deploy
This commit is contained in:
a2a-platform
158
.a2a/agent.dsl.json
Normal file
158
.a2a/agent.dsl.json
Normal file
@@ -0,0 +1,158 @@
|
||||
{
|
||||
"schema_version": "2026-06-04",
|
||||
"language": "python",
|
||||
"name": "agent-reviewer",
|
||||
"description": "Audit an A2A agent's source before deploy. Reads the target repo from Gitea, applies security / best-practice / grant-scope skill bundles, and returns a structured ReviewReport.",
|
||||
"version": "0.1.1",
|
||||
"entrypoint": {
|
||||
"module": "agent",
|
||||
"class_name": "AgentReviewer",
|
||||
"function": null,
|
||||
"command": []
|
||||
},
|
||||
"skills": [
|
||||
{
|
||||
"name": "review",
|
||||
"description": "Audit an agent's source. Pass the target ``agent_name`` (kebab-case) and optional ``ref`` (defaults to ``main``). Returns a ReviewReport with severity-categorized findings.",
|
||||
"handler": "review",
|
||||
"tags": [
|
||||
"reviewer",
|
||||
"audit",
|
||||
"meta"
|
||||
],
|
||||
"scopes": [],
|
||||
"stream": true,
|
||||
"policy": {
|
||||
"timeout_seconds": 900.0,
|
||||
"idempotent": false,
|
||||
"max_retries": 0,
|
||||
"cost_class": "medium",
|
||||
"allow_scope_expansion": false,
|
||||
"grant_mode": null,
|
||||
"grant_allow_patterns": [],
|
||||
"grant_deny_patterns": [],
|
||||
"grant_outputs_prefix": null,
|
||||
"grant_write_prefixes": [],
|
||||
"grant_ttl_seconds": null,
|
||||
"grant_run_timeout_seconds": null,
|
||||
"grant_approval_timeout_seconds": null,
|
||||
"grant_scope_approval_timeout_seconds": null
|
||||
},
|
||||
"input_schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"agent_name": {
|
||||
"type": "string"
|
||||
},
|
||||
"ref": {
|
||||
"type": "string"
|
||||
},
|
||||
"owner": {
|
||||
"anyOf": [
|
||||
{
|
||||
"type": "string"
|
||||
},
|
||||
{
|
||||
"type": "null"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"required": [
|
||||
"agent_name"
|
||||
],
|
||||
"additionalProperties": false
|
||||
},
|
||||
"output_schema": {
|
||||
"additionalProperties": true,
|
||||
"type": "object"
|
||||
}
|
||||
}
|
||||
],
|
||||
"capabilities": {},
|
||||
"input_modes": [
|
||||
"application/json"
|
||||
],
|
||||
"output_modes": [
|
||||
"application/json"
|
||||
],
|
||||
"required_secrets": [],
|
||||
"required_env": [],
|
||||
"consumer_setup": {
|
||||
"fields": []
|
||||
},
|
||||
"runtime": {
|
||||
"lifecycle": "ephemeral",
|
||||
"state": "none",
|
||||
"sandbox": "microsandbox",
|
||||
"resources": {
|
||||
"cpu": "100m",
|
||||
"memory": "256Mi",
|
||||
"gpu": 0,
|
||||
"max_runtime_seconds": 600
|
||||
},
|
||||
"concurrency": 1,
|
||||
"egress": {
|
||||
"allow_hosts": [],
|
||||
"allow_internal_services": [],
|
||||
"deny_internet_by_default": true
|
||||
},
|
||||
"tools_used": [
|
||||
"deepagents",
|
||||
"a2a-pack",
|
||||
"litellm",
|
||||
"microsandbox",
|
||||
"gitea"
|
||||
],
|
||||
"llm_provisioning": "platform",
|
||||
"pricing": {
|
||||
"price_per_call_usd": 0.05,
|
||||
"caller_pays_llm": true,
|
||||
"notes": "Reads target source via a short-lived, repo-scoped Gitea token minted on the caller's behalf. Never deploys or writes."
|
||||
},
|
||||
"wants_cp_jwt": true,
|
||||
"platform_resources": {
|
||||
"memory": null,
|
||||
"databases": []
|
||||
},
|
||||
"apt_packages": []
|
||||
},
|
||||
"template_lineage": null,
|
||||
"meta_agent_manifest": null,
|
||||
"state_schema": null,
|
||||
"workspace_access": {
|
||||
"enabled": false,
|
||||
"max_files": 0,
|
||||
"allowed_modes": [],
|
||||
"require_reason": true,
|
||||
"deny_patterns": [],
|
||||
"require_human_approval": false,
|
||||
"max_total_size_bytes": 104857600
|
||||
},
|
||||
"config_schema": {
|
||||
"properties": {},
|
||||
"title": "ReviewerConfig",
|
||||
"type": "object"
|
||||
},
|
||||
"auth": {
|
||||
"model": "a2a_pack.auth.NoAuth",
|
||||
"strategy": "public",
|
||||
"principal_schema": {
|
||||
"additionalProperties": false,
|
||||
"description": "Public agent: no caller identity required.",
|
||||
"properties": {},
|
||||
"title": "NoAuth",
|
||||
"type": "object"
|
||||
},
|
||||
"resolver": null,
|
||||
"required": false
|
||||
},
|
||||
"metadata": {
|
||||
"source": "python-a2a-pack",
|
||||
"project_manifest": {
|
||||
"name": "agent-reviewer",
|
||||
"version": "0.1.1",
|
||||
"entrypoint": "agent:AgentReviewer"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
paths-ignore:
|
||||
- 'deploy/**'
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: checkout from in-cluster gitea
|
||||
run: |
|
||||
set -e
|
||||
git clone --depth=1 \
|
||||
"http://gitea_admin:${{ secrets.ADMIN_PW }}@gitea-http.gitea.svc.cluster.local:3000/gitea_admin/agent-reviewer.git" .
|
||||
git checkout "$GITHUB_SHA"
|
||||
|
||||
- name: build image
|
||||
run: |
|
||||
IMG=registry.a2acloud.io/agents/agent-reviewer
|
||||
docker build --pull -t "$IMG:$GITHUB_SHA" -t "$IMG:latest" .
|
||||
docker push "$IMG:$GITHUB_SHA"
|
||||
docker push "$IMG:latest"
|
||||
|
||||
- name: bump deploy manifest
|
||||
run: |
|
||||
IMG=registry.a2acloud.io/agents/agent-reviewer
|
||||
sed -i "s|image: $IMG:.*|image: $IMG:$GITHUB_SHA|" deploy/20-deployment.yaml
|
||||
git config user.email "ci@a2a.local"
|
||||
git config user.name "ci"
|
||||
git add deploy/20-deployment.yaml
|
||||
if git diff --staged --quiet; then
|
||||
echo "no manifest changes"
|
||||
else
|
||||
git commit -m "ci: bump image to $GITHUB_SHA"
|
||||
git push "http://gitea_admin:${{ secrets.ADMIN_PW }}@gitea-http.gitea.svc.cluster.local:3000/gitea_admin/agent-reviewer.git" HEAD:main
|
||||
fi
|
||||
13
Dockerfile
13
Dockerfile
@@ -1,13 +0,0 @@
|
||||
FROM registry.a2acloud.io/a2a/a2a-pack-base:latest
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY requirements.txt .
|
||||
RUN pip install --no-cache-dir -r requirements.txt
|
||||
COPY . .
|
||||
|
||||
ENV A2A_ENTRYPOINT=agent:AgentReviewer
|
||||
ENV PORT=8000
|
||||
EXPOSE 8000
|
||||
|
||||
CMD a2a run --entrypoint "$A2A_ENTRYPOINT" --host 0.0.0.0 --port 8000
|
||||
@@ -1,113 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: agent-reviewer
|
||||
namespace: agents
|
||||
labels:
|
||||
app: agent-reviewer
|
||||
a2a/managed-by: control-plane
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: agent-reviewer
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
progressDeadlineSeconds: 900
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: agent-reviewer
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
terminationGracePeriodSeconds: 30
|
||||
containers:
|
||||
- name: agent
|
||||
image: registry.a2acloud.io/agents/agent-reviewer:9758c5588db0ebd4d59b94b8e3c9572952e790a8
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http1
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: SANDBOX_URL
|
||||
value: http://sandbox.sandbox.svc.cluster.local:8000
|
||||
- name: A2A_SANDBOX_URL
|
||||
value: http://sandbox.sandbox.svc.cluster.local:8000
|
||||
- name: SANDBOX_TIMEOUT_S
|
||||
value: "600"
|
||||
- name: A2A_GRANT_VERIFYING_KEY
|
||||
valueFrom:
|
||||
secretKeyRef: {name: platform-secrets, key: grant_verifying_key}
|
||||
- name: A2A_RECEIPT_SIGNING_KEY
|
||||
valueFrom:
|
||||
secretKeyRef: {name: platform-secrets, key: receipt_signing_key, optional: true}
|
||||
- name: A2A_REPLAY_SIGNING_KEY
|
||||
valueFrom:
|
||||
secretKeyRef: {name: platform-secrets, key: replay_signing_key, optional: true}
|
||||
- name: A2A_GITEA_INTERNAL
|
||||
value: http://gitea-http.gitea.svc.cluster.local:3000
|
||||
- name: A2A_GITEA_PUBLIC
|
||||
value: http://gitea.a2acloud.io
|
||||
- name: A2A_CP_URL
|
||||
value: http://control-plane.control-plane.svc.cluster.local
|
||||
readinessProbe:
|
||||
httpGet: {path: /healthz, port: 8000}
|
||||
initialDelaySeconds: 8
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
timeoutSeconds: 1
|
||||
livenessProbe:
|
||||
httpGet: {path: /healthz, port: 8000}
|
||||
initialDelaySeconds: 25
|
||||
periodSeconds: 15
|
||||
resources:
|
||||
requests: {cpu: 200m, memory: 384Mi}
|
||||
limits: {cpu: "1", memory: 768Mi}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: agent-reviewer
|
||||
namespace: agents
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: ServerSideApply=false,Replace=true
|
||||
labels:
|
||||
app: agent-reviewer
|
||||
a2a/managed-by: control-plane
|
||||
spec:
|
||||
selector:
|
||||
app: agent-reviewer
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: agent-reviewer
|
||||
namespace: agents
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
|
||||
spec:
|
||||
tls:
|
||||
- hosts: [agent-reviewer.a2acloud.io]
|
||||
secretName: agent-reviewer-a2acloud-io-tls
|
||||
rules:
|
||||
- host: agent-reviewer.a2acloud.io
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: agent-reviewer
|
||||
port:
|
||||
number: 80
|
||||
Reference in New Issue
Block a user