sha256sum -c validates the file under the name recorded in the checksums file (mcp-grafana_Linux_<arch>.tar.gz); saving the download as mcp.tar.gz made the check fail with 'No such file or directory'.
- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.