feat: a release tag also builds the agent image; both images scanned, base pinned, Renovate added #10

Merged

morten-olsen merged 1 commit from mc/d50e173f-a8c1-46a2-889f-e1c5b7e1bcc5 into main 2026-10-07 15:32:40 +02:00

Conversation 1 Commits 1 Files changed 7 +88 -5

paperclip commented 2026-10-07 15:14:46 +02:00

Contributor

• Copy link
• Copy Markdown

Summary

A release tag now produces both images the cluster needs:

• code.olsen.cloud/ai/mission-control:<version> — already built by image.yaml; unchanged apart from a new advisory Trivy step.
• code.olsen.cloud/ai/mission-control-agent:<version> and :latest — new .woodpecker/image-agent.yaml (tag only): builds the linux/x64 executable into dist/release (task release:agent-context), then kaniko-build with that as context (repo: ai/mission-control-agent, absolute Dockerfile path).
• Trivy target: image, exit_code: 0 (advisory) on both images; severity HIGH,CRITICAL, unfixed ignored.
• node:24-bookworm-slim pinned by index digest in both Dockerfiles (3 FROMs).
• Agent Dockerfile: TARGETARCH falls back to dpkg --print-architecture, in case Kaniko does not set it (not verified either way).
• Renovate: .woodpecker/renovate.yaml (cron/manual only) and renovate.json (config:recommended, docker:pinDigests, node base image grouped).
• delivery-path skill updated with the ai/ images and what it learned about kaniko-build (no build_args, overridable repo/context/dockerfile).

Architecture: amd64 only, the node's. Nothing in the cluster needs arm64; the laptop builds its own agent image with task image:agent.

Evidence

• woodpecker-cli lint --strict .woodpecker: all six workflows valid.
• Plugin settings checked against ci/ci plugin sources (kaniko-build, trivy, renovate entrypoints).
• Not run: the pipelines themselves (they fire on a tag), and no Docker/Kaniko build here. First proof is the first release tag.

Merge danger

• Nothing runs on merge except the existing image.yaml on main, which now also runs the advisory scan; the scan cannot fail the build. The Renovate workflow does nothing until Morten adds a cron.
• The agent build installs the CLIs and runs the Bun build on a CI pod: heavier than the server build (SRE: please check the step's resources on the node).
• Pull of the image by the Trivy step needs the package to be readable without credentials (the smoke test already pulls the server image anonymously). If the package turns private, the scan step errors but cannot block.

Known gaps

• kaniko-build has no build_args, so the server's CI_COMMIT_TAG build arg does not reach the Dockerfile (the executable reports the CLI package's version). Fix belongs in ci/ci.
• Agent image tag-only: no image to test on PR; the first tag is the test.

Rollback

Revert this commit on Forgejo. Images already pushed stay in the registry (delete a tag in Forgejo Packages if needed). Reverting the digest pin only restores the floating node:24-bookworm-slim.

After rollout

Morten publishes a release; check woodpecker-cli pipeline ls ai/mission-control for image, image-agent, image-smoke, then that both :<version> tags exist and the cluster can pull them.

Reviewers

Security Engineer (secrets: only forgejo_registry_auth on the Kaniko steps, renovate_forgejo_token on Renovate; plugin permissions), SRE (build resource use).

## Summary A release tag now produces both images the cluster needs: - `code.olsen.cloud/ai/mission-control:<version>` — already built by `image.yaml`; unchanged apart from a new advisory Trivy step. - `code.olsen.cloud/ai/mission-control-agent:<version>` and `:latest` — new `.woodpecker/image-agent.yaml` (tag only): builds the linux/x64 executable into `dist/release` (`task release:agent-context`), then `kaniko-build` with that as context (`repo: ai/mission-control-agent`, absolute Dockerfile path). - Trivy `target: image`, `exit_code: 0` (advisory) on both images; severity HIGH,CRITICAL, unfixed ignored. - `node:24-bookworm-slim` pinned by index digest in both Dockerfiles (3 `FROM`s). - Agent Dockerfile: `TARGETARCH` falls back to `dpkg --print-architecture`, in case Kaniko does not set it (not verified either way). - Renovate: `.woodpecker/renovate.yaml` (cron/manual only) and `renovate.json` (`config:recommended`, `docker:pinDigests`, node base image grouped). - `delivery-path` skill updated with the `ai/` images and what it learned about `kaniko-build` (no `build_args`, overridable `repo`/`context`/`dockerfile`). **Architecture:** amd64 only, the node's. Nothing in the cluster needs arm64; the laptop builds its own agent image with `task image:agent`. ## Evidence - `woodpecker-cli lint --strict .woodpecker`: all six workflows valid. - Plugin settings checked against `ci/ci` plugin sources (`kaniko-build`, `trivy`, `renovate` entrypoints). - **Not run:** the pipelines themselves (they fire on a tag), and no Docker/Kaniko build here. First proof is the first release tag. ## Merge danger - Nothing runs on merge except the existing `image.yaml` on main, which now also runs the advisory scan; the scan cannot fail the build. The Renovate workflow does nothing until Morten adds a cron. - The agent build installs the CLIs and runs the Bun build on a CI pod: heavier than the server build (SRE: please check the step's resources on the node). - Pull of the image by the Trivy step needs the package to be readable without credentials (the smoke test already pulls the server image anonymously). If the package turns private, the scan step errors but cannot block. ## Known gaps - `kaniko-build` has no `build_args`, so the server's `CI_COMMIT_TAG` build arg does not reach the Dockerfile (the executable reports the CLI package's version). Fix belongs in `ci/ci`. - Agent image tag-only: no image to test on PR; the first tag is the test. ## Rollback Revert this commit on Forgejo. Images already pushed stay in the registry (delete a tag in Forgejo Packages if needed). Reverting the digest pin only restores the floating `node:24-bookworm-slim`. ## After rollout Morten publishes a release; check `woodpecker-cli pipeline ls ai/mission-control` for `image`, `image-agent`, `image-smoke`, then that both `:<version>` tags exist and the cluster can pull them. ## Reviewers Security Engineer (secrets: only `forgejo_registry_auth` on the Kaniko steps, `renovate_forgejo_token` on Renovate; plugin permissions), SRE (build resource use).

paperclip added 1 commit 2026-10-07 15:14:46 +02:00

feat: a release tag also builds the agent image, both images are scanned and their base pinned ... c99f73a4d0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

morten-olsen approved these changes 2026-10-07 15:32:34 +02:00

morten-olsen merged commit aad334af9c into main 2026-10-07 15:32:40 +02:00

morten-olsen referenced this pull request from a commit 2026-10-07 15:32:41 +02:00

feat: a release tag also builds the agent image; both images scanned, base pinned, Renovate added (#10)

paperclip referenced this pull request 2026-10-07 15:44:14 +02:00

fix: quote the scan steps' image so an empty tag does not break every pipeline #11

morten-olsen referenced this pull request from a commit 2026-10-07 15:45:16 +02:00

fix: quote the scan steps' image so an empty tag does not break every pipeline (#11)

paperclip referenced this pull request 2026-10-07 18:49:19 +02:00

feat: the pipeline renders every workflow per event and dry-runs the agent image on PRs #17

Sign in to join this conversation.

Reviewers

No reviewers

morten-olsen

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ai/mission-control!10

No description provided.