Update workflow to embed app assets

[jlewi]

• Support downloading the static assets from the published OCI image since thats how runmedev/web is publishing them

• We want to be able to support serving additional YAML/JSON files from the server e.g.
  https://acme.dev/configs/app-configs.yaml

• This YAML can contain application configuration that the webapp fetches and configures itself with

  • e.g. it can contain the OIDC and Google Drive configuration.

• Then in the web app we can just do

   app.setConfig("http://localhost:9966/configs/app-configs.yaml")
  

• Allow CORS to be partially set on static assets. During development we might still serve app-configs from the server even though the frontend is running on a different development server.

[Copilot]

Pull request overview

This pull request adds functionality to download static web app assets from an OCI image and embed them into the Go binary, while enhancing CORS support for serving these assets and additional configuration files.

Changes:

• Implements OCI image downloader to fetch and extract web app assets from published images
• Refactors CORS handling into a reusable wrapper function and extends it to static asset serving
• Adds OpenAI Organization and Project configuration fields to support OAuth-based authentication flows

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
pkg/agent/assets/downloader.go	New package implementing OCI image pull and tar.gz extraction for static assets
pkg/agent/cmd/download_assets.go	New CLI command to download assets from OCI images
pkg/agent/cmd/agent.go	Registers the new download-assets command
pkg/agent/server/cors.go	Extracts CORS configuration into reusable wrapWithCORS function
pkg/agent/server/auth.go	Refactored to use the new wrapWithCORS helper, removing duplicate code
pkg/agent/server/assets.go	Adds CORS support for static assets with wildcard origin filtering
pkg/agent/config/config.go	Adds Organization and Project fields for OpenAI OAuth configuration
pkg/agent/cmd/serve.go	Passes OpenAI org/project config to the agent
pkg/agent/ai/client.go	Allows creating OpenAI client without API key for OAuth flows
pkg/agent/ai/agent.go	Enhanced logging of agent initialization parameters
.github/workflows/runme-image.yml	Adds workflow_dispatch trigger and downloads assets during build
go.mod/go.sum	Adds oras.land/oras-go/v2 dependency for OCI operations

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sourishkrout]

Add DCOs, please, @jlewi. The LF/CNCF requires it.

[jlewi]

@sourishkrout FYI looks like github copilot doesn't signoff correctly when you accept its suggestions.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Jeremy Lewi <jeremy+github@lewi.us>

Commit sha: [db7f144](https://github.com/runmedev/runme/pull/1039/commits/db7f14467e91a10bbc66221be4fbc64480ac1a87), Author: Jeremy Lewi, Committer: GitHub; Expected "Jeremy Lewi [jeremy@lewi.us](mailto:jeremy@lewi.us)", but got "Jeremy Lewi [jeremy+github@lewi.us](mailto:jeremy+github@lewi.us)".

[sourishkrout]

Feel free to remove it in this PR, @jlewi. It's unused.