Description
Dockerfile.package agent targets (e.g. the Claude target with its CLAUDE_AGENT_ACP_VERSION / CLAUDE_CODE_VERSION pins and OPENAB_AGENT_COMMAND / OPENAB_AGENT_AUTH_COMMAND defaults) have no pull-request build or runtime verification. The only workflow that builds them (pre-beta-build.yml) is triggered by schedule/workflow_dispatch, so changes to the package targets are first exercised after merge while publishing images.
Raised by the review panel on #1419 (finding F3): that PR changed the package Claude target pins and runtime/auth defaults with no PR-time verification. Mitigated there by live-verifying the equivalent Dockerfile.claude content (same pins/env) as image pr1419-claude on ECS, but the gap is structural.
Use Case
A PR that edits Dockerfile.package should get the same smoke coverage as Dockerfile.claude/Dockerfile.unified targets: build the target with its bins context, then verify the agent binaries exist, pinned versions match the Dockerfile ARGs, both OPENAB_AGENT_COMMAND/OPENAB_AGENT_AUTH_COMMAND defaults are correct, and the ACP initialize handshake succeeds — mirroring the pattern in docker-smoke-test-unified.yml.
Description
Dockerfile.packageagent targets (e.g. the Claude target with itsCLAUDE_AGENT_ACP_VERSION/CLAUDE_CODE_VERSIONpins andOPENAB_AGENT_COMMAND/OPENAB_AGENT_AUTH_COMMANDdefaults) have no pull-request build or runtime verification. The only workflow that builds them (pre-beta-build.yml) is triggered byschedule/workflow_dispatch, so changes to the package targets are first exercised after merge while publishing images.Raised by the review panel on #1419 (finding F3): that PR changed the package Claude target pins and runtime/auth defaults with no PR-time verification. Mitigated there by live-verifying the equivalent
Dockerfile.claudecontent (same pins/env) as imagepr1419-claudeon ECS, but the gap is structural.Use Case
A PR that edits
Dockerfile.packageshould get the same smoke coverage asDockerfile.claude/Dockerfile.unifiedtargets: build the target with itsbinscontext, then verify the agent binaries exist, pinned versions match the Dockerfile ARGs, bothOPENAB_AGENT_COMMAND/OPENAB_AGENT_AUTH_COMMANDdefaults are correct, and the ACP initialize handshake succeeds — mirroring the pattern indocker-smoke-test-unified.yml.