release: harden NetOpsBench 0.2 runtime lifecycle #4

	name: client-agent-image

	on:
	push:
	branches:
	- main
	- "codex/**"
	tags:
	- "v*"
	paths:
	- ".github/workflows/client-agent-image.yml"
	- "containers/client/**"
	- "native/client-agent/**"
	workflow_dispatch:

	permissions:
	contents: read
	packages: write

	jobs:
	publish:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- uses: docker/setup-buildx-action@v3

	- name: Set immutable image tags
	id: tags
	shell: bash
	run: \|
	tags="ghcr.io/netx-lab/netopsbench-client:sha-${GITHUB_SHA}"
	if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
	tags="${tags}"$'\n'"ghcr.io/netx-lab/netopsbench-client:${GITHUB_REF_NAME}"
	fi
	{
	echo "value<<EOF"
	echo "${tags}"
	echo "EOF"
	} >> "${GITHUB_OUTPUT}"

	- name: Build and publish linux/amd64 image
	id: build
	uses: docker/build-push-action@v6
	with:
	context: .
	file: containers/client/Dockerfile
	platforms: linux/amd64
	push: true
	provenance: false
	tags: ${{ steps.tags.outputs.value }}

	- name: Publish manifest digest
	run: echo "digest=${{ steps.build.outputs.digest }}" >> "${GITHUB_STEP_SUMMARY}"

	- name: Verify anonymous digest pull
	env:
	IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
	run: \|
	docker logout ghcr.io
	for attempt in $(seq 1 12); do
	if docker manifest inspect "ghcr.io/netx-lab/netopsbench-client@${IMAGE_DIGEST}" >/dev/null; then
	exit 0
	fi
	sleep 5
	done
	exit 1

Navigation Menu