From 1f172734fa45470e97bdd4da8c8e88ee5eaa5ccf Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 20:55:11 +0800 Subject: [PATCH 01/10] docker-build.yml --- .github/workflows/docker-build.yml | 100 +++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 .github/workflows/docker-build.yml diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml new file mode 100644 index 00000000..6b69aeda --- /dev/null +++ b/.github/workflows/docker-build.yml @@ -0,0 +1,100 @@ +# Docker Build - Build and push image to GitHub Container Registry +# +# This workflow builds the Docker image on every push to main +# and pushes it to GitHub Container Registry (ghcr.io). +# +# Usage: +# - Image is tagged with: latest, commit SHA, and Git tag (if present) +# - Access packages at: https://github.com/OWNER/REPOSITORY/pkgs/container/REPO_NAME +# +# Required secrets: +# - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR + +name: Docker Build + +on: + push: + branches: [main] + tags: ["v*"] + pull_request: + branches: [main] + paths: + - Dockerfile + - requirements.txt + - "**.py" + workflow_dispatch: + inputs: + tag: + description: "Custom tag for the image (optional)" + required: false + default: "" + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Container Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha,prefix=,suffix=,format=short + type=raw,value=latest,enable={{is_default_branch}} + type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} + + - name: Build and push Docker image + id: push + uses: docker/build-push-action@v6 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64 + + - name: Generate artifact attestation + if: github.event_name != 'pull_request' + uses: actions/attest-build-provenance@v2 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true + + - name: Print image digest + if: github.event_name != 'pull_request' + run: | + echo "✅ Image pushed successfully!" + echo "📦 Digest: ${{ steps.push.outputs.digest }}" + echo "🐳 Tags:" + echo "${{ steps.meta.outputs.tags }}" From 600e0c484b2b0bb9239bff896bfa73c3552370e5 Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 21:06:06 +0800 Subject: [PATCH 02/10] ci(docker): add conditional login and multi-arch support --- .github/workflows/docker-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 6b69aeda..14fea76b 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -50,6 +50,7 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry + if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -81,7 +82,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - platforms: linux/amd64 + platforms: linux/amd64,linux/arm64 - name: Generate artifact attestation if: github.event_name != 'pull_request' From 9f0ccac2e1a5f03713b242f05f2627e885d1bd73 Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 21:11:58 +0800 Subject: [PATCH 03/10] docker-build.yml --- .github/workflows/docker-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 14fea76b..4138f666 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -22,6 +22,7 @@ on: - Dockerfile - requirements.txt - "**.py" + - ".github/workflows/docker-build.yml" workflow_dispatch: inputs: tag: @@ -68,7 +69,7 @@ jobs: type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} - type=sha,prefix=,suffix=,format=short + type=sha,prefix=sha-,suffix=,format=short type=raw,value=latest,enable={{is_default_branch}} type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} From 6ae928ac83a785c290418b1bf2f2c6533889a008 Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 22:43:31 +0800 Subject: [PATCH 04/10] ci(mcp-sse-server): add Docker build workflow Add GitHub Actions workflow to build and push mcp-sse-server Docker image to GHCR. Triggered on changes to mcp-sse-server/** directory. Co-Authored-By: Claude Sonnet 4.6 --- .../workflows/docker-build-mcp-sse-server.yml | 103 ++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 .github/workflows/docker-build-mcp-sse-server.yml diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml new file mode 100644 index 00000000..250ca749 --- /dev/null +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -0,0 +1,103 @@ +# Docker Build for MCP SSE Server - Build and push image to GitHub Container Registry +# +# This workflow builds the mcp-sse-server Docker image on every push to main +# and pushes it to GitHub Container Registry (ghcr). +# +# Usage: +# - Image is tagged with: latest, commit SHA, and Git tag (if present) +# - Access packages at: https://github.com/OWNER/REPOSITORY/pkgs/container/REPO_NAME +# +# Required secrets: +# - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR + +name: Docker Build (MCP SSE Server) + +on: + push: + branches: [main] + tags: ["v*"] + paths: + - "mcp-sse-server/**" + - ".github/workflows/docker-build-mcp-sse-server.yml" + pull_request: + branches: [main] + paths: + - "mcp-sse-server/**" + - ".github/workflows/docker-build-mcp-sse-server.yml" + workflow_dispatch: + inputs: + tag: + description: "Custom tag for the image (optional)" + required: false + default: "" + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }}/mcp-sse-server + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Container Registry + if: github.event_name != 'pull_request' + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha,prefix=sha-,suffix=,format=short + type=raw,value=latest,enable={{is_default_branch}} + type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} + + - name: Build and push Docker image + id: push + uses: docker/build-push-action@v6 + with: + context: ./mcp-sse-server + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64,linux/arm64 + + - name: Generate artifact attestation + if: github.event_name != 'pull_request' + uses: actions/attest-build-provenance@v2 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true + + - name: Print image digest + if: github.event_name != 'pull_request' + run: | + echo "✅ MCP SSE Server image pushed successfully!" + echo "📦 Digest: ${{ steps.push.outputs.digest }}" + echo "🐳 Tags:" + echo "${{ steps.meta.outputs.tags }}" From 3f959dff293b5bb3b80cae98fa3842f59b7405dc Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 22:53:04 +0800 Subject: [PATCH 05/10] ci(mcp-sse-server): fix workflow triggers and permissions - Split push.tags into separate workflow (tags ignore paths filters) - Separate build (PR) and publish (non-PR) jobs with least privilege - Build job: contents:read only, no push - Publish job: elevated permissions for GHCR push and attestation Co-Authored-By: Claude Sonnet 4.6 --- .../docker-build-mcp-sse-server-tags.yml | 77 +++++++++++++++++++ .../workflows/docker-build-mcp-sse-server.yml | 46 ++++++++--- 2 files changed, 114 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/docker-build-mcp-sse-server-tags.yml diff --git a/.github/workflows/docker-build-mcp-sse-server-tags.yml b/.github/workflows/docker-build-mcp-sse-server-tags.yml new file mode 100644 index 00000000..ac414ffd --- /dev/null +++ b/.github/workflows/docker-build-mcp-sse-server-tags.yml @@ -0,0 +1,77 @@ +# Docker Build for MCP SSE Server (Tags) - Build and push on version tags +# +# This workflow builds the mcp-sse-server Docker image when version tags are pushed. +# Tag events are handled separately because GitHub Actions ignores paths filters for tags. +# +# Required secrets: +# - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR + +name: Docker Build (MCP SSE Server - Tags) + +on: + push: + tags: ["v*"] + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }}/mcp-sse-server + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Log in to Container Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=sha,prefix=sha-,suffix=,format=short + + - name: Build and push Docker image + id: push + uses: docker/build-push-action@v6 + with: + context: ./mcp-sse-server + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64,linux/arm64 + + - name: Generate artifact attestation + uses: actions/attest-build-provenance@v2 + with: + subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true + + - name: Print image digest + run: | + echo "✅ MCP SSE Server image pushed successfully!" + echo "📦 Digest: ${{ steps.push.outputs.digest }}" + echo "🐳 Tags:" + echo "${{ steps.meta.outputs.tags }}" diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index 250ca749..bd3bc8a2 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -15,7 +15,6 @@ name: Docker Build (MCP SSE Server) on: push: branches: [main] - tags: ["v*"] paths: - "mcp-sse-server/**" - ".github/workflows/docker-build-mcp-sse-server.yml" @@ -38,6 +37,42 @@ env: jobs: build: runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=sha,prefix=sha-,suffix=,format=short + type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} + + - name: Build Docker image + uses: docker/build-push-action@v6 + with: + context: ./mcp-sse-server + push: false + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64,linux/arm64 + + publish: + runs-on: ubuntu-latest + needs: build + if: github.event_name != 'pull_request' permissions: contents: read packages: write @@ -52,7 +87,6 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry - if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -66,10 +100,6 @@ jobs: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} type=sha,prefix=sha-,suffix=,format=short type=raw,value=latest,enable={{is_default_branch}} type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} @@ -79,7 +109,7 @@ jobs: uses: docker/build-push-action@v6 with: context: ./mcp-sse-server - push: ${{ github.event_name != 'pull_request' }} + push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha @@ -87,7 +117,6 @@ jobs: platforms: linux/amd64,linux/arm64 - name: Generate artifact attestation - if: github.event_name != 'pull_request' uses: actions/attest-build-provenance@v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -95,7 +124,6 @@ jobs: push-to-registry: true - name: Print image digest - if: github.event_name != 'pull_request' run: | echo "✅ MCP SSE Server image pushed successfully!" echo "📦 Digest: ${{ steps.push.outputs.digest }}" From 3657e84ebfbc5a2bb8b22816dc33bc9a6e07d7b0 Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 23:17:16 +0800 Subject: [PATCH 06/10] ci(mcp-sse-server): add concurrency control to prevent race conditions - Tags workflow: serialize runs with cancel-in-progress: false to queue - Branch/PR workflow: cancel in-progress runs for same ref to save resources Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/docker-build-mcp-sse-server-tags.yml | 4 ++++ .github/workflows/docker-build-mcp-sse-server.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/docker-build-mcp-sse-server-tags.yml b/.github/workflows/docker-build-mcp-sse-server-tags.yml index ac414ffd..855a97d6 100644 --- a/.github/workflows/docker-build-mcp-sse-server-tags.yml +++ b/.github/workflows/docker-build-mcp-sse-server-tags.yml @@ -12,6 +12,10 @@ on: push: tags: ["v*"] +concurrency: + group: docker-build-mcp-sse-server-tags + cancel-in-progress: false + env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }}/mcp-sse-server diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index bd3bc8a2..8d6670a2 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -24,6 +24,10 @@ on: - "mcp-sse-server/**" - ".github/workflows/docker-build-mcp-sse-server.yml" workflow_dispatch: + +concurrency: + group: docker-build-mcp-sse-server-${{ github.ref }} + cancel-in-progress: true inputs: tag: description: "Custom tag for the image (optional)" From 6de27b0568ebab05824bd7645270814d9fcc8d21 Mon Sep 17 00:00:00 2001 From: sakullla Date: Thu, 26 Feb 2026 23:47:57 +0800 Subject: [PATCH 07/10] fix(ci): correct mcp sse docker workflow yaml indentation --- .github/workflows/docker-build-mcp-sse-server.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index 8d6670a2..9ea57c82 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -24,16 +24,16 @@ on: - "mcp-sse-server/**" - ".github/workflows/docker-build-mcp-sse-server.yml" workflow_dispatch: - -concurrency: - group: docker-build-mcp-sse-server-${{ github.ref }} - cancel-in-progress: true inputs: tag: description: "Custom tag for the image (optional)" required: false default: "" +concurrency: + group: docker-build-mcp-sse-server-${{ github.ref }} + cancel-in-progress: true + env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }}/mcp-sse-server From bdc5e22a14e1db29d65ce860f8c2bb2cc453a87c Mon Sep 17 00:00:00 2001 From: sakullla Date: Fri, 6 Mar 2026 19:55:49 +0800 Subject: [PATCH 08/10] ci(workflows): optimize docker build triggers and multi-arch strategy --- .../docker-build-mcp-sse-server-tags.yml | 81 ------------------- .../workflows/docker-build-mcp-sse-server.yml | 24 +++--- .github/workflows/docker-build.yml | 29 ++++--- 3 files changed, 28 insertions(+), 106 deletions(-) delete mode 100644 .github/workflows/docker-build-mcp-sse-server-tags.yml diff --git a/.github/workflows/docker-build-mcp-sse-server-tags.yml b/.github/workflows/docker-build-mcp-sse-server-tags.yml deleted file mode 100644 index 855a97d6..00000000 --- a/.github/workflows/docker-build-mcp-sse-server-tags.yml +++ /dev/null @@ -1,81 +0,0 @@ -# Docker Build for MCP SSE Server (Tags) - Build and push on version tags -# -# This workflow builds the mcp-sse-server Docker image when version tags are pushed. -# Tag events are handled separately because GitHub Actions ignores paths filters for tags. -# -# Required secrets: -# - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR - -name: Docker Build (MCP SSE Server - Tags) - -on: - push: - tags: ["v*"] - -concurrency: - group: docker-build-mcp-sse-server-tags - cancel-in-progress: false - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }}/mcp-sse-server - -jobs: - publish: - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - attestations: write - id-token: write - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to Container Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} - type=sha,prefix=sha-,suffix=,format=short - - - name: Build and push Docker image - id: push - uses: docker/build-push-action@v6 - with: - context: ./mcp-sse-server - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 - - - name: Generate artifact attestation - uses: actions/attest-build-provenance@v2 - with: - subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - subject-digest: ${{ steps.push.outputs.digest }} - push-to-registry: true - - - name: Print image digest - run: | - echo "✅ MCP SSE Server image pushed successfully!" - echo "📦 Digest: ${{ steps.push.outputs.digest }}" - echo "🐳 Tags:" - echo "${{ steps.meta.outputs.tags }}" diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index 9ea57c82..fb26a2c1 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -1,11 +1,7 @@ -# Docker Build for MCP SSE Server - Build and push image to GitHub Container Registry +# Docker Build for MCP SSE Server - Validate and publish image to GitHub Container Registry # -# This workflow builds the mcp-sse-server Docker image on every push to main -# and pushes it to GitHub Container Registry (ghcr). -# -# Usage: -# - Image is tagged with: latest, commit SHA, and Git tag (if present) -# - Access packages at: https://github.com/OWNER/REPOSITORY/pkgs/container/REPO_NAME +# This workflow validates the mcp-sse-server Docker image for PRs/main changes and +# publishes a container image for main pushes, version tags, and manual dispatches. # # Required secrets: # - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR @@ -15,6 +11,7 @@ name: Docker Build (MCP SSE Server) on: push: branches: [main] + tags: ["v*"] paths: - "mcp-sse-server/**" - ".github/workflows/docker-build-mcp-sse-server.yml" @@ -71,7 +68,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 + platforms: linux/amd64 publish: runs-on: ubuntu-latest @@ -104,6 +101,9 @@ jobs: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} type=sha,prefix=sha-,suffix=,format=short type=raw,value=latest,enable={{is_default_branch}} type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} @@ -118,7 +118,7 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 + platforms: ${{ (startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch') && 'linux/amd64,linux/arm64' || 'linux/amd64' }} - name: Generate artifact attestation uses: actions/attest-build-provenance@v2 @@ -129,7 +129,7 @@ jobs: - name: Print image digest run: | - echo "✅ MCP SSE Server image pushed successfully!" - echo "📦 Digest: ${{ steps.push.outputs.digest }}" - echo "🐳 Tags:" + echo "MCP SSE Server image pushed successfully!" + echo "Digest: ${{ steps.push.outputs.digest }}" + echo "Tags:" echo "${{ steps.meta.outputs.tags }}" diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 4138f666..aab0af57 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -1,10 +1,10 @@ # Docker Build - Build and push image to GitHub Container Registry # -# This workflow builds the Docker image on every push to main -# and pushes it to GitHub Container Registry (ghcr.io). +# This workflow validates Docker builds for container-related changes and +# publishes release/manual images to GitHub Container Registry (ghcr.io). # # Usage: -# - Image is tagged with: latest, commit SHA, and Git tag (if present) +# - Release images are tagged from git refs/semver metadata # - Access packages at: https://github.com/OWNER/REPOSITORY/pkgs/container/REPO_NAME # # Required secrets: @@ -16,12 +16,15 @@ on: push: branches: [main] tags: ["v*"] + paths: + - Dockerfile + - requirements.txt + - ".github/workflows/docker-build.yml" pull_request: branches: [main] paths: - Dockerfile - requirements.txt - - "**.py" - ".github/workflows/docker-build.yml" workflow_dispatch: inputs: @@ -51,7 +54,7 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry - if: github.event_name != 'pull_request' + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -73,20 +76,20 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} - - name: Build and push Docker image + - name: Build and optionally push Docker image id: push uses: docker/build-push-action@v6 with: context: . - push: ${{ github.event_name != 'pull_request' }} + push: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - platforms: linux/amd64,linux/arm64 + platforms: ${{ (startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch') && 'linux/amd64,linux/arm64' || 'linux/amd64' }} - name: Generate artifact attestation - if: github.event_name != 'pull_request' + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' uses: actions/attest-build-provenance@v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -94,9 +97,9 @@ jobs: push-to-registry: true - name: Print image digest - if: github.event_name != 'pull_request' + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' run: | - echo "✅ Image pushed successfully!" - echo "📦 Digest: ${{ steps.push.outputs.digest }}" - echo "🐳 Tags:" + echo "Image pushed successfully!" + echo "Digest: ${{ steps.push.outputs.digest }}" + echo "Tags:" echo "${{ steps.meta.outputs.tags }}" From c1b8bee47dbcd1e6fa923ef9e7ad0933d1f8f46c Mon Sep 17 00:00:00 2001 From: sakullla Date: Fri, 6 Mar 2026 20:09:33 +0800 Subject: [PATCH 09/10] ci(workflows): align mcp sse docker trigger policy --- .../workflows/docker-build-mcp-sse-server.yml | 60 ++++--------------- 1 file changed, 13 insertions(+), 47 deletions(-) diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index fb26a2c1..72e94b1f 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -1,7 +1,7 @@ -# Docker Build for MCP SSE Server - Validate and publish image to GitHub Container Registry +# Docker Build for MCP SSE Server - Build and push image to GitHub Container Registry # -# This workflow validates the mcp-sse-server Docker image for PRs/main changes and -# publishes a container image for main pushes, version tags, and manual dispatches. +# This workflow validates Docker builds for container-related changes and +# publishes release/manual images to GitHub Container Registry (ghcr.io). # # Required secrets: # - GITHUB_TOKEN (auto-provided): Used to authenticate with GHCR @@ -13,12 +13,14 @@ on: branches: [main] tags: ["v*"] paths: - - "mcp-sse-server/**" + - "mcp-sse-server/Dockerfile" + - "mcp-sse-server/package.json" - ".github/workflows/docker-build-mcp-sse-server.yml" pull_request: branches: [main] paths: - - "mcp-sse-server/**" + - "mcp-sse-server/Dockerfile" + - "mcp-sse-server/package.json" - ".github/workflows/docker-build-mcp-sse-server.yml" workflow_dispatch: inputs: @@ -27,10 +29,6 @@ on: required: false default: "" -concurrency: - group: docker-build-mcp-sse-server-${{ github.ref }} - cancel-in-progress: true - env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }}/mcp-sse-server @@ -38,42 +36,6 @@ env: jobs: build: runs-on: ubuntu-latest - permissions: - contents: read - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=sha,prefix=sha-,suffix=,format=short - type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} - - - name: Build Docker image - uses: docker/build-push-action@v6 - with: - context: ./mcp-sse-server - push: false - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - platforms: linux/amd64 - - publish: - runs-on: ubuntu-latest - needs: build - if: github.event_name != 'pull_request' permissions: contents: read packages: write @@ -88,6 +50,7 @@ jobs: uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -101,6 +64,7 @@ jobs: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch + type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} @@ -108,12 +72,12 @@ jobs: type=raw,value=latest,enable={{is_default_branch}} type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }} - - name: Build and push Docker image + - name: Build and optionally push Docker image id: push uses: docker/build-push-action@v6 with: context: ./mcp-sse-server - push: true + push: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha @@ -121,6 +85,7 @@ jobs: platforms: ${{ (startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch') && 'linux/amd64,linux/arm64' || 'linux/amd64' }} - name: Generate artifact attestation + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' uses: actions/attest-build-provenance@v2 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -128,6 +93,7 @@ jobs: push-to-registry: true - name: Print image digest + if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' run: | echo "MCP SSE Server image pushed successfully!" echo "Digest: ${{ steps.push.outputs.digest }}" From c286658d5de1521d57ad0cd8583cb339f573c8fa Mon Sep 17 00:00:00 2001 From: Jack Arturo Date: Sun, 8 Mar 2026 01:24:42 +0530 Subject: [PATCH 10/10] fix(ci): trigger mcp sse docker build on lockfile changes --- .github/workflows/docker-build-mcp-sse-server.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/docker-build-mcp-sse-server.yml b/.github/workflows/docker-build-mcp-sse-server.yml index 72e94b1f..dc787bfd 100644 --- a/.github/workflows/docker-build-mcp-sse-server.yml +++ b/.github/workflows/docker-build-mcp-sse-server.yml @@ -15,12 +15,14 @@ on: paths: - "mcp-sse-server/Dockerfile" - "mcp-sse-server/package.json" + - "mcp-sse-server/package-lock.json" - ".github/workflows/docker-build-mcp-sse-server.yml" pull_request: branches: [main] paths: - "mcp-sse-server/Dockerfile" - "mcp-sse-server/package.json" + - "mcp-sse-server/package-lock.json" - ".github/workflows/docker-build-mcp-sse-server.yml" workflow_dispatch: inputs: