fix(ci): use AGENT_SERVER_SHA to avoid conflict with GitHub's default GITHUB_SHA

[neubig]

Summary

Fixes the 5 docker/apptainer/remote-runtime example failures seen in the v1.17.0 release PR (#2812).

Problem

GITHUB_SHA is a GitHub Actions built-in env var that defaults to the merge commit SHA for pull_request events. The run-examples.yml workflow attempted to override it at step level with the PR head SHA, but this stopped working reliably with runner image ubuntu24/20260406.80 (it worked on ubuntu24/20260323.65 used by v1.16.0).

The result: example scripts resolved os.getenv("GITHUB_SHA") to the merge commit SHA (a76b56b), but agent-server images were tagged with the head SHA (9e90afa). The images existed — the examples just looked for the wrong tag.

Fix

Use a custom variable name AGENT_SERVER_SHA that doesn't conflict with GitHub's built-in. This is the same approach server.yml already uses with SDK_SHA.

Files changed

• .github/workflows/run-examples.yml — GITHUB_SHA → AGENT_SERVER_SHA
• examples/02_remote_agent_server/02_convo_with_docker_sandboxed_server.py
• examples/02_remote_agent_server/03_browser_use_with_docker_sandboxed_server.py
• examples/02_remote_agent_server/04_convo_with_api_sandboxed_server.py
• examples/02_remote_agent_server/05_vscode_with_docker_sandboxed_server.py
• examples/02_remote_agent_server/08_convo_with_apptainer_sandboxed_server.py
• examples/02_remote_agent_server/09_acp_agent_with_remote_runtime.py

Context

Full diagnosis in PR #2812 comments.

This PR was created by an AI assistant (OpenHands) on behalf of the user.

---

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python	amd64, arm64	nikolaik/python-nodejs:python3.13-nodejs22-slim	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:f5440c3-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-f5440c3-python \
  ghcr.io/openhands/agent-server:f5440c3-python

All tags pushed for this build

ghcr.io/openhands/agent-server:f5440c3-golang-amd64
ghcr.io/openhands/agent-server:f5440c3-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:f5440c3-golang-arm64
ghcr.io/openhands/agent-server:f5440c3-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:f5440c3-java-amd64
ghcr.io/openhands/agent-server:f5440c3-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:f5440c3-java-arm64
ghcr.io/openhands/agent-server:f5440c3-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:f5440c3-python-amd64
ghcr.io/openhands/agent-server:f5440c3-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-slim-amd64
ghcr.io/openhands/agent-server:f5440c3-python-arm64
ghcr.io/openhands/agent-server:f5440c3-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-slim-arm64
ghcr.io/openhands/agent-server:f5440c3-golang
ghcr.io/openhands/agent-server:f5440c3-java
ghcr.io/openhands/agent-server:f5440c3-python

About Multi-Architecture Support

• Each variant tag (e.g., f5440c3-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., f5440c3-python-amd64) are also available if needed

[github-actions]

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[xingyaoww]

@OpenHands reviewed against main. I vaguely remember that I implemented a similar fix a while ago. Is this fix still necessary? If not, let's close this PR.

[openhands-ai]

I'm on it! xingyaoww can track my progress at all-hands.dev

[xingyaoww]

You're right — this fix is no longer necessary. Commit aabf4072 (included in the v1.17.0 release) already addresses the same issue using SDK_SHA instead of AGENT_SERVER_SHA. The approach on main is actually better since it uses the same env var name (SDK_SHA) that server.yml already sets, and keeps GITHUB_SHA as a backward-compatible fallback.

This PR can be closed.

This comment was generated by an AI assistant (OpenHands).

[xingyaoww]

Closing — superseded by aabf407 on main.

[openhands-ai]

Summary

The reviewer (@xingyaoww) asked whether this PR's fix was still necessary, recalling a similar fix was implemented previously.

Answer: The fix in PR #2816 is no longer necessary. Commit aabf4072 (tagged v1.17.0, already on main) addresses the exact same GITHUB_SHA merge-commit conflict issue. The fix on main is actually superior because:

1. It uses SDK_SHA — the same env var name that server.yml already sets, providing consistent naming across workflows.
2. It retains GITHUB_SHA as a backward-compatible fallback (os.getenv("SDK_SHA") or os.getenv("GITHUB_SHA")), whereas this PR removed the fallback entirely.

Actions taken:

• ✅ Investigated the current state of main to confirm the fix already exists
• ✅ Posted a comment on PR fix(ci): use AGENT_SERVER_SHA to avoid conflict with GitHub's default GITHUB_SHA #2816 explaining why it's superseded (with a link to the commit)
• ✅ Closed PR fix(ci): use AGENT_SERVER_SHA to avoid conflict with GitHub's default GITHUB_SHA #2816

No code changes were made — this was purely an investigation and PR closure.