chore: update Authlete IdP OpenAPI specification (#82) #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Build and Publish | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'Dockerfile' | |
| - 'docker-compose.yml' | |
| - '.dockerignore' | |
| - 'src/**' | |
| - 'main.py' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| security-events: write | |
| jobs: | |
| docker-build-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 | |
| with: | |
| platforms: arm64,amd64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| with: | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Test Docker build (AMD64) | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| push: false | |
| tags: authlete-mcp:test-amd64 | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| BUILDKIT_INLINE_CACHE=1 | |
| - name: Test Docker build (ARM64) | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/arm64 | |
| push: false | |
| tags: authlete-mcp:test-arm64 | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| BUILDKIT_INLINE_CACHE=1 | |
| - name: Test container startup (AMD64 only) | |
| run: | | |
| echo "Testing container startup on AMD64 platform..." | |
| # Build the image locally for AMD64 only (for testing) | |
| docker build -t authlete-mcp:test --platform linux/amd64 . | |
| # Test Python environment and module imports | |
| echo "Testing Python environment..." | |
| docker run --rm --platform linux/amd64 --entrypoint="" authlete-mcp:test /usr/bin/python3.11 -c " | |
| import sys | |
| print('✅ Python version:', sys.version) | |
| print('✅ Platform:', sys.platform) | |
| # Test essential package imports | |
| packages = ['duckdb', 'pydantic', 'httpx', 'mcp'] | |
| for pkg in packages: | |
| try: | |
| __import__(pkg) | |
| print(f'✅ {pkg}: OK') | |
| except ImportError as e: | |
| print(f'❌ {pkg}: {e}') | |
| sys.exit(1) | |
| # Test application modules | |
| try: | |
| import src.authlete_mcp.server | |
| import src.authlete_mcp.tools.service_tools | |
| import src.authlete_mcp.tools.client_tools | |
| print('✅ All application modules imported successfully') | |
| except Exception as e: | |
| print(f'❌ Module import error: {e}') | |
| sys.exit(1) | |
| " | |
| # Test actual container startup (with timeout) | |
| echo "Testing container startup with MCP server..." | |
| timeout 10s docker run --rm --platform linux/amd64 \ | |
| -e ORGANIZATION_ACCESS_TOKEN="dummy_token" \ | |
| -e ORGANIZATION_ID="test_org" \ | |
| authlete-mcp:test 2>&1 | tee startup_log.txt & | |
| # Wait for the process to start and check logs | |
| sleep 3 | |
| if grep -q "Starting Authlete MCP Server" startup_log.txt; then | |
| echo "✅ Container starts successfully and shows expected log message" | |
| elif grep -q "INFO:" startup_log.txt; then | |
| echo "✅ Container starts successfully with INFO logs" | |
| else | |
| echo "⚠️ Container startup check completed (may need valid credentials for full startup)" | |
| fi | |
| - name: Check image size | |
| run: | | |
| echo "Checking Docker image size..." | |
| if docker images authlete-mcp:test --format "table {{.Size}}" | tail -n 1 > /dev/null 2>&1; then | |
| IMAGE_SIZE=$(docker images authlete-mcp:test --format "table {{.Size}}" | tail -n 1) | |
| echo "📏 Docker image size (AMD64): $IMAGE_SIZE" | |
| else | |
| echo "📏 Cross-platform images built successfully (size check skipped for multi-arch)" | |
| fi | |
| - name: Test Docker Compose | |
| run: | | |
| echo "Testing Docker Compose configuration..." | |
| # Create a dummy .env file for testing | |
| cat > .env << EOF | |
| ORGANIZATION_ACCESS_TOKEN=dummy_token_for_testing | |
| ORGANIZATION_ID=12345 | |
| EOF | |
| # Test docker-compose configuration | |
| docker compose config --quiet | |
| echo "✅ Docker Compose configuration is valid" | |
| docker-publish: | |
| runs-on: ubuntu-latest | |
| needs: docker-build-test | |
| if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 | |
| with: | |
| platforms: arm64,amd64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| with: | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Log in to Container Registry | |
| uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata | |
| id: meta | |
| uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-args: | | |
| BUILDKIT_INLINE_CACHE=1 | |
| - name: Generate deployment summary | |
| run: | | |
| echo "## Docker Image Published" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Registry:** ${{ env.REGISTRY }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**Image:** ${{ env.IMAGE_NAME }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**Tags:**" >> $GITHUB_STEP_SUMMARY | |
| echo '${{ steps.meta.outputs.tags }}' | while read tag; do | |
| echo "- \`$tag\`" >> $GITHUB_STEP_SUMMARY | |
| done | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Platforms:** linux/amd64, linux/arm64" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Usage" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY | |
| echo "# Pull the image (supports both AMD64 and ARM64)" >> $GITHUB_STEP_SUMMARY | |
| echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "# Run with environment variables" >> $GITHUB_STEP_SUMMARY | |
| echo "docker run -it --rm \\" >> $GITHUB_STEP_SUMMARY | |
| echo " -e ORGANIZATION_ACCESS_TOKEN=\\\$YOUR_TOKEN \\" >> $GITHUB_STEP_SUMMARY | |
| echo " ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "# For specific platform (optional)" >> $GITHUB_STEP_SUMMARY | |
| echo "docker run --platform linux/arm64 -it --rm \\" >> $GITHUB_STEP_SUMMARY | |
| echo " -e ORGANIZATION_ACCESS_TOKEN=\\\$YOUR_TOKEN \\" >> $GITHUB_STEP_SUMMARY | |
| echo " ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| docker-security-scan: | |
| runs-on: ubuntu-latest | |
| needs: docker-build-test | |
| if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4 | |
| with: | |
| platforms: arm64,amd64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4 | |
| with: | |
| platforms: linux/amd64,linux/arm64 | |
| - name: Build image for scanning (AMD64 only) | |
| uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| platforms: linux/amd64 | |
| load: true | |
| tags: authlete-mcp:scan | |
| cache-from: type=gha | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0 | |
| with: | |
| image-ref: 'authlete-mcp:scan' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Display Trivy scan results | |
| if: always() | |
| run: | | |
| echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ -f trivy-results.sarif ]; then | |
| echo "✅ Trivy vulnerability scan completed successfully" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**SARIF file generated**: \`trivy-results.sarif\`" >> $GITHUB_STEP_SUMMARY | |
| # Run Trivy again in table format for summary display | |
| docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ | |
| -v $(pwd):/workspace aquasec/trivy:latest image \ | |
| --format table --exit-code 0 authlete-mcp:scan >> trivy-summary.txt 2>&1 || true | |
| if [ -f trivy-summary.txt ]; then | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Vulnerability Summary:" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| head -50 trivy-summary.txt >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| else | |
| echo "❌ SARIF file not found" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@3b1a19a80ab047f35cbb237b5bd9bdc1e14f166c # v3 | |
| # Only upload SARIF in main branch pushes due to security-events permission requirements | |
| if: always() && github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| with: | |
| sarif_file: 'trivy-results.sarif' |