From 4b3da5641f74e0b73cd1f97e9ed3a57e320e4204 Mon Sep 17 00:00:00 2001 From: a2a-platform Date: Mon, 8 Jun 2026 12:27:34 +0000 Subject: [PATCH] deploy --- .a2a/agent.dsl.json | 158 +++++++++++++++++++++++++++++++++++++ .gitea/workflows/build.yml | 38 --------- Dockerfile | 13 --- deploy/20-deployment.yaml | 113 -------------------------- 4 files changed, 158 insertions(+), 164 deletions(-) create mode 100644 .a2a/agent.dsl.json delete mode 100644 .gitea/workflows/build.yml delete mode 100644 Dockerfile delete mode 100644 deploy/20-deployment.yaml diff --git a/.a2a/agent.dsl.json b/.a2a/agent.dsl.json new file mode 100644 index 0000000..46ff4b0 --- /dev/null +++ b/.a2a/agent.dsl.json @@ -0,0 +1,158 @@ +{ + "schema_version": "2026-06-04", + "language": "python", + "name": "agent-reviewer", + "description": "Audit an A2A agent's source before deploy. Reads the target repo from Gitea, applies security / best-practice / grant-scope skill bundles, and returns a structured ReviewReport.", + "version": "0.1.1", + "entrypoint": { + "module": "agent", + "class_name": "AgentReviewer", + "function": null, + "command": [] + }, + "skills": [ + { + "name": "review", + "description": "Audit an agent's source. Pass the target ``agent_name`` (kebab-case) and optional ``ref`` (defaults to ``main``). Returns a ReviewReport with severity-categorized findings.", + "handler": "review", + "tags": [ + "reviewer", + "audit", + "meta" + ], + "scopes": [], + "stream": true, + "policy": { + "timeout_seconds": 900.0, + "idempotent": false, + "max_retries": 0, + "cost_class": "medium", + "allow_scope_expansion": false, + "grant_mode": null, + "grant_allow_patterns": [], + "grant_deny_patterns": [], + "grant_outputs_prefix": null, + "grant_write_prefixes": [], + "grant_ttl_seconds": null, + "grant_run_timeout_seconds": null, + "grant_approval_timeout_seconds": null, + "grant_scope_approval_timeout_seconds": null + }, + "input_schema": { + "type": "object", + "properties": { + "agent_name": { + "type": "string" + }, + "ref": { + "type": "string" + }, + "owner": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "agent_name" + ], + "additionalProperties": false + }, + "output_schema": { + "additionalProperties": true, + "type": "object" + } + } + ], + "capabilities": {}, + "input_modes": [ + "application/json" + ], + "output_modes": [ + "application/json" + ], + "required_secrets": [], + "required_env": [], + "consumer_setup": { + "fields": [] + }, + "runtime": { + "lifecycle": "ephemeral", + "state": "none", + "sandbox": "microsandbox", + "resources": { + "cpu": "100m", + "memory": "256Mi", + "gpu": 0, + "max_runtime_seconds": 600 + }, + "concurrency": 1, + "egress": { + "allow_hosts": [], + "allow_internal_services": [], + "deny_internet_by_default": true + }, + "tools_used": [ + "deepagents", + "a2a-pack", + "litellm", + "microsandbox", + "gitea" + ], + "llm_provisioning": "platform", + "pricing": { + "price_per_call_usd": 0.05, + "caller_pays_llm": true, + "notes": "Reads target source via a short-lived, repo-scoped Gitea token minted on the caller's behalf. Never deploys or writes." + }, + "wants_cp_jwt": true, + "platform_resources": { + "memory": null, + "databases": [] + }, + "apt_packages": [] + }, + "template_lineage": null, + "meta_agent_manifest": null, + "state_schema": null, + "workspace_access": { + "enabled": false, + "max_files": 0, + "allowed_modes": [], + "require_reason": true, + "deny_patterns": [], + "require_human_approval": false, + "max_total_size_bytes": 104857600 + }, + "config_schema": { + "properties": {}, + "title": "ReviewerConfig", + "type": "object" + }, + "auth": { + "model": "a2a_pack.auth.NoAuth", + "strategy": "public", + "principal_schema": { + "additionalProperties": false, + "description": "Public agent: no caller identity required.", + "properties": {}, + "title": "NoAuth", + "type": "object" + }, + "resolver": null, + "required": false + }, + "metadata": { + "source": "python-a2a-pack", + "project_manifest": { + "name": "agent-reviewer", + "version": "0.1.1", + "entrypoint": "agent:AgentReviewer" + } + } +} diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml deleted file mode 100644 index 3894fe7..0000000 --- a/.gitea/workflows/build.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: build -on: - push: - branches: [main] - paths-ignore: - - 'deploy/**' - -jobs: - build: - runs-on: ubuntu-latest - steps: - - name: checkout from in-cluster gitea - run: | - set -e - git clone --depth=1 \ - "http://gitea_admin:${{ secrets.ADMIN_PW }}@gitea-http.gitea.svc.cluster.local:3000/gitea_admin/agent-reviewer.git" . - git checkout "$GITHUB_SHA" - - - name: build image - run: | - IMG=registry.a2acloud.io/agents/agent-reviewer - docker build --pull -t "$IMG:$GITHUB_SHA" -t "$IMG:latest" . - docker push "$IMG:$GITHUB_SHA" - docker push "$IMG:latest" - - - name: bump deploy manifest - run: | - IMG=registry.a2acloud.io/agents/agent-reviewer - sed -i "s|image: $IMG:.*|image: $IMG:$GITHUB_SHA|" deploy/20-deployment.yaml - git config user.email "ci@a2a.local" - git config user.name "ci" - git add deploy/20-deployment.yaml - if git diff --staged --quiet; then - echo "no manifest changes" - else - git commit -m "ci: bump image to $GITHUB_SHA" - git push "http://gitea_admin:${{ secrets.ADMIN_PW }}@gitea-http.gitea.svc.cluster.local:3000/gitea_admin/agent-reviewer.git" HEAD:main - fi diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index fbc29e5..0000000 --- a/Dockerfile +++ /dev/null @@ -1,13 +0,0 @@ -FROM registry.a2acloud.io/a2a/a2a-pack-base:latest - -WORKDIR /app - -COPY requirements.txt . -RUN pip install --no-cache-dir -r requirements.txt -COPY . . - -ENV A2A_ENTRYPOINT=agent:AgentReviewer -ENV PORT=8000 -EXPOSE 8000 - -CMD a2a run --entrypoint "$A2A_ENTRYPOINT" --host 0.0.0.0 --port 8000 diff --git a/deploy/20-deployment.yaml b/deploy/20-deployment.yaml deleted file mode 100644 index bb324ed..0000000 --- a/deploy/20-deployment.yaml +++ /dev/null @@ -1,113 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: agent-reviewer - namespace: agents - labels: - app: agent-reviewer - a2a/managed-by: control-plane -spec: - replicas: 1 - revisionHistoryLimit: 1 - selector: - matchLabels: - app: agent-reviewer - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - progressDeadlineSeconds: 900 - template: - metadata: - labels: - app: agent-reviewer - spec: - enableServiceLinks: false - terminationGracePeriodSeconds: 30 - containers: - - name: agent - image: registry.a2acloud.io/agents/agent-reviewer:9758c5588db0ebd4d59b94b8e3c9572952e790a8 - imagePullPolicy: Always - ports: - - containerPort: 8000 - name: http1 - protocol: TCP - env: - - name: SANDBOX_URL - value: http://sandbox.sandbox.svc.cluster.local:8000 - - name: A2A_SANDBOX_URL - value: http://sandbox.sandbox.svc.cluster.local:8000 - - name: SANDBOX_TIMEOUT_S - value: "600" - - name: A2A_GRANT_VERIFYING_KEY - valueFrom: - secretKeyRef: {name: platform-secrets, key: grant_verifying_key} - - name: A2A_RECEIPT_SIGNING_KEY - valueFrom: - secretKeyRef: {name: platform-secrets, key: receipt_signing_key, optional: true} - - name: A2A_REPLAY_SIGNING_KEY - valueFrom: - secretKeyRef: {name: platform-secrets, key: replay_signing_key, optional: true} - - name: A2A_GITEA_INTERNAL - value: http://gitea-http.gitea.svc.cluster.local:3000 - - name: A2A_GITEA_PUBLIC - value: http://gitea.a2acloud.io - - name: A2A_CP_URL - value: http://control-plane.control-plane.svc.cluster.local - readinessProbe: - httpGet: {path: /healthz, port: 8000} - initialDelaySeconds: 8 - periodSeconds: 5 - failureThreshold: 3 - timeoutSeconds: 1 - livenessProbe: - httpGet: {path: /healthz, port: 8000} - initialDelaySeconds: 25 - periodSeconds: 15 - resources: - requests: {cpu: 200m, memory: 384Mi} - limits: {cpu: "1", memory: 768Mi} ---- -apiVersion: v1 -kind: Service -metadata: - name: agent-reviewer - namespace: agents - annotations: - argocd.argoproj.io/sync-options: ServerSideApply=false,Replace=true - labels: - app: agent-reviewer - a2a/managed-by: control-plane -spec: - selector: - app: agent-reviewer - ports: - - name: http - port: 80 - targetPort: 8000 - protocol: TCP ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: agent-reviewer - namespace: agents - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - traefik.ingress.kubernetes.io/router.entrypoints: web,websecure -spec: - tls: - - hosts: [agent-reviewer.a2acloud.io] - secretName: agent-reviewer-a2acloud-io-tls - rules: - - host: agent-reviewer.a2acloud.io - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: agent-reviewer - port: - number: 80