deploy.yml

name: Build and Publish Images

on:
  push:
    branches:
      - main
    tags:
      - boss-sidecar-win32-x64-v*
      - boss-sidecar-win32-arm64-v*
      - boss-sidecar-darwin-arm64-v*
      - boss-sidecar-darwin-x64-v*
      # Publishes the public multi-arch GHCR image (ghcr-build/ghcr-merge
      # jobs below). Does NOT match the boss-sidecar-*-v* tags above.
      - "v*"
  workflow_dispatch:

jobs:
  # ── 1. GHCR Multi-Arch Publish ───────────────────────────────────────────
  # Publishes a public ghcr.io/prometheus-ags/universal-agent-runtime image so
  # other projects can `docker pull` UAR instead of rebuilding it from source.
  # Runs on pushes to main, `v*` tags, and workflow_dispatch — never on the
  # boss-sidecar-* tags used by the sidecar release jobs below.
  ghcr-build:
    name: GHCR Build (${{ matrix.platform }})
    if: ${{ !startsWith(github.ref, 'refs/tags/boss-sidecar-') }}
    runs-on: ${{ matrix.runner }}
    # ~3GB 5-toolchain image and a full Rust release compile; a cold GHA
    # cache needs >30min. Native arm64 runner avoids QEMU emulation entirely.
    timeout-minutes: 75
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-24.04
          - platform: linux/arm64
            runner: ubuntu-24.04-arm

    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          submodules: true
          token: ${{ secrets.SUBMODULES_TOKEN || github.token }}

      - name: Complete recursive submodule checkout
        shell: bash
        run: bash scripts/update-submodules.sh

      # GitHub-hosted runners (amd64 and arm64) ship preinstalled toolchains
      # that are unused here but consume disk space the 5-toolchain UAR image
      # build needs. Remove the largest offenders before building.
      - name: Free disk space
        shell: bash
        run: |
          echo "Disk space before cleanup:"
          df -h /
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc || true
          sudo rm -rf /opt/hostedtoolcache/CodeQL || true
          docker system prune -af || true
          echo "Disk space after cleanup:"
          df -h /

      - name: Set platform pair
        run: |
          platform="${{ matrix.platform }}"
          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      # Build-by-digest: each arch pushes an untagged manifest and reports its
      # digest; ghcr-merge below assembles the multi-arch manifest list and
      # applies the real tags. Standard docker/build-push-action pattern for
      # multi-platform images across a build matrix.
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@v7
        with:
          context: .
          file: ./Dockerfile
          platforms: ${{ matrix.platform }}
          # Token for cargo git deps over SSH (kreuzberg) + any private
          # fetches. The Dockerfile rewrites ssh://git@github.com → https.
          secrets: |
            github_token=${{ secrets.SUBMODULES_TOKEN }}
          outputs: type=image,name=ghcr.io/prometheus-ags/universal-agent-runtime,push-by-digest=true,name-canonical=true,push=true
          cache-from: type=gha,scope=ghcr-${{ env.PLATFORM_PAIR }}
          cache-to: type=gha,mode=max,scope=ghcr-${{ env.PLATFORM_PAIR }}

      - name: Export digest
        run: |
          mkdir -p "${{ runner.temp }}/digests"
          digest="${{ steps.build.outputs.digest }}"
          touch "${{ runner.temp }}/digests/${digest#sha256:}"

      - name: Upload digest
        uses: actions/upload-artifact@v7
        with:
          name: digests-${{ env.PLATFORM_PAIR }}
          path: ${{ runner.temp }}/digests/*
          if-no-files-found: error
          retention-days: 1

  ghcr-merge:
    name: GHCR Merge Manifest
    if: ${{ !startsWith(github.ref, 'refs/tags/boss-sidecar-') }}
    needs: ghcr-build
    runs-on: ubuntu-24.04
    timeout-minutes: 15

    permissions:
      contents: read
      packages: write

    steps:
      - name: Download digests
        uses: actions/download-artifact@v8
        with:
          path: ${{ runner.temp }}/digests
          pattern: digests-*
          merge-multiple: true

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ghcr.io/prometheus-ags/universal-agent-runtime
          tags: |
            type=sha,format=long
            type=raw,value=main,enable={{is_default_branch}}
            type=semver,pattern={{version}}

      - name: Create manifest list and push
        working-directory: ${{ runner.temp }}/digests
        run: |
          # shellcheck disable=SC2046  # intentional word-splitting: each -t
          # tag and each name@digest must be its own argv element.
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
            $(printf 'ghcr.io/prometheus-ags/universal-agent-runtime@sha256:%s ' *)

      - name: Inspect image
        run: |
          docker buildx imagetools inspect ghcr.io/prometheus-ags/universal-agent-runtime:${{ steps.meta.outputs.version }}

  boss-sidecar-build:
    name: The Boss sidecar (${{ matrix.platform }})
    if: ${{ startsWith(github.ref, 'refs/tags/boss-sidecar-') }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: ${{ matrix.platform == 'darwin-x64' && 180 || 120 }}
    strategy:
      fail-fast: false
      matrix:
        include: >-
          ${{ fromJSON(
            startsWith(github.ref_name, 'boss-sidecar-win32-x64-v') && '[{"platform":"win32-x64","runner":"windows-2025","target":"x86_64-pc-windows-msvc"}]' ||
            startsWith(github.ref_name, 'boss-sidecar-win32-arm64-v') && '[{"platform":"win32-arm64","runner":"windows-11-arm","target":"aarch64-pc-windows-msvc"}]' ||
            startsWith(github.ref_name, 'boss-sidecar-darwin-arm64-v') && '[{"platform":"darwin-arm64","runner":"macos-15","target":"aarch64-apple-darwin"}]' ||
            '[{"platform":"darwin-x64","runner":"macos-15-intel","target":"x86_64-apple-darwin"}]'
          ) }}
    env:
      CARGO_BUILD_JOBS: 2
      CARGO_INCREMENTAL: 0
    steps:
      - uses: actions/checkout@v7
        with:
          token: ${{ secrets.SUBMODULES_TOKEN || github.token }}
          sparse-checkout: |
            /*
            !/.kbd-orchestrator/
          sparse-checkout-cone-mode: false
      - name: Checkout Rust workspace submodules
        shell: bash
        run: |
          git submodule update --init --depth=1 -- \
            crates/prometheus-skill-system \
            vendor/git/liter-llm \
            vendor/git/rust-mcp-filesystem
      - name: Install pinned Rust target
        run: rustup target add ${{ matrix.target }}
      - name: Restore Rust build cache
        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
        with:
          shared-key: boss-sidecar-${{ matrix.platform }}-${{ matrix.target }}-server-full
          workspaces: ". -> target"
          cache-targets: "true"
      - name: Build production sidecar
        run: >-
          cargo build --release --locked --no-default-features
          --features ${{ matrix.platform == 'darwin-x64' && 'server-full,tract-embeddings' || 'server-full' }}
          --bin uar-sidecar --target ${{ matrix.target }}
      - name: Package complete sidecar payload
        env:
          UAR_SIDECAR_FEATURES: ${{ matrix.platform == 'darwin-x64' && 'server-full,tract-embeddings' || 'server-full' }}
        run: node scripts/package-boss-sidecar.mjs ${{ matrix.platform }} ${{ matrix.target }}
      - uses: actions/upload-artifact@v7
        with:
          name: uar-sidecar-${{ matrix.platform }}
          path: |
            dist/boss-sidecar/uar-sidecar-${{ matrix.platform }}.tar.gz
            dist/boss-sidecar/uar-sidecar-${{ matrix.platform }}.json
          if-no-files-found: error
          retention-days: 90

  boss-sidecar-publish:
    name: Publish immutable The Boss sidecar payload
    if: ${{ startsWith(github.ref, 'refs/tags/boss-sidecar-') }}
    needs: boss-sidecar-build
    runs-on: ubuntu-24.04
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/download-artifact@v8
        with:
          pattern: uar-sidecar-*
          path: dist/boss-sidecar
          merge-multiple: true
      - name: Publish GitHub Release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >-
          gh release create "${GITHUB_REF_NAME}"
          dist/boss-sidecar/uar-sidecar-*.tar.gz
          dist/boss-sidecar/uar-sidecar-*.json
          --verify-tag --latest=false --prerelease
          --title "The Boss UAR sidecar ${GITHUB_REF_NAME}"
          --notes "Immutable ${GITHUB_REF_NAME} payload for The Boss. Built natively with the server-full feature; the archive includes local embedding assets, Cedar policies, runtime libraries found beside the binary, licenses, and a checksummed file manifest."