justin
d5cd602d85
Build & push patched image / build (push) Failing after 1m13s
The wrapper sed-patches the two host-wide OAuth 2.1 discovery route registrations in MetaMCP's compiled backend bundle so spec-compliant MCP clients do not force an interactive login flow on public endpoints. See README for full rationale (RFC 9728, MCP Authorization spec 2026-03-26 revision) and the diagnostic evidence. Guarded with grep pre/post-conditions so a future upstream release that renames or restructures these routes fails the build loudly rather than silently shipping an unpatched image.
84 lines
2.9 KiB
YAML
84 lines
2.9 KiB
YAML
name: Build & push patched image
|
|
|
|
# Wraps ghcr.io/metatool-ai/metamcp:latest with our sed-patch to hide
|
|
# the OAuth 2.1 discovery endpoints, then pushes the resulting image
|
|
# to the git.jpaul.io registry.
|
|
#
|
|
# Runs on push to main, on the nightly cron so we automatically pick up
|
|
# upstream :latest updates, and on demand via workflow_dispatch. The
|
|
# Dockerfile has grep guards that fail the build loudly if upstream
|
|
# renames or restructures the OAuth routes, so a bad bump is loud —
|
|
# nightly failures show up as red workflow runs, not a silently broken
|
|
# unpatched image.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore:
|
|
- "README.md"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
schedule:
|
|
# Every day at 08:00 UTC — pulls upstream :latest and rebuilds.
|
|
- cron: "0 8 * * *"
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
# Push to the plain-HTTP LAN endpoint (bypasses Cloudflare's body cap
|
|
# on multi-hundred-MB layers). Pull consumers use the FQDN over TLS.
|
|
REGISTRY_PUSH: 192.168.0.2:1234
|
|
REGISTRY_PULL: git.jpaul.io
|
|
IMAGE: justin/metamcp-patched
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: docker
|
|
container:
|
|
image: catthehacker/ubuntu:act-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver-opts: image=moby/buildkit:latest
|
|
buildkitd-config-inline: |
|
|
[registry."192.168.0.2:1234"]
|
|
http = true
|
|
insecure = true
|
|
|
|
- name: Registry login (hand-written config — login-action 403s on plain HTTP)
|
|
shell: bash
|
|
run: |
|
|
AUTH=$(printf '%s' "justin:${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
|
|
mkdir -p ~/.docker
|
|
printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_PUSH}" "$AUTH" > ~/.docker/config.json
|
|
|
|
- name: Compute tag
|
|
id: tags
|
|
shell: bash
|
|
run: |
|
|
SHA="$(echo "${{ github.sha }}" | cut -c1-12)"
|
|
echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build & push
|
|
shell: bash
|
|
run: |
|
|
docker buildx build \
|
|
--push \
|
|
--pull \
|
|
-t "${REGISTRY_PUSH}/${IMAGE}:latest" \
|
|
-t "${REGISTRY_PUSH}/${IMAGE}:${{ steps.tags.outputs.sha }}" \
|
|
--label "org.opencontainers.image.source=https://git.jpaul.io/${IMAGE}" \
|
|
--label "org.opencontainers.image.description=MetaMCP with host-wide OAuth 2.1 discovery routes hidden" \
|
|
.
|
|
echo "Pushed ${REGISTRY_PULL}/${IMAGE}:{latest,${{ steps.tags.outputs.sha }}}"
|
|
|
|
- name: Link package to repo (idempotent)
|
|
shell: bash
|
|
run: |
|
|
curl -s -o /dev/null -w "link HTTP %{http_code}\n" \
|
|
-H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
|
|
-X POST "http://${REGISTRY_PUSH}/api/v1/packages/justin/container/metamcp-patched/-/link/metamcp-patched" || true
|