WIP: upstream import 2026-08-07 (2f42a496..42c73562, 900 commits) #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Agent runtime images | ||
| on: | ||
| push: | ||
| <<<<<<< HEAD | ||
| branches: [main] | ||
| paths: | ||
| - "docker/agent-runtime/**" | ||
| - "tools/agent-shim/**" | ||
| - "tools/workspace-init/**" | ||
| - "packages/workspace-strategy/**" | ||
| ======= | ||
| branches: [master] | ||
| paths: | ||
| - "docker/agent-runtime/**" | ||
| - "tools/agent-shim/**" | ||
| >>>>>>> origin/master | ||
| - ".github/workflows/agent-runtime-images.yml" | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: "Image version tag (e.g., v1.0.0 or dev-test)" | ||
| required: true | ||
| default: "dev" | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| id-token: write # cosign keyless OIDC | ||
| env: | ||
| <<<<<<< HEAD | ||
| REGISTRY: ghcr.io/paperclipinc | ||
| ======= | ||
| REGISTRY: ghcr.io/paperclipai | ||
| >>>>>>> origin/master | ||
| VERSION: ${{ github.event.inputs.version || format('git-{0}', github.sha) }} | ||
| jobs: | ||
| build-and-sign: | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| <<<<<<< HEAD | ||
| - name: Set up QEMU (multi-arch builds) | ||
| uses: docker/setup-qemu-action@v3 | ||
| ======= | ||
| >>>>>>> origin/master | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v4 | ||
| - name: Log into GHCR | ||
| uses: docker/login-action@v4 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Install cosign | ||
| uses: sigstore/cosign-installer@v3 | ||
| - name: Build + push all deployed harness images (linux/amd64) | ||
| id: bake | ||
| run: | | ||
| <<<<<<< HEAD | ||
| # Scope: the harness images cloud agent execution ships (opencode + pi | ||
| # proven e2e; codex + gemini in bring-up) + claude (NOT in the hosted | ||
| # cloud's curated registry, but built/tested so the upstream k8s plugin | ||
| # contribution covers self-deployers running claude_local). acpx/hermes | ||
| # stay out (not deployed yet). | ||
| # Platforms come from the bake HCL (linux/amd64; our cluster is amd64). | ||
| ======= | ||
| # Scope: the five harnesses the kubernetes sandbox provider supports | ||
| # out of the box (opencode, pi, codex, gemini, claude). acpx/hermes | ||
| # have Dockerfiles in the bake group but are not published by default. | ||
| # Platforms come from the bake HCL (linux/amd64). | ||
| >>>>>>> origin/master | ||
| # Use --push rather than a "*.push" --set so the wildcard does not hit | ||
| # the bake group (which has no such key -> "unknown key" error). | ||
| docker buildx bake \ | ||
| -f docker/agent-runtime/buildx-bake.hcl \ | ||
| base opencode pi codex gemini claude \ | ||
| --push \ | ||
| --metadata-file=bake-metadata.json | ||
| # Extract digests for cosign signing | ||
| BASE_DIGEST=$(jq -r '."base"."containerimage.digest"' bake-metadata.json) | ||
| OPENCODE_DIGEST=$(jq -r '."opencode"."containerimage.digest"' bake-metadata.json) | ||
| PI_DIGEST=$(jq -r '."pi"."containerimage.digest"' bake-metadata.json) | ||
| CODEX_DIGEST=$(jq -r '."codex"."containerimage.digest"' bake-metadata.json) | ||
| GEMINI_DIGEST=$(jq -r '."gemini"."containerimage.digest"' bake-metadata.json) | ||
| CLAUDE_DIGEST=$(jq -r '."claude"."containerimage.digest"' bake-metadata.json) | ||
| echo "base_digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT" | ||
| echo "opencode_digest=$OPENCODE_DIGEST" >> "$GITHUB_OUTPUT" | ||
| echo "pi_digest=$PI_DIGEST" >> "$GITHUB_OUTPUT" | ||
| echo "codex_digest=$CODEX_DIGEST" >> "$GITHUB_OUTPUT" | ||
| echo "gemini_digest=$GEMINI_DIGEST" >> "$GITHUB_OUTPUT" | ||
| echo "claude_digest=$CLAUDE_DIGEST" >> "$GITHUB_OUTPUT" | ||
| env: | ||
| VERSION: ${{ env.VERSION }} | ||
| REGISTRY: ${{ env.REGISTRY }} | ||
| <<<<<<< HEAD | ||
| - name: Verify codex model catalog against the pinned CLI | ||
| # The adapter's model picker and the CLI in the image are versioned | ||
| # independently. They drifted for 25 days without a single failure: | ||
| # gpt-5.6-luna reached the catalog on 2026-07-11, the image was built | ||
| # 2026-07-02 with a CLI that had no metadata for it, and every affected | ||
| # run opened with an item of type "error" that made a healthy run look | ||
| # broken. This step is the thing that would have caught it. | ||
| run: | | ||
| docker/agent-runtime/verify-model-catalog.sh \ | ||
| "${{ env.REGISTRY }}/agent-runtime-codex@${{ steps.bake.outputs.codex_digest }}" | ||
| ======= | ||
| >>>>>>> origin/master | ||
| - name: Cosign sign base | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-base@${{ steps.bake.outputs.base_digest }}" | ||
| - name: Cosign sign opencode | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-opencode@${{ steps.bake.outputs.opencode_digest }}" | ||
| - name: Cosign sign pi | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-pi@${{ steps.bake.outputs.pi_digest }}" | ||
| - name: Cosign sign codex | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-codex@${{ steps.bake.outputs.codex_digest }}" | ||
| - name: Cosign sign gemini | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-gemini@${{ steps.bake.outputs.gemini_digest }}" | ||
| - name: Cosign sign claude | ||
| run: | | ||
| cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-claude@${{ steps.bake.outputs.claude_digest }}" | ||
