fix(agent-runtime): ship ripgrep in the base image (egress-locked san… #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Agent runtime images | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "docker/agent-runtime/**" | |
| - "tools/agent-shim/**" | |
| - "tools/workspace-init/**" | |
| - "packages/workspace-strategy/**" | |
| - ".github/workflows/agent-runtime-images.yml" | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Image version tag (e.g., v1.0.0 or dev-test)" | |
| required: true | |
| default: "dev" | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write # cosign keyless OIDC | |
| env: | |
| REGISTRY: ghcr.io/paperclipinc | |
| VERSION: ${{ github.event.inputs.version || format('git-{0}', github.sha) }} | |
| jobs: | |
| build-and-sign: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up QEMU (multi-arch builds) | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log into GHCR | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Build + push all deployed harness images (linux/amd64) | |
| id: bake | |
| run: | | |
| # Scope: the harness images cloud agent execution ships (opencode + pi | |
| # proven e2e; codex + gemini in bring-up) + claude (NOT in the hosted | |
| # cloud's curated registry, but built/tested so the upstream k8s plugin | |
| # contribution covers self-deployers running claude_local). acpx/hermes | |
| # stay out (not deployed yet). | |
| # Platforms come from the bake HCL (linux/amd64; our cluster is amd64). | |
| # Use --push rather than a "*.push" --set so the wildcard does not hit | |
| # the bake group (which has no such key -> "unknown key" error). | |
| docker buildx bake \ | |
| -f docker/agent-runtime/buildx-bake.hcl \ | |
| base opencode pi codex gemini claude \ | |
| --push \ | |
| --metadata-file=bake-metadata.json | |
| # Extract digests for cosign signing | |
| BASE_DIGEST=$(jq -r '."base"."containerimage.digest"' bake-metadata.json) | |
| OPENCODE_DIGEST=$(jq -r '."opencode"."containerimage.digest"' bake-metadata.json) | |
| PI_DIGEST=$(jq -r '."pi"."containerimage.digest"' bake-metadata.json) | |
| CODEX_DIGEST=$(jq -r '."codex"."containerimage.digest"' bake-metadata.json) | |
| GEMINI_DIGEST=$(jq -r '."gemini"."containerimage.digest"' bake-metadata.json) | |
| CLAUDE_DIGEST=$(jq -r '."claude"."containerimage.digest"' bake-metadata.json) | |
| echo "base_digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "opencode_digest=$OPENCODE_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "pi_digest=$PI_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "codex_digest=$CODEX_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "gemini_digest=$GEMINI_DIGEST" >> "$GITHUB_OUTPUT" | |
| echo "claude_digest=$CLAUDE_DIGEST" >> "$GITHUB_OUTPUT" | |
| env: | |
| VERSION: ${{ env.VERSION }} | |
| REGISTRY: ${{ env.REGISTRY }} | |
| - name: Cosign sign base | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-base@${{ steps.bake.outputs.base_digest }}" | |
| - name: Cosign sign opencode | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-opencode@${{ steps.bake.outputs.opencode_digest }}" | |
| - name: Cosign sign pi | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-pi@${{ steps.bake.outputs.pi_digest }}" | |
| - name: Cosign sign codex | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-codex@${{ steps.bake.outputs.codex_digest }}" | |
| - name: Cosign sign gemini | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-gemini@${{ steps.bake.outputs.gemini_digest }}" | |
| - name: Cosign sign claude | |
| run: | | |
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-claude@${{ steps.bake.outputs.claude_digest }}" |