diff --git a/.github/workflows/constitution.yml b/.github/workflows/constitution.yml index 45139a5..51be531 100644 --- a/.github/workflows/constitution.yml +++ b/.github/workflows/constitution.yml @@ -18,4 +18,4 @@ permissions: jobs: constitution: name: Constitution - uses: crunchtools/constitution/.github/workflows/validate.yml@v1.36.0 + uses: crunchtools/constitution/.github/workflows/validate.yml@v1.39.1 diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 7421fa2..d800771 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -1,120 +1,35 @@ -name: Container Build & Push +# Container release: build once per change, gate the digest, promote what was +# tested (constitution III and Container Image VII). The merge does not +# rebuild: it promotes the pull request's gated digest to :main, and a v* tag +# copies main's digest to the version tags and :latest. Quay.io only. + +name: Container on: + pull_request: push: branches: [main] tags: ["v*"] - pull_request: - branches: [main] + schedule: + - cron: "30 5 * * 1" # weekly: base-image errata, gated like any build workflow_dispatch: -env: - QUAY_IMAGE: quay.io/crunchtools/mcp-wordpress - GHCR_IMAGE: ghcr.io/crunchtools/mcp-wordpress +permissions: {} jobs: - build-and-push-quay: - runs-on: ubuntu-latest - permissions: - contents: read - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log in to Quay.io - if: github.event_name != 'pull_request' - uses: docker/login-action@v4 - with: - registry: quay.io - username: ${{ secrets.QUAY_USERNAME }} - password: ${{ secrets.QUAY_PASSWORD }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.QUAY_IMAGE }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - # `latest` is the newest STABLE RELEASE, not the newest build of the - # branch, which has its own tag above (constitution 1.33.0, RT#1559). - # A prerelease is not what `latest` means, so it is excluded by the - # hyphen: SemVer puts every prerelease identifier after one. - type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - file: ./Containerfile - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - - name: Run Trivy vulnerability scanner - continue-on-error: true - if: github.event_name != 'pull_request' - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: ${{ env.QUAY_IMAGE }}:${{ steps.meta.outputs.version }} - format: "table" - exit-code: "0" - severity: "CRITICAL,HIGH" - version: "v0.68.2" - - build-and-push-ghcr: - runs-on: ubuntu-latest - needs: build-and-push-quay - if: github.event_name != 'pull_request' + container: + uses: crunchtools/constitution/.github/workflows/container-release.yml@v1.39.1 permissions: contents: read - packages: write - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ github.token }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.GHCR_IMAGE }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - # `latest` is the newest STABLE RELEASE, not the newest build of the - # branch, which has its own tag above (constitution 1.33.0, RT#1559). - # A prerelease is not what `latest` means, so it is excluded by the - # hyphen: SemVer puts every prerelease identifier after one. - type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: . - file: ./Containerfile - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha + pull-requests: read + with: + image: quay.io/crunchtools/mcp-wordpress + boot: mcp + # Dummy settings: config loads at startup, no request reaches them. + boot-env: | + WORDPRESS_URL=https://example.invalid + WORDPRESS_USERNAME=gate-dummy + WORDPRESS_APP_PASSWORD=gate-dummy-gate-dummy + secrets: + QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} + QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }} diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 794a085..47017c6 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -15,4 +15,4 @@ permissions: jobs: automerge: name: Dependabot - uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.31.0 + uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.39.1 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index f745de1..b907c4a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -21,32 +21,7 @@ jobs: permissions: contents: read issues: write - uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.31.0 - - container-scan: - name: Container Security Scan - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v7 - - - name: Build container image - run: | - docker build -t mcp-wordpress:scan -f Containerfile . - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@v0.36.0 - with: - image-ref: "mcp-wordpress:scan" - format: "sarif" - output: "trivy-results.sarif" - severity: "CRITICAL,HIGH" - - - name: Upload Trivy scan results - uses: github/codeql-action/upload-sarif@v4 - if: always() - with: - sarif_file: "trivy-results.sarif" + uses: crunchtools/constitution/.github/workflows/dependency-audit.yml@v1.39.1 codeql: name: CodeQL Analysis diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md index 851d9b2..2e24a5b 100644 --- a/.specify/memory/constitution.md +++ b/.specify/memory/constitution.md @@ -4,7 +4,7 @@ > **Ratified:** 2026-03-03 > **Amended:** 2026-11-08 > **Status:** Active -> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.36.0 +> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.39.1 > **Profile:** MCP Server This file holds what is specific to mcp-wordpress. The fleet rules and the