build

type AgentSpecStage ¶

type AgentSpecStage struct{}

AgentSpecStage generates agent.json from ForgeConfig.

func (s *AgentSpecStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *AgentSpecStage) Name() string

type ChannelsStage ¶

type ChannelsStage struct{}

ChannelsStage unions env var names declared by the project's configured communication channels into Spec.Requirements.EnvRequired so the generated Kubernetes secrets and deployment manifests include them alongside skill env vars.

The canonical source is the per-channel YAML (workDir/<channel>-config.yaml) — every setting key ending in "_env" declares an env-var name. Adding a new channel adapter that ships its own config template will pick up here with no edits to this file.

func (s *ChannelsStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ChannelsStage) Name() string

type ChecksumsFile ¶

type ChecksumsFile struct {
	Version   string            `json:"version"`
	Checksums map[string]string `json:"checksums"` // relPath -> sha256 hex
	Timestamp string            `json:"timestamp"`
	Signature string            `json:"signature,omitempty"` // base64 Ed25519 signature of checksums JSON
	KeyID     string            `json:"key_id,omitempty"`    // identifier of the signing key
}

ChecksumsFile is the JSON structure written to checksums.json.

type DockerfileStage ¶

type DockerfileStage struct{}

DockerfileStage generates a Dockerfile from the embedded template.

func (s *DockerfileStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *DockerfileStage) Name() string

type EgressStage ¶

type EgressStage struct{}

EgressStage resolves egress configuration and generates allowlist artifacts.

func (s *EgressStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *EgressStage) Name() string

type FrameworkAdapterStage ¶

type FrameworkAdapterStage struct {
	Registry *plugins.FrameworkRegistry
}

FrameworkAdapterStage detects the agent framework, extracts configuration, and generates an A2A wrapper if needed.

func (s *FrameworkAdapterStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *FrameworkAdapterStage) Name() string

type K8sStage ¶

type K8sStage struct{}

K8sStage generates Kubernetes deployment and service manifests.

func (s *K8sStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *K8sStage) Name() string

type ManifestStage ¶

type ManifestStage struct{}

ManifestStage writes the build-manifest.json with build metadata.

func (s *ManifestStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ManifestStage) Name() string

type ModelProviderStage ¶

type ModelProviderStage struct{}

ModelProviderStage adds the configured model provider's API-key env var (e.g. OPENAI_API_KEY) to Spec.Requirements.EnvOptional, so the generated secrets.yaml placeholder and the Deployment's secretKeyRef env entry include it. Without this the provider key — declared in the catalog but never referenced at build time — never reaches the running agent, and the LLM client falls back to a stub.

The key is added as OPTIONAL (not required) because a provider may authenticate via OAuth instead of an API key, and local providers (e.g. Ollama) need no key at all; an unset optional secret key is simply ignored at runtime. When a key is supplied at deploy time it is wired through to the pod.

func (s *ModelProviderStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ModelProviderStage) Name() string

type PolicyStage ¶

type PolicyStage struct{}

PolicyStage generates the policy scaffold file.

func (s *PolicyStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *PolicyStage) Name() string

type RequirementsStage ¶

type RequirementsStage struct{}

RequirementsStage validates skill requirements and populates the agent spec.

func (s *RequirementsStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *RequirementsStage) Name() string

type ScheduleManifestStage ¶

type ScheduleManifestStage struct{}

ScheduleManifestStage emits Kubernetes CronJob manifests, a credential-less Secret template, and a Role/RoleBinding pair for every entry in forge.yaml `schedules[]` when the scheduler block requests a Kubernetes-aware deploy. Issue #162 part 3.

Output files land in <output>/k8s/:

cronjob-<schedule-id>.yaml     (one per schedule)
internal-token-secret.yaml     (credential-less template)
scheduler-role.yaml            (Role with verbs gated by allow_dynamic)
scheduler-rolebinding.yaml     (binds the Role to the agent's SA)

The Secret manifest deliberately ships WITHOUT a `data:` field so the artifact is safe to commit. Operators populate it out-of-band via `forge auth secret-yaml | kubectl apply -f -` (#162 part 1) or their preferred secret manager. Applying the Deployment before the Secret is populated leaves the agent pod NotReady with a clear `secret "..." not found` event — failure is loud, not silent.

This stage runs unconditionally; when forge.yaml has no schedules or no scheduler block, Execute is a no-op. When the scheduler block requests the file backend explicitly (`backend: file`), CronJobs are not emitted — operators using file mode in production would be a misconfiguration we don't want to encourage.

func (s *ScheduleManifestStage) Execute(_ context.Context, bc *pipeline.BuildContext) error

func (s *ScheduleManifestStage) Name() string

type SecretSafetyStage ¶

type SecretSafetyStage struct{}

SecretSafetyStage validates that container builds won't leak secrets.

func (s *SecretSafetyStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *SecretSafetyStage) Name() string

type SecurityAnalysisStage ¶

type SecurityAnalysisStage struct {
	// PolicyPathOverride is the value passed via `forge build
	// --policy`. Empty means "fall back to forge.yaml's
	// security.policy_path, then DefaultPolicy()".
	PolicyPathOverride string
}

SecurityAnalysisStage runs security risk analysis and policy checks on skills.

The active SecurityPolicy is resolved with this precedence (highest wins): PolicyPathOverride (set by the `--policy` CLI flag) > bc.Config.Security.PolicyPath (forge.yaml) > analyzer.DefaultPolicy(). When a policy file is loaded, its origin is printed to stderr so operators can see which knobs are active.

func (s *SecurityAnalysisStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *SecurityAnalysisStage) Name() string

type SigningStage ¶

type SigningStage struct{}

SigningStage computes SHA-256 checksums of all generated files and optionally signs them with an Ed25519 private key. This stage should run last in the pipeline.

func (s *SigningStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *SigningStage) Name() string

type SkillsStage ¶

type SkillsStage struct{}

SkillsStage compiles SKILL.md into container artifacts.

func (s *SkillsStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *SkillsStage) Name() string

type ToolFilterStage ¶

type ToolFilterStage struct{}

ToolFilterStage annotates tool categories and filters dev tools in production mode.

func (s *ToolFilterStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ToolFilterStage) Name() string

type ToolsStage ¶

type ToolsStage struct{}

ToolsStage generates tool schema files for each tool in the spec.

func (s *ToolsStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ToolsStage) Name() string

type ValidateStage ¶

type ValidateStage struct{}

ValidateStage validates the generated output files.

func (s *ValidateStage) Execute(ctx context.Context, bc *pipeline.BuildContext) error

func (s *ValidateStage) Name() string