Template
mathias
c704fed563
Rootless buildah in gitea-runner's hardened securityContext (capabilities:
drop [ALL], allowPrivilegeEscalation: false) cannot remap the UID/GID range
newuidmap/newgidmap need on a fresh base-image pull, and the pod has no OCI
runtime at all. buildctl talks to the host's buildkitd over a socket, so the
privileged layer extraction happens on the host and the pod's securityContext
stops being in the picture. Same pattern as mathias/infra's segment-embedder.yml
and postgres18.yml.
A template is the highest-leverage place to fix this. Every repo generated from
here inherits its CI, so a buildah-based template does not just carry the bug —
it manufactures new instances of it. A fleet inventory for infra#241 found nine
repos still invoking buildah, and two of them are the templates.
Note the failure is latent, not immediate: warm base-image layers mask it, so a
generated repo builds fine until the first genuinely cold pull. That is exactly
the situation a NEW repo is in.
Verified by running the exact command against this repo's real build context:
buildctl --addr unix:///run/buildkit/buildkitd.sock build \
--frontend dockerfile.v0 --local context=. --local dockerfile=. \
--output type=oci,dest=$TAR
-> exporting manifest sha256:5a841529... DONE, 6.8MB OCI archive
That check matters here because this repo's own CI cannot validate the change:
the build job is deliberately skipped on the raw template (2ba2698), since
__PROJECT_NAME__ is not a legal image name. The next generated repo is the first
place it runs for real.
skopeo copy replaces `buildah push` — buildctl has no registry-push equivalent —
and runs twice to preserve the :sha and :latest tags the previous version pushed.
PROJECT_NAME
Go agent built on Google ADK with a LiteLLM adapter for local model routing.
Quick start
cp .env.example .env
# edit .env with your LITELLM_API_KEY
go mod tidy
task run
Harness & workflow
Single harness: Claude Code + hyperguild — session-based (start a session, it works, it
stops). No push-triggered dispatch. MCP connections live in .mcp.json: brain (knowledge)
and gitea (issues/PRs — the audit trail); provide BRAIN_MCP_TOKEN and GITEA_MCP_TOKEN.
Work flows: issue → hyperguild session → PR (task check gate) → report-back comment on the
issue → brain capture if the learning is durable. See AGENTS.md / CLAUDE.md for the full
context, AGENT_BOUNDARIES.md for runtime scope.
Observability
Set OTLP_ENDPOINT=http://jaeger.d-ma.be:4318 to emit traces. Each invocation produces:
invoke_agent __PROJECT_NAME__spangenerate_content <model>child span withgen_ai.request.modelattribute
Structure
cmd/__PROJECT_NAME__/ agent entrypoint
pkg/litellm/ OpenAI-compat ADK adapter + OTLP telemetry helper