[5650] feat(ci): build and push Railway preview wrapper images (WP1)

[mmabrouk]

Part of the clone-based Railway preview redesign (#5650, WP1 of 3). Do not merge before #5658; merge order is bottom-up through the stack.

Preview clones can only consume plain registry images: upload-built (railway up) services do not survive Railway's environment cloning (proven in the spike, #5658). Today the gateway, redis, and seaweedfs wrappers are generated at deploy time by deploy-from-images.sh, so nothing publishes them as images. This PR makes the build pipeline own them.

What changes

• hosting/railway/oss/images/{gateway,redis,seaweedfs}/: the wrapper Dockerfiles and their config/entrypoint files, byte-faithful to what the deploy scripts generate (two documented divergences: comment headers, and a hard redis:8 FROM pin that matches today's compose resolution).
• Workflow 42 gains a wrapper-images matrix job: verifies byte-faithfulness, computes a content-addressed tag (content-<12hex> via compute-tag.sh, deterministic, no timestamps), checks GHCR for that manifest, builds and pushes only when missing, then aliases the run's pr-<n>-<sha> tag onto the content manifest. Never latest (Railway's environmentPatchCommit no-ops on equal tags). Skips cleanly on fork PRs.
• verify-wrappers.sh is the drift guard: it re-extracts the deploy script's actual heredocs at runtime and diffs them against the image sources, so any edit to the legacy render functions that is not mirrored here fails the build before a push. Negative-tested both ways.
• README section documenting the images, the tag scheme, and the local build recipe.

Legacy deploy behavior is untouched; this only adds the build.

Verification

• verify-wrappers.sh green, and correctly fails on injected drift (extra byte, FROM pin change).
• All three images build locally; compute-tag.sh is stable across runs (tags in the job summary).
• bash -n + shellcheck clean on both scripts; actionlint clean on the new job.
• The push path itself needs the first real Actions run of workflow 42 (registry credentials); this PR triggers it.

Refs #5650

https://claude.ai/code/session_011zdniFW44QDqcs4Nz8n3hr

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agenta-documentation	Ready	Preview	Aug 3, 2026 6:37am

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 76cedf03-d889-48f3-b5c8-d0a51048e7ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mmabrouk]

Local verification evidence (WP1 acceptance):

• verify-wrappers.sh: green — "all wrapper image sources match the deploy-time content; redis FROM pin: redis:8; seaweedfs FROM pin: chrislusf/seaweedfs:4.37". Negative-tested twice: an appended byte in images/redis/entrypoint.sh and a FROM redis:9 pin change both made it exit 1 with a diff; restoring made it green again.
• compute-tag.sh deterministic across repeated runs: gateway content-778baa45f18f, redis content-cdbfac207702, seaweedfs content-03d718eacd47.
• docker build of all three image dirs succeeded locally (linux/amd64).
• bash -n and shellcheck (warning level) clean on both scripts; actionlint: the new job is clean (the one remaining finding, SC2129, is in the pre-existing untouched prepare job).

Remaining proof that needs a real Actions run (this PR provides it): the GHCR push path, the manifest-existence skip, and the imagetools alias step. The agenta-preview-* packages already exist and are public (created during the spike), so pushes append tags to public packages.

[mmabrouk]

CI status note: the three wrapper-image jobs fail with permission_denied: write_package. Cause: the agenta-preview-* GHCR packages were first pushed with a personal token during the spike, so they are not linked to this repository, and the workflow's GITHUB_TOKEN cannot write to them. One-time fix (org packages web UI, ~30s per package): agenta-preview-gateway / -redis / -seaweedfs → Package settings → Manage Actions access → Add repository → Agenta-AI/agenta → role: Write. Then re-run the failed jobs; the rest of this PR's CI is green (all app-image builds pass, and the wrapper jobs' verify + tag steps passed before the push step). Everything else in the job proved out: byte-faithfulness verify ran green in CI and the content tags matched the locally computed values.

[github-actions]

Railway Preview Environment

Status	Destroyed (PR closed)

Updated at 2026-08-03T06:54:28.759Z