fix(ci): push tutorial images from buildx instead of re-pushing a stale local tag

The publish path built a multi-platform image without --push, then a separate
'docker push' step shipped ':latest'. But a multi-arch buildx build can't be
loaded into the local Docker image store, so no fresh local ':latest' exists;
the preceding validation step's 'docker run' pulls the *existing* (stale)
':latest' from ghcr, and 'docker push' then re-pushes that same stale image.
Result: ':latest' has been frozen at a Dec-2025 build, re-pushed unchanged on
every run, which is why the 020_state_machine agent's mcp<2 pin never reached
the published image and the scale-agentex integration test kept failing.

Fix: on the publish path, pass --push to 'agentex agents build' so buildx sends
the freshly-built multi-arch image straight to the registry, and drop the
now-redundant separate 'docker push' step. Validation still runs and now
exercises the freshly-pushed image.

Also revert the CLI build cache default back to True (keep the --cache/--no-cache
flag): the staleness was never a layer-cache problem, so forcing --no-cache
globally only slowed builds without fixing anything.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: deepthi-rao-scale

.github/workflows/build-and-push-tutorial-agent.yml

@@ -196,8 +196,16 @@ jobs:
             echo "SKIP_VALIDATION=true" >> $GITHUB_ENV
           fi
 
-          # Always build locally first (without push)
+          # Build the image. On the publish path, push straight from buildx.
+          # A multi-platform build cannot be loaded into the local Docker image
+          # store, so a subsequent `docker push` has no freshly-built image to send
+          # and ends up re-pushing whatever :latest was pulled during validation —
+          # i.e. the previous, stale image. Pushing from the build itself is the
+          # only way the newly-built multi-arch image actually lands on the tag.
           BUILD_ARGS="--manifest ${{ matrix.agent_path }}/manifest.yaml --registry ${REGISTRY} --tag ${VERSION_TAG} --platforms linux/amd64,linux/arm64 --repository-name ${REPOSITORY_NAME}"
+          if [ "$SHOULD_PUSH" = "true" ]; then
+            BUILD_ARGS="$BUILD_ARGS --push"
+          fi
 
           agentex agents build $BUILD_ARGS
           echo "✅ Successfully built: ${REGISTRY}/${REPOSITORY_NAME}:${VERSION_TAG}"
@@ -279,14 +287,6 @@ jobs:
 
           echo "✅ All validations passed for: $FULL_IMAGE"
 
-      - name: Push Agent Image
-        if: env.SHOULD_PUSH == 'true'
-        run: |
-          FULL_IMAGE="${{ env.FULL_IMAGE }}"
-          echo "🚀 Pushing validated image: $FULL_IMAGE"
-          docker push "$FULL_IMAGE"
-          echo "✅ Successfully pushed: $FULL_IMAGE"
-
   deprecate-agents:
     name: "Deprecate Removed Agents"
     runs-on: ubuntu-latest

src/agentex/lib/cli/commands/agents.py

@@ -128,11 +128,9 @@ def build(
         help="Docker build argument in the format 'KEY=VALUE' (can be used multiple times)",
     ),
     cache: bool = typer.Option(
-        False,
+        True,
         "--cache/--no-cache",
-        help="Whether to use the build cache. Defaults to off so a stale cached layer "
-        "can't silently ship source that no longer matches the checkout (notably when "
-        "republishing a moving tag like ':latest'). Pass --cache to opt back in.",
+        help="Whether to use the build cache (default on). Pass --no-cache for a clean rebuild.",
     ),
 ):
     """

src/agentex/lib/cli/handlers/agent_handlers.py

@@ -39,7 +39,7 @@ def build_agent(
     secret: str | None = None,
     tag: str | None = None,
     build_args: list[str] | None = None,
-    cache: bool = False,
+    cache: bool = True,
 ) -> str:
     """Build the agent locally and optionally push to registry
 
@@ -50,10 +50,8 @@ def build_agent(
         secret: Docker build secret in format 'id=secret-id,src=path-to-secret-file'
         tag: Image tag to use (defaults to 'latest')
         build_args: List of Docker build arguments in format 'KEY=VALUE'
-        cache: Whether to use the build cache. Defaults to False (passes --no-cache to
-            buildx) so a stale cached layer can't silently ship source that no longer
-            matches the checkout, notably when republishing a moving tag like ':latest'.
-            Pass True to opt back in for faster local rebuilds.
+        cache: Whether to use the build cache. Defaults to True. Set to False to pass
+            --no-cache to buildx for a clean rebuild.
 
     Returns:
         The image URL