build: agent-runtime images (base/opencode/pi) -> paperclipinc (#105) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Agent runtime images | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "docker/agent-runtime/**" | |
| - "tools/agent-shim/**" | |
| - "tools/workspace-init/**" | |
| - "packages/workspace-strategy/**" | |
| - ".github/workflows/agent-runtime-images.yml" | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Image version tag (e.g., v1.0.0 or dev-test)" | |
| required: true | |
| default: "dev" | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # cosign keyless OIDC | |
| env: | |
| REGISTRY: ghcr.io/paperclipinc | |
| VERSION: ${{ github.event.inputs.version || format('git-{0}', github.sha) }} | |
| jobs: | |
| build-and-sign: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up QEMU (multi-arch builds) | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log into GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Build + push base + opencode + pi (multi-arch) | |
| id: bake | |
| run: | | |
| # Scope: cloud agent execution currently ships opencode + pi only. We | |
| # build just those two harness images (+ their base) to keep the | |
| # publish fast and avoid failing on harnesses we do not deploy yet. | |
| docker buildx bake \ | |
| -f docker/agent-runtime/buildx-bake.hcl \ | |
| base opencode pi \ | |
| --set "*.platforms=linux/amd64,linux/arm64" \ | |
| --set "*.push=true" \ | |
| --metadata-file=bake-metadata.json | |
| # Extract digests for cosign signing | |
| BASE_DIGEST=$(jq -r '."base"."containerimage.digest"' bake-metadata.json) | |
| OPENCODE_DIGEST=$(jq -r '."opencode"."containerimage.digest"' bake-metadata.json) | |
| PI_DIGEST=$(jq -r '."pi"."containerimage.digest"' bake-metadata.json) | |
| echo "base_digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "opencode_digest=$OPENCODE_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "pi_digest=$PI_DIGEST" >> "$GITHUB_OUTPUT" | |
| env: | |
| VERSION: ${{ env.VERSION }} | |
| REGISTRY: ${{ env.REGISTRY }} | |
| - name: Cosign sign base | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-base@${{ steps.bake.outputs.base_digest }}" | |
| - name: Cosign sign opencode | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-opencode@${{ steps.bake.outputs.opencode_digest }}" | |
| - name: Cosign sign pi | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-pi@${{ steps.bake.outputs.pi_digest }}" |