[WIP] Add Codex CLI and APM agent-skills to container images - #657
[WIP] Add Codex CLI and APM agent-skills to container images#657not-stbenjam wants to merge 5 commits into
Conversation
Install the OpenAI Codex CLI as a standalone Rust binary from GitHub releases (~109 MB, zero runtime deps, musl-linked). This avoids pulling in Node.js solely as a delivery vehicle for a single binary. Add apm-cli (pinned 0.26.0) and an apm.yml manifest that declares all ai-helpers plugins as dependencies targeting agent-skills. At build time `apm install --target agent-skills` deploys the same plugin skills that Claude Code uses to the .agents/skills/ convention, making them discoverable by Codex and other agents that follow the agentskills.io standard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: not-stbenjam The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @not-stbenjam. Thanks for your PR. I'm waiting for a openshift-eng member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
WalkthroughAdds the ChangesAgent skills container integration
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant DockerBuild
participant CodexRelease
participant PythonEnvironment
participant APMCLI
participant Workspace
DockerBuild->>CodexRelease: Download versioned Codex musl tarball
CodexRelease-->>DockerBuild: Return checksum-verified archive
DockerBuild->>PythonEnvironment: Install apm-cli 0.26.0
DockerBuild->>APMCLI: Run install for agent-skills with root /workspace
APMCLI->>Workspace: Deploy configured plugins
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Only include the 3 plugins pre-enabled in claude-settings.json: ci, hello-world, and jira. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apm.yml`:
- Around line 7-46: Make APM dependency resolution reproducible by pinning every
plugin reference under dependencies.apm in apm.yml to immutable commits, or
generate and commit apm.lock.yaml containing those resolved commits. Ensure the
Dockerfile install flow uses the pinned lockfile or refs so rebuilds cannot
resolve floating plugin revisions.
In `@images/Dockerfile`:
- Around line 69-71: The agent-skills installation in images/Dockerfile and
images/Dockerfile.nested-podman currently targets /opt/ai-helpers instead of the
runtime workspace. Update both Dockerfiles so the installed .agents/skills
output is available under /workspace for Codex discovery, either by installing
from the workspace or copying the generated skills there.
- Around line 39-45: Add Codex release archive digest validation before
extraction in the install blocks at images/Dockerfile lines 39-45 and
images/Dockerfile.nested-podman lines 42-47. Fetch the official checksum and
verify the downloaded tarball before invoking tar, or replace both blocks with
Codex’s official installer that performs validation; preserve the existing
versioned release installation and final /usr/local/bin/codex path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 4d170b1a-62d6-49e9-a8fc-8a9d7ce29f1c
📒 Files selected for processing (3)
apm.ymlimages/Dockerfileimages/Dockerfile.nested-podman
The rule fires on a consumer-only apm.yml that has no .apm/ directory, which is expected for manifests that only declare dependencies to install rather than authoring APM content. Filed: stbenjam/skillsaw#472 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use --root /workspace so apm installs .agents/skills/ where Codex looks for them at runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tested: Codex discovers ai-helpers skillsBuilt the image locally (with a public base image since CI builder requires auth) and confirmed Codex picks up all deployed agent-skills via 39 skills from the |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
images/Dockerfile (1)
39-45: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winMake Codex installation architecture-aware in both images.
Both Dockerfiles hard-code the Linux x86_64 Codex archive URL, which means arm64 builds extract the wrong release binary. Use
TARGETARCHto select the corresponding arm64/x86_64 asset, or explicitly restrict these images to amd64.
images/Dockerfile#L39-L45images/Dockerfile.nested-podman#L42-L47🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@images/Dockerfile` around lines 39 - 45, Make Codex installation architecture-aware in the RUN blocks of images/Dockerfile lines 39-45 and images/Dockerfile.nested-podman lines 42-47 by using TARGETARCH to select the matching arm64 or x86_64 archive and binary name. Apply the same architecture mapping in both Dockerfiles, or explicitly restrict both images to amd64.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@images/Dockerfile`:
- Around line 39-45: Make Codex installation architecture-aware in the RUN
blocks of images/Dockerfile lines 39-45 and images/Dockerfile.nested-podman
lines 42-47 by using TARGETARCH to select the matching arm64 or x86_64 archive
and binary name. Apply the same architecture mapping in both Dockerfiles, or
explicitly restrict both images to amd64.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 37327ecc-bcb6-4a7a-974f-32092f53c936
📒 Files selected for processing (3)
.skillsaw.yamlimages/Dockerfileimages/Dockerfile.nested-podman
Download to a temp file and check the digest against a pinned CODEX_SHA256 build arg before extracting, addressing the CodeRabbit supply-chain security comment. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
Summary
apm-cli(pinned 0.26.0) and anapm.ymlmanifest declaring all ai-helpers plugins as dependencies targetingagent-skillsapm install --target agent-skillsdeploys plugin skills to.agents/skills/, making them discoverable by Codex and other agents following the agentskills.io conventionTest plan
codex --versionworks inside the containerapmCLI is available andapm.ymlis parsed correctly.agents/skills/is populated after build🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores / Build
apm-cli.