[rigel-mintaka]

What does this PR do?

Publishes the fork image to ghcr.io/rigelbuild/hermes-agent so Hermes can run in k3s from a pinned digest (Matt ruled "move to k8s"). Upstream docker.yml cannot run here: it needs Blacksmith runners and pushes to Docker Hub.

Related Issue

RIG-8568 (Linear). Consumer: Nemo-on-k3s design, orion-docs#175 T1.

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• New .github/workflows/rigel-image.yml. Runs on a v*-rigel.* tag push or dispatch with such a tag; branch refs are refused.
• Native amd64 and arm64 builds on GitHub-hosted runners. Dockerfile unchanged, so s6 stays PID 1.
• Each arch builds once and pushes by digest, then pulls that digest and runs tests/docker/ on it. Only tested digests reach the manifest.
• The manifest is tagged <tag> and sha-<commit>. Its digest goes to the job summary and the release as image-digest.txt. No release yet only warns.
• No untagged-image pruning: per-arch children of the manifest are untagged.
• actions/checkout is pinned to the real v7.0.1 commit. rigel-ci.yml pins main under that label; that file is left for a separate fix.

How to Test

1. nix run nixpkgs#actionlint -- .github/workflows/rigel-image.yml: clean.
2. After merge, push a v<version>-rigel.1 tag; docker buildx imagetools inspect ghcr.io/rigelbuild/hermes-agent:<tag> shows both arches.

Checklist

Code

• My commit messages follow Conventional Commits
• My PR contains only changes related to this feature
• Workflow run: first run happens after merge, on a tag

Documentation & Housekeeping

• Documentation: N/A

For New Skills

N/A.

Screenshots / Logs

N/A.

Refs RIG-8568

Co-authored-by: Matt Wilkinson matt@rigel.build

[linear-code]

RIG-8568

[rigel-mintaka]

Review round 1 (single review pass, pre-submit), head c1fc7eb:

Severity	Finding	Action
high	arm64 pushed without integration tests	Fixed: tests/docker/ runs on both native arches
medium	pushed image was a rebuild, not the tested bytes	Fixed: SOURCE_DATE_EPOCH pinned; job fails unless pushed config digest equals tested image ID
medium	dispatch accepted any ref, incl. mutable branches	Fixed: ref must match ^v[0-9][^/]*-rigel\.[^/]+$ and resolve as a tag
medium	manifest job re-resolved HEAD	Fixed: commit passed as a build job output
medium	release upload swallowed gh errors	Fixed: 404 warns, other errors fail
medium	actions/checkout pin was main tip, labelled v7.0.1	Fixed here (3d3c42e5); rigel-ci.yml left for a separate fix
low	v*-rigel.* tag not parsed into the install stamp version	Accepted: stamp carries the commit; image tag carries the release name
(driver)	untagged-only prune would delete per-arch manifest children	Fixed: prune job removed

Re-ran actionlint after fixes: clean.

[rigel-mintaka]

Review rounds 2-3 at edc6525: round 2 found the pushed-vs-tested ID check could fail spuriously under the containerd store, the tag regex allowed invalid Docker tags, and a 404 on release lookup was silent. Fixed: build once and push by digest, then pull and test that digest on both arches; Docker tag grammar added to validation; 404 warns on purpose (tag often precedes its release). Round 3: all-clear on edc6525 (two accepted lows: ASCII-range locale nit, digest attach needs a manifest rerun if the release is created later).

[rigel-mintaka]

All-clear on head edc6525: review round 3 clean, CI green. Ready for Matt to merge.