From 22f32f72fee40c2a25f1aa2d99ea33858d59b1b6 Mon Sep 17 00:00:00 2001 From: Scott McCarty Date: Wed, 11 Nov 2026 09:46:12 -0500 Subject: [PATCH] ci: build once, gate the digest, promote what was tested (RT#1550) Replace the Quay+GHCR build workflow with constitution's container-release.yml (mcp boot gate, GITLAB_TOKEN dummy), drop the docker-build container-scan job from security.yml (Trivy now scans the gated digest), remove GHCR, and move the repo to constitution v1.39.1. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01R7Y1jh5QhdxRuFKyWVev5h --- .github/workflows/constitution.yml | 2 +- .github/workflows/container.yml | 130 ++++----------------- .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/security.yml | 27 +---- .specify/memory/constitution.md | 2 +- 5 files changed, 26 insertions(+), 137 deletions(-) diff --git a/.github/workflows/constitution.yml b/.github/workflows/constitution.yml index 45139a5..51be531 100644 --- a/.github/workflows/constitution.yml +++ b/.github/workflows/constitution.yml @@ -18,4 +18,4 @@ permissions: jobs: constitution: name: Constitution - uses: crunchtools/constitution/.github/workflows/validate.yml@v1.36.0 + uses: crunchtools/constitution/.github/workflows/validate.yml@v1.39.1 diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 5a53b93..b453155 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -1,119 +1,33 @@ -name: Container Build & Push +# Container release: build once per change, gate the digest, promote what was +# tested (constitution III and Container Image VII). The merge does not +# rebuild: it promotes the pull request's gated digest to :main, and a v* tag +# copies main's digest to the version tags and :latest. Quay.io only. + +name: Container on: + pull_request: push: branches: [main] tags: ["v*"] - pull_request: - branches: [main] + schedule: + - cron: "25 4 * * 1" # weekly: base-image errata, gated like any build workflow_dispatch: -env: - QUAY_IMAGE: quay.io/crunchtools/mcp-gitlab - GHCR_IMAGE: ghcr.io/crunchtools/mcp-gitlab +permissions: {} jobs: - build-and-push-quay: - runs-on: ubuntu-latest - permissions: - contents: read - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log in to Quay.io - if: github.event_name != 'pull_request' - uses: docker/login-action@v4 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.QUAY_IMAGE }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - # `latest` is the newest STABLE RELEASE, not the newest build of the - # branch, which has its own tag above (constitution 1.33.0, RT#1559). - # A prerelease is not what `latest` means, so it is excluded by the - # hyphen: SemVer puts every prerelease identifier after one. - type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - file: ./Containerfile - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - - name: Run Trivy vulnerability scanner - continue-on-error: true - if: github.event_name != 'pull_request' - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: ${{ env.QUAY_IMAGE }}:${{ steps.meta.outputs.version }} - format: "table" - exit-code: "0" - severity: "CRITICAL,HIGH" - - build-and-push-ghcr: - runs-on: ubuntu-latest - needs: build-and-push-quay - if: github.event_name != 'pull_request' + container: + uses: crunchtools/constitution/.github/workflows/container-release.yml@v1.39.1 permissions: contents: read - packages: write - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ github.token }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.GHCR_IMAGE }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - # `latest` is the newest STABLE RELEASE, not the newest build of the - # branch, which has its own tag above (constitution 1.33.0, RT#1559). - # A prerelease is not what `latest` means, so it is excluded by the - # hyphen: SemVer puts every prerelease identifier after one. - type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - file: ./Containerfile - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha + pull-requests: read + with: + image: quay.io/crunchtools/mcp-gitlab + boot: mcp + # Dummy settings: config loads at startup, no request reaches them. + boot-env: | + GITLAB_TOKEN=gate-dummy + secrets: + QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} + QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 794a085..47017c6 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -15,4 +15,4 @@ permissions: jobs: automerge: name: Dependabot - uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.31.0 + uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.39.1 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 032e71b..b907c4a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,32 +21,7 @@ jobs: permissions: contents: read issues: write - uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.31.0 - - container-scan: - name: Container Security Scan - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v7 - - - name: Build container image - run: | - docker build -f Containerfile -t mcp-gitlab:scan . - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "mcp-gitlab:scan" - format: "sarif" - output: "trivy-results.sarif" - severity: "CRITICAL,HIGH" - - - name: Upload Trivy scan results - uses: github/codeql-action/upload-sarif@v4 - if: always() - with: - sarif_file: "trivy-results.sarif" + uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.39.1 codeql: name: CodeQL Analysis diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md index 027dc0a..0bf9c9f 100644 --- a/.specify/memory/constitution.md +++ b/.specify/memory/constitution.md @@ -4,7 +4,7 @@ > **Ratified:** 2026-02-27 > **Amended:** 2026-11-09 > **Status:** Active -> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.36.0 +> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.39.1 > **Profile:** MCP Server This file holds what is specific to mcp-gitlab. The fleet rules and the MCP