fix(agent-runtime): create the OPA destination directory, which does not exist on a clean checkout

[beyondnetPeru]

Root cause, and it was never the download

.gitignore:47 ignores .harness/bin/ — roughly 400 MB of platform OPA binaries — so git tracks not one file there. A developer's machine has that directory because they downloaded into it. A clean checkout does not have it at all.

So mv /tmp/opa .harness/bin/opa failed for want of a destination. One line fixes it:

&& mkdir -p .harness/bin \
&& mv /tmp/opa .harness/bin/opa \

Why it took three attempts

Two things hid it:

• BusyBox mv names the source when the destination is missing. can't rename '/tmp/opa': No such file or directory reads exactly like a download that produced nothing — which is what #672 chased, replacing wget with curl. Necessary (BusyBox wget really does not follow the redirect) but not the cause.
• Every local build passed, because it used files that exist only on my disk. That is the same class of error as the one that started this: verifying something adjacent to what CI runs instead of what CI runs.

#675 is what made this findable — it turned the step into an && chain with set -x, so a failure stops at the command that failed. It earned its keep immediately: a transient DNS failure during verification stopped the build at apk add and said so. Under the previous ; form that would have surfaced as the same misleading mv error.

Two of my own claims, corrected

The Dockerfile comment and the commit that introduced this step said the build was shipping a Mach-O binary into a Linux image. It was not — those binaries are gitignored, so on CI there was no binary at all. That is what the original audit actually said ("absent from the alpine image"); I overstated it. The comments now say what is true.

Verified the way it should have been from the start

In a clean git worktree — no .harness/bin/, exactly what the runner checks out — building --platform linux/amd64 --no-cache:

OPA pin resuelto: '1.19.0'
Descargando https://openpolicyagent.org/downloads/v1.19.0/opa_linux_amd64_static
-rw-r--r-- 1 root root 60526763 /tmp/opa
+ mkdir -p .harness/bin
Version: 1.19.0

Before you submit

• Sign-off (DCO): the commit carries Signed-off-by.
• Conventional Commits: title and commit follow the convention.
• Agnosticism: no new dependency.
• Bilingual: no documents touched.

Linked ADRs / Issues

• Completes fix(agent-runtime): the OPA download follows its redirect instead of silently writing nothing #672 and fix(agent-runtime): the OPA step fails at the command that fails, and says why #675; repairs what fix(core): the deployed runtime runs its own adapters, two guards stop lying, and the eleven unsigned ADRs are audited #669 introduced and chore(release): promote develop to main — security hardening, audited ADRs and two guards that stopped lying #670/chore(release): promote develop to main — repair the agent-runtime image build #673 promoted
• Related: GT-591 (the OPA pin remains the single owner of the version)

What the reviewer should know

Build & Push Services (GHCR) is gated on github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'). It does not run on PRs, and it is skipped on develop — so this PR's green checks will not prove the image builds, and neither did the green checks on #669, #670, #673 or #675. The first honest signal comes only when main moves.

That is the finding worth acting on beyond this fix: the only job that answers "does the artifact we ship actually build?" runs after every gate that could have stopped it.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Bilingual Coverage Impact

PR Changes

• Paired EN/ES files modified: 0
• New EN files needing ES translation: 0

Repository Coverage

Metric	Value
Total EN files	527
Total ES files	497
Paired files	0
Coverage	0%

✅ Good: All EN changes have ES counterparts.

---

Generated by GitHub Actions