fix(agent-runtime): build linux/amd64 only via --push (drop arm64 + the group-matching --set platforms) (#106)

Author: stubbi

.github/workflows/agent-runtime-images.yml

@@ -47,17 +47,19 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
 
-      - name: Build + push base + opencode + pi (multi-arch)
+      - name: Build + push base + opencode + pi (linux/amd64)
         id: bake
         run: |
           # Scope: cloud agent execution currently ships opencode + pi only. We
           # build just those two harness images (+ their base) to keep the
           # publish fast and avoid failing on harnesses we do not deploy yet.
+          # Platforms come from the bake HCL (linux/amd64; our cluster is amd64).
+          # Use --push rather than a "*.push" --set so the wildcard does not hit
+          # the bake group (which has no such key -> "unknown key" error).
           docker buildx bake \
             -f docker/agent-runtime/buildx-bake.hcl \
             base opencode pi \
-            --set "*.platforms=linux/amd64,linux/arm64" \
-            --set "*.push=true" \
+            --push \
             --metadata-file=bake-metadata.json
           # Extract digests for cosign signing
           BASE_DIGEST=$(jq -r '."base"."containerimage.digest"' bake-metadata.json)

docker/agent-runtime/buildx-bake.hcl

@@ -8,14 +8,14 @@ variable "REGISTRY" { default = "ghcr.io/paperclipinc" }
 target "base" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.base"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-base:${VERSION}"]
 }
 
 target "claude" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.claude"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-claude:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -25,7 +25,7 @@ target "claude" {
 target "codex" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.codex"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-codex:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -35,7 +35,7 @@ target "codex" {
 target "gemini" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.gemini"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-gemini:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -45,7 +45,7 @@ target "gemini" {
 target "acpx" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.acpx"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-acpx:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -55,7 +55,7 @@ target "acpx" {
 target "opencode" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.opencode"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-opencode:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -65,7 +65,7 @@ target "opencode" {
 target "pi" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.pi"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-pi:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"
@@ -75,7 +75,7 @@ target "pi" {
 target "hermes" {
   context = "."
   dockerfile = "docker/agent-runtime/Dockerfile.hermes"
-  platforms = ["linux/amd64", "linux/arm64"]
+  platforms = ["linux/amd64"]
   tags = ["${REGISTRY}/agent-runtime-hermes:${VERSION}"]
   contexts = {
     "paperclipinc/agent-runtime-base:${VERSION}" = "target:base"