From 7e57fa5179c28a970f7cd56a65ab28452a5aaaf5 Mon Sep 17 00:00:00 2001
From: sebasnallar <sebastiansaidnallar@gmail.com>
Date: Fri, 7 Aug 2026 16:03:33 -0300
Subject: [PATCH] feat: build lambda worker image on worker-bridge base +
 register artifact
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Dockerfile: replace the http-echo placeholder with the real worker image —
  FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0 (the lean gRPC
  worker bridge), add the cloud tooling the lambda steps need (aws, opentofu,
  gomplate), bake the scope in and point the bridge at the lambda entrypoint +
  service-path via NP_* env. Verified it builds and tofu/aws/gomplate/np/worker
  all resolve.
- publish-image.yml: after the ECR push, register the pushed image as an
  oci_image platform artifact pinned by digest, visible-to organization=*,
  using the alpha-packages np CLI. Digest comes from the build job output.
- .dockerignore: keep .git/.github/worker-base/node_modules out of the image.
---
 .dockerignore                       |  4 ++++
 .github/workflows/publish-image.yml | 29 +++++++++++++++++++++++++++++
 Dockerfile                          | 18 +++++++++++++++---
 3 files changed, 48 insertions(+), 3 deletions(-)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..20152a3
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,4 @@
+.git
+.github
+worker-base
+node_modules
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index ad21d9a..a93c4f9 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -20,3 +20,32 @@ jobs:
       tag: ${{ github.ref_name }}
     secrets:
       aws_role_arn: ${{ secrets.AWS_ROLE_ARN_ECR_PUSH }}
+
+  # Register the pushed image as a platform artifact, pinned by its digest and
+  # visible to every organization — so `np package publish` / scope_definition
+  # can resolve it. Idempotent upsert: re-runs of the same digest return the
+  # same ids.
+  publish-artifact:
+    name: Register oci_image artifact
+    needs: publish
+    runs-on: ubuntu-24.04
+    env:
+      # np reads the key from NULLPLATFORM_API_KEY; supply it via the
+      # ARTIFACT_NP_API_KEY repository secret.
+      NULLPLATFORM_API_KEY: ${{ secrets.ARTIFACT_NP_API_KEY }}
+      # Owner NRN for the artifact (repository/organization variable). Making it
+      # globally visible additionally requires artifact permissions org-wide.
+      NP_ARTIFACT_NRN: ${{ vars.NP_ARTIFACT_NRN }}
+    steps:
+      - name: Install np CLI (alpha-packages build)
+        run: curl -s https://cli.nullplatform.com/install.sh | VERSION=alpha-packages sh
+
+      - name: Register scopes-lambda image artifact (visible to everyone)
+        run: |
+          np artifact create \
+            --nrn "$NP_ARTIFACT_NRN" \
+            --type oci_image \
+            --registry public.ecr.aws \
+            --repository nullplatform/scopes/lambda \
+            --digest "${{ needs.publish.outputs.image_digest }}" \
+            --visible-to "organization=*"
diff --git a/Dockerfile b/Dockerfile
index 2c788e0..20e20be 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,17 @@
-FROM hashicorp/http-echo:1.0.0
-
-CMD ["-text={\"status\":\"ok\",\"msg\":\"Hola mundo\"}", "-listen=:8080", "-status-code=200"]
+# syntax=docker/dockerfile:1
+#
+# scopes-lambda worker image — the AWS Lambda scope built on the lean gRPC
+# worker bridge. The bridge dials over gRPC and runs the bash entrypoint on each
+# package-exec action; this image adds the cloud tooling the lambda steps need
+# and bakes the scope in, so the package-exec channel needs no cmdline.
+FROM public.ecr.aws/nullplatform/scopes/worker-bridge:1.0.0
 
+# Cloud tooling the lambda steps call (the bridge base stays minimal on purpose):
+# aws + opentofu (tofu) + gomplate. bash, jq, np, base64 and curl ship in the base.
+RUN apk add --no-cache aws-cli opentofu gomplate
 
+# Bake the scope in and point the bridge at the lambda entrypoint + service path.
+COPY . /app/pkg
+ENV NP_PACKAGE_NAME=scopes-lambda \
+    NP_SERVICE_PATH=/app/pkg/lambda \
+    NP_SCOPE_ENTRYPOINT=/app/pkg/lambda/entrypoint