Merge nucleic/warm-ancient-lemur-kprc into dev

.github/workflows/linux-vm-agents.yml

@@ -13,8 +13,10 @@ name: Publish Linux VM guest agents + kernel
 # same committed-binary model the C agent already uses) and (b) pushed to GHCR as a single-blob OCI
 # artifact (the project's distribution channel, mirroring kernel-image.yml / ProjectSandbox.kernelImage).
 #
-# Manual + on-change. After the FIRST publish, set each GHCR package to Public (GitHub → Packages) so it
-# can be pulled anonymously while the repo stays private, exactly like nucleic-kernel / nucleic-sandbox.
+# Auto-publishes on push to main/dev/canary (tagged "latest"), same as nucleic-sandbox. Can also be
+# run manually from the Actions tab with a custom tag. After the FIRST publish, set each GHCR package
+# to Public (GitHub → Packages) so it can be pulled anonymously while the repo stays private, exactly
+# like nucleic-kernel / nucleic-sandbox.
 
 on:
   workflow_dispatch:
@@ -28,6 +30,7 @@ on:
         type: boolean
         default: true
   push:
+    branches: [main, dev, canary]
     paths:
       - "guest/nucleic-linux-agent/**"
       - "guest/nucleic-a11y-agent/**"
@@ -74,15 +77,15 @@ jobs:
         run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
       - uses: oras-project/setup-oras@v1
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
       - name: Log in to GHCR
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
         run: oras login ghcr.io -u '${{ github.actor }}' -p '${{ secrets.GITHUB_TOKEN }}'
       - name: Push agents as OCI artifacts
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
         working-directory: guest
         run: |
-          T='${{ inputs.tag }}'
+          T='${{ inputs.tag || 'latest' }}'
           O='${{ steps.ref.outputs.owner }}'
           oras push "ghcr.io/$O/nucleic-linux-agent:$T" \
             --artifact-type application/vnd.nucleic.agent \
@@ -114,13 +117,13 @@ jobs:
         id: ref
         run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
       - uses: oras-project/setup-oras@v1
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
       - name: Log in to GHCR
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
         run: oras login ghcr.io -u '${{ github.actor }}' -p '${{ secrets.GITHUB_TOKEN }}'
       - name: Push kernel as an OCI artifact
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish }}
+        if: ${{ github.event_name == 'push' || inputs.publish }}
         run: |
-          oras push "ghcr.io/${{ steps.ref.outputs.owner }}/nucleic-linux-vm-kernel:26.04-${{ inputs.tag }}" \
+          oras push "ghcr.io/${{ steps.ref.outputs.owner }}/nucleic-linux-vm-kernel:26.04-${{ inputs.tag || 'latest' }}" \
             --artifact-type application/vnd.nucleic.kernel \
             vmlinux-arm64:application/octet-stream