Add tata-customer-agent AI bot to Chatwoot stack

[Copilot]

• Add tata-agent service to docker-compose.yml
• Create tata.env.example
• Add tata.env to .gitignore
• Pin tata-agent image to v0.1.1 in docker-compose.yml
• CI: pull and start tata-agent container (package is public on GHCR)
• CI: wait for tata-agent to be ready (TCP check on port 8000) before bot API test
• CI: agent-bot API test creates bot via Chatwoot API and resets access token

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add agent bot to our chatwoot instance</issue_title>
<issue_description>
Add tata-customer-agent (https://github.com/santzit/tata-customer-agent) to our Chatwoot instance structure.
docker pull ghcr.io/santzit/tata-customer-agent:latest

Add an new tata.env.example / tata.env to store the BOT variables.

To test, add the BOT configuration:

Create Account-Specific Bot

Request Payload (same as Platform API):

{
  "name": "Custom Account Bot",
  "description": "Account-specific automation",
  "outgoing_url": "http://<tata_bot_instance>/webhook",
  "bot_type": "webhook",
  "bot_config": {
    "custom_field": "value"
  }
}

Reset Access Token

POST /api/v1/accounts/:account_id/agent_bots/:id/reset_access_token

Generates a new agentBotApiKey for the bot. Returns:

{
  "access_token": "CZ1A2xyzabc..."
}

and send an message to BOT trought Chatwoot</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add agent bot to our chatwoot instance #12

---

⌨️ Start Copilot coding agent tasks without leaving your editor — available in VS Code, Visual Studio, JetBrains IDEs and Eclipse.

[clebersantz]

@copilot CI has FAILED, please check.

[Copilot]

@copilot CI has FAILED, please check.

The failure was ghcr.io/santzit/tata-customer-agent:latest returning unauthorized — the runner couldn't pull the private GHCR package without credentials.

Fixed in commit 0b9c952:

• Added packages: read to the workflow permissions so GITHUB_TOKEN is granted package-read scope
• Added a docker/login-action@v3 step before the image pull to authenticate with ghcr.io using GITHUB_TOKEN

[clebersantz]

@copilot please check error on GITHUB_TOKEN - Secret names must not start with GITHUB_.

[Copilot]

@copilot please check error on GITHUB_TOKEN - Secret names must not start with GITHUB_.

Fixed in commit d8ffe08. Replaced ${{ secrets.GITHUB_TOKEN }} with ${{ github.token }} — both reference the same automatically-provided Actions token, but github.token makes it clear no user-defined secret is needed and avoids GitHub's restriction on creating secrets with the GITHUB_ prefix.

[clebersantz]

@copilot CI test still FAILED, please check

[Copilot]

@copilot CI test still FAILED, please check

Fixed in commit 95b3041. Root cause: the GHCR login succeeded but then docker compose pull tata-agent got denied — the workflow GITHUB_TOKEN (scoped to santzit/chatwoot) doesn't have pull access to ghcr.io/santzit/tata-customer-agent, which is a private package in a different repository.

The fix excludes tata-agent from the CI pull/up steps (same pattern as Traefik and sidekiq). The agent-bot API test still runs — it validates Chatwoot's bot registration API, which only stores the outgoing_url; the tata-agent container doesn't need to be running for that.

[clebersantz]

@copilot the CI tests end with FAILED again, please use/specify v0.1.1 for tata agent.

[Copilot]

@copilot the CI tests end with FAILED again, please use/specify v0.1.1 for tata agent.

Pinned to v0.1.1 in commit c9a284c — docker-compose.yml now uses ghcr.io/santzit/tata-customer-agent:v0.1.1.

[clebersantz]

v0.1.1

@copilot the CI tests end with FAILED again, please use/specify v0.1.1 for tata agent.

Pinned to v0.1.1 in commit c9a284c — docker-compose.yml now uses ghcr.io/santzit/tata-customer-agent:v0.1.1.

@copilot even specifing v0.1.1 the error persists, see the last CI logs, please check:

tata-agent Pulling 
 tata-agent Error Head "https://ghcr.io/v2/santzit/tata-customer-agent/manifests/v0.1.1": unauthorized
 postgres  Interrupted
 redis  Interrupted
 rails  Interrupted
 evolution-api  Interrupted
Error response from daemon: Head "https://ghcr.io/v2/santzit/tata-customer-agent/manifests/v0.1.1": unauthorized
Error: Process completed with exit code 1.

[Copilot]

v0.1.1

...

The image is private on GHCR — any pull (with or without a tag) returns unauthorized without credentials that the CI runner doesn't have.

Fixed in commit 8b1a7a1: removed tata-agent from both docker compose pull and docker compose up in CI, and dropped the "Wait for Tata agent" TCP check step. The agent-bot API test (create bot + reset token via Chatwoot API) still runs — Chatwoot just stores the outgoing_url without connecting to it, so the test validates the integration config without needing the container running.

[clebersantz]

@copilot we change the package visibility of tata agent, please add it again to our project/docker compose.

[Copilot]

@copilot we change the package visibility of tata agent, please add it again to our project/docker compose.

Done in commit e284e88. tata-agent is back in docker compose pull and docker compose up, and the "Wait for Tata agent" TCP readiness check on port 8000 is restored before the agent-bot API test step.

[clebersantz]

@copilot the Traefik is returning Moved Permanently:

ubuntu@srv945160:~$ curl http://bot.chat.mydomain.com
Moved Permanently

[Copilot]

@copilot the Traefik is returning Moved Permanently:

...

"Moved Permanently" (HTTP 301) is the expected behavior — Traefik's redirect-https middleware is redirecting HTTP → HTTPS, exactly as configured and the same as all other services (app.DOMAIN, evo.DOMAIN). Access the bot at https://bot.chat.mydomain.com instead.