Merge branch 'main' into ci/fix-conformance-kubeconfig

Author: stubbi

.github/workflows/agent-image-smoke.yaml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - name: Guard: skip when uv.lock is absent
+      - name: "Guard: skip when uv.lock is absent"
         id: guard
         run: |
           if [ ! -f images/hermes-agent/uv.lock ]; then
@@ -51,11 +51,14 @@ jobs:
             -t hermes-agent:smoke \
             images/hermes-agent
 
-      - name: Smoke: --help exits 0
+      - name: "Smoke: --help exits 0"
         if: steps.guard.outputs.skip != 'true'
-        run: docker run --rm hermes-agent:smoke hermes-agent --help >/dev/null
+        # Bypass hermes-entrypoint: it requires a mounted config for every
+        # command (exit 78 otherwise, covered by the next step), so --help can
+        # only be exercised against the CLI directly.
+        run: docker run --rm --entrypoint hermes-agent hermes-agent:smoke --help >/dev/null
 
-      - name: Smoke: entrypoint refuses missing config with EX_CONFIG (78)
+      - name: "Smoke: entrypoint refuses missing config with EX_CONFIG (78)"
         if: steps.guard.outputs.skip != 'true'
         run: |
           set +e
@@ -66,7 +69,7 @@ jobs:
             exit 1
           fi
 
-      - name: Smoke: non-root by default
+      - name: "Smoke: non-root by default"
         if: steps.guard.outputs.skip != 'true'
         run: |
           uid=$(docker run --rm --entrypoint id hermes-agent:smoke -u)

images/hermes-agent/Dockerfile

@@ -33,7 +33,8 @@ COPY --from=uv /uv /uvx /usr/local/bin/
 ENV UV_LINK_MODE=copy \
     UV_COMPILE_BYTECODE=1 \
     UV_PYTHON_DOWNLOADS=never \
-    VIRTUAL_ENV=/opt/venv
+    VIRTUAL_ENV=/opt/venv \
+    UV_PROJECT_ENVIRONMENT=/opt/venv
 
 WORKDIR /build