Skip to content

fix(db): Migration 22 transactional rewrite — stop startup-brick crash-loop (syslog-mcp-tfr0) #501

fix(db): Migration 22 transactional rewrite — stop startup-brick crash-loop (syslog-mcp-tfr0)

fix(db): Migration 22 transactional rewrite — stop startup-brick crash-loop (syslog-mcp-tfr0) #501

Workflow file for this run

name: Build and Push Docker Image
on:
push:
branches:
- main
tags:
- 'v*'
pull_request:
branches:
- main
workflow_dispatch:
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
# Gate: run CI checks before pushing an image for tag releases.
# On branch/PR pushes the Docker build also runs (for image smoke testing),
# but it skips `cargo publish`-equivalent ops. The check job is a no-op for
# non-tag pushes (it still runs, ensuring we never ship a broken image on tags).
check:
name: Pre-publish CI gate
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
components: rustfmt, clippy
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
- name: Check formatting
run: cargo fmt -- --check
- name: Clippy
run: cargo clippy -- -D warnings
- name: Run tests
run: cargo test
build-and-push:
runs-on: ubuntu-latest
needs: [check]
permissions:
contents: read
packages: write
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
- name: Log in to GitHub Container Registry
if: github.event_name != 'pull_request'
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=raw,value=latest,enable={{is_default_branch}}
type=sha
- name: Build and push Docker image
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
context: .
file: config/Dockerfile
platforms: linux/amd64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
sbom: true
provenance: mode=max
- name: Scan image for vulnerabilities
if: github.event_name != 'pull_request'
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security
if: github.event_name != 'pull_request'
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
- name: Install mcp-publisher
if: startsWith(github.ref, 'refs/tags/v')
run: |
curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
- name: Set version in server.json
if: startsWith(github.ref, 'refs/tags/v')
run: |
VERSION="${GITHUB_REF_NAME#v}"
jq --arg v "$VERSION" --arg img "ghcr.io/jmagar/cortex:${VERSION}" '
.version = $v |
.packages = [.packages[] | if .registryType == "oci" then .identifier = $img else . end]
' server.json > server.tmp && mv server.tmp server.json
- name: Authenticate to MCP Registry
if: startsWith(github.ref, 'refs/tags/v')
run: ./mcp-publisher login dns --domain tootie.tv --private-key ${{ secrets.MCP_PRIVATE_KEY }}
- name: Publish to MCP Registry
if: startsWith(github.ref, 'refs/tags/v')
run: ./mcp-publisher publish