ci: publish ghcr.io/esipfed/mc2 from main (gated by MCP conformance s… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Publish Container Image | |
| # Publishes ghcr.io/esipfed/mc2 from main (and version tags). | |
| # | |
| # Auth: the workflow-scoped GITHUB_TOKEN with `packages: write` — no PAT. | |
| # The first successful push auto-creates the GHCR package, links it to this | |
| # repository, and grants this repo's Actions write access. New GHCR packages | |
| # default to PRIVATE; a maintainer flips visibility to public once in the | |
| # package settings (Package settings → Danger Zone → Change visibility). | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| IMAGE_NAME: ghcr.io/esipfed/mc2 | |
| jobs: | |
| build-test-push: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout source | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Tag scheme: latest on main, vX.Y.Z + X.Y on version tags, | |
| # sha-<short> always (immutable pin for deployments). | |
| - name: Compute image metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix=sha- | |
| # Build first and `load` into the runner's daemon so the conformance | |
| # gates below run against the EXACT artifact we're about to ship | |
| # (same layers, same digest). Single-platform so `load` works. | |
| - name: Build image (load for the conformance gates) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| platforms: linux/amd64 | |
| tags: ${{ env.IMAGE_NAME }}:gate | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # ---------- MCP conformance + auth gates ---------- # | |
| # Run the acceptance suites INSIDE the freshly built image — against the | |
| # deployable artifact with the real runtime env (GDAL, mcp SDK, pyjwt). | |
| # Each suite runs in its own container so the Streamable-HTTP session | |
| # manager's once-per-process run() never collides. A failure here fails | |
| # the job and BLOCKS the push step below. | |
| - name: MCP conformance gate (tools/protocol/errors/root-path) | |
| run: | | |
| timeout 120 docker run --rm --workdir /app/server \ | |
| ${{ env.IMAGE_NAME }}:gate \ | |
| python tests/test_mcp.py | |
| - name: MCP authorization gate (§5b Resource Server) | |
| run: | | |
| timeout 120 docker run --rm --workdir /app/server \ | |
| ${{ env.IMAGE_NAME }}:gate \ | |
| python tests/test_mcp_auth.py | |
| - name: MCP standalone auth portal gate | |
| run: | | |
| timeout 120 docker run --rm --workdir /app/server \ | |
| ${{ env.IMAGE_NAME }}:gate \ | |
| python tests/test_portal.py | |
| # ---------- Push (main + tags only; PRs stop at the gates) ---------- # | |
| - name: Push image to GHCR | |
| if: github.event_name != 'pull_request' | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| platforms: linux/amd64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| - name: Image summary | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| { | |
| echo "### Published :package:" | |
| echo "" | |
| echo '```' | |
| echo "${{ steps.meta.outputs.tags }}" | |
| echo '```' | |
| echo "" | |
| echo "Pull with: \`docker pull ${{ env.IMAGE_NAME }}:latest\`" | |
| } >> "$GITHUB_STEP_SUMMARY" |