@cyanautomation/kaseki-agent 1.4.1

package/.github/workflows/build-docker-image.yml

@@ -0,0 +1,453 @@
+name: Build Docker Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      tags:
+        description: "Comma-separated Docker tags to publish (auto-detects from git ref if empty)"
+        required: false
+        default: ""
+  schedule:
+    # Weekly build every Sunday at 00:00 UTC, publishes 'latest' tag to both registries
+    - cron: '0 0 * * 0'
+  workflow_run:
+    workflows:
+      - Release
+    types:
+      - completed
+
+env:
+  DOCKER_IMAGE: cyanautomation/kaseki-agent
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  type_check_changed:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.22.2'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check changed-code scope (blocking)
+        run: npm run type-check:changed
+
+  type_check_full:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.22.2'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Full type check (non-blocking baseline)
+        id: full_type_check
+        shell: bash
+        run: |
+          set +e
+          npm run type-check:full > type-check-full.log 2>&1
+          exit_code=$?
+          cat type-check-full.log
+          echo "exit_code=${exit_code}" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Upload full type-check report
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: type-check-full-report
+          path: |
+            type-check-full.log
+          if-no-files-found: warn
+
+  checks:
+    needs: type_check_changed
+    runs-on: ubuntu-latest
+    # Runs in parallel with type_check_full (both independent after type_check_changed blocks all)
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.22.2'
+          cache: npm
+
+      - name: Install ShellCheck
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends shellcheck
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run lint
+        run: npm run lint
+
+      - name: Run tests
+        run: npm test
+
+      - name: Build TypeScript
+        run: npm run build
+
+      - name: Verify API service build artifact
+        shell: bash
+        run: |
+          test -f dist/kaseki-api-service.js
+          ls -l dist/kaseki-api-service.js
+
+  build:
+    needs: [checks, type_check_full]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine tags
+        id: meta
+        shell: bash
+        run: |
+          # Tag determination logic for different trigger types:
+          # 1. workflow_dispatch with custom tags input: use those tags
+          # 2. workflow_dispatch without input OR workflow_run: auto-detect from git ref
+          # 3. schedule (Sunday 00:00 UTC): use 'latest'
+          
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && -n "${{ github.event.inputs.tags }}" ]]; then
+            # Manual dispatch with explicit tags provided
+            TAGS="${{ github.event.inputs.tags }}"
+          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            # On a git tag (from release workflow via workflow_run, or manual push)
+            VERSION="${GITHUB_REF#refs/tags/}"
+            VERSION="${VERSION#v}"
+            TAGS="$VERSION,latest"
+          elif [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+            # On main branch (scheduled builds only now)
+            SHORT_SHA="${GITHUB_SHA::12}"
+            TAGS="latest,main-$SHORT_SHA"
+          else
+            # Default to 'latest' for other triggers
+            TAGS="latest"
+          fi
+
+          DOCKER_HUB_TAGS=""
+          GHCR_TAGS=""
+          FIRST_TAG=""
+          for raw_tag in ${TAGS//,/ }; do
+            tag="$(echo "$raw_tag" | xargs)"
+            [[ -z "$tag" ]] && continue
+            [[ -z "$FIRST_TAG" ]] && FIRST_TAG="$tag"
+            DOCKER_HUB_TAGS="${DOCKER_HUB_TAGS}${DOCKER_IMAGE}:$tag"$'\n'
+            DOCKER_HUB_TAGS="${DOCKER_HUB_TAGS}${DOCKER_IMAGE}:$tag-arm64"$'\n'
+            GHCR_TAGS="${GHCR_TAGS}ghcr.io/${DOCKER_IMAGE}:$tag"$'\n'
+            GHCR_TAGS="${GHCR_TAGS}ghcr.io/${DOCKER_IMAGE}:$tag-arm64"$'\n'
+          done
+
+          if [[ -z "$DOCKER_HUB_TAGS" ]]; then
+            echo "No Docker tags were provided" >&2
+            exit 1
+          fi
+
+          DOCKER_HUB_TAGS="${DOCKER_HUB_TAGS%$'\n'}"
+          GHCR_TAGS="${GHCR_TAGS%$'\n'}"
+          ALL_TAGS="${DOCKER_HUB_TAGS}"$'\n'"${GHCR_TAGS}"
+          echo "tags<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$ALL_TAGS" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+          echo "primary_tag=${FIRST_TAG:-latest}" >> "$GITHUB_OUTPUT"
+          echo "Building tags:"
+          echo "$ALL_TAGS"
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha,scope=${{ github.ref_name }}
+          cache-to: type=gha,scope=${{ github.ref_name }},mode=max
+          provenance: true
+          sbom: true
+
+      - name: Log build cache statistics
+        shell: bash
+        run: |
+          echo "Build completed successfully"
+          echo "Build digest: ${{ steps.build.outputs.digest }}"
+          echo "Image size (metadata): ${{ steps.build.outputs.imageid }}"
+          echo ""
+          echo "Cache strategy: GitHub Actions cache with scope=${{ github.ref_name }}"
+          echo "Expected cache hit rate on subsequent builds: 80-90%"
+          echo "See .github/skills/docker-image-management/SKILL.md for cache optimization details"
+
+  scan:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      # artifact uploads for SBOM
+      packages: read
+
+    steps:
+      # Vulnerability scanning strategy:
+      # 1. HIGH/CRITICAL: Blocking scan uploaded to GitHub Security tab (fails if found)
+      # 2. All severities: Informational JSON report for visibility into MEDIUM/LOW
+      # 3. SBOM: Generated in SPDX format for supply chain security
+      #
+      # We scan docker.io registry since that's the primary distribution point.
+      # GHCR images have parity via multi-registry build, so scanning one is sufficient.
+      # Both amd64 and arm64 variants use the same base image and have identical vulnerabilities.
+
+      - name: Run Trivy vulnerability scanner (HIGH/CRITICAL only)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'docker.io/cyanautomation/kaseki-agent:latest'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'HIGH,CRITICAL'
+
+      - name: Run Trivy vulnerability scanner (all severities - informational)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'docker.io/cyanautomation/kaseki-agent:latest'
+          format: 'json'
+          output: 'trivy-results-all.json'
+
+      - name: Generate SBOM (SPDX format)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: 'docker.io/cyanautomation/kaseki-agent:latest'
+          format: 'spdx-json'
+          output: 'sbom-spdx.json'
+
+      - name: Upload Trivy results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+      - name: Upload SBOM and detailed scan results
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: vulnerability-scan-results
+          path: |
+            trivy-results.sarif
+            trivy-results-all.json
+            sbom-spdx.json
+          retention-days: 30
+
+      - name: Summarize scan results
+        if: always()
+        shell: bash
+        run: |
+          echo "=== Vulnerability Scan Complete ==="
+          echo ""
+          echo "Scanned Image: docker.io/cyanautomation/kaseki-agent:latest"
+          echo "Scanner: Trivy v0.36.0"
+          echo ""
+          echo "Results:"
+          echo "  - HIGH/CRITICAL findings → trivy-results.sarif (uploaded to GitHub Security tab)"
+          echo "  - All severities → trivy-results-all.json (informational, includes MEDIUM/LOW)"
+          echo "  - SBOM (SPDX) → sbom-spdx.json (software composition)"
+          echo ""
+          echo "Artifacts retained for 30 days"
+          echo ""
+          if grep -q '"severity":"HIGH"' trivy-results-all.json 2>/dev/null || grep -q '"severity":"CRITICAL"' trivy-results-all.json 2>/dev/null; then
+            echo "⚠️  HIGH or CRITICAL vulnerabilities detected - review trivy-results.sarif"
+          else
+            echo "✓ No HIGH or CRITICAL vulnerabilities found"
+          fi
+
+  verify:
+    needs: build
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine verification tag
+        id: meta
+        shell: bash
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            TAGS="${{ github.event.inputs.tags }}"
+            TAG="$(echo "${TAGS%%,*}" | xargs)"
+            echo "tag=${TAG:-latest}" >> "$GITHUB_OUTPUT"
+          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
+            TAG="${TAG#v}"
+            echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Verify multi-arch manifest
+        shell: bash
+        run: |
+          IMAGE="${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          echo "Verifying manifest for: $IMAGE"
+          docker manifest inspect "$IMAGE" | jq -e '
+            [.manifests[].platform | "\(.os)/\(.architecture)"] as $platforms |
+            ($platforms | index("linux/amd64")) and ($platforms | index("linux/arm64"))
+          '
+          docker manifest inspect "$IMAGE" | jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture)"'
+          echo "Multi-arch image verified successfully"
+
+      - name: Verify Pi CLI entrypoint
+        shell: bash
+        run: |
+          IMAGE="${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          docker run --rm --entrypoint pi "$IMAGE" --version
+
+      - name: Smoke test runtime artifacts
+        shell: bash
+        run: |
+          IMAGE="${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          WORKSPACE="$(mktemp -d)"
+          RESULTS="$(mktemp -d)"
+          chmod 0777 "$WORKSPACE" "$RESULTS"
+
+          set +e
+          docker run --rm \
+            --read-only \
+            --tmpfs /tmp:rw,nosuid,nodev,size=256m \
+            --security-opt no-new-privileges:true \
+            --cap-drop ALL \
+            -e KASEKI_INSTANCE=kaseki-smoke \
+            -v "$WORKSPACE:/workspace:rw" \
+            -v "$RESULTS:/results:rw" \
+            -w /workspace \
+            "$IMAGE"
+          exit_code="$?"
+          set -e
+
+          test "$exit_code" -eq 2
+          jq -e '
+            .instance == "kaseki-smoke" and
+            .exit_code == 2 and
+            .failed_command == "missing OPENROUTER_API_KEY"
+          ' "$RESULTS/metadata.json"
+          test -s "$RESULTS/result-summary.md"
+          test -f "$RESULTS/quality.log"
+          test -f "$RESULTS/secret-scan.log"
+          test ! -d "$WORKSPACE/repo"
+
+          docker run --rm \
+            --entrypoint kaseki-report \
+            -v "$RESULTS:/results:ro" \
+            "$IMAGE" \
+            /results
+
+      - name: Verify multi-arch manifest (GHCR)
+        shell: bash
+        run: |
+          IMAGE="ghcr.io/${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          echo "Verifying manifest for: $IMAGE"
+          docker manifest inspect "$IMAGE" | jq -e '
+            [.manifests[].platform | "\(.os)/\(.architecture)"] as $platforms |
+            ($platforms | index("linux/amd64")) and ($platforms | index("linux/arm64"))
+          '
+          docker manifest inspect "$IMAGE" | jq -r '.manifests[] | "\(.platform.os)/\(.platform.architecture)"'
+          echo "Multi-arch image verified successfully (GHCR)"
+
+      - name: Verify Pi CLI entrypoint (GHCR)
+        shell: bash
+        run: |
+          IMAGE="ghcr.io/${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          docker run --rm --entrypoint pi "$IMAGE" --version
+
+      - name: Smoke test runtime artifacts (GHCR)
+        shell: bash
+        run: |
+          IMAGE="ghcr.io/${DOCKER_IMAGE}:${{ steps.meta.outputs.tag }}"
+          WORKSPACE="$(mktemp -d)"
+          RESULTS="$(mktemp -d)"
+          chmod 0777 "$WORKSPACE" "$RESULTS"
+
+          set +e
+          docker run --rm \
+            --read-only \
+            --tmpfs /tmp:rw,nosuid,nodev,size=256m \
+            --security-opt no-new-privileges:true \
+            --cap-drop ALL \
+            -e KASEKI_INSTANCE=kaseki-smoke-ghcr \
+            -v "$WORKSPACE:/workspace:rw" \
+            -v "$RESULTS:/results:rw" \
+            -w /workspace \
+            "$IMAGE"
+          exit_code="$?"
+          set -e
+
+          test "$exit_code" -eq 2
+          jq -e '
+            .instance == "kaseki-smoke-ghcr" and
+            .exit_code == 2 and
+            .failed_command == "missing OPENROUTER_API_KEY"
+          ' "$RESULTS/metadata.json"
+          test -s "$RESULTS/result-summary.md"
+          test -f "$RESULTS/quality.log"
+          test -f "$RESULTS/secret-scan.log"
+          test ! -d "$WORKSPACE/repo"
+
+          docker run --rm \
+            --entrypoint kaseki-report \
+            -v "$RESULTS:/results:ro" \
+            "$IMAGE" \
+            /results

package/.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Perform a dry-run (preview only, no tags/releases created)"
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "true"
+          - "false"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # Full history for semantic-release
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.22.2'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run semantic-release
+        id: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
+            npm run release:dry 2>&1 | tee release-output.log
+            echo "released=false" >> "$GITHUB_OUTPUT"
+            echo "dry_run=true" >> "$GITHUB_OUTPUT"
+          else
+            npm run release 2>&1 | tee release-output.log
+            # Check if release was created (look for "published" in output)
+            if grep -q "Published release" release-output.log; then
+              echo "released=true" >> "$GITHUB_OUTPUT"
+              # Extract version from git describe
+              VERSION=$(git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//')
+              echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+            else
+              echo "released=false" >> "$GITHUB_OUTPUT"
+            fi
+          fi
+
+      - name: Upload release log
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-output
+          path: release-output.log
+          retention-days: 30

package/.releaserc.json

@@ -0,0 +1,135 @@
+{
+  "branches": [
+    {
+      "name": "main",
+      "prerelease": false
+    }
+  ],
+  "plugins": [
+    [
+      "@semantic-release/commit-analyzer",
+      {
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          {
+            "type": "feat",
+            "release": "minor"
+          },
+          {
+            "type": "fix",
+            "release": "patch"
+          },
+          {
+            "type": "perf",
+            "release": "patch"
+          },
+          {
+            "type": "revert",
+            "release": "patch"
+          },
+          {
+            "type": "docs",
+            "release": false
+          },
+          {
+            "type": "style",
+            "release": false
+          },
+          {
+            "type": "refactor",
+            "release": false
+          },
+          {
+            "type": "test",
+            "release": false
+          },
+          {
+            "type": "chore",
+            "release": false
+          }
+        ]
+      }
+    ],
+    [
+      "@semantic-release/release-notes-generator",
+      {
+        "preset": "conventionalcommits",
+        "presetConfig": {
+          "types": [
+            {
+              "type": "feat",
+              "section": "Features",
+              "hidden": false
+            },
+            {
+              "type": "fix",
+              "section": "Bug Fixes",
+              "hidden": false
+            },
+            {
+              "type": "perf",
+              "section": "Performance Improvements",
+              "hidden": false
+            },
+            {
+              "type": "revert",
+              "section": "Reverts",
+              "hidden": false
+            },
+            {
+              "type": "docs",
+              "section": "Documentation",
+              "hidden": true
+            },
+            {
+              "type": "style",
+              "section": "Styles",
+              "hidden": true
+            },
+            {
+              "type": "refactor",
+              "section": "Refactoring",
+              "hidden": true
+            },
+            {
+              "type": "test",
+              "section": "Tests",
+              "hidden": true
+            },
+            {
+              "type": "chore",
+              "section": "Miscellaneous",
+              "hidden": true
+            }
+          ]
+        }
+      }
+    ],
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md",
+        "changelogTitle": "# Changelog\n\nAll notable changes to Kaseki Agent are documented in this file.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)."
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "package.json",
+          "package-lock.json",
+          "CHANGELOG.md"
+        ],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    [
+      "@semantic-release/github",
+      {
+        "successComment": false,
+        "failComment": false,
+        "failTitle": "The automated release failed"
+      }
+    ]
+  ]
+}