11---
22title : Advanced CI/CD with ToolHive
3- description : Advanced CI/CD patterns for building and deploying MCP server containers with ToolHive.
3+ description :
4+ Advanced CI/CD patterns for building and deploying MCP server containers with
5+ ToolHive.
46---
57
6- This guide covers advanced CI/CD patterns for production environments using ToolHive's [ ` thv build ` ] ( ../reference/cli/thv_build.md ) command. These patterns include multi-architecture builds, supply chain security, and efficient change detection.
8+ This guide covers advanced CI/CD patterns for production environments using
9+ ToolHive's [ ` thv build ` ] ( ../reference/cli/thv_build.md ) command. These patterns
10+ include multi-architecture builds, supply chain security, and efficient change
11+ detection.
712
813## Prerequisites
914
@@ -29,25 +34,25 @@ jobs:
2934 runs-on : ubuntu-latest
3035 steps :
3136 - uses : actions/checkout@v4
32-
37+
3338 - name : Set up QEMU
3439 uses : docker/setup-qemu-action@v3
35-
40+
3641 - name : Set up Docker Buildx
3742 uses : docker/setup-buildx-action@v3
38-
43+
3944 - name : Install ToolHive
4045 run : |
4146 # Install ToolHive CLI (replace with your preferred installation method)
4247 # See: https://github.com/stacklok/toolhive/releases
4348 wget https://github.com/stacklok/toolhive/releases/latest/download/toolhive_linux_amd64.tar.gz
4449 tar -xzf toolhive_linux_amd64.tar.gz
4550 sudo install -m 0755 thv /usr/local/bin/
46-
51+
4752 - name : Generate Dockerfile
4853 run : |
4954 thv build --dry-run --output Dockerfile uvx://mcp-server-git
50-
55+
5156 - name : Build multi-arch container
5257 run : |
5358 docker buildx build \
5964
6065## Supply chain security
6166
62- Enhance security with SBOM generation, provenance attestation, and image signing:
67+ Enhance security with SBOM generation, provenance attestation, and image
68+ signing:
6369
6470` ` ` yaml
6571name : Secure Build
@@ -76,25 +82,25 @@ jobs:
7682 id-token : write
7783 steps :
7884 - uses : actions/checkout@v4
79-
85+
8086 - name : Install Cosign
8187 uses : sigstore/cosign-installer@v3
82-
88+
8389 - name : Set up Docker Buildx
8490 uses : docker/setup-buildx-action@v3
85-
91+
8692 - name : Install ToolHive
8793 run : |
8894 # Install ToolHive CLI (replace with your preferred installation method)
8995 # See: https://github.com/stacklok/toolhive/releases
9096 wget https://github.com/stacklok/toolhive/releases/latest/download/toolhive_linux_amd64.tar.gz
9197 tar -xzf toolhive_linux_amd64.tar.gz
9298 sudo install -m 0755 thv /usr/local/bin/
93-
99+
94100 - name : Generate Dockerfile
95101 run : |
96102 thv build --dry-run --output Dockerfile uvx://mcp-server-git
97-
103+
98104 - name : Build with security features
99105 uses : docker/build-push-action@v6
100106 id : build
@@ -103,11 +109,11 @@ jobs:
103109 platforms : linux/amd64,linux/arm64
104110 push : true
105111 tags : ghcr.io/myorg/mcp-server:${{ github.ref_name }}
106- sbom : true # Generate Software Bill of Materials
107- provenance : true # Generate build provenance
112+ sbom : true # Generate Software Bill of Materials
113+ provenance : true # Generate build provenance
108114 cache-from : type=gha
109115 cache-to : type=gha,mode=max
110-
116+
111117 - name : Sign container image
112118 env :
113119 DIGEST : ${{ steps.build.outputs.digest }}
@@ -136,7 +142,7 @@ jobs:
136142 - uses : actions/checkout@v4
137143 with :
138144 fetch-depth : 2
139-
145+
140146 - name : Detect changes
141147 id : changes
142148 run : |
@@ -153,15 +159,15 @@ jobs:
153159 runs-on : ubuntu-latest
154160 steps :
155161 - uses : actions/checkout@v4
156-
162+
157163 - name : Install ToolHive
158164 run : |
159165 # Install ToolHive CLI (replace with your preferred installation method)
160166 # See: https://github.com/stacklok/toolhive/releases
161167 wget https://github.com/stacklok/toolhive/releases/latest/download/toolhive_linux_amd64.tar.gz
162168 tar -xzf toolhive_linux_amd64.tar.gz
163169 sudo install -m 0755 thv /usr/local/bin/
164-
170+
165171 - name : Build containers
166172 run : |
167173 thv build --tag ghcr.io/myorg/mcp-server:latest uvx://mcp-server-git
@@ -191,20 +197,20 @@ jobs:
191197 scheme : go://github.com/myorg/custom-mcp-server@latest
192198 steps :
193199 - uses : actions/checkout@v4
194-
200+
195201 - name : Install ToolHive
196202 run : |
197203 # Install ToolHive CLI (replace with your preferred installation method)
198204 # See: https://github.com/stacklok/toolhive/releases
199205 wget https://github.com/stacklok/toolhive/releases/latest/download/toolhive_linux_amd64.tar.gz
200206 tar -xzf toolhive_linux_amd64.tar.gz
201207 sudo install -m 0755 thv /usr/local/bin/
202-
208+
203209 - name : Build ${{ matrix.server.name }}
204210 run : |
205211 thv build --tag ghcr.io/myorg/${{ matrix.server.name }}:${{ github.ref_name }} \
206212 ${{ matrix.server.scheme }}
207-
213+
208214 - name : Push ${{ matrix.server.name }}
209215 run : |
210216 docker push ghcr.io/myorg/${{ matrix.server.name }}:${{ github.ref_name }}
@@ -225,32 +231,32 @@ jobs:
225231 runs-on : ubuntu-latest
226232 steps :
227233 - uses : actions/checkout@v4
228-
234+
229235 - name : Install ToolHive
230236 run : |
231237 # Install ToolHive CLI (replace with your preferred installation method)
232238 # See: https://github.com/stacklok/toolhive/releases
233239 wget https://github.com/stacklok/toolhive/releases/latest/download/toolhive_linux_amd64.tar.gz
234240 tar -xzf toolhive_linux_amd64.tar.gz
235241 sudo install -m 0755 thv /usr/local/bin/
236-
242+
237243 - name : Build container
238244 run : |
239245 thv build --tag mcp-server:scan uvx://mcp-server-git
240-
246+
241247 - name : Run Trivy vulnerability scanner
242248 uses : aquasecurity/trivy-action@master
243249 with :
244250 image-ref : ' mcp-server:scan'
245251 format : ' sarif'
246252 output : ' trivy-results.sarif'
247-
253+
248254 - name : Upload Trivy scan results
249255 uses : github/codeql-action/upload-sarif@v3
250256 if : always()
251257 with :
252258 sarif_file : ' trivy-results.sarif'
253-
259+
254260 - name : Tag and push if scan passes
255261 run : |
256262 docker tag mcp-server:scan ghcr.io/myorg/mcp-server:${{ github.ref_name }}
@@ -270,7 +276,7 @@ stages:
270276
271277variables :
272278 DOCKER_DRIVER : overlay2
273- DOCKER_TLS_CERTDIR : " /certs"
279+ DOCKER_TLS_CERTDIR : ' /certs'
274280
275281build :
276282 stage : build
@@ -285,7 +291,8 @@ build:
285291 install -m 0755 thv /usr/local/bin/
286292 - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
287293 script :
288- - thv build --tag $CI_REGISTRY_IMAGE/mcp-server:$CI_COMMIT_TAG uvx://mcp-server-git
294+ - thv build --tag $CI_REGISTRY_IMAGE/mcp-server:$CI_COMMIT_TAG
295+ uvx://mcp-server-git
289296 - docker push $CI_REGISTRY_IMAGE/mcp-server:$CI_COMMIT_TAG
290297 only :
291298 - tags
@@ -294,7 +301,8 @@ security_scan:
294301 stage : security
295302 image : aquasec/trivy:latest
296303 script :
297- - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE/mcp-server:$CI_COMMIT_TAG
304+ - trivy image --exit-code 1 --severity HIGH,CRITICAL
305+ $CI_REGISTRY_IMAGE/mcp-server:$CI_COMMIT_TAG
298306 only :
299307 - tags
300308` ` `
@@ -316,4 +324,4 @@ When implementing advanced CI/CD patterns:
316324- [Build MCP server containers](./build-containers.mdx)
317325- [Run MCP servers in Kubernetes](../guides-k8s/run-mcp-k8s.md)
318326- [`thv build` command reference](../reference/cli/thv_build.md)
319- - [Secrets management](./secrets-management.mdx)
327+ - [Secrets management](./secrets-management.mdx)
0 commit comments