From 61ec9ed98a9d43a1c3509d64f63494b6e64d9118 Mon Sep 17 00:00:00 2001 From: Jakub Worek Date: Wed, 12 Aug 2026 15:30:42 +0000 Subject: [PATCH 1/3] feat(itk): switch to v2 itk launcher --- .github/workflows/itk.yaml | 25 +++++++++++++++++++++++++ .github/workflows/nightly.yaml | 25 +++++++++++++++++++++++++ itk/run_itk.sh | 17 ++++++++++++++--- 3 files changed, 64 insertions(+), 3 deletions(-) diff --git a/.github/workflows/itk.yaml b/.github/workflows/itk.yaml index 42a1d6bd2..52f8f8b0d 100644 --- a/.github/workflows/itk.yaml +++ b/.github/workflows/itk.yaml @@ -27,8 +27,33 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v7 + - name: Clone a2a-itk + working-directory: itk + run: git clone -b main --depth 1 https://github.com/a2aproject/a2a-itk.git a2a-itk + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build itk_service image (GHA layer cache) + uses: docker/build-push-action@v6 + with: + context: itk/a2a-itk + tags: itk_service:latest + load: true + cache-from: type=gha,scope=itk_service + cache-to: type=gha,mode=max,scope=itk_service + + - name: Cache launcher peer-SDK checkouts + build outputs + uses: actions/cache@v4 + with: + path: ~/.cache/a2a-itk-launcher + key: itk-launcher-${{ runner.os }}-${{ github.sha }} + restore-keys: | + itk-launcher-${{ runner.os }}- + - name: Run ITK Tests run: bash run_itk.sh working-directory: itk env: A2A_ITK_REVISION: main + ITK_SKIP_BUILD: "1" diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 1d731fa95..afea12bfd 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -20,12 +20,37 @@ jobs: - name: Install uv uses: astral-sh/setup-uv@v7 + - name: Clone a2a-itk + working-directory: itk + run: git clone -b main --depth 1 https://github.com/a2aproject/a2a-itk.git a2a-itk + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build itk_service image (GHA layer cache) + uses: docker/build-push-action@v6 + with: + context: itk/a2a-itk + tags: itk_service:latest + load: true + cache-from: type=gha,scope=itk_service + cache-to: type=gha,mode=max,scope=itk_service + + - name: Cache launcher peer-SDK checkouts + build outputs + uses: actions/cache@v4 + with: + path: ~/.cache/a2a-itk-launcher + key: itk-launcher-${{ runner.os }}-${{ github.sha }} + restore-keys: | + itk-launcher-${{ runner.os }}- + - name: Run Nightly ITK Tests run: bash run_itk.sh working-directory: itk env: A2A_ITK_REVISION: main ITK_NIGHTLY_RUN: "True" + ITK_SKIP_BUILD: "1" - name: Upload Results to Rolling Release uses: softprops/action-gh-release@v3 diff --git a/itk/run_itk.sh b/itk/run_itk.sh index 243fc1be3..75de51680 100755 --- a/itk/run_itk.sh +++ b/itk/run_itk.sh @@ -54,9 +54,11 @@ uv run --with grpcio-tools python -m grpc_tools.protoc \ # Fix imports in generated file sed -i 's/^import instruction_pb2 as instruction__pb2/from . import instruction_pb2 as instruction__pb2/' pyproto/instruction_pb2_grpc.py -# 4. Build jit itk_service docker image from root of a2a-itk -# We run docker build from the root directory of a2a-itk -docker build -t itk_service a2a-itk +# 4. Build jit itk_service docker image from root of a2a-itk (skipped in CI +# where the workflow builds via docker/build-push-action for GHA caching). +if [ "${ITK_SKIP_BUILD:-0}" != "1" ]; then + docker build -t itk_service a2a-itk +fi # 5. Start docker service # Mounting a2a-python as repo and itk as current agent @@ -76,11 +78,17 @@ if [ "${ITK_LOG_LEVEL^^}" = "DEBUG" ]; then DOCKER_MOUNT_LOGS="-v $ITK_DIR/logs:/app/logs" fi +mkdir -p "$HOME/.cache/a2a-itk-launcher" + docker run -d --name itk-service \ -v "$A2A_PYTHON_ROOT:/app/agents/repo" \ -v "$ITK_DIR:/app/agents/repo/itk" \ + -v "$HOME/.cache/a2a-itk-launcher:/root/.cache/a2a-itk" \ $DOCKER_MOUNT_LOGS \ -e ITK_LOG_LEVEL="$ITK_LOG_LEVEL" \ + -e ITK_ENTRYPOINT="${ITK_ENTRYPOINT:-itk_service_v2.py}" \ + -e ITK_READINESS_TIMEOUT="${ITK_READINESS_TIMEOUT:-180}" \ + -e ITK_MAX_WORKERS="${ITK_MAX_WORKERS:-2}" \ -p 8000:8000 \ itk_service @@ -88,6 +96,9 @@ docker run -d --name itk-service \ docker exec -u root itk-service git config --system --add safe.directory /app/agents/repo docker exec -u root itk-service git config --system --add safe.directory /app/agents/repo/itk docker exec -u root itk-service git config --system core.multiPackIndex false +# Launcher's peer checkouts under /root/.cache/a2a-itk are host-owned; trust +# every path so container-side git accepts them. +docker exec -u root itk-service git config --system --add safe.directory '*' # 6. Verify service is up and send post request MAX_RETRIES=30 From 33210bf39fb1cb502288baa4da9634a50a1348a1 Mon Sep 17 00:00:00 2001 From: Jakub Worek Date: Thu, 13 Aug 2026 08:53:47 +0000 Subject: [PATCH 2/3] ci(itk): use actions/checkout for a2a-itk clone Idiomatic, matches the existing 'Checkout code' step, gets free GITHUB_TOKEN auth + built-in retries on transient network failures. --- .github/workflows/itk.yaml | 7 +++++-- .github/workflows/nightly.yaml | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/itk.yaml b/.github/workflows/itk.yaml index 52f8f8b0d..73dd5e21c 100644 --- a/.github/workflows/itk.yaml +++ b/.github/workflows/itk.yaml @@ -28,8 +28,11 @@ jobs: uses: astral-sh/setup-uv@v7 - name: Clone a2a-itk - working-directory: itk - run: git clone -b main --depth 1 https://github.com/a2aproject/a2a-itk.git a2a-itk + uses: actions/checkout@v6 + with: + repository: a2aproject/a2a-itk + ref: main + path: itk/a2a-itk - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index afea12bfd..307c337e0 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -21,8 +21,11 @@ jobs: uses: astral-sh/setup-uv@v7 - name: Clone a2a-itk - working-directory: itk - run: git clone -b main --depth 1 https://github.com/a2aproject/a2a-itk.git a2a-itk + uses: actions/checkout@v6 + with: + repository: a2aproject/a2a-itk + ref: main + path: itk/a2a-itk - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 From c08cc843951bca4d1af6d89f501473e289fb49ce Mon Sep 17 00:00:00 2001 From: Jakub Worek Date: Thu, 13 Aug 2026 09:51:41 +0000 Subject: [PATCH 3/3] ci(itk): scope safe.directory to launcher cache repos, not wildcard Replace 'safe.directory *' (trusts every path) with a targeted per-repo whitelist under /root/.cache/a2a-itk. Only warm-cache repos need this (fresh clones by container root are already same-UID). --- itk/run_itk.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/itk/run_itk.sh b/itk/run_itk.sh index 75de51680..4490f9119 100755 --- a/itk/run_itk.sh +++ b/itk/run_itk.sh @@ -97,8 +97,8 @@ docker exec -u root itk-service git config --system --add safe.directory /app/ag docker exec -u root itk-service git config --system --add safe.directory /app/agents/repo/itk docker exec -u root itk-service git config --system core.multiPackIndex false # Launcher's peer checkouts under /root/.cache/a2a-itk are host-owned; trust -# every path so container-side git accepts them. -docker exec -u root itk-service git config --system --add safe.directory '*' +# only repos under the launcher cache dir so container-side git accepts them. +docker exec -u root itk-service bash -lc 'while IFS= read -r -d "" d; do git config --system --add safe.directory "${d%/.git}"; done < <(find /root/.cache/a2a-itk -type d -name .git -print0)' # 6. Verify service is up and send post request MAX_RETRIES=30