From 4f2e586041a69d43a7bc72ed3592e918c097a951 Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Tue, 3 Nov 2026 04:08:24 +0000 Subject: [PATCH] Require MCP_GRAFANA_VERSION build-arg; fix workflow step order and comments --- .gitea/workflows/build.yaml | 58 ++++++++++++++++++------------------- Dockerfile | 5 ++-- README.md | 7 +++-- 3 files changed, 36 insertions(+), 34 deletions(-) diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index 6b0766b..17b4707 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -4,7 +4,7 @@ # standalone. # # Triggers: -# - push to main (e.g. bumping the Dockerfile default version ARG) +# - push to main (runs the same resolve-latest build as the schedule) # - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release # and builds it if not yet published, ~7h BEFORE the cluster0 # image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like @@ -56,23 +56,13 @@ jobs: fi [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; } echo "version=$VER" >> "$GITHUB_OUTPUT" - # Image tag strips a leading 'v' from the release tag (v1.2.3 -> v1.2.3), - # so the tag is always v regardless of upstream's tag style. + # The image tag is always v: the release tag's leading 'v' is + # stripped and re-added, so 'v1.2.3' and '1.2.3' both yield tag v1.2.3. # An optional workflow_dispatch suffix (-1) allows rebuilds of the same # upstream version (e.g. image fixes) without overwriting the original tag. echo "tag=${VER#v}${{ github.event.inputs.suffix }}" >> "$GITHUB_OUTPUT" echo "Resolved grafana/mcp-grafana version: $VER" - - name: Skip if already published - id: skip - run: | - if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then - echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do." - echo "skip=true" >> "$GITHUB_OUTPUT" - else - echo "skip=false" >> "$GITHUB_OUTPUT" - fi - - name: Configure registry credentials # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's # container registry rejects scope requests from the Actions job token @@ -84,7 +74,32 @@ jobs: chmod 600 "$HOME/.docker/config.json" echo "docker config.json written for $REGISTRY" - - name: Diagnose registry auth (runs only if a later step fails) + - name: Skip if already published + id: skip + run: | + if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then + echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do." + echo "skip=true" >> "$GITHUB_OUTPUT" + else + echo "skip=false" >> "$GITHUB_OUTPUT" + fi + + - name: Build + if: steps.skip.outputs.skip != 'true' + run: | + VER="${{ steps.ver.outputs.version }}" + TAG="${{ steps.ver.outputs.tag }}" + docker build --build-arg MCP_GRAFANA_VERSION="$VER" \ + -t "$IMAGE:v$TAG" -t "$IMAGE:latest" . + + - name: Push + if: steps.skip.outputs.skip != 'true' + run: | + TAG="${{ steps.ver.outputs.tag }}" + docker push "$IMAGE:v$TAG" + docker push "$IMAGE:latest" + + - name: Diagnose registry auth (runs only if an earlier step fails) if: failure() # Prints only metadata (lengths, status codes) — never the token itself. run: | @@ -102,18 +117,3 @@ jobs: curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \ -H "Authorization: Bearer $BT" \ "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true - - - name: Build - if: steps.skip.outputs.skip != 'true' - run: | - VER="${{ steps.ver.outputs.version }}" - TAG="${{ steps.ver.outputs.tag }}" - docker build --build-arg MCP_GRAFANA_VERSION="$VER" \ - -t "$IMAGE:v$TAG" -t "$IMAGE:latest" . - - - name: Push - if: steps.skip.outputs.skip != 'true' - run: | - TAG="${{ steps.ver.outputs.tag }}" - docker push "$IMAGE:v$TAG" - docker push "$IMAGE:latest" diff --git a/Dockerfile b/Dockerfile index a4bd9fd..afa3c4a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -19,14 +19,14 @@ # this image — the token comes from the server's own Kubernetes secret # (Kubernetes_Cluster0, namespace ai-0-1) at deploy time. -ARG MCP_GRAFANA_VERSION=v1.1.0 +ARG MCP_GRAFANA_VERSION FROM docker.io/library/alpine:3.22 AS fetch ARG MCP_GRAFANA_VERSION ARG TARGETARCH -# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned +# curl + tar + coreutils (sha256sum) to fetch and verify the pinned # upstream release. ca-certificates for HTTPS to github.com — and the CA # bundle is copied into the final scratch image too, because Grafana # (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical @@ -41,6 +41,7 @@ WORKDIR /tmp # .sbom.json sidecar entries for the same tarball names, which must stay out # of the sha256sum input (only the downloaded tarball is verified). RUN set -eux; \ + [ -n "${MCP_GRAFANA_VERSION:-}" ] || { echo "MCP_GRAFANA_VERSION build-arg is required"; exit 1; }; \ SHORT="${MCP_GRAFANA_VERSION#v}"; \ case "$TARGETARCH" in \ amd64) ASSET="Linux_x86_64" ;; \ diff --git a/README.md b/README.md index c476b6d..c9fd779 100644 --- a/README.md +++ b/README.md @@ -12,9 +12,10 @@ HTTP MCP server. | `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). | | `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. | -The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg -(default `v1.1.0`); the workflow resolves the newest GitHub release and -skips the build when it's already published. +The upstream version comes from the required `MCP_GRAFANA_VERSION` +build-arg; the workflow resolves the newest GitHub release and passes it, +skipping the build when the tag is already published. A build without the +arg fails at the fetch step. ## Deployment (cluster0)