Skip to content

Add MCP Gateway v0.3.6 container pin to lock data and embedded pin maps #30408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
May 5, 2026
Merged

Add MCP Gateway v0.3.6 container pin to lock data and embedded pin maps #30408

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c55c8e
Initial plan
Copilot May 5, 2026
241826e
chore: pin gh-aw-mcpg v0.3.6 in actions lock
Copilot May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/patch-bump-mcpg-container-pin-v0-3-6.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions .github/aw/actions-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,11 @@
"digest": "sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.1@sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c"
},
"ghcr.io/github/gh-aw-mcpg:v0.3.6": {
"image": "ghcr.io/github/gh-aw-mcpg:v0.3.6",
"digest": "sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.6@sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c"
Comment on lines +313 to +316
},
"ghcr.io/github/github-mcp-server:v0.32.0": {
"image": "ghcr.io/github/github-mcp-server:v0.32.0",
"digest": "sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28",
Expand Down
10 changes: 10 additions & 0 deletions pkg/actionpins/actionpins_internal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,3 +68,13 @@ func TestGetContainerPin_ReturnsPinnedImage(t *testing.T) {
assert.NotEmpty(t, pin.Digest, "Expected digest to be populated")
assert.Contains(t, pin.PinnedImage, "@sha256:", "Expected pinned image to include digest")
}

func TestGetContainerPin_MCPGatewayV036IsPinned(t *testing.T) {
const image = "ghcr.io/github/gh-aw-mcpg:v0.3.6"

pin, ok := GetContainerPin(image)
require.True(t, ok, "Expected embedded container pin for %s", image)
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 Good use of require.True here — it short-circuits on failure and avoids a nil-pointer panic when pin is uninitialized. Consider also adding a t.Logf for the digest on success to aid future debugging.

assert.Equal(t, image, pin.Image, "Expected image name to match key")
assert.Equal(t, "sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c", pin.Digest, "Expected v0.3.6 digest to match")
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good test: verifies the digest and pinned image format for v0.3.6. Consider also testing that GetContainerPin returns ok=false for an unknown tag to ensure negative path coverage.

assert.Equal(t, image+"@sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c", pin.PinnedImage, "Expected pinned image to include v0.3.6 digest")
}
5 changes: 5 additions & 0 deletions pkg/actionpins/data/action_pins.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,11 @@
"digest": "sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.1@sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c"
},
"ghcr.io/github/gh-aw-mcpg:v0.3.6": {
"image": "ghcr.io/github/gh-aw-mcpg:v0.3.6",
"digest": "sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c",
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot May 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📌 Digest entry looks correct. One nit: verify that this digest (sha256:2bb8eef8...) is the canonical immutable digest from the container registry, not a manifest list digest — the tests will catch a mismatch, but double-checking prevents latent issues if the registry reuses tags.

"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.6@sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c"
},
"ghcr.io/github/github-mcp-server:v0.32.0": {
"image": "ghcr.io/github/github-mcp-server:v0.32.0",
"digest": "sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28",
Expand Down
5 changes: 5 additions & 0 deletions pkg/workflow/data/action_pins.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,11 @@
"digest": "sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.1@sha256:287fad0236959f3b3d9936ea1ef8d5b4f135ef2a5f5789713495cbbef191e60c"
},
"ghcr.io/github/gh-aw-mcpg:v0.3.6": {
"image": "ghcr.io/github/gh-aw-mcpg:v0.3.6",
"digest": "sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c",
"pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.6@sha256:2bb8eef86006a4c5963c55616a9c51c32f27bfdecb023b8aa6f91f6718d9171c"
},
"ghcr.io/github/github-mcp-server:v0.32.0": {
"image": "ghcr.io/github/github-mcp-server:v0.32.0",
"digest": "sha256:2763823c63bcca718ce53850a1d7fcf2f501ec84028394f1b63ce7e9f4f9be28",
Expand Down
Loading