feat(container): add UBI 10 image with scan-gated GHCR publish workflow - #7
Merged
Conversation
jonpspri
force-pushed
the
container-build
branch
from
September 1, 2026 12:24
a0c720c to
b71c1bc
Compare
Signed-off-by: Jonathan Springer <jps@s390x.com>
Signed-off-by: Jonathan Springer <jps@s390x.com>
Signed-off-by: Jonathan Springer <jps@s390x.com>
Add .lockgen.in (build-backend seeds referenced in the lock's via-lines) and a CONTRIBUTING section with the exact regenerate command. Correct the lock header: --python-version 3.12 is required - without it uv omits typing-extensions (an anyio requirement on Python <3.13) and the image build fails pip check. Verified: the documented command with the recorded cutoff reproduces the committed lock body byte-for-byte. Signed-off-by: Jonathan Springer <jps@s390x.com>
A dispatch from main publishes exactly like a push to main (the job-level condition passes and tags compute normally); the previous comment claimed dispatch never publishes. Signed-off-by: Jonathan Springer <jps@s390x.com>
python-json-logger moved JsonFormatter from pythonjsonlogger.jsonlogger to pythonjsonlogger.json; the old shim emits a DeprecationWarning on every import. Signed-off-by: Jonathan Springer <jps@s390x.com>
jonpspri
force-pushed
the
container-build
branch
from
September 11, 2026 13:36
ba3d651 to
94356c4
Compare
Documents the DCO sign-off requirement, Conventional Commits, uv-based setup, CI check commands, testing conventions (integration marker and its silent skip), and the repo's import-section style. Signed-off-by: Jonathan Springer <jps@s390x.com>
…race mcp SDK 2.x (pulled in by fastmcp>=4.0.0) intermittently returns from the streamable-HTTP ASGI app before sending the final SSE body chunk under CPU contention; uvicorn aborts the connection and the client's initialize POST fails with 'incomplete chunked read'. CI history shows the regression window exactly (last green: fastmcp 3.4.7/mcp 1.29.1; first red: fastmcp 4.0.0/mcp 2.1.1, all else identical), and a container A/B under CPU contention confirms causation: 24/25 failures on mcp 2.2.0 vs 0/25 on mcp 1.30.0 with identical sse-starlette. Pin fastmcp>=3.4.7,<4 and regenerate uv.lock until the SDK race is fixed upstream. Signed-off-by: Jonathan Springer <jps@s390x.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Delivers the F3 container-image work for
mcp-reverse-proxy:Containerfile(UBI 10 builder/runtime multi-stage), pinnedrequirements-container.txt(353 locked deps), and a minimal.dockerignorebuild context..github/workflows/container.yml: scan-gated, immutable-tag publish toghcr.io/contextforge-org/mcp-reverse-proxywith Trivy scanning, Buildx provenance, and Sigstore signing; publish is restricted tomainpushes andv*tags only.gh attestation verify-equivalent Sigstore checks; CI reproduces the same attested build.README.mdandUSER_README.mddocument published-image usage.Three commits, all DCO-signed:
c9e9e92feat(container): add UBI 10 builder-runtime Containerfile3296d50ci(container): add scan-gated ghcr.io publish workflow0009441docs(container): document published image usagePublish guard
The
publishjob is guarded off for pull requests:PRs cannot run publish. On
pull_requestonlyBuild + smoke test (no push)executes — no registry login, no push, no signing, no tagging.Testing (local QA, all passed)
aquasec/trivy@sha256:62b1e6…, v0.74.0).Signed-off-bytrailers.Independent reviewers F1, F2, and F4 returned APPROVE on this branch.