ci(agent-helper): version image independently of app release

[skevetter]

Summary

Decouples the agent-helper image version from the main devsy application release cadence so it does not change on every release.

• Image version is now owned by images/agent-helper/VERSION (seeded at 0.1.0).
• Publish workflow triggers on push to main scoped to image paths (and workflow_dispatch) instead of release: published, so the image republishes only when its sources or VERSION change.
• Version resolution moved out of inline bash into a version subcommand on the agent_helper_image Go tool (honors a -tag override, else reads VERSION, emits value=<version> to $GITHUB_OUTPUT).
• Added a registry check that skips the push when the resolved tag already exists.

Summary by CodeRabbit

• New Features

  • Agent-helper images can now be published automatically on pushes to the main branch or through manual workflow runs.
  • Manual publishing supports an optional version override.
  • Added safeguards to avoid publishing an image tag that already exists.
  • Set the agent-helper image version to 0.1.0.

• Bug Fixes

  • Pull request builds no longer publish images.
  • Improved version detection and Docker tag generation during publishing.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	a5d12a6
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a66d5b15679b8000892061c

[coderabbitai]

Warning

Review limit reached

@skevetter, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f19f5553-2f7d-4ede-bae4-bcef81355716

📥 Commits

Reviewing files that changed from the base of the PR and between 824c5e1 and a5d12a6.

📒 Files selected for processing (2)

• .github/workflows/publish-agent-helper.yml
• hack/agent_helper_image/main.go

📝 Walkthrough

Walkthrough

The agent-helper image workflow now runs on main pushes and manual dispatches, uses Go subcommands for building, version resolution, and registry checks, and conditionally pushes new image tags. The default image version is set to 0.1.0.

Changes

Agent-helper image publishing

Layer / File(s)	Summary
Helper command dispatcher and outputs hack/agent_helper_image/main.go, images/agent-helper/VERSION	The helper now supports build, version, and exists commands, resolves version overrides or the VERSION file, checks Docker manifests, writes GitHub Actions outputs, and uses version 0.1.0.
Workflow triggers and conditional publishing .github/workflows/publish-agent-helper.yml	Publishing now targets main pushes and manual dispatches, invokes explicit helper subcommands, enables latest for non-PR events, and skips pushing tags already present in GHCR.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant AgentHelper
  participant GHCR
  participant DockerBuildPush
  GitHubActions->>AgentHelper: Resolve image version
  AgentHelper-->>GitHubActions: Return version output
  GitHubActions->>AgentHelper: Check target image tag
  AgentHelper->>GHCR: Inspect image manifest
  GHCR-->>AgentHelper: Return tag existence
  GitHubActions->>DockerBuildPush: Build image
  DockerBuildPush->>GHCR: Push when tag is absent and event is not a PR

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: decoupling the agent-helper image version from the app release cycle.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	a5d12a6
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a66d5b1ad370f00080addb1

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish-agent-helper.yml:
- Around line 43-51: Replace direct GitHub Actions expression interpolation in
the `version` step and the publish step with `env:` bindings, then reference
those values as shell variables in each `run` command. Update the commands
around `steps.version.outputs.value`, `inputs.tag`, and the publish references
to `env.IMAGE` so untrusted input is not inserted into shell source while
preserving the existing version and image behavior.

In `@hack/agent_helper_image/main.go`:
- Around line 124-141: Update runExists to capture docker manifest inspect
stderr and exit status instead of treating every failure as absence. Set
exists=false only when the captured error output indicates a not-found or
manifest-unknown response; return a descriptive error for authentication,
network, rate-limit, permission, and other failures, while preserving the
existing notice and writeOutput behavior for successful checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8356ca61-fc41-426b-991b-0700744c341f

📥 Commits

Reviewing files that changed from the base of the PR and between 50e858d and 824c5e1.

📒 Files selected for processing (3)

• .github/workflows/publish-agent-helper.yml
• hack/agent_helper_image/main.go
• images/agent-helper/VERSION