ci: build once, gate the digest, promote what was tested (RT#1550)

.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.36.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.39.1

.github/workflows/container.yml

@@ -1,120 +1,35 @@
-name: Container Build & Push
+# Container release: build once per change, gate the digest, promote what was
+# tested (constitution III and Container Image VII). The merge does not
+# rebuild: it promotes the pull request's gated digest to :main, and a v* tag
+# copies main's digest to the version tags and :latest. Quay.io only.
+
+name: Container
 
 on:
+  pull_request:
   push:
     branches: [main]
     tags: ["v*"]
-  pull_request:
-    branches: [main]
+  schedule:
+    - cron: "30 5 * * 1"   # weekly: base-image errata, gated like any build
   workflow_dispatch:
 
-env:
-  QUAY_IMAGE: quay.io/crunchtools/mcp-wordpress
-  GHCR_IMAGE: ghcr.io/crunchtools/mcp-wordpress
+permissions: {}
 
 jobs:
-  build-and-push-quay:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to Quay.io
-        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_PASSWORD }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ${{ env.QUAY_IMAGE }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            # `latest` is the newest STABLE RELEASE, not the newest build of the
-            # branch, which has its own tag above (constitution 1.33.0, RT#1559).
-            # A prerelease is not what `latest` means, so it is excluded by the
-            # hyphen: SemVer puts every prerelease identifier after one.
-            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Containerfile
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Run Trivy vulnerability scanner
-        continue-on-error: true
-        if: github.event_name != 'pull_request'
-        uses: aquasecurity/[email protected]
-        with:
-          image-ref: ${{ env.QUAY_IMAGE }}:${{ steps.meta.outputs.version }}
-          format: "table"
-          exit-code: "0"
-          severity: "CRITICAL,HIGH"
-          version: "v0.68.2"
-
-  build-and-push-ghcr:
-    runs-on: ubuntu-latest
-    needs: build-and-push-quay
-    if: github.event_name != 'pull_request'
+  container:
+    uses: crunchtools/constitution/.github/workflows/[email protected]
     permissions:
       contents: read
-      packages: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ github.token }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v6
-        with:
-          images: ${{ env.GHCR_IMAGE }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            # `latest` is the newest STABLE RELEASE, not the newest build of the
-            # branch, which has its own tag above (constitution 1.33.0, RT#1559).
-            # A prerelease is not what `latest` means, so it is excluded by the
-            # hyphen: SemVer puts every prerelease identifier after one.
-            type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref_name, 'v') && !contains(github.ref_name, '-') }}
-
-      - name: Build and push
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Containerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
+      pull-requests: read
+    with:
+      image: quay.io/crunchtools/mcp-wordpress
+      boot: mcp
+      # Dummy settings: config loads at startup, no request reaches them.
+      boot-env: |
+        WORDPRESS_URL=https://example.invalid
+        WORDPRESS_USERNAME=gate-dummy
+        WORDPRESS_APP_PASSWORD=gate-dummy-gate-dummy
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.31.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.39.1

.github/workflows/security.yml

@@ -21,32 +21,7 @@ jobs:
     permissions:
       contents: read
       issues: write
-    uses: crunchtools/constitution/.github/workflows/[email protected]
-
-  container-scan:
-    name: Container Security Scan
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Build container image
-        run: |
-          docker build -t mcp-wordpress:scan -f Containerfile .
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/[email protected]
-        with:
-          image-ref: "mcp-wordpress:scan"
-          format: "sarif"
-          output: "trivy-results.sarif"
-          severity: "CRITICAL,HIGH"
-
-      - name: Upload Trivy scan results
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: "trivy-results.sarif"
+    uses: crunchtools/constitution/.github/workflows/[email protected]
 
   codeql:
     name: CodeQL Analysis

.specify/memory/constitution.md

@@ -4,7 +4,7 @@
 > **Ratified:** 2026-03-03
 > **Amended:** 2026-11-08
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.36.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.39.1
 > **Profile:** MCP Server
 
 This file holds what is specific to mcp-wordpress. The fleet rules and the