Publish versioned sample Runtime images for v0.1

.github/workflows/release.yml

@@ -0,0 +1,92 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - name: Check out the tagged revision
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          fetch-depth: 0
+
+      - name: Verify annotated semantic tag
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          test "$(git cat-file -t "$RELEASE_TAG")" = tag
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "$(git rev-list -n 1 "$RELEASE_TAG")" = "$GITHUB_SHA"
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - name: Verify release source
+        run: |
+          go mod verify
+          go build ./...
+          go test ./...
+          go vet ./...
+
+      - name: Authenticate to GHCR
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: echo "$GH_TOKEN" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Publish Runtime images with provenance and SBOM
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          docker buildx create --use
+          for runtime in a b; do
+            image="ghcr.io/nekiro-project/nekiro-runtime-$runtime"
+            docker buildx build \
+              --file "runtime-$runtime/Dockerfile" \
+              --platform linux/amd64,linux/arm64 \
+              --provenance=mode=max \
+              --sbom=true \
+              --metadata-file "runtime-$runtime-metadata.json" \
+              --tag "$image:$RELEASE_TAG" \
+              --push .
+          done
+
+      - name: Write immutable release evidence
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          runtime_a_digest="$(jq -r '.["containerimage.digest"]' runtime-a-metadata.json)"
+          runtime_b_digest="$(jq -r '.["containerimage.digest"]' runtime-b-metadata.json)"
+          [[ "$runtime_a_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          [[ "$runtime_b_digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          jq -n \
+            --arg tag "$RELEASE_TAG" \
+            --arg commit "$GITHUB_SHA" \
+            --arg runtimeAImage "ghcr.io/nekiro-project/nekiro-runtime-a:$RELEASE_TAG" \
+            --arg runtimeADigest "$runtime_a_digest" \
+            --arg runtimeBImage "ghcr.io/nekiro-project/nekiro-runtime-b:$RELEASE_TAG" \
+            --arg runtimeBDigest "$runtime_b_digest" \
+            '{schemaVersion:"1",tag:$tag,commitSha:$commit,agentIngressVersion:"v1",images:{runtimeA:{reference:$runtimeAImage,digest:$runtimeADigest},runtimeB:{reference:$runtimeBImage,digest:$runtimeBDigest}}}' > images.json
+          sha256sum images.json > checksums.txt
+
+      - name: Publish GitHub Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: gh release create "$RELEASE_TAG" images.json checksums.txt --verify-tag --generate-notes --title "NeKiro Samples $RELEASE_TAG"

README.md

@@ -20,6 +20,9 @@ wire profile. Both provider entrypoints use the public SDK's
 `agent/registration/nacos` package; `internal/challengeproof` contains only
 sample-owned endpoint ownership proof handling.
 
+Both Runtime servers expose the stable Agent ingress `/agent/v1`. They do not
+call Gateway Platform API routes and do not implement fallback route probing.
+
 ## Repository verification
 
 ```text
@@ -72,6 +75,15 @@ Do not invent placeholder credentials simply to make a process start. Use
 NeKiro-Stack for a real local run so the Router, signed credential policy,
 Agent Cards, publication, installation, and Ledger are all explicit.
 
+## Releases
+
+An annotated semantic tag publishes both Runtime images to GHCR for
+`linux/amd64` and `linux/arm64`. The GitHub Release includes `images.json` with
+the exact tag, source commit, and immutable digest for each image plus a
+checksum file. The images are consumable inputs for the matching NeKiro-Stack
+release; a source commit by itself is not presented as a supported product
+combination.
+
 ## RepoWiki
 
 The [NeKiro Samples RepoWiki](https://nekiro-project.github.io/NeKiro-Samples/)

go.mod

@@ -3,8 +3,8 @@ module github.com/NeKiro-project/NeKiro-Samples
 go 1.26.0
 
 require (
-	github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369
-	github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115
+	github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b
+	github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974
 	github.com/a2aproject/a2a-go v0.3.15
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	trpc.group/trpc-go/trpc-agent-go v1.10.0

go.sum

@@ -1,9 +1,9 @@
 github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
 github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
-github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369 h1:eL4X7jgfAOHB9zqocNmpOfLvqUk1JWrJ2HdAbiGH4HQ=
-github.com/NeKiro-project/NeKiro v0.0.0-20260811175413-b588c754e369/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo=
-github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115 h1:/baMQ7BljeY5DH3uMHvwxirR60zzltymxPr2zbhUxCg=
-github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260811200209-d7e06dff6115/go.mod h1:45UMR7aQNvyLhpWH9vuk2HSPE469m7eWoDZS+HN1X20=
+github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b h1:p3W6WWmeUSbPqQ7jV0qHtaVvUypBGoFpjIvxFCLt55E=
+github.com/NeKiro-project/NeKiro v0.0.0-20260817000254-c7f5abac9a9b/go.mod h1:JCIEeiLu52WC/Q5QlcAKmWKRtW7CNLkZ3lV3BAn92Oo=
+github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974 h1:pNFrvy3ipFcQyacZli+B2OX4BYpnq9PdjYsWd65lxwQ=
+github.com/NeKiro-project/nekiro-sdk-go v0.0.0-20260817000403-ef4fd2f78974/go.mod h1:RZBux2DL+jMhITl1oB3AOmIhf4X+TMhthct0hcR/794=
 github.com/a2aproject/a2a-go v0.3.15 h1:h5YpCiPq3jxQ5rIns7oDjPag3ivP8u817AzdA4F+NiI=
 github.com/a2aproject/a2a-go v0.3.15/go.mod h1:I7Cm+a1oL+UT6zMoP+roaRE5vdfUa1iQGVN8aSOuZ0I=
 github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=