refactor(embed): drive picoclaw image tags from agent.toml version

.github/workflows/release.yml

@@ -1,10 +1,8 @@
 # Release on tag v* / workflow_dispatch.
 #
-# Container images for embed templates (those with a Dockerfile) are built on GitLab CI (ACR).
-# This workflow only:
-#   1. Stages embed/<template>/dist/ for every template dir that contains a Dockerfile
-#   2. Patches dist/agent.toml [image].ref to ${ACR_REGISTRY}/opencsghq/<template>:<version>
-#   3. Builds csgclaw / csgclaw-cli release archives with the patched embed
+# Container images for embed templates are built on GitLab CI (main branch, ACR).
+# This workflow:
+#   1. Builds csgclaw / csgclaw-cli release archives with embed agent.toml from the tag commit
 #
 # <version> is the git tag (v*) or workflow_dispatch input.
 
@@ -105,48 +103,8 @@ jobs:
           path: web/static-dist/
           if-no-files-found: error
 
-  docker-embed-dist:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Resolve version
-        id: version
-        shell: bash
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            version="${{ github.event.inputs.version }}"
-          else
-            version="${GITHUB_REF_NAME}"
-          fi
-          echo "value=${version}" >> "$GITHUB_OUTPUT"
-
-      - name: Stage docker embed dist and patch ACR image refs
-        shell: bash
-        env:
-          ACR_REGISTRY: ${{ env.ACR_REGISTRY }}
-          VERSION: ${{ steps.version.outputs.value }}
-        run: |
-          chmod +x scripts/list-docker-embed-templates.sh \
-            scripts/prepare-docker-embed-dist.sh \
-            scripts/patch-docker-embed-image-refs.sh
-          ./scripts/prepare-docker-embed-dist.sh
-          ./scripts/patch-docker-embed-image-refs.sh
-          while IFS= read -r name; do
-            echo "${name} ref:"
-            grep '^ref = ' "internal/templates/embed/${name}/dist/agent.toml"
-          done < <(./scripts/list-docker-embed-templates.sh)
-
-      - name: Upload patched docker embed directories
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-embed-dist-patched
-          path: internal/templates/embed/*/dist/
-          if-no-files-found: error
-
   build:
-    needs: [prepare, web, docker-embed-dist]
+    needs: [prepare, web]
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -167,20 +125,17 @@ jobs:
           name: web-static-dist
           path: web/static-dist
 
-      - name: Download patched docker embed directories
-        uses: actions/download-artifact@v4
-        with:
-          name: docker-embed-dist-patched
-          # Artifact root is internal/templates/embed/ (LCA of embed/*/dist paths).
-          path: internal/templates/embed
-
-      - name: Verify docker embed dist is present
+      - name: Verify embed agent manifests are present
         shell: bash
         run: |
           chmod +x scripts/list-docker-embed-templates.sh
           while IFS= read -r name; do
-            test -f "internal/templates/embed/${name}/dist/agent.toml"
-            grep '^ref = ' "internal/templates/embed/${name}/dist/agent.toml"
+            test -f "internal/templates/embed/${name}/agent.toml"
+            grep '^ref = ' "internal/templates/embed/${name}/agent.toml"
+            if grep -q '^ref = ""' "internal/templates/embed/${name}/agent.toml"; then
+              echo "missing image ref in internal/templates/embed/${name}/agent.toml" >&2
+              exit 1
+            fi
           done < <(./scripts/list-docker-embed-templates.sh)
 
       - name: Set up Go

.gitignore

@@ -5,6 +5,7 @@
 bin/
 bin-csghub/
 dist/
+picoclaw-build.env
 *.test
 *.out
 
@@ -30,8 +31,6 @@ docker/
 
 # Generated embedded runtime workspaces
 /internal/agent/embed/
-# Docker embed dist/ is populated by make/CI (see make prepare-docker-embed-dist).
-# Note: go:embed ignores .gitignore, so these paths must not be listed here.
 
 # Editor / tool directories
 .cursor/

.gitlab/ci-picoclaw-image.sh

@@ -11,16 +11,38 @@ dockerfile="$2"
 image_name="$3"
 
 : "${CI_PROJECT_DIR:?CI_PROJECT_DIR must be set}"
-: "${CI_COMMIT_TAG:?CI_COMMIT_TAG must be set}"
 : "${ACR_REGISTRY:?ACR_REGISTRY must be set}"
 
-archive="${CI_PROJECT_DIR}/dist/csgclaw-cli_${CI_COMMIT_TAG}_linux_${goarch}.tar.gz"
+manifest="${CI_PROJECT_DIR}/internal/templates/embed/${image_name}/agent.toml"
+if [ ! -f "${manifest}" ]; then
+  echo "missing manifest: ${manifest}" >&2
+  exit 1
+fi
+
+PICOCLAW_IMAGE_VERSION="$(awk -F= '
+  /^version[[:space:]]*=[[:space:]]*/ {
+    value = $2
+    gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+    gsub(/^"/, "", value)
+    gsub(/"$/, "", value)
+    print value
+    exit
+  }
+' "${manifest}")"
+
+if [ -z "${PICOCLAW_IMAGE_VERSION}" ]; then
+  echo "missing version in ${manifest}" >&2
+  exit 1
+fi
+
+PICOCLAW_CLI_VERSION="${PICOCLAW_CLI_VERSION:-${CI_COMMIT_SHORT_SHA:-unknown}}"
+archive="${CI_PROJECT_DIR}/dist/csgclaw-cli_${PICOCLAW_CLI_VERSION}_linux_${goarch}.tar.gz"
 staging_dir="${CI_PROJECT_DIR}/bin"
 cli_path="${staging_dir}/csgclaw-cli"
 
 if [ ! -f "${archive}" ]; then
   echo "missing release artifact: ${archive}" >&2
-  echo "picoclaw image builds reuse csgclaw-cli from release-build (scripts/release-build-all.sh)" >&2
+  echo "picoclaw image builds reuse csgclaw-cli from picoclaw-cli-build (scripts/release-build-all.sh)" >&2
   exit 1
 fi
 
@@ -34,11 +56,17 @@ if [ ! -f "${cli_path}" ]; then
   exit 1
 fi
 
-export PICOCLAW_BASE_TAG="${PICOCLAW_BASE_TAG:-2026.5.27}"
-
-/kaniko/executor \
+set -- /kaniko/executor \
   --context "${CI_PROJECT_DIR}" \
   --dockerfile "${CI_PROJECT_DIR}/${dockerfile}" \
   --custom-platform "linux/${goarch}" \
-  --destination "${ACR_REGISTRY}/opencsghq/${image_name}:${CI_COMMIT_TAG}-${goarch}" \
-  --build-arg PICOCLAW_IMAGE="${ACR_REGISTRY}/opencsghq/picoclaw:${PICOCLAW_BASE_TAG}"
+  --destination "${ACR_REGISTRY}/opencsghq/${image_name}:${PICOCLAW_IMAGE_VERSION}-${goarch}"
+
+if [ -n "${PICOCLAW_BASE_IMAGE:-}" ]; then
+  set -- "$@" --build-arg "PICOCLAW_IMAGE=${PICOCLAW_BASE_IMAGE}"
+  echo "using PICOCLAW_IMAGE override: ${PICOCLAW_BASE_IMAGE}"
+else
+  echo "using PICOCLAW_IMAGE from Dockerfile default"
+fi
+
+exec "$@"

.gitlab/ci-picoclaw-manifest.sh

@@ -11,12 +11,34 @@ image_name="$1"
 : "${ACR_REGISTRY:?ACR_REGISTRY must be set}"
 : "${ACR_USERNAME:?ACR_USERNAME must be set}"
 : "${ACR_PASSWORD:?ACR_PASSWORD must be set}"
-: "${CI_COMMIT_TAG:?CI_COMMIT_TAG must be set}"
+: "${CI_PROJECT_DIR:?CI_PROJECT_DIR must be set}"
+
+manifest="${CI_PROJECT_DIR}/internal/templates/embed/${image_name}/agent.toml"
+if [ ! -f "${manifest}" ]; then
+  echo "missing manifest: ${manifest}" >&2
+  exit 1
+fi
+
+PICOCLAW_IMAGE_VERSION="$(awk -F= '
+  /^version[[:space:]]*=[[:space:]]*/ {
+    value = $2
+    gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+    gsub(/^"/, "", value)
+    gsub(/"$/, "", value)
+    print value
+    exit
+  }
+' "${manifest}")"
+
+if [ -z "${PICOCLAW_IMAGE_VERSION}" ]; then
+  echo "missing version in ${manifest}" >&2
+  exit 1
+fi
 
 repo="${ACR_REGISTRY}/opencsghq/${image_name}"
-amd64_ref="${repo}:${CI_COMMIT_TAG}-amd64"
-arm64_ref="${repo}:${CI_COMMIT_TAG}-arm64"
-target_ref="${repo}:${CI_COMMIT_TAG}"
+amd64_ref="${repo}:${PICOCLAW_IMAGE_VERSION}-amd64"
+arm64_ref="${repo}:${PICOCLAW_IMAGE_VERSION}-arm64"
+target_ref="${repo}:${PICOCLAW_IMAGE_VERSION}"
 
 crane auth login "$ACR_REGISTRY" -u "$ACR_USERNAME" -p "$ACR_PASSWORD"