agent: image build workflow (#7) #8

Merged

mlvtito merged 2 commits from agent/issue-7 into main

2026-11-15 20:44:46 +00:00

hermes_forgeron commented

2026-11-15 07:47:20 +00:00

Collaborator

Implements #7: a manual-dispatch workflow that builds, tags and publishes the agent image, then opens the deployment bump PR — the whole chain without any LLM call.

What changed

.forgejo/workflows/image.yml (new) — Build agent image, manual dispatch only:
- job container quay.io/podman/stable (no node needed: checkout is a plain anonymous git clone, the repo is public; git/curl/jq installed at step 1),
- tag YYYYMMDD-N (UTC date + run number) + latest, pushed to the instance registry as bot with podman login --password-stdin,
- podman build --storage-driver=vfs -f image/Containerfile (per #7: try rootless/fuse later, --privileged shipped for the first iteration),
- after the image push succeeds: annotated git tag of the same name on the built commit, message carrying the commit SHA and the registry digest (podman push --digestfile),
- opens (or updates — deduplicated branch image-bump, force-pushed) a PR bumping the agent-image default in .forgejo/workflows/agent.yml; merging it is the human gate,
- order enforced: build → push image → git tag → bump PR (a failed push leaves no tag),
- registry credentials never appear in the workflow file (org secret BOT_TOKEN) and the git token is kept out of argv (credential helper reading a 0600 file).
docs/setup.md — §3 rewritten around the dispatch flow; the image/Dockerfile → image/Containerfile name drift fixed.
README.md — layout table gains the new workflow file; same name-drift fix.

Verification

YAML validated; shell logic reviewed step by step (ordering, dedupe, failure paths: creation 409/422 → update the existing PR; still failing and no open bump PR → step fails with the API error).
Cannot be fully tested before merge — a workflow_dispatch workflow only becomes runnable once on main. Post-merge validation path (also the acceptance criteria of #7):
1. check BOT_TOKEN scopes first: package write + repository write + issue write (first dispatch fails with a 403 at the missing step otherwise),
2. dispatch Build agent image → expect registry tags YYYYMMDD-N + latest, annotated git tag on main's HEAD, summary showing the digest,
3. expect the bump PR against main (one line changed),
4. merge the bump PR, then dispatch a plan run on test_factory_ai without agent-image override → it uses the new tag.

Wiki updates on merge

Workflow page — Plumbing table: add a row for .forgejo/workflows/image.yml (build & publish the agent image on manual dispatch; immutable YYYYMMDD-N tag + latest; opens the bump PR).
Limitations page — nothing to change (the images-pinned-by-tag caveat stays true and is now handled by the bump PR).
Home page — nothing to change.

Closes #7

Implements #7: a manual-dispatch workflow that builds, tags and publishes the agent image, then opens the deployment bump PR — the whole chain without any LLM call. ## What changed - **`.forgejo/workflows/image.yml`** (new) — `Build agent image`, manual dispatch only: - job container `quay.io/podman/stable` (no node needed: checkout is a plain anonymous `git clone`, the repo is public; `git`/`curl`/`jq` installed at step 1), - tag `YYYYMMDD-N` (UTC date + run number) + `latest`, pushed to the instance registry as `bot` with `podman login --password-stdin`, - `podman build --storage-driver=vfs -f image/Containerfile` (per #7: try rootless/fuse later, `--privileged` shipped for the first iteration), - **after** the image push succeeds: annotated git tag of the same name on the built commit, message carrying the commit SHA and the registry digest (`podman push --digestfile`), - opens (or updates — deduplicated branch `image-bump`, force-pushed) a PR bumping the `agent-image` default in `.forgejo/workflows/agent.yml`; merging it is the human gate, - order enforced: build → push image → git tag → bump PR (a failed push leaves no tag), - registry credentials never appear in the workflow file (org secret `BOT_TOKEN`) and the git token is kept out of argv (credential helper reading a 0600 file). - **`docs/setup.md`** — §3 rewritten around the dispatch flow; the `image/Dockerfile` → `image/Containerfile` name drift fixed. - **`README.md`** — layout table gains the new workflow file; same name-drift fix. ## Verification - YAML validated; shell logic reviewed step by step (ordering, dedupe, failure paths: creation 409/422 → update the existing PR; still failing and no open bump PR → step fails with the API error). - **Cannot be fully tested before merge** — a `workflow_dispatch` workflow only becomes runnable once on `main`. Post-merge validation path (also the acceptance criteria of #7): 1. check `BOT_TOKEN` scopes first: package write + repository write + issue write (first dispatch fails with a 403 at the missing step otherwise), 2. dispatch `Build agent image` → expect registry tags `YYYYMMDD-N` + `latest`, annotated git tag on main's HEAD, summary showing the digest, 3. expect the bump PR against `main` (one line changed), 4. merge the bump PR, then dispatch a plan run on `test_factory_ai` without `agent-image` override → it uses the new tag. ## Wiki updates on merge - `Workflow` page — Plumbing table: add a row for `.forgejo/workflows/image.yml` (build & publish the agent image on manual dispatch; immutable `YYYYMMDD-N` tag + `latest`; opens the bump PR). - `Limitations` page — nothing to change (the images-pinned-by-tag caveat stays true and is now handled by the bump PR). - `Home` page — nothing to change. Closes #7

hermes_forgeron added 2 commits

2026-11-15 07:47:20 +00:00

feat: image build workflow (build, tag, push, bump PR) 6beadb59db

Manual dispatch chain, zero LLM: podman build -> push YYYYMMDD-N + latest ->
annotated git tag carrying the registry digest -> deduplicated PR bumping
the agent-image default. Runs as the bot user with BOT_TOKEN.

docs: rewrite image setup around the build workflow d7ccc28530