempt*20))s..." >&2
            sleep $((attempt*20))
          done
          echo "cosign sign failed after retries" >&2; exit 1

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Generate SBOM
        run: |
          syft "ghcr.io/paperclipinc/hermes-agent:${{ steps.ver.outputs.tag }}" \
            -o spdx-json=sbom.spdx.json

      - name: Attach SBOM as Cosign attestation
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          for attempt in 1 2 3 4 5; do
            if cosign attest --yes \
              --predicate sbom.spdx.json \
              --type spdxjson \
              "ghcr.io/paperclipinc/hermes-agent@${DIGEST}"; then exit 0; fi
            echo "cosign attest attempt ${attempt} failed (likely transient rekor); retrying in $((attempt*20))s..." >&2
            sleep $((attempt*20))
          done
          echo "cosign attest failed after retries" >&2; exit 1