mcp-grafana GitHub releases are tagged v1.1.0, so prefixing v$VER produced vv1.1.0. Normalize the tag to v<semver> for the Monday image cron.
sha256sum -c validates the file under the name recorded in the checksums file (mcp-grafana_Linux_<arch>.tar.gz); saving the download as mcp.tar.gz made the check fail with 'No such file or directory'.
- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.