Add Dockerfile + Gitea Actions workflow for mcp-grafana container

- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.
2026-08-15 22:24:37 +00:00
commit 23f636a501
3 changed files with 220 additions and 0 deletions
@@ -0,0 +1,109 @@
+# Builds and publishes the grafana-mcp (Grafana MCP server) container image
+# to the Gitea registry. This repo deliberately contains no build process
+# that depends on Hermes' container — Gitea Actions builds and pushes it
+# standalone.
+#
+# Triggers:
+#   - push to main (e.g. bumping the Dockerfile default version ARG)
+#   - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release
+#     and builds it if not yet published, ~7h BEFORE the cluster0
+#     image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like
+#     any other app.
+#   - workflow_dispatch with an explicit version input
+name: build
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'grafana/mcp-grafana GitHub release (empty = latest)'
+        required: false
+        default: ''
+
+env:
+  REGISTRY: gitea.williammiceli.systems
+  IMAGE: gitea.williammiceli.systems/hermes/grafana-mcp
+
+jobs:
+  build:
+    runs-on: ubuntu-latest # cluster0 Gitea runner (registers this label; has docker + network)
+    # Minimal explicit scopes: read code (checkout), write packages (registry push).
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Resolve upstream version
+        id: ver
+        run: |
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            VER="${{ github.event.inputs.version }}"
+          else
+            VER=$(curl -fsSL https://api.github.com/repos/grafana/mcp-grafana/releases/latest \
+              | python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'])")
+          fi
+          [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
+          echo "version=$VER" >> "$GITHUB_OUTPUT"
+          echo "Resolved grafana/mcp-grafana version: $VER"
+
+      - name: Skip if already published
+        id: skip
+        run: |
+          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then
+            echo "Image $IMAGE:v${{ steps.ver.outputs.version }} already exists — nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure registry credentials
+        # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's
+        # container registry rejects scope requests from the Actions job token
+        # (upstream issue #23642). Write config.json directly; no login ping.
+        run: |
+          mkdir -p "$HOME/.docker"
+          AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
+          printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > "$HOME/.docker/config.json"
+          chmod 600 "$HOME/.docker/config.json"
+          echo "docker config.json written for $REGISTRY"
+
+      - name: Diagnose registry auth (runs only if a later step fails)
+        if: failure()
+        # Prints only metadata (lengths, status codes) — never the token itself.
+        run: |
+          T="${{ secrets.REGISTRY_TOKEN }}"
+          echo "REGISTRY_TOKEN length: ${#T} (0 = secret empty or missing)"
+          echo "--- /v2/ ping with basic auth ---"
+          curl -s -o /dev/null -w "HTTP %{http_code}\n" -u "Hermes:$T" \
+            "https://gitea.williammiceli.systems/v2/" || true
+          echo "--- bearer-token flow (what docker push does after a 401 challenge) ---"
+          BT=$(curl -s -u "Hermes:$T" -G "https://gitea.williammiceli.systems/v2/token" \
+            --data-urlencode "service=container_registry" \
+            --data-urlencode "scope=repository:hermes/grafana-mcp:pull,push" \
+            | python3 -c "import sys,json;print(json.load(sys.stdin).get('token',''))")
+          echo "bearer token length: ${#BT}"
+          curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
+            -H "Authorization: Bearer $BT" \
+            "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true
+
+      - name: Build
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
+            -t "$IMAGE:v$VER" -t "$IMAGE:latest" .
+
+      - name: Push
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          docker push "$IMAGE:v$VER"
+          docker push "$IMAGE:latest"