ci: publish multi-platform tools image - #118
Conversation
|
🔍 OpenCodeReview found 4 issue(s) in this PR.
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| - uses: docker/setup-buildx-action@v4 | ||
|
|
||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v4 |
There was a problem hiding this comment.
[security · high]
These Docker actions (and docker/build-push-action@v7 below) are third-party actions referenced by mutable tags. In the publishing jobs they execute with packages: write, so a moved or compromised tag could publish altered artifacts or abuse the job token. Pin every docker/* action occurrence in this workflow to a reviewed full commit SHA (optionally retaining the release tag in a comment).
| image="ghcr.io/$OWNER/agentenv-tools:$TOOLS_VERSION" | ||
| if docker buildx imagetools inspect "$image" >/dev/null 2>&1; then | ||
| echo "Refusing to overwrite published tools drive $image." >&2 | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
[bug · high]
This preflight does not enforce immutability atomically. Two dispatches for the same version can both pass before either publishes, then overwrite the -$arch tags and assemble a manifest from whichever tag values win. Add workflow-level concurrency keyed by tools_version with cancel-in-progress: false, and preferably capture each pushed image digest and build the manifest from those digests rather than mutable architecture tags. Also distinguish a confirmed registry “not found” response from authentication/network failures instead of treating every inspect error as absence.
| publish-images: | ||
| name: Publish ${{ matrix.platform }} image | ||
| needs: validate | ||
| runs-on: ${{ matrix.os }} |
There was a problem hiding this comment.
[other · medium]
None of the three jobs defines timeout-minutes. A stalled registry operation or Docker build can therefore occupy a hosted runner until GitHub's platform limit. Add explicit, job-appropriate timeouts to validate, publish-images, and publish-manifest (with the image build allowed a longer limit than the registry-only jobs).
| build-args: | | ||
| TOOLS_VERSION=${{ inputs.tools_version }} | ||
| ENVD_REF=${{ inputs.envd_ref }} | ||
| ENVD_UPSTREAM_REPO=https://github.com/e2b-dev/infra.git |
There was a problem hiding this comment.
[bug · medium]
envd_ref is neither validated nor resolved once. Because each matrix leg independently fetches this ref, a branch or moved tag can resolve to different commits for amd64 and arm64, producing an internally inconsistent supposedly immutable release. Require an immutable full commit SHA (and validate its format), or resolve the input to one commit in validate and pass that exact SHA to both builds.
| # --------------------------------------------------------------------------- | ||
| FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-${DEBIAN_VERSION} AS envd-builder | ||
|
|
||
| ARG ENVD_REF=2026.16 |
There was a problem hiding this comment.
Why do we change the ENVD REF?
There was a problem hiding this comment.
Because the previous 2026.16 corresponds to envd version 0.5.13, and 2026.17 corresponds to envd version 0.5.15, which is the version pinned in the toml file.
2 participants
What
Add a publication workflow for the AgentENV tools image.
Why
Previously, tools image publication was a manual, local process.
This workflow builds each platform on a native GitHub-hosted runner and publishes a multi-platform image to:
ghcr.io/<repository-owner>/agentenv-tools:<version>Related issue
Closes #
Scope and non-goals
Included:
not included:
Design and behavior changes
The
Publish Tools Imageworkflow is triggered manually with two inputs:tools_version: immutable SemVer version for the complete tools drive.envd_ref: tag, branch, or commit frome2b-dev/infra.The workflow performs three stages:
tools_versionusing the existing Makefile SemVer check.Compatibility and operations
0.1.0; the default envd ref changes to2026.17, and the default Go builder changes to1.25.9.agentenv-toolsGHCR package.Validation
make fmtmake clippymake test-unitmake -C services test(required whenservices/changes)maketargetCommands and results:
Skipped checks and reasons:
Risks and reviewer notes
Checklist