diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..b08bc38 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,92 @@ +name: Release + +on: + push: + tags: + - 'v*' + +permissions: + contents: write + packages: write + +jobs: + release: + runs-on: ubuntu-latest + timeout-minutes: 40 + steps: + - name: Check out the tagged revision + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Verify annotated semantic tag + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + test "$(git cat-file -t "$RELEASE_TAG")" = tag + [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] + test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA" + + - name: Set up Go + uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + with: + go-version-file: go.mod + cache-dependency-path: go.sum + + - name: Verify release source + run: | + go mod verify + go build ./... + go test ./... + go vet ./... + + - name: Authenticate to GHCR + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin + + - name: Publish Runtime images with provenance and SBOM + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + docker buildx create --use + for runtime in a b; do + image="ghcr.io/nekiro-project/nekiro-runtime-$runtime" + docker buildx build \ + --file "runtime-$runtime/Dockerfile" \ + --platform linux/amd64,linux/arm64 \ + --provenance=mode=max \ + --sbom=true \ + --metadata-file "runtime-$runtime-metadata.json" \ + --tag "$image:$RELEASE_TAG" \ + --push . + done + + - name: Write immutable release evidence + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + runtime_a_digest="$(jq -r '.["containerimage.digest"]' runtime-a-metadata.json)" + runtime_b_digest="$(jq -r '.["containerimage.digest"]' runtime-b-metadata.json)" + [[ "$runtime_a_digest" =~ ^sha256:[0-9a-f]{64}$ ]] + [[ "$runtime_b_digest" =~ ^sha256:[0-9a-f]{64}$ ]] + jq -n \ + --arg tag "$RELEASE_TAG" \ + --arg commit "$GITHUB_SHA" \ + --arg runtimeAImage "ghcr.io/nekiro-project/nekiro-runtime-a:$RELEASE_TAG" \ + --arg runtimeADigest "$runtime_a_digest" \ + --arg runtimeBImage "ghcr.io/nekiro-project/nekiro-runtime-b:$RELEASE_TAG" \ + --arg runtimeBDigest "$runtime_b_digest" \ + '{schemaVersion:"1",tag:$tag,commitSha:$commit,agentIngressVersion:"v1",images:{runtimeA:{reference:$runtimeAImage,digest:$runtimeADigest},runtimeB:{reference:$runtimeBImage,digest:$runtimeBDigest}}}' > images.json + sha256sum images.json > checksums.txt + + - name: Publish GitHub Release + shell: bash + env: + GH_TOKEN: ${{ github.token }} + RELEASE_TAG: ${{ github.ref_name }} + run: gh release create "$RELEASE_TAG" images.json checksums.txt --verify-tag --generate-notes --title "NeKiro Samples $RELEASE_TAG" diff --git a/README.md b/README.md index 6af7c72..6163d81 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,9 @@ wire profile. Both provider entrypoints use the public SDK's `agent/registration/nacos` package; `internal/challengeproof` contains only sample-owned endpoint ownership proof handling. +Both Runtime servers expose the stable Agent ingress `/agent/v1`. They do not +call Gateway Platform API routes and do not implement fallback route probing. + ## Repository verification ```text @@ -72,6 +75,15 @@ Do not invent placeholder credentials simply to make a process start. Use NeKiro-Stack for a real local run so the Router, signed credential policy, Agent Cards, publication, installation, and Ledger are all explicit. +## Releases + +An annotated semantic tag publishes both Runtime images to GHCR for +`linux/amd64` and `linux/arm64`. The GitHub Release includes `images.json` with +the exact tag, source commit, and immutable digest for each image plus a +checksum file. The images are consumable inputs for the matching NeKiro-Stack +release; a source commit by itself is not presented as a supported product +combination. + ## RepoWiki The [NeKiro Samples RepoWiki](https://nekiro-project.github.io/NeKiro-Samples/) diff --git a/go.mod b/go.mod index 7ced533..386c3a2 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module github.com/NeKiro-project/NeKiro-Samples go 1.26.0 require ( - github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369 - github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115 + github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b + github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974 github.com/a2aproject/a2a-go v0.3.15 github.com/golang-jwt/jwt/v5 v5.3.1 trpc.group/trpc-go/trpc-agent-go v1.10.0 diff --git a/go.sum b/go.sum index 8239cae..04fc4a0 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,9 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369 h1:eL4X7jgfAOHB9zqocNmpOfLvqUk1JWrJ2HdAbiGH4HQ= -github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115 h1:/baMQ7BljeY5DH3uMHvwxirR60zzltymxPr2zbhUxCg= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115/go.mod h1:45UMR7aQNvyLhpWH9vuk2HSPE469m7eWoDZS+HN1X20= +github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b h1:p3W6WWmeUSbPqQ7jV0qHtaVvUypBGoFpjIvxFCLt55E= +github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974 h1:pNFrvy3ipFcQyacZli+B2OX4BYpnq9PdjYsWd65lxwQ= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974/go.mod h1:RZBux2DL+jMhITl1oB3AOmIhf4X+TMhthct0hcR/794= github.com/a2aproject/a2a-go v0.3.15 h1:h5YpCiPq3jxQ5rIns7oDjPag3ivP8u817AzdA4F+NiI= github.com/a2aproject/a2a-go v0.3.15/go.mod h1:I7Cm+a1oL+UT6zMoP+roaRE5vdfUa1iQGVN8aSOuZ0I= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=