Skip to content
Compass Engineering Docs

agent-image-index

Composes the amd64 and arm64 compass-agent images into an OCI index, publishes it to GHCR, and verifies the immutable build tag and :latest. It exists to publish one verified multi-architecture reference from the per-architecture images.

Run

Section titled “Run”

From the repository root, with podman, skopeo, and a populated GHCR auth file ready:

Terminal window
export GH_SHA="$(git rev-parse HEAD)"
export RUNNER_TEMP="$(mktemp -d)"
export REGISTRY_AUTH_FILE="/path/to/ghcr-auth.json"
bun tools/agent-image-index/index.ts

The publish-image-manifest job in .github/workflows/release.yml runs this command after skopeo login.

Credentials

Section titled “Credentials”

REGISTRY_AUTH_FILE names the auth file used by skopeo and podman. The publish-image-manifest job creates the file with skopeo login using secrets.GITHUB_TOKEN; it grants packages: write.

Rotate

Section titled “Rotate”

GitHub issues GITHUB_TOKEN per run and rotates it automatically. CI recreates the temporary auth file on each run, so there is no long-lived registry token to rotate.

Retention

Section titled “Retention”

The weekly agent-image-retention workflow keeps tags for commits in the last 30 days of main first-parent history plus 50 more commits, with a minimum window of 200. It also keeps release and unknown tags, off-main tags, lock-pinned images, their index children, and untagged versions younger than seven days. Dispatch the workflow to review a dry-run plan; scheduled runs delete eligible versions. GitHub keeps a deleted version restorable for 30 days.