agent-runtime-images.yml

name: Agent runtime images

on:
  push:
    branches: [main]
    paths:
      - "docker/agent-runtime/**"
      - "tools/agent-shim/**"
      - "tools/workspace-init/**"
      - "packages/workspace-strategy/**"
      - ".github/workflows/agent-runtime-images.yml"
  workflow_dispatch:
    inputs:
      version:
        description: "Image version tag (e.g., v1.0.0 or dev-test)"
        required: true
        default: "dev"

permissions:
  contents: read
  packages: write
  id-token: write   # cosign keyless OIDC

env:
  REGISTRY: ghcr.io/paperclipinc
  VERSION: ${{ github.event.inputs.version || format('git-{0}', github.sha) }}

jobs:
  build-and-sign:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v7

      - name: Set up QEMU (multi-arch builds)
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Log into GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Build + push all deployed harness images (linux/amd64)
        id: bake
        run: |
          # Scope: the harness images cloud agent execution ships (opencode + pi
          # proven e2e; codex + gemini in bring-up) + claude (NOT in the hosted
          # cloud's curated registry, but built/tested so the upstream k8s plugin
          # contribution covers self-deployers running claude_local). acpx/hermes
          # stay out (not deployed yet).
          # Platforms come from the bake HCL (linux/amd64; our cluster is amd64).
          # Use --push rather than a "*.push" --set so the wildcard does not hit
          # the bake group (which has no such key -> "unknown key" error).
          docker buildx bake \
            -f docker/agent-runtime/buildx-bake.hcl \
            base opencode pi codex gemini claude \
            --push \
            --metadata-file=bake-metadata.json
          # Extract digests for cosign signing
          BASE_DIGEST=$(jq -r '."base"."containerimage.digest"' bake-metadata.json)
          OPENCODE_DIGEST=$(jq -r '."opencode"."containerimage.digest"' bake-metadata.json)
          PI_DIGEST=$(jq -r '."pi"."containerimage.digest"' bake-metadata.json)
          CODEX_DIGEST=$(jq -r '."codex"."containerimage.digest"' bake-metadata.json)
          GEMINI_DIGEST=$(jq -r '."gemini"."containerimage.digest"' bake-metadata.json)
          CLAUDE_DIGEST=$(jq -r '."claude"."containerimage.digest"' bake-metadata.json)
          echo "base_digest=$BASE_DIGEST" >> "$GITHUB_OUTPUT"
          echo "opencode_digest=$OPENCODE_DIGEST" >> "$GITHUB_OUTPUT"
          echo "pi_digest=$PI_DIGEST" >> "$GITHUB_OUTPUT"
          echo "codex_digest=$CODEX_DIGEST" >> "$GITHUB_OUTPUT"
          echo "gemini_digest=$GEMINI_DIGEST" >> "$GITHUB_OUTPUT"
          echo "claude_digest=$CLAUDE_DIGEST" >> "$GITHUB_OUTPUT"
        env:
          VERSION: ${{ env.VERSION }}
          REGISTRY: ${{ env.REGISTRY }}

      - name: Verify codex model catalog against the pinned CLI
        # The adapter's model picker and the CLI in the image are versioned
        # independently. They drifted for 25 days without a single failure:
        # gpt-5.6-luna reached the catalog on 2026-07-11, the image was built
        # 2026-07-02 with a CLI that had no metadata for it, and every affected
        # run opened with an item of type "error" that made a healthy run look
        # broken. This step is the thing that would have caught it.
        run: |
          docker/agent-runtime/verify-model-catalog.sh \
            "${{ env.REGISTRY }}/agent-runtime-codex@${{ steps.bake.outputs.codex_digest }}"

      - name: Cosign sign base
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-base@${{ steps.bake.outputs.base_digest }}"

      - name: Cosign sign opencode
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-opencode@${{ steps.bake.outputs.opencode_digest }}"

      - name: Cosign sign pi
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-pi@${{ steps.bake.outputs.pi_digest }}"

      - name: Cosign sign codex
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-codex@${{ steps.bake.outputs.codex_digest }}"

      - name: Cosign sign gemini
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-gemini@${{ steps.bake.outputs.gemini_digest }}"

      - name: Cosign sign claude
        run: |
          cosign sign --yes "${{ env.REGISTRY }}/agent-runtime-claude@${{ steps.bake.outputs.claude_digest }}"