fix: use crane to extract cross-platform host-info binaries

Use crane to export platform-specific binaries from a single multi-arch
image instead of pulling separate arch-tagged images, which fails when
the build platform differs from the target.

Also adds git commit policy to AGENTS.md - always ask before committing.

Author: v0l

.github/workflows/build.yml

@@ -11,18 +11,9 @@ env:
   HOST_INFO_IMAGE: registry.v0l.io/lnvps-host-info
 
 jobs:
-  # Build host-info for multiple architectures first
+  # Build host-info as a multi-arch image first
   build-host-info:
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            tag_suffix: amd64
-          - platform: linux/arm64
-            tag_suffix: arm64
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -41,14 +32,14 @@ jobs:
           username: registry
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      - name: Build and push lnvps-host-info (${{ matrix.tag_suffix }})
+      - name: Build and push lnvps-host-info
         uses: docker/build-push-action@v5
         with:
           context: .
           file: lnvps_host_util/Dockerfile
-          platforms: ${{ matrix.platform }}
+          platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-          tags: ${{ env.HOST_INFO_IMAGE }}:latest-${{ matrix.tag_suffix }}
+          tags: ${{ env.HOST_INFO_IMAGE }}:latest
 
   # Build main images after host-info is ready
   build:
@@ -94,4 +85,6 @@ jobs:
           push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
           tags: ${{ matrix.image }}
           build-args: |
-            HOST_INFO_IMAGE=${{ env.HOST_INFO_IMAGE }}
+            HOST_INFO_IMAGE=${{ env.HOST_INFO_IMAGE }}:latest
+            REGISTRY_USER=registry
+            REGISTRY_PASS=${{ secrets.REGISTRY_TOKEN }}

AGENTS.md

@@ -18,6 +18,8 @@ If the estimate is XL, create a work file in `work/` that decomposes the task in
 
 **2. Check `work/`** for an active task file on the same topic before starting new work. If one exists, resume from the first unchecked task. **Never pick up a work file unless the user explicitly asks you to work on that topic.**
 
+**3. Git commits** — Never auto-commit changes. Always ask the user before committing.
+
 | File | Description |
 |---|---|
 | [work/agent-rules-compliance.md](work/agent-rules-compliance.md) | Bringing codebase into full compliance with all agent rules |

lnvps_api/Dockerfile

@@ -1,5 +1,5 @@
 ARG IMAGE=rust:trixie
-ARG HOST_INFO_IMAGE=registry.v0l.io/lnvps-host-info
+ARG HOST_INFO_IMAGE=registry.v0l.io/lnvps-host-info:latest
 
 FROM $IMAGE AS build
 WORKDIR /app/src
@@ -9,12 +9,19 @@ RUN cargo test --locked --package lnvps_api -- --test-threads=1 \
   && cargo install --locked --root /app/build --path lnvps_api lnvps_api
 
 # Download host-info binaries from pre-built multi-arch images using crane
-FROM gcr.io/go-containerregistry/crane:latest AS crane
+FROM gcr.io/go-containerregistry/crane:latest AS crane-bin
+FROM debian:trixie-slim AS crane
+RUN apt update && apt install -y ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=crane-bin /ko-app/crane /usr/local/bin/crane
 
 ARG HOST_INFO_IMAGE
-RUN crane export --platform linux/amd64 ${HOST_INFO_IMAGE}:latest - | tar -xf - -C /tmp app/lnvps-host-info \
+ARG REGISTRY_USER
+ARG REGISTRY_PASS
+RUN crane auth login registry.v0l.io -u "${REGISTRY_USER}" -p "${REGISTRY_PASS}" \
+    && crane export --platform linux/amd64 ${HOST_INFO_IMAGE} - | tar -xf - -C /tmp app/lnvps-host-info \
     && mv /tmp/app/lnvps-host-info /lnvps-host-info-amd64
-RUN crane export --platform linux/arm64 ${HOST_INFO_IMAGE}:latest - | tar -xf - -C /tmp app/lnvps-host-info \
+RUN crane auth login registry.v0l.io -u "${REGISTRY_USER}" -p "${REGISTRY_PASS}" \
+    && crane export --platform linux/arm64 ${HOST_INFO_IMAGE} - | tar -xf - -C /tmp app/lnvps-host-info \
     && mv /tmp/app/lnvps-host-info /lnvps-host-info-arm64
 
 FROM debian:trixie-slim AS runner