feat: live x402 + MPP weather agent, deployable, wired into the tutorials showcase

.github/workflows/weather-x402-image.yml

@@ -0,0 +1,146 @@
+name: Weather x402 image
+
+# Builds the weather-x402 agent (http-simple-agent-ts/Dockerfile) and pushes it
+# to Google Artifact Registry so ArgoCD can deploy it. Keyless auth via Workload
+# Identity Federation (same SA/provider the other Nevermined repos use — no
+# secrets).
+#
+#   pull_request  → verify only (install, self-checks, build); no credentials, no push.
+#   push to main  → verify, then build & push.
+#   dispatch      → verify, then build & push (optional extra semver tag).
+#
+# Versioning (immutable-first — the AR repo has immutableTags=true, so a moving
+# `latest` tag would be rejected on the second build; we don't publish one):
+#   - sha-<short>  every build — the immutable tag ArgoCD should pin in production
+#   - <version>    optional, when run manually with a version input (e.g. 1.0.0)
+
+on:
+  pull_request:
+    paths:
+      - "http-simple-agent-ts/**"
+      - ".github/workflows/weather-x402-image.yml"
+  push:
+    branches: [main]
+    paths:
+      - "http-simple-agent-ts/**"
+      - ".github/workflows/weather-x402-image.yml"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Optional explicit semver tag to also publish (e.g. 1.0.0)"
+        required: false
+        type: string
+
+# Superseded PR pushes shouldn't keep burning a runner. Cancel only in-flight PR
+# runs (grouped per ref, so distinct PRs don't cancel each other); never cancel a
+# push/dispatch run — those publish the immutable image and must finish.
+concurrency:
+  group: weather-x402-image-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  IMAGE: europe-west3-docker.pkg.dev/nevermined-eu-dev/nevermined-io/tutorials-weather-x402
+  AR_LOCATION: europe-west3
+  PROJECT_ID: nevermined-eu-dev
+  SERVICE_ACCOUNT: github-actions-service-account@nevermined-eu-dev.iam.gserviceaccount.com
+  WORKLOAD_IDENTITY_PROVIDER: projects/112425687177/locations/global/workloadIdentityPools/github/providers/github-actions
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  # Runs on every PR and every push. `tsc` type-checks the agent, and the pure
+  # self-checks cover the pricing/request-validation logic — neither needs
+  # credentials, so a broken PR fails here instead of on main.
+  verify:
+    name: Verify (install + self-checks + build)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: http-simple-agent-ts
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: yarn
+          cache-dependency-path: http-simple-agent-ts/yarn.lock
+
+      - name: Install
+        run: yarn install --frozen-lockfile
+
+      - name: Pricing self-check
+        run: yarn pricing:selfcheck
+
+      - name: Request validation self-check
+        run: yarn request:selfcheck
+
+      - name: Build (type-checks the agent)
+        run: yarn build
+
+  # Only publishes on main / dispatch — never on a pull request.
+  build-push:
+    name: Build & push weather-x402 image
+    runs-on: ubuntu-latest
+    needs: verify
+    if: github.event_name != 'pull_request'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker metadata (tags + labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=sha,prefix=sha-,format=short
+            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
+
+      - name: Authenticate to Google Cloud
+        id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          token_format: access_token
+          project_id: ${{ env.PROJECT_ID }}
+          service_account: ${{ env.SERVICE_ACCOUNT }}
+          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
+
+      - name: Log in to Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.AR_LOCATION }}-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.auth.outputs.access_token }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build & push
+        uses: docker/build-push-action@v5
+        with:
+          context: ./http-simple-agent-ts
+          file: ./http-simple-agent-ts/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: false
+          sbom: false
+
+      - name: Summary
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          {
+            echo "### Pushed tutorials-weather-x402 image"
+            echo '```'
+            echo "$TAGS"
+            echo '```'
+            echo "Pin the immutable sha-* tag in ArgoCD for production."
+          } >> "$GITHUB_STEP_SUMMARY"