@oisincoveney/pipeline 1.22.5 → 1.23.0

package/.agents/skills/execute/SKILL.md

@@ -20,9 +20,11 @@ hooks: generated-defaults-audit
 Instructions:
 Orchestrate package-owned pipeline config.
 
+Submit Kubernetes runner Jobs by default through `oisin-pipeline quick` and `oisin-pipeline execute`.
+
 Generate a schedule for entrypoint `execute` and the user task.
 The schedule policy is `execute-schedule`.
-Run `oisin-pipeline run --entrypoint execute <task description>` to generate and execute the schedule artifact.
-The pipeline CLI runtime is the deterministic graph scheduler for scheduled entrypoints.
-It launches configured Codex/OpenCode agent subprocesses as soon as their dependencies pass.
+Run `oisin-pipeline execute <task description>` to submit the pipeline as a k8s job.
+The pipeline runtime executes inside a Kubernetes pod using the package-owned runner image.
+Use `oisin-pipeline execute --local <task description>` for local execution instead.
 Use `oisin-pipeline run --schedule <schedule.yaml>` only when rerunning an existing schedule artifact.

package/.agents/skills/quick/SKILL.md

@@ -20,9 +20,11 @@ hooks: generated-defaults-audit
 Instructions:
 Orchestrate package-owned pipeline config.
 
+Submit Kubernetes runner Jobs by default through `oisin-pipeline quick` and `oisin-pipeline execute`.
+
 Generate a schedule for entrypoint `quick` and the user task.
 The schedule policy is `quick-schedule`.
-Run `oisin-pipeline run --entrypoint quick <task description>` to generate and execute the schedule artifact.
-The pipeline CLI runtime is the deterministic graph scheduler for scheduled entrypoints.
-It launches configured Codex/OpenCode agent subprocesses as soon as their dependencies pass.
+Run `oisin-pipeline quick <task description>` to submit the pipeline as a k8s job.
+The pipeline runtime executes inside a Kubernetes pod using the package-owned runner image.
+Use `oisin-pipeline quick --local <task description>` for local execution instead.
 Use `oisin-pipeline run --schedule <schedule.yaml>` only when rerunning an existing schedule artifact.

package/defaults/opencode-ecosystem.yaml

@@ -59,6 +59,15 @@ ecosystem_code:
     role: Codex-style long-running goal mode with /goal slash command, persistent state, evidence-gated completion, and TUI sidebar
     default_stack: true
     source: https://www.npmjs.com/package/@prevalentware/opencode-goal-plugin
+  - id: oc-codex-multi-auth
+    name: oc-codex-multi-auth
+    package: oc-codex-multi-auth
+    plugin:
+      kind: npm
+      package: oc-codex-multi-auth
+    role: ChatGPT Plus/Pro OAuth with multi-account rotation, health checks, and Codex/GPT-5 routing for OpenCode
+    default_stack: true
+    source: https://github.com/ndycode/oc-codex-multi-auth
   - id: opencode-snip
     name: opencode-snip
     role: prompt snippet and command-discipline helper patterns

package/dist/commands/pipeline-command.js

@@ -14,8 +14,8 @@ function registerConfiguredEntrypointCommands(program, config, runEntrypoint) {
 	const reservedCommands = new Set(program.commands.map((command) => command.name()));
 	for (const [id, entrypoint] of Object.entries(config.entrypoints)) {
 		if (reservedCommands.has(id)) continue;
-		program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description").action(async (descriptionParts) => {
-			await runEntrypoint(id, descriptionParts.join(" "));
+		program.command(id).description(entrypoint.description ?? `Run the ${id} workflow`).argument("<description...>", "task description").option("--local", "run locally instead of submitting as a k8s job").action(async (descriptionParts, flags) => {
+			await runEntrypoint(id, descriptionParts.join(" "), flags);
 		});
 		registered.add(id);
 		reservedCommands.add(id);

package/dist/config.d.ts

@@ -494,8 +494,8 @@ declare const configSchema: z.ZodObject<{
   rules: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   runners: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
@@ -534,8 +534,8 @@ declare const configSchema: z.ZodObject<{
     host_models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     model: z.ZodOptional<z.ZodString>;
     type: z.ZodEnum<{
-      opencode: "opencode";
       command: "command";
+      opencode: "opencode";
       codex: "codex";
     }>;
   }, z.core.$strict>>>;
@@ -636,8 +636,8 @@ declare const configSchema: z.ZodObject<{
   skills: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
     path: z.ZodString;
     source_root: z.ZodDefault<z.ZodEnum<{
-      package: "package";
       project: "project";
+      package: "package";
     }>>;
   }, z.core.$strict>>>;
   task_context: z.ZodOptional<z.ZodObject<{

package/dist/gates.js

@@ -75,7 +75,11 @@ async function resolvePackageBinaryCommand(worktreePath, binary, args) {
 		};
 		default: return {
 			command: "npx",
-			args: [binary, ...args]
+			args: [
+				"--yes",
+				binary,
+				...args
+			]
 		};
 	}
 }

package/dist/index.js

@@ -10,6 +10,7 @@ import { formatConfigError, runPipelineFromConfig } from "./pipeline-runtime.js"
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "./schedule-planner.js";
 import { registerRunnerJobCommand } from "./commands/runner-job-command.js";
 import { formatInstallCommandsResult, installCommands, parseCommandHost } from "./install-commands.js";
+import { submitK8sRunnerJob } from "./k8s-submit.js";
 import { formatPipelineInitResult, initPipelineProject } from "./pipeline-init.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
@@ -296,7 +297,16 @@ function createCliProgram() {
 		console.log(formatInstallCommandsResult(result));
 	});
 	registerRunnerJobCommand(program);
-	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, configuredPipeline, (entrypoint, task) => execute(task, { entrypoint }));
+	const configuredEntrypointCommands = registerConfiguredEntrypointCommands(program, configuredPipeline, async (entrypoint, task, opts) => {
+		if (!opts.local && (entrypoint === "quick" || entrypoint === "execute")) {
+			const result = await submitK8sRunnerJob({
+				entrypoint,
+				task,
+				eventUrl: process.env.PIPELINE_EVENT_URL ?? ""
+			});
+			console.log(`Job submitted: ${result.jobName} in ${result.namespace}`);
+		} else await execute(task, { entrypoint });
+	});
 	if (configuredEntrypointCommands.size > 0) program.configureHelp({ subcommandTerm(command) {
 		if (configuredEntrypointCommands.has(command.name())) return command.name();
 		return Help.prototype.subcommandTerm.call(this, command);
@@ -385,7 +395,8 @@ async function runDoctor(cwd) {
 	const commandChecks = await Promise.all([
 		checkCommand("npx", ["--version"], cwd),
 		checkCommand("codex", ["--version"], cwd),
-		checkCommand("opencode", ["--version"], cwd)
+		checkCommand("opencode", ["--version"], cwd),
+		checkCommand("fallow", ["--version"], cwd)
 	]);
 	const configCheck = checkPipelineConfig(cwd);
 	const checks = [...commandChecks, configCheck];

package/dist/install-commands.js

@@ -175,12 +175,16 @@ function entrypointDispatchBlock(host, config, id, entrypoint) {
 	return [
 		`Generate a schedule for entrypoint \`${id}\` and the user task.`,
 		`The schedule policy is \`${entrypoint.schedule}\`.`,
-		`Run \`oisin-pipeline run --entrypoint ${id} <task description>\` to generate and execute the schedule artifact.`,
-		"The pipeline CLI runtime is the deterministic graph scheduler for scheduled entrypoints.",
-		"It launches configured Codex/OpenCode agent subprocesses as soon as their dependencies pass.",
+		`Run \`oisin-pipeline ${id} <task description>\` to submit the pipeline as a k8s job.`,
+		"The pipeline runtime executes inside a Kubernetes pod using the package-owned runner image.",
+		`Use \`oisin-pipeline ${id} --local <task description>\` for local execution instead.`,
 		"Use `oisin-pipeline run --schedule <schedule.yaml>` only when rerunning an existing schedule artifact."
 	].join("\n");
 }
+function scheduledEntrypointK8sNote(entrypoint) {
+	if ("workflow" in entrypoint) return;
+	return "Submit Kubernetes runner Jobs by default through `oisin-pipeline quick` and `oisin-pipeline execute`.";
+}
 function orchestratorEntrypointDispatchBlock(host, config) {
 	const scheduledEntrypoints = entrypointEntries(config).filter(([, entrypoint]) => !("workflow" in entrypoint));
 	if (scheduledEntrypoints.length === 0) return dispatchBlock(host, config);
@@ -379,6 +383,8 @@ function opencodeDefinitions(config, cwd) {
 				"",
 				orchestratorBlock(config),
 				"",
+				scheduledEntrypointK8sNote(entrypoint),
+				scheduledEntrypointK8sNote(entrypoint) ? "" : void 0,
 				entrypointDispatchBlock("opencode", config, id, entrypoint)
 			]).join("\n")),
 			host: "opencode",
@@ -447,6 +453,8 @@ function codexDefinitions(config, cwd) {
 				"",
 				orchestratorBlock(config),
 				"",
+				scheduledEntrypointK8sNote(entrypoint),
+				scheduledEntrypointK8sNote(entrypoint) ? "" : void 0,
 				entrypointDispatchBlock("codex", config, id, entrypoint)
 			]).join("\n")),
 			host: "codex",
@@ -466,6 +474,8 @@ function codexDefinitions(config, cwd) {
 				"",
 				orchestratorBlock(config),
 				"",
+				scheduledEntrypointK8sNote(entrypoint),
+				scheduledEntrypointK8sNote(entrypoint) ? "" : void 0,
 				entrypointDispatchBlock("codex", config, id, entrypoint)
 			]).join("\n")),
 			host: "codex",

package/dist/k8s-submit.js

@@ -0,0 +1,267 @@
+import { z } from "zod";
+import { simpleGit } from "simple-git";
+import { randomBytes } from "node:crypto";
+import { BatchV1Api, CoreV1Api, KubeConfig } from "@kubernetes/client-node";
+//#region src/k8s-submit.ts
+const GIT_SUFFIX_RE = /\.git$/;
+const k8sSecretRefSchema = z.object({
+	key: z.string().min(1),
+	name: z.string().min(1)
+}).strict();
+const k8sSubmitOptionsSchema = z.object({
+	codexAuth: k8sSecretRefSchema.default({
+		key: "auth.json",
+		name: "codex-auth-1"
+	}),
+	entrypoint: z.enum(["execute", "quick"]),
+	eventAuth: k8sSecretRefSchema.default({
+		key: "token",
+		name: "pipeline-runner-event-auth"
+	}),
+	eventUrl: z.string().url(),
+	githubAuth: k8sSecretRefSchema.default({
+		key: "hosts.yml",
+		name: "pipeline-runner-github-auth"
+	}),
+	jobName: z.string().min(1).optional(),
+	kubeconfigPath: z.string().min(1).optional(),
+	namespace: z.string().min(1).default("momokaya-pipeline"),
+	opencodeAuth: k8sSecretRefSchema.default({
+		key: "auth.json",
+		name: "opencode-auth-1"
+	}),
+	opencodeOpenaiAccounts: k8sSecretRefSchema.optional(),
+	orchestrator: z.enum(["codex", "opencode"]).default("opencode"),
+	serviceAccountName: z.string().min(1).default("pipeline-runner"),
+	task: z.string().min(1)
+}).strict();
+z.object({
+	jobName: z.string().min(1),
+	namespace: z.string().min(1)
+}).strict();
+async function resolveGitContext() {
+	const git = simpleGit();
+	const [branchResult, sha, remoteConfig] = await Promise.all([
+		git.branch(),
+		git.revparse(["HEAD"]),
+		git.getConfig("remote.origin.url")
+	]);
+	const url = remoteConfig.value;
+	if (!url) throw new Error("Could not resolve git remote origin URL. Ensure the repository has a remote configured.");
+	const project = projectNameFromUrl(url);
+	return {
+		baseBranch: branchResult.current,
+		project,
+		sha: sha.trim(),
+		url
+	};
+}
+function projectNameFromUrl(url) {
+	return url.replace(GIT_SUFFIX_RE, "").split("/").at(-1) ?? "unknown";
+}
+function generateRunId() {
+	return `run-${randomBytes(8).toString("hex")}`;
+}
+function generatePayloadConfigMapName() {
+	return `pipeline-payload-${randomBytes(6).toString("hex")}`;
+}
+async function submitK8sRunnerJob(rawOptions) {
+	const options = k8sSubmitOptionsSchema.parse(rawOptions);
+	const git = await resolveGitContext();
+	const kc = new KubeConfig();
+	if (options.kubeconfigPath) kc.loadFromFile(options.kubeconfigPath);
+	else kc.loadFromDefault();
+	const coreApi = kc.makeApiClient(CoreV1Api);
+	const batchApi = kc.makeApiClient(BatchV1Api);
+	const payloadConfigMapName = generatePayloadConfigMapName();
+	const jobName = options.jobName ?? `pipeline-run-${options.entrypoint}-${randomBytes(4).toString("hex")}`;
+	const namespace = options.namespace;
+	const payload = {
+		command: options.entrypoint,
+		contractVersion: "1",
+		events: {
+			authTokenFile: `/etc/pipeline/event-auth/${options.eventAuth.key}`,
+			url: options.eventUrl
+		},
+		repository: {
+			baseBranch: git.baseBranch,
+			sha: git.sha,
+			url: git.url
+		},
+		run: {
+			id: generateRunId(),
+			project: git.project
+		},
+		task: {
+			kind: "prompt",
+			prompt: options.task
+		}
+	};
+	const configMapBody = {
+		apiVersion: "v1",
+		kind: "ConfigMap",
+		metadata: {
+			name: payloadConfigMapName,
+			namespace
+		},
+		data: { "payload.json": JSON.stringify(payload) }
+	};
+	await coreApi.createNamespacedConfigMap(namespace, configMapBody);
+	const volumes = [
+		{
+			name: payloadConfigMapName,
+			configMap: {
+				name: payloadConfigMapName,
+				items: [{
+					key: "payload.json",
+					path: "payload.json"
+				}]
+			}
+		},
+		{
+			name: options.eventAuth.name,
+			secret: {
+				secretName: options.eventAuth.name,
+				items: [{
+					key: options.eventAuth.key,
+					path: options.eventAuth.key
+				}]
+			}
+		},
+		{
+			name: options.codexAuth.name,
+			secret: {
+				secretName: options.codexAuth.name,
+				defaultMode: 256
+			}
+		},
+		{
+			name: options.opencodeAuth.name,
+			secret: {
+				secretName: options.opencodeAuth.name,
+				defaultMode: 256
+			}
+		},
+		...options.opencodeOpenaiAccounts ? [{
+			name: options.opencodeOpenaiAccounts.name,
+			secret: {
+				secretName: options.opencodeOpenaiAccounts.name,
+				defaultMode: 256
+			}
+		}] : [],
+		{
+			name: options.githubAuth.name,
+			secret: {
+				secretName: options.githubAuth.name,
+				items: [
+					{
+						key: "gitconfig",
+						path: "gitconfig"
+					},
+					{
+						key: "git-credentials",
+						path: "git-credentials"
+					},
+					{
+						key: "hosts.yml",
+						path: "hosts.yml"
+					}
+				]
+			}
+		}
+	];
+	const volumeMounts = [
+		{
+			name: payloadConfigMapName,
+			mountPath: "/etc/pipeline/payload.json",
+			subPath: "payload.json",
+			readOnly: true
+		},
+		{
+			name: options.eventAuth.name,
+			mountPath: "/etc/pipeline/event-auth",
+			readOnly: true
+		},
+		{
+			name: options.codexAuth.name,
+			mountPath: `/root/.codex/${options.codexAuth.key}`,
+			subPath: options.codexAuth.key,
+			readOnly: true
+		},
+		{
+			name: options.opencodeAuth.name,
+			mountPath: `/root/.local/share/opencode/${options.opencodeAuth.key}`,
+			subPath: options.opencodeAuth.key,
+			readOnly: true
+		},
+		...options.opencodeOpenaiAccounts ? [{
+			name: options.opencodeOpenaiAccounts.name,
+			mountPath: "/root/.opencode/oc-codex-multi-auth-accounts.json",
+			subPath: options.opencodeOpenaiAccounts.key,
+			readOnly: true
+		}] : [],
+		{
+			name: options.githubAuth.name,
+			mountPath: "/root/.gitconfig",
+			subPath: "gitconfig",
+			readOnly: true
+		},
+		{
+			name: options.githubAuth.name,
+			mountPath: "/root/.git-credentials",
+			subPath: "git-credentials",
+			readOnly: true
+		},
+		{
+			name: options.githubAuth.name,
+			mountPath: "/root/.config/gh/hosts.yml",
+			subPath: "hosts.yml",
+			readOnly: true
+		}
+	];
+	const env = options.opencodeOpenaiAccounts ? [{
+		name: "CODEX_AUTH_PER_PROJECT_ACCOUNTS",
+		value: "false"
+	}] : [];
+	const jobBody = {
+		apiVersion: "batch/v1",
+		kind: "Job",
+		metadata: {
+			name: jobName,
+			namespace
+		},
+		spec: {
+			backoffLimit: 0,
+			template: { spec: {
+				serviceAccountName: options.serviceAccountName,
+				restartPolicy: "Never",
+				containers: [{
+					name: "runner",
+					image: "ghcr.io/oisin-ee/pipeline-runner:latest",
+					imagePullPolicy: "Always",
+					args: [
+						"runner-job",
+						"--payload-file",
+						"/etc/pipeline/payload.json",
+						options.orchestrator
+					],
+					...env.length > 0 ? { env } : {},
+					volumeMounts
+				}],
+				volumes
+			} }
+		}
+	};
+	try {
+		await batchApi.createNamespacedJob(namespace, jobBody);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`Kubernetes cluster unreachable or Job creation failed: ${message}`);
+	}
+	return {
+		jobName,
+		namespace
+	};
+}
+//#endregion
+export { submitK8sRunnerJob };

package/docs/operator-guide.md

@@ -250,6 +250,48 @@ The runner does not own the console database, event store, Job builder, Kueue
 watcher, or UI. Do not add a runner-side Kubernetes API kind, database, console
 deployment per run, or separate language stack for this integration.
 
+
+
+### K8s-native pipeline execution (quick and execute)
+
+The `quick` and `execute` entrypoints submit Kubernetes runner Jobs by default. Each command builds a runner job payload from the task description
+and current git context, creates a ConfigMap, and submits a `batch/v1` Job that
+runs the pipeline inside a pod using the package-owned runner image.
+
+Set `PIPELINE_EVENT_URL` to configure the runner event sink. Without it, the
+command fails with a validation error.
+
+#### Prerequisites
+
+The following must exist in the target namespace:
+
+- **ServiceAccount** `pipeline-runner` with RBAC to read pods/logs (for
+  debugging).
+- **Secret** `codex-auth-1` with key `auth.json` (Codex authentication).
+- **Secret** `opencode-auth-1` with key `auth.json` (OpenCode authentication).
+- **Secret** `pipeline-runner-event-auth` with key `token` (event sink bearer
+  token, mounted at `/etc/pipeline/event-auth/token`).
+- **Secret** `pipeline-runner-github-auth` with keys `gitconfig`,
+  `git-credentials`, `hosts.yml` (GitHub authentication for `git` and `gh`).
+- A pipeline-console event sink endpoint reachable from the pod.
+
+#### Usage
+
+```shell
+export PIPELINE_EVENT_URL="https://console.example.com/api/pipeline/runner-events"
+oisin-pipeline quick "fix the login bug"
+oisin-pipeline execute "Implement PIPE-53"
+```
+
+#### Local execution fallback
+
+Use the `--local` flag for workstation-local execution:
+
+```shell
+oisin-pipeline quick --local "fix the login bug"
+oisin-pipeline execute --local "Implement PIPE-53"
+```
+
 Generated invocations include:
 
 ```text

package/package.json

@@ -1,6 +1,7 @@
 {
   "dependencies": {
     "@dagrejs/graphlib": "^4.0.1",
+    "@kubernetes/client-node": "^1.4.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "commander": "^14.0.3",
@@ -111,7 +112,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.22.5",
+  "version": "1.23.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",