name: Agent runner image

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - ops/i1-dogfood-deploy
    paths:
      - infra/agent-runner/**
      - .github/workflows/agent-runner-image.yml

permissions:
  contents: write
  packages: write

concurrency:
  group: agent-runner-image-${{ github.ref }}
  cancel-in-progress: true

env:
  IMAGE: ghcr.io/platform-modules/awp-agent-runner

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and publish immutable runner
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          file: infra/agent-runner/Dockerfile
          platforms: linux/amd64
          push: true
          tags: ${{ env.IMAGE }}:git-${{ github.sha }}
          labels: |
            org.opencontainers.image.source=https://github.com/${{ github.repository }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: Smoke-test runner IPC
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          image="$IMAGE@$DIGEST"
          docker pull "$image"
          docker run -d --rm --name awp-agent-runner-smoke \
            --tmpfs /workspace:rw,uid=1000,gid=1000 \
            "$image" >/dev/null
          trap 'docker rm -f awp-agent-runner-smoke >/dev/null 2>&1 || true' EXIT
          for _ in $(seq 1 30); do
            if docker logs awp-agent-runner-smoke 2>&1 | grep -q 'AWP ACP runner ready'; then
              break
            fi
            sleep 1
          done
          request=$(printf '%s' '{"action":"capabilities","key":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}' | base64 -w0 | tr '+/' '-_' | tr -d '=')
          output=$(docker exec awp-agent-runner-smoke node /opt/awp-agent-runner/runner.mjs request "$request")
          printf '%s\n' "$output" | grep -q '"agentName":"codex-acp"'
          printf '%s\n' "$output" | grep -q '"session.resume"'

      - name: Record desired immutable execution image
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          set -euo pipefail
          test -n "$DIGEST"
          printf '%s@%s\n' "$IMAGE" "$DIGEST" > infra/dogfood/agent-runner-image.lock

      - name: Commit desired-state digest
        run: |
          set -euo pipefail
          if [ -z "$(git status --porcelain -- infra/dogfood/agent-runner-image.lock)" ]; then
            echo "Runner digest lock already current."
            exit 0
          fi
          git config user.name "AWP Image Publisher"
          git config user.email "awp-image-publisher@users.noreply.github.com"
          git add infra/dogfood/agent-runner-image.lock
          git commit -m "chore(execution): pin published agent runner digest"
          git push origin "HEAD:${GITHUB_REF_NAME}"
