From f7c666166bfabbffb6291030c6572567e4d95266 Mon Sep 17 00:00:00 2001 From: Nene7ko_ <1604009816@qq.com> Date: Mon, 17 Aug 2026 07:17:45 +0800 Subject: [PATCH 1/5] feat: publish versioned sample runtime images --- .github/workflows/release.yml | 91 +++++++++++++++++++++++++++++++++++ README.md | 12 +++++ 2 files changed, 103 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..878aec4 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,91 @@ +name: Release + +on: + push: + tags: + - 'v[0-9]+.[0-9]+.[0-9]+' + +permissions: + contents: write + packages: write + +jobs: + release: + runs-on: ubuntu-latest + timeout-minutes: 40 + steps: + - name: Check out the tagged revision + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 + with: + fetch-depth: 0 + + - name: Verify annotated semantic tag + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + test "$(git cat-file -t "$RELEASE_TAG")" = tag + [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] + + - name: Set up Go + uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + with: + go-version-file: go.mod + cache-dependency-path: go.sum + + - name: Verify release source + run: | + go mod verify + go build ./... + go test ./... + go vet ./... + + - name: Authenticate to GHCR + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin + + - name: Publish Runtime images with provenance and SBOM + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + docker buildx create --use + for runtime in a b; do + image="ghcr.io/nekiro-project/nekiro-runtime-$runtime" + docker buildx build \ + --file "runtime-$runtime/Dockerfile" \ + --platform linux/amd64,linux/arm64 \ + --provenance=mode=max \ + --sbom=true \ + --metadata-file "runtime-$runtime-metadata.json" \ + --tag "$image:$RELEASE_TAG" \ + --push . + done + + - name: Write immutable release evidence + shell: bash + env: + RELEASE_TAG: ${{ github.ref_name }} + run: | + runtime_a_digest="$(jq -r '.["containerimage.digest"]' runtime-a-metadata.json)" + runtime_b_digest="$(jq -r '.["containerimage.digest"]' runtime-b-metadata.json)" + test "$runtime_a_digest" != null + test "$runtime_b_digest" != null + jq -n \ + --arg tag "$RELEASE_TAG" \ + --arg commit "$GITHUB_SHA" \ + --arg runtimeAImage "ghcr.io/nekiro-project/nekiro-runtime-a:$RELEASE_TAG" \ + --arg runtimeADigest "$runtime_a_digest" \ + --arg runtimeBImage "ghcr.io/nekiro-project/nekiro-runtime-b:$RELEASE_TAG" \ + --arg runtimeBDigest "$runtime_b_digest" \ + '{schemaVersion:"1",tag:$tag,commitSha:$commit,agentIngressVersion:"v1",images:{runtimeA:{reference:$runtimeAImage,digest:$runtimeADigest},runtimeB:{reference:$runtimeBImage,digest:$runtimeBDigest}}}' > images.json + sha256sum images.json > checksums.txt + + - name: Publish GitHub Release + shell: bash + env: + GH_TOKEN: ${{ github.token }} + RELEASE_TAG: ${{ github.ref_name }} + run: gh release create "$RELEASE_TAG" images.json checksums.txt --verify-tag --generate-notes --title "NeKiro Samples $RELEASE_TAG" diff --git a/README.md b/README.md index 6af7c72..6163d81 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,9 @@ wire profile. Both provider entrypoints use the public SDK's `agent/registration/nacos` package; `internal/challengeproof` contains only sample-owned endpoint ownership proof handling. +Both Runtime servers expose the stable Agent ingress `/agent/v1`. They do not +call Gateway Platform API routes and do not implement fallback route probing. + ## Repository verification ```text @@ -72,6 +75,15 @@ Do not invent placeholder credentials simply to make a process start. Use NeKiro-Stack for a real local run so the Router, signed credential policy, Agent Cards, publication, installation, and Ledger are all explicit. +## Releases + +An annotated semantic tag publishes both Runtime images to GHCR for +`linux/amd64` and `linux/arm64`. The GitHub Release includes `images.json` with +the exact tag, source commit, and immutable digest for each image plus a +checksum file. The images are consumable inputs for the matching NeKiro-Stack +release; a source commit by itself is not presented as a supported product +combination. + ## RepoWiki The [NeKiro Samples RepoWiki](https://nekiro-project.github.io/NeKiro-Samples/) From 23c26c7546c2a2d81de47a55cc9da3b2a939cf6b Mon Sep 17 00:00:00 2001 From: Nene7ko_ <1604009816@qq.com> Date: Mon, 17 Aug 2026 07:25:10 +0800 Subject: [PATCH 2/5] chore: pin the v1 release candidates --- .github/workflows/release.yml | 2 +- go.mod | 4 ++-- go.sum | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 878aec4..0afb089 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,7 @@ name: Release on: push: tags: - - 'v[0-9]+.[0-9]+.[0-9]+' + - 'v*' permissions: contents: write diff --git a/go.mod b/go.mod index 7ced533..31eba1b 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module github.com/NeKiro-project/NeKiro-Samples go 1.26.0 require ( - github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369 - github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115 + github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6 + github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e github.com/a2aproject/a2a-go v0.3.15 github.com/golang-jwt/jwt/v5 v5.3.1 trpc.group/trpc-go/trpc-agent-go v1.10.0 diff --git a/go.sum b/go.sum index 8239cae..469b24c 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,9 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369 h1:eL4X7jgfAOHB9zqocNmpOfLvqUk1JWrJ2HdAbiGH4HQ= -github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115 h1:/baMQ7BljeY5DH3uMHvwxirR60zzltymxPr2zbhUxCg= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115/go.mod h1:45UMR7aQNvyLhpWH9vuk2HSPE469m7eWoDZS+HN1X20= +github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6 h1:18OJqH/v7aJWMjQMLIlradgfIfRgLMs40hjgnbrUaCc= +github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e h1:YpGiFTgOmus/nEahfvD/29jV0394XBhtk1z1IrRVS8I= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e/go.mod h1:HaX9mLvy+SWLD5BWVO10HSlUb5N38tbYMABcPhaRFbc= github.com/a2aproject/a2a-go v0.3.15 h1:h5YpCiPq3jxQ5rIns7oDjPag3ivP8u817AzdA4F+NiI= github.com/a2aproject/a2a-go v0.3.15/go.mod h1:I7Cm+a1oL+UT6zMoP+roaRE5vdfUa1iQGVN8aSOuZ0I= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= From b3c255253fcd91f632ed30c7b0ebf1a28a66eb05 Mon Sep 17 00:00:00 2001 From: Nene7ko_ <1604009816@qq.com> Date: Mon, 17 Aug 2026 07:29:08 +0800 Subject: [PATCH 3/5] chore: pin the final v1 candidates --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 31eba1b..e308857 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module github.com/NeKiro-project/NeKiro-Samples go 1.26.0 require ( - github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6 - github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e + github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87 + github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8 github.com/a2aproject/a2a-go v0.3.15 github.com/golang-jwt/jwt/v5 v5.3.1 trpc.group/trpc-go/trpc-agent-go v1.10.0 diff --git a/go.sum b/go.sum index 469b24c..6fc4c58 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,9 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6 h1:18OJqH/v7aJWMjQMLIlradgfIfRgLMs40hjgnbrUaCc= -github.com/NeKiro-project/NeKiro v0.0.0-20260816231622-2d6160cf6be6/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e h1:YpGiFTgOmus/nEahfvD/29jV0394XBhtk1z1IrRVS8I= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232416-8ed5b24a900e/go.mod h1:HaX9mLvy+SWLD5BWVO10HSlUb5N38tbYMABcPhaRFbc= +github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87 h1:dUzTIPM9LQQNmeUOYJY75WXp6HGn407aMEdzMBonyEU= +github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8 h1:zDZMrHU5JBFDYZqgHdrvgpsOZzb+gnEXDkTMfapBSEY= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8/go.mod h1:To7nhRB0sF09CScmW9m9XNzP+ovxtKfWz3GJnWRbbFo= github.com/a2aproject/a2a-go v0.3.15 h1:h5YpCiPq3jxQ5rIns7oDjPag3ivP8u817AzdA4F+NiI= github.com/a2aproject/a2a-go v0.3.15/go.mod h1:I7Cm+a1oL+UT6zMoP+roaRE5vdfUa1iQGVN8aSOuZ0I= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= From 6da7543afbb3005c8ec34746b89fc1fb13450515 Mon Sep 17 00:00:00 2001 From: Nene7ko_ <1604009816@qq.com> Date: Mon, 17 Aug 2026 08:04:55 +0800 Subject: [PATCH 4/5] build: pin final v1 dependencies --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index e308857..386c3a2 100644 --- a/go.mod +++ b/go.mod @@ -3,8 +3,8 @@ module github.com/NeKiro-project/NeKiro-Samples go 1.26.0 require ( - github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87 - github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8 + github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b + github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974 github.com/a2aproject/a2a-go v0.3.15 github.com/golang-jwt/jwt/v5 v5.3.1 trpc.group/trpc-go/trpc-agent-go v1.10.0 diff --git a/go.sum b/go.sum index 6fc4c58..04fc4a0 100644 --- a/go.sum +++ b/go.sum @@ -1,9 +1,9 @@ github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= -github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87 h1:dUzTIPM9LQQNmeUOYJY75WXp6HGn407aMEdzMBonyEU= -github.com/NeKiro-project/NeKiro v0.0.0-20260816232744-ad6ef152cd87/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8 h1:zDZMrHU5JBFDYZqgHdrvgpsOZzb+gnEXDkTMfapBSEY= -github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260816232840-57638b6df6e8/go.mod h1:To7nhRB0sF09CScmW9m9XNzP+ovxtKfWz3GJnWRbbFo= +github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b h1:p3W6WWmeUSbPqQ7jV0qHtaVvUypBGoFpjIvxFCLt55E= +github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974 h1:pNFrvy3ipFcQyacZli+B2OX4BYpnq9PdjYsWd65lxwQ= +github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974/go.mod h1:RZBux2DL+jMhITl1oB3AOmIhf4X+TMhthct0hcR/794= github.com/a2aproject/a2a-go v0.3.15 h1:h5YpCiPq3jxQ5rIns7oDjPag3ivP8u817AzdA4F+NiI= github.com/a2aproject/a2a-go v0.3.15/go.mod h1:I7Cm+a1oL+UT6zMoP+roaRE5vdfUa1iQGVN8aSOuZ0I= github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE= From ddc1ce92f180b91bab596be667f70dfaed6ac868 Mon Sep 17 00:00:00 2001 From: Nene7ko_ <1604009816@qq.com> Date: Mon, 17 Aug 2026 14:54:53 +0800 Subject: [PATCH 5/5] ci: validate immutable release identity --- .github/workflows/release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0afb089..b08bc38 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,7 @@ jobs: run: | test "$(git cat-file -t "$RELEASE_TAG")" = tag [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] + test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA" - name: Set up Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 @@ -71,8 +72,8 @@ jobs: run: | runtime_a_digest="$(jq -r '.["containerimage.digest"]' runtime-a-metadata.json)" runtime_b_digest="$(jq -r '.["containerimage.digest"]' runtime-b-metadata.json)" - test "$runtime_a_digest" != null - test "$runtime_b_digest" != null + [[ "$runtime_a_digest" =~ ^sha256:[0-9a-f]{64}$ ]] + [[ "$runtime_b_digest" =~ ^sha256:[0-9a-f]{64}$ ]] jq -n \ --arg tag "$RELEASE_TAG" \ --arg commit "$GITHUB_SHA" \