Pin all three Dockerfile base images to their SHA256 digests to resolve
code scanning alerts for unpinned Docker images. Dependabot docker
ecosystem is already configured and will keep these digests up to date.
- node:20-alpine (alert #14)
- golang:1.25.7-alpine (alert #15)
- gcr.io/distroless/base-debian12 (proactive)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* PoC full flow (hello world example)
* add avatar resource domain
* add postmessage logic and richer UI
* add create issue ui
* update ui for issue creatioon
* fix
* ignore banner
* update docs after rebase
* update toolsnap for get_me
* new UI changes
* update docs
* update workflows that need ui build
* add UI diff
* fix build ui step for windows runners to use git bash
* fix UI diff
* refactor issue creation UI
* add AvatarWithFallback component and update UserCard to use it; enhance CreateIssueApp to manage existing issue data
* fix formatting of button labels
* add create pull request functionality with UI support and insiders
* update docs
* add test for insiders mode handling in ServerTool schema
* remove `show_ui` param for now
* make insiders mode metadata stripping generic
* remove ui diff
* fix CI
* remove redundant mention of old app name
* add node types to fix ide issues for ts code
* remove unused TriangleDownIcon import
* update @primer/behaviors and electron-to-chromium versions in package-lock.json
* add check to ensure base and head are not the same when creating a new PR
* remove old show_ui
* fix gitignore for dist so builds dont break
* add tests for insiders mode handling and metadata stripping in ServerTool
* remove unused state and components from CreatePRApp
* fix ui build
* update docker build to fix npm issue
* remove reference to show_ui
* allow insiders to work for non-ui features
* formalise insiders inventory support
* update docs
* fix overflow issues and replace pull request dropdown with matching UI from dotcom
* fix createpullrequest test
* consolidate fetching tools under `ui_get` tool to remove toolset deps
* fix issue data prefill in issue_write form
* fix link component when updating issue
* fix avatar URL
* fix broken issue update logic
* remove dbg
* fix for new GetFlags
* revert to original required fields for create_pull_request
* fix for UI form submission
* Simplify MCP App UIs for basic branch
Remove advanced features to be kept in mcp-ui-apps-advanced:
- Strip labels, assignees, milestones, issue types, repo picker from issue-write
- Strip repo picker, branch selectors from pr-write
- Delete ui_get tool (ui_tools.go, ui_tools_test.go, ui_get.snap)
- Remove UIGet registration from tools.go
Basic forms retain: title, body, submit with _ui_submitted,
draft/regular split button (PR), MarkdownEditor, and SuccessView.
* Fix header spacing in issue-write and pr-write UIs
Add proper spacing between icon, title text, and repo name in the
header bar for both issue-write and create-pull-request forms.
* fix UI spacing
* Add insiders flag to User-Agent header
When InsidersMode is enabled, append '(insiders)' to the User-Agent
string sent with GitHub API requests, enabling server-side adoption
tracking.
* address ui feedback
* added ui/no-ui support
* improve active state UI for write and preview button. make padding consistent in textarea
* return to prev non ui check
* use hardcoded client name check for ui support
* linter fixes
* merge fix
* linter fix 2
---------
Co-authored-by: tommaso-moro <tommaso-moro@github.com>
* Pin go-licenses to v2.0.1 for reproducible builds
Fixes code scanning alerts #10 and #11 by removing the @latest
version for local development and using the pinned v2.0.1 version
consistently across all environments.
This ensures deterministic builds and addresses the CWE-494
'Download of Code Without Integrity Check' security concern.
* Build full package in Dockerfile to include all commands
* fix: use ENTRYPOINT and CMD for proper argument handling
- Change from CMD to ENTRYPOINT + CMD pattern for better Docker practices
- ENTRYPOINT sets the executable that always runs
- CMD provides default arguments that can be overridden
- This allows container runtimes to properly append additional arguments
- Fixes issues with argument passing in container orchestration tools
Before: CMD ["./github-mcp-server", "stdio"]
After: ENTRYPOINT ["./github-mcp-server"] + CMD ["stdio"]
* address review feedback: use absolute path and improve comments
* Optimize Docker build with bind mounts
This commit further optimize the Docker builds on top of PR #92 with:
1. Add .dockerignore file to exclude non-source code files [1].
2. Use Alpine image variant for build stage to reduce download size.
golang:1.23.7-alpine is 200 MB smaller than golang:1.23.7 [2][3].
3. Replace COPY instruction with RUN --mount=type=bind. Bind mounts do
not add unnecessary layers to the cache [4][5].
[1]: https://docs.docker.com/build-cloud/optimization/#dockerignore-files
[2]: https://hub.docker.com/layers/library/golang/1.23.7-alpine/images/sha256-333d4ba78773b3a3ae9cf2cff8962df56effc5c9481faa355f211abf2baf175c
[3]: https://hub.docker.com/layers/library/golang/1.23.7/images/sha256-2087a99c3235972660b3d35c1564d9d1a3f639dcace9c790acbabc7e938d1570
[4]: https://docs.docker.com/build/building/best-practices/#add-or-copy
[5]: https://docs.docker.com/build/cache/optimize/#use-bind-mounts
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Remove `go mod download` step
`go build` will automatically download module dependencies. In many
cases, that is a much smaller set of modules than what is downloaded by
`go mod download`.
Size of GOMODCACHE with `go mod download:
$ go clean -i -r -cache -modcache
$ go mod download
$ du -sh ~/go/pkg/mod
186M /home/jun/go/pkg/mod
Size of GOMODCACHE with `go build`:
$ go clean -i -r -cache -modcache
$ CGO_ENABLED=0 go build -ldflags="-s -w" cmd/github-mcp-server/main.go
go: downloading github.com/spf13/viper v1.20.1
go: downloading github.com/mark3labs/mcp-go v0.18.0
go: downloading github.com/google/go-github/v69 v69.2.0
go: downloading github.com/sirupsen/logrus v1.9.3
go: downloading github.com/spf13/cobra v1.9.1
go: downloading golang.org/x/sys v0.31.0
go: downloading github.com/spf13/afero v1.14.0
go: downloading github.com/fsnotify/fsnotify v1.8.0
go: downloading github.com/spf13/cast v1.7.1
go: downloading github.com/go-viper/mapstructure/v2 v2.2.1
go: downloading github.com/subosito/gotenv v1.6.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading github.com/spf13/pflag v1.0.6
go: downloading github.com/pelletier/go-toml/v2 v2.2.3
go: downloading github.com/sagikazarmark/locafero v0.9.0
go: downloading golang.org/x/text v0.23.0
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/yosida95/uritemplate/v3 v3.0.2
go: downloading github.com/sourcegraph/conc v0.3.0
go: downloading github.com/google/go-querystring v1.1.0
$ du -sh ~/go/pkg/mod
80M /home/jun/go/pkg/mod
Reference: https://stackoverflow.com/a/68172023/7902371
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
dependabot[bot]