initial commit: wrapper Dockerfile + CI

The wrapper sed-patches the two host-wide OAuth 2.1 discovery route registrations in MetaMCP's compiled backend bundle so spec-compliant MCP clients do not force an interactive login flow on public endpoints. See README for full rationale (RFC 9728, MCP Authorization spec 2026-03-26 revision) and the diagnostic evidence. Guarded with grep pre/post-conditions so a future upstream release that renames or restructures these routes fails the build loudly rather than silently shipping an unpatched image.
2026-07-22 12:04:58 -04:00
commit d5cd602d85
5 changed files with 267 additions and 0 deletions
@@ -0,0 +1,83 @@
+name: Build & push patched image
+
+# Wraps ghcr.io/metatool-ai/metamcp:latest with our sed-patch to hide
+# the OAuth 2.1 discovery endpoints, then pushes the resulting image
+# to the git.jpaul.io registry.
+#
+# Runs on push to main, on the nightly cron so we automatically pick up
+# upstream :latest updates, and on demand via workflow_dispatch. The
+# Dockerfile has grep guards that fail the build loudly if upstream
+# renames or restructures the OAuth routes, so a bad bump is loud —
+# nightly failures show up as red workflow runs, not a silently broken
+# unpatched image.
+
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - "README.md"
+      - "LICENSE"
+      - ".gitignore"
+  schedule:
+    # Every day at 08:00 UTC — pulls upstream :latest and rebuilds.
+    - cron: "0 8 * * *"
+  workflow_dispatch:
+
+env:
+  # Push to the plain-HTTP LAN endpoint (bypasses Cloudflare's body cap
+  # on multi-hundred-MB layers). Pull consumers use the FQDN over TLS.
+  REGISTRY_PUSH: 192.168.0.2:1234
+  REGISTRY_PULL: git.jpaul.io
+  IMAGE: justin/metamcp-patched
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: image=moby/buildkit:latest
+          buildkitd-config-inline: |
+            [registry."192.168.0.2:1234"]
+              http = true
+              insecure = true
+
+      - name: Registry login (hand-written config — login-action 403s on plain HTTP)
+        shell: bash
+        run: |
+          AUTH=$(printf '%s' "justin:${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
+          mkdir -p ~/.docker
+          printf '{"auths":{"%s":{"auth":"%s"}}}' "${REGISTRY_PUSH}" "$AUTH" > ~/.docker/config.json
+
+      - name: Compute tag
+        id: tags
+        shell: bash
+        run: |
+          SHA="$(echo "${{ github.sha }}" | cut -c1-12)"
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: Build & push
+        shell: bash
+        run: |
+          docker buildx build \
+            --push \
+            --pull \
+            -t "${REGISTRY_PUSH}/${IMAGE}:latest" \
+            -t "${REGISTRY_PUSH}/${IMAGE}:${{ steps.tags.outputs.sha }}" \
+            --label "org.opencontainers.image.source=https://git.jpaul.io/${IMAGE}" \
+            --label "org.opencontainers.image.description=MetaMCP with host-wide OAuth 2.1 discovery routes hidden" \
+            .
+          echo "Pushed ${REGISTRY_PULL}/${IMAGE}:{latest,${{ steps.tags.outputs.sha }}}"
+
+      - name: Link package to repo (idempotent)
+        shell: bash
+        run: |
+          curl -s -o /dev/null -w "link HTTP %{http_code}\n" \
+            -H "Authorization: token ${{ secrets.REGISTRY_TOKEN }}" \
+            -X POST "http://${REGISTRY_PUSH}/api/v1/packages/justin/container/metamcp-patched/-/link/metamcp-patched" || true