Require MCP_GRAFANA_VERSION build-arg; fix workflow step order and comments

.gitea/workflows/build.yaml

@@ -4,7 +4,7 @@
 # standalone.
 #
 # Triggers:
-#   - push to main (e.g. bumping the Dockerfile default version ARG)
+#   - push to main (runs the same resolve-latest build as the schedule)
 #   - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release
 #     and builds it if not yet published, ~7h BEFORE the cluster0
 #     image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like
@@ -56,23 +56,13 @@ jobs:
           fi
           [ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
           echo "version=$VER" >> "$GITHUB_OUTPUT"
-          # Image tag strips a leading 'v' from the release tag (v1.2.3 -> v1.2.3),
+          # The image tag is always v<semver>: the release tag's leading 'v' is
-          # so the tag is always v<semver> regardless of upstream's tag style.
+          # stripped and re-added, so 'v1.2.3' and '1.2.3' both yield tag v1.2.3.
           # An optional workflow_dispatch suffix (-1) allows rebuilds of the same
           # upstream version (e.g. image fixes) without overwriting the original tag.
           echo "tag=${VER#v}${{ github.event.inputs.suffix }}" >> "$GITHUB_OUTPUT"
           echo "Resolved grafana/mcp-grafana version: $VER"
 
-      - name: Skip if already published
-        id: skip
-        run: |
-          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
-            echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do."
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Configure registry credentials
         # Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's
         # container registry rejects scope requests from the Actions job token
@@ -84,7 +74,32 @@ jobs:
           chmod 600 "$HOME/.docker/config.json"
           echo "docker config.json written for $REGISTRY"
 
-      - name: Diagnose registry auth (runs only if a later step fails)
+      - name: Skip if already published
+        id: skip
+        run: |
+          if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.tag }}" >/dev/null 2>&1; then
+            echo "Image $IMAGE:v${{ steps.ver.outputs.tag }} already exists — nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          VER="${{ steps.ver.outputs.version }}"
+          TAG="${{ steps.ver.outputs.tag }}"
+          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
+            -t "$IMAGE:v$TAG" -t "$IMAGE:latest" .
+
+      - name: Push
+        if: steps.skip.outputs.skip != 'true'
+        run: |
+          TAG="${{ steps.ver.outputs.tag }}"
+          docker push "$IMAGE:v$TAG"
+          docker push "$IMAGE:latest"
+
+      - name: Diagnose registry auth (runs only if an earlier step fails)
         if: failure()
         # Prints only metadata (lengths, status codes) — never the token itself.
         run: |
@@ -102,18 +117,3 @@ jobs:
           curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
             -H "Authorization: Bearer $BT" \
             "https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true
-
-      - name: Build
-        if: steps.skip.outputs.skip != 'true'
-        run: |
-          VER="${{ steps.ver.outputs.version }}"
-          TAG="${{ steps.ver.outputs.tag }}"
-          docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
-            -t "$IMAGE:v$TAG" -t "$IMAGE:latest" .
-
-      - name: Push
-        if: steps.skip.outputs.skip != 'true'
-        run: |
-          TAG="${{ steps.ver.outputs.tag }}"
-          docker push "$IMAGE:v$TAG"
-          docker push "$IMAGE:latest"

Dockerfile

@@ -19,14 +19,14 @@
 # this image — the token comes from the server's own Kubernetes secret
 # (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
 
-ARG MCP_GRAFANA_VERSION=v1.1.0
+ARG MCP_GRAFANA_VERSION
 
 FROM docker.io/library/alpine:3.22 AS fetch
 
 ARG MCP_GRAFANA_VERSION
 ARG TARGETARCH
 
-# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
+# curl + tar + coreutils (sha256sum) to fetch and verify the pinned
 # upstream release. ca-certificates for HTTPS to github.com — and the CA
 # bundle is copied into the final scratch image too, because Grafana
 # (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
@@ -41,6 +41,7 @@ WORKDIR /tmp
 # .sbom.json sidecar entries for the same tarball names, which must stay out
 # of the sha256sum input (only the downloaded tarball is verified).
 RUN set -eux; \
+    [ -n "${MCP_GRAFANA_VERSION:-}" ] || { echo "MCP_GRAFANA_VERSION build-arg is required"; exit 1; }; \
     SHORT="${MCP_GRAFANA_VERSION#v}"; \
     case "$TARGETARCH" in \
         amd64) ASSET="Linux_x86_64" ;; \

README.md

@@ -12,9 +12,10 @@ HTTP MCP server.
 | `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). |
 | `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |
 
-The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg
+The upstream version comes from the required `MCP_GRAFANA_VERSION`
-(default `v1.1.0`); the workflow resolves the newest GitHub release and
+build-arg; the workflow resolves the newest GitHub release and passes it,
-skips the build when it's already published.
+skipping the build when the tag is already published. A build without the
+arg fails at the fetch step.
 
 ## Deployment (cluster0)