chore(deps): update ghcr.io/buildkite/buildkite-mcp-server docker tag to v0.11.1 #836

Workflow file for this run

.github/workflows/update-tools.yml at ff36c09

	name: Update Server Tool Lists

	on:
	pull_request:
	paths:
	- 'registries/**/server.json'
	workflow_dispatch:
	inputs:
	server:
	description: 'Specific server to update (directory name, leave empty for all changed)'
	required: false
	type: string

	permissions:
	contents: write
	pull-requests: write

	jobs:
	# Security check for fork PRs - prevents untrusted code execution with write permissions
	security-check:
	name: Security Check for Fork PRs
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	outputs:
	is-fork: ${{ steps.check-fork.outputs.is-fork }}
	has-label: ${{ steps.check-label.outputs.has-label }}
	should-run: ${{ steps.check-fork.outputs.should-run }}
	steps:
	- name: Check if PR is from a fork
	id: check-fork
	run: \|
	# Get PR details from GitHub API
	PR_DATA=$(gh pr view "$PR_NUMBER" --json isCrossRepository,labels --repo "$GH_REPOSITORY")

	IS_FORK=$(echo "$PR_DATA" \| jq -r '.isCrossRepository')
	echo "is-fork=$IS_FORK" >> $GITHUB_OUTPUT

	if [ "$IS_FORK" = "false" ]; then
	echo "PR is from the same repository - workflow will run automatically"
	echo "should-run=true" >> $GITHUB_OUTPUT
	else
	echo "PR is from a fork - checking for 'safe-to-update' label"

	# Check if PR has the safe-to-update label
	HAS_LABEL=$(echo "$PR_DATA" \| jq -r '.labels \| map(select(.name == "safe-to-update")) \| length > 0')

	if [ "$HAS_LABEL" = "true" ]; then
	echo "PR has 'safe-to-update' label - workflow will run"
	echo "should-run=true" >> $GITHUB_OUTPUT
	else
	echo "PR does not have 'safe-to-update' label - workflow will be skipped"
	echo "should-run=false" >> $GITHUB_OUTPUT
	fi
	fi
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PR_NUMBER: ${{ github.event.pull_request.number }}
	GH_REPOSITORY: ${{ github.repository }}

	- name: Check label status
	id: check-label
	if: steps.check-fork.outputs.is-fork == 'true'
	run: \|
	PR_DATA=$(gh pr view "$PR_NUMBER" --json labels --repo "$GH_REPOSITORY")
	HAS_LABEL=$(echo "$PR_DATA" \| jq -r '.labels \| map(select(.name == "safe-to-update")) \| length > 0')
	echo "has-label=$HAS_LABEL" >> $GITHUB_OUTPUT
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PR_NUMBER: ${{ github.event.pull_request.number }}
	GH_REPOSITORY: ${{ github.repository }}

	- name: Post instructions for fork PRs without label
	if: steps.check-fork.outputs.is-fork == 'true' && steps.check-fork.outputs.should-run == 'false'
	run: \|
	gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
	--method POST \
	--field body="$(cat <<'BODY'
	## Security Notice: Fork PR Tool Update Workflow

	This PR is from a forked repository. For security reasons, the automatic tool list update workflow requires a maintainer to add the `safe-to-update` label before it will run.

	A maintainer will review this PR and add the label if appropriate. The workflow will then automatically update the tool lists.

	---

	Why is this needed? This workflow executes code and connects to MCP servers specified in server.json files. To prevent potential security issues, we require manual verification for fork PRs.
	BODY
	)"
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PR_NUMBER: ${{ github.event.pull_request.number }}

	detect-changes:
	name: Detect Changed Servers
	runs-on: ubuntu-latest
	needs: [security-check]
	if: \|
	always() &&
	(github.event_name == 'workflow_dispatch' \|\|
	(github.event_name == 'pull_request' && needs.security-check.outputs.should-run == 'true'))
	outputs:
	matrix: ${{ steps.set-matrix.outputs.matrix }}
	has-changes: ${{ steps.set-matrix.outputs.has-changes }}
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	with:
	fetch-depth: 0

	- name: Get changed files
	id: changed-files
	run: \|
	if [ "$EVENT_NAME" = "pull_request" ]; then
	# For PRs, get changed files between base and head
	# Get changed server.json files
	CHANGED_FILES=$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" \| grep -E '^registries/./servers/./server\.json$' \|\| true)
	else
	# For workflow_dispatch, get files changed in the last commit
	CHANGED_FILES=$(git diff --name-only HEAD~1 HEAD \| grep -E '^registries/./servers/./server\.json$' \|\| true)
	fi

	# Convert to JSON array
	if [ -z "$CHANGED_FILES" ]; then
	echo "all_changed_files=[]" >> $GITHUB_OUTPUT
	else
	JSON_ARRAY=$(echo "$CHANGED_FILES" \| jq -R -s -c 'split("\n") \| map(select(length > 0))')
	echo "all_changed_files=$JSON_ARRAY" >> $GITHUB_OUTPUT
	fi
	env:
	EVENT_NAME: ${{ github.event_name }}
	BASE_SHA: ${{ github.event.pull_request.base.sha }}
	HEAD_SHA: ${{ github.event.pull_request.head.sha }}

	- name: Validate server input
	if: github.event_name == 'workflow_dispatch' && inputs.server != ''
	run: \|
	if [[ ! "$INPUT_SERVER" =~ ^[a-zA-Z0-9._-]+$ ]]; then
	echo "::error::Invalid server name: must contain only alphanumeric characters, dots, hyphens, and underscores"
	exit 1
	fi
	env:
	INPUT_SERVER: ${{ inputs.server }}

	- name: Set matrix for changed servers
	id: set-matrix
	run: \|
	if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ -n "$INPUT_SERVER" ]; then
	# Manual run with specific server
	SERVER_FILE="registries/toolhive/servers/${INPUT_SERVER}/server.json"
	if [ -f "$SERVER_FILE" ]; then
	echo "matrix={\"server\":[\"$SERVER_FILE\"]}" >> $GITHUB_OUTPUT
	echo "has-changes=true" >> $GITHUB_OUTPUT
	else
	echo "Error: Server $INPUT_SERVER not found at $SERVER_FILE"
	echo "has-changes=false" >> $GITHUB_OUTPUT
	exit 1
	fi
	elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
	# Manual run without specific server - process all server.json files
	echo "Manual run without specific server - processing all server.json files"
	ALL_SERVERS=$(find registries -path '/servers//server.json' \| sort)
	if [ -z "$ALL_SERVERS" ]; then
	echo "No server.json files found"
	echo "has-changes=false" >> $GITHUB_OUTPUT
	else
	JSON_ARRAY=$(echo "$ALL_SERVERS" \| jq -R -s -c 'split("\n") \| map(select(length > 0))')
	MATRIX=$(echo "$JSON_ARRAY" \| jq -c '{server: .}')
	echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
	echo "has-changes=true" >> $GITHUB_OUTPUT

	echo "Files to process:"
	echo "$JSON_ARRAY" \| jq -r '.[]'
	fi
	else
	# PR - use changed files
	CHANGED_FILES="$ALL_CHANGED_FILES"

	if [ "$CHANGED_FILES" = "[]" ]; then
	echo "No server.json files changed"
	echo "has-changes=false" >> $GITHUB_OUTPUT
	else
	MATRIX=$(echo "$CHANGED_FILES" \| jq -c '{server: .}')
	echo "matrix=$MATRIX" >> $GITHUB_OUTPUT
	echo "has-changes=true" >> $GITHUB_OUTPUT

	echo "Files to process:"
	echo "$CHANGED_FILES" \| jq -r '.[]'
	fi
	fi
	env:
	EVENT_NAME: ${{ github.event_name }}
	INPUT_SERVER: ${{ inputs.server }}
	ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}

	update-tools:
	name: Update Tools for ${{ matrix.server }}
	needs: detect-changes
	if: needs.detect-changes.outputs.has-changes == 'true'
	runs-on: ubuntu-latest
	strategy:
	matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }}
	fail-fast: false
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	ref: ${{ github.head_ref \|\| github.ref }}

	- name: Set up Go
	uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
	with:
	go-version-file: 'go.mod'
	cache: true

	- name: Install ToolHive
	uses: StacklokLabs/toolhive-actions/install@87b30f145f84b3186fd20e74c133111a5da24710 # v0
	with:
	version: 'v0.2.9'

	- name: Build catalog
	run: \|
	echo "Building catalog..."
	go build -o /tmp/catalog ./cmd/catalog

	- name: Extract server name
	id: server-info
	run: \|
	SERVER_DIR=$(dirname "$SERVER_FILE")
	SERVER_NAME=$(basename "$SERVER_DIR")
	# Derive a unique key including the registry name to avoid artifact
	# collisions when the same server exists in multiple registries
	# (e.g. registries/official/servers/heroku and registries/toolhive/servers/heroku).
	REGISTRY_NAME=$(echo "$SERVER_FILE" \| cut -d/ -f2)
	SERVER_KEY="${REGISTRY_NAME}-${SERVER_NAME}"
	echo "server-name=$SERVER_NAME" >> $GITHUB_OUTPUT
	echo "server-key=$SERVER_KEY" >> $GITHUB_OUTPUT
	echo "Processing server: $SERVER_NAME (key: $SERVER_KEY)"
	env:
	SERVER_FILE: ${{ matrix.server }}

	- name: Update tool list
	id: update
	run: \|
	echo "Updating tools for $SERVER_NAME..."

	# Run the update tool
	if /tmp/catalog update-tools "$SERVER_FILE" -v; then
	echo "update-status=success" >> $GITHUB_OUTPUT

	# Check if file was modified
	if git diff --quiet "$SERVER_FILE"; then
	echo "No changes needed for $SERVER_FILE"
	echo "changed=false" >> $GITHUB_OUTPUT
	else
	echo "Tools updated for $SERVER_FILE"
	echo "changed=true" >> $GITHUB_OUTPUT

	# Get the diff for the comment
	DIFF=$(git diff "$SERVER_FILE" \| head -100)
	echo "diff<<EOF" >> $GITHUB_OUTPUT
	echo "$DIFF" >> $GITHUB_OUTPUT
	echo "EOF" >> $GITHUB_OUTPUT
	fi
	else
	echo "update-status=failed" >> $GITHUB_OUTPUT
	echo "changed=false" >> $GITHUB_OUTPUT

	# Check if warning was added
	if git diff "$SERVER_FILE" \| grep -q "WARNING"; then
	echo "Warning comment added to server file"
	echo "warning-added=true" >> $GITHUB_OUTPUT
	else
	echo "warning-added=false" >> $GITHUB_OUTPUT
	fi
	fi
	env:
	SERVER_FILE: ${{ matrix.server }}
	SERVER_NAME: ${{ steps.server-info.outputs.server-name }}

	- name: Prepare changes for commit
	if: (steps.update.outputs.changed == 'true' \|\| steps.update.outputs.warning-added == 'true') && github.event_name == 'pull_request'
	run: \|
	mkdir -p /tmp/commit-info

	if [ "$UPDATE_CHANGED" = "true" ]; then
	echo "update" > "/tmp/commit-info/${SERVER_KEY}.type"
	echo "$SERVER_NAME" > "/tmp/commit-info/${SERVER_KEY}.name"
	echo "$SERVER_FILE" > "/tmp/commit-info/${SERVER_KEY}.server"
	else
	echo "warning" > "/tmp/commit-info/${SERVER_KEY}.type"
	echo "$SERVER_NAME" > "/tmp/commit-info/${SERVER_KEY}.name"
	echo "$SERVER_FILE" > "/tmp/commit-info/${SERVER_KEY}.server"
	fi

	# Copy the modified server.json to the artifact directory
	cp "$SERVER_FILE" "/tmp/commit-info/${SERVER_KEY}.server.json"
	env:
	SERVER_FILE: ${{ matrix.server }}
	SERVER_NAME: ${{ steps.server-info.outputs.server-name }}
	SERVER_KEY: ${{ steps.server-info.outputs.server-key }}
	UPDATE_CHANGED: ${{ steps.update.outputs.changed }}

	- name: Upload commit info
	if: (steps.update.outputs.changed == 'true' \|\| steps.update.outputs.warning-added == 'true') && github.event_name == 'pull_request'
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
	with:
	name: commit-info-${{ steps.server-info.outputs.server-key }}
	path: /tmp/commit-info/

	- name: Output diff for workflow dispatch
	if: github.event_name == 'workflow_dispatch' && (steps.update.outputs.changed == 'true' \|\| steps.update.outputs.warning-added == 'true')
	run: \|
	echo "## Tool List Update for $SERVER_NAME" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY

	if [ "$UPDATE_CHANGED" = "true" ]; then
	echo "Status: Successfully updated tool list" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "### Changes Made:" >> $GITHUB_STEP_SUMMARY
	echo '```diff' >> $GITHUB_STEP_SUMMARY
	git diff "$SERVER_FILE" >> $GITHUB_STEP_SUMMARY
	echo '```' >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "Note: Changes were not committed because this is a workflow dispatch run. To apply these changes:" >> $GITHUB_STEP_SUMMARY
	echo "1. Create a new branch" >> $GITHUB_STEP_SUMMARY
	echo "2. Apply the changes shown above" >> $GITHUB_STEP_SUMMARY
	echo "3. Open a pull request" >> $GITHUB_STEP_SUMMARY
	else
	echo "Status: Tool list update failed, warning added" >> $GITHUB_STEP_SUMMARY
	echo "" >> $GITHUB_STEP_SUMMARY
	echo "### Warning Added:" >> $GITHUB_STEP_SUMMARY
	echo '```diff' >> $GITHUB_STEP_SUMMARY
	git diff "$SERVER_FILE" >> $GITHUB_STEP_SUMMARY
	echo '```' >> $GITHUB_STEP_SUMMARY
	fi

	echo "" >> $GITHUB_STEP_SUMMARY
	echo "Server: $SERVER_NAME" >> $GITHUB_STEP_SUMMARY
	echo "Server File: \`$SERVER_FILE\`" >> $GITHUB_STEP_SUMMARY
	echo "Triggered by: @$GH_ACTOR" >> $GITHUB_STEP_SUMMARY
	env:
	SERVER_FILE: ${{ matrix.server }}
	SERVER_NAME: ${{ steps.server-info.outputs.server-name }}
	UPDATE_CHANGED: ${{ steps.update.outputs.changed }}
	GH_ACTOR: ${{ github.actor }}

	commit-all-changes:
	name: Commit All Tool Updates
	needs: [detect-changes, update-tools]
	if: always() && needs.detect-changes.outputs.has-changes == 'true' && github.event_name == 'pull_request'
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	ref: ${{ github.head_ref \|\| github.ref }}

	- name: Download all commit info artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	path: /tmp/artifacts/
	pattern: commit-info-*
	merge-multiple: true

	- name: Check if any changes were made
	id: check_changes
	run: \|
	if [ -d "/tmp/artifacts" ] && [ "$(ls -A /tmp/artifacts 2>/dev/null)" ]; then
	echo "changes=true" >> $GITHUB_OUTPUT
	echo "Found commit info files:"
	ls -la /tmp/artifacts/
	else
	echo "changes=false" >> $GITHUB_OUTPUT
	echo "No changes to commit"
	fi

	- name: Commit and push all changes
	if: steps.check_changes.outputs.changes == 'true'
	run: \|
	git config --local user.email "action@github.com"
	git config --local user.name "GitHub Action"

	# Pull any remote changes first to avoid conflicts
	git pull origin "$BRANCH_REF" --rebase

	# Collect all the server names that were updated
	UPDATED_SERVERS=""
	WARNING_SERVERS=""

	for file in /tmp/artifacts/*.type; do
	if [ -f "$file" ]; then
	SERVER_KEY=$(basename "$file" .type)
	SERVER_NAME=$(cat "/tmp/artifacts/${SERVER_KEY}.name")
	TYPE=$(cat "$file")

	if [ "$TYPE" = "update" ]; then
	UPDATED_SERVERS="$UPDATED_SERVERS $SERVER_NAME"
	else
	WARNING_SERVERS="$WARNING_SERVERS $SERVER_NAME"
	fi

	# Restore the modified server.json from the artifact
	SERVER_FILE=$(cat "/tmp/artifacts/${SERVER_KEY}.server")
	if [ -f "/tmp/artifacts/${SERVER_KEY}.server.json" ]; then
	cp "/tmp/artifacts/${SERVER_KEY}.server.json" "$SERVER_FILE"
	git add "$SERVER_FILE"
	else
	echo "Warning: Modified server.json not found in artifacts for $SERVER_KEY"
	fi
	fi
	done

	# Create commit message
	COMMIT_MSG="chore: update tool lists for MCP servers (server.json)"

	if [ -n "$UPDATED_SERVERS" ]; then
	COMMIT_MSG="$COMMIT_MSG\n\nUpdated servers:$(echo $UPDATED_SERVERS \| sed 's/ /\\n- /g' \| sed 's/^/\\n- /')"
	fi

	if [ -n "$WARNING_SERVERS" ]; then
	COMMIT_MSG="$COMMIT_MSG\n\nWarning added for servers:$(echo $WARNING_SERVERS \| sed 's/ /\\n- /g' \| sed 's/^/\\n- /')"
	fi

	COMMIT_MSG="$COMMIT_MSG\n\nAutomatically updated using 'catalog update-tools' command.\n\nCo-authored-by: $GH_ACTOR <${GH_ACTOR}@users.noreply.github.com>"

	# Check if there are actually any changes to commit
	if ! git diff --cached --quiet; then
	git commit -m "$COMMIT_MSG"
	git push
	echo "Successfully committed and pushed all tool updates"
	else
	echo "No changes to commit (files may have been identical)"
	fi
	env:
	BRANCH_REF: ${{ github.head_ref \|\| github.ref_name }}
	GH_ACTOR: ${{ github.actor }}

	comment-summary:
	name: Post Summary Comment
	needs: [detect-changes, update-tools]
	if: always() && needs.detect-changes.outputs.has-changes == 'true'
	runs-on: ubuntu-latest
	steps:
	- name: Download all commit info artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
	with:
	path: /tmp/comment-artifacts/
	pattern: commit-info-*
	merge-multiple: true

	- name: Post or update summary comment
	if: github.event_name == 'pull_request'
	run: \|
	# Build summary table from artifacts
	SUMMARY=""

	if [ -d "/tmp/comment-artifacts" ] && [ "$(ls -A /tmp/comment-artifacts 2>/dev/null)" ]; then
	for file in /tmp/comment-artifacts/*.type; do
	if [ -f "$file" ]; then
	SERVER_KEY=$(basename "$file" .type)
	SERVER_NAME=$(cat "/tmp/comment-artifacts/${SERVER_KEY}.name")
	TYPE=$(cat "$file")

	if [ "$TYPE" = "update" ]; then
	SUMMARY="${SUMMARY}\| ${SERVER_NAME} \| Updated \| Tool list refreshed \|
	"
	else
	SUMMARY="${SUMMARY}\| ${SERVER_NAME} \| Warning \| Could not fetch tools, added warning comment \|
	"
	fi
	fi
	done
	fi

	if [ -z "$SUMMARY" ]; then
	SUMMARY="\| _No changes detected_ \| \| \|"
	fi

	COMMENT_BODY="## MCP Server Tool List Updates (server.json)

	The tool lists for modified MCP server entries have been automatically updated using \`catalog update-tools\`.

	### Summary

	\| Server \| Status \| Details \|
	\|--------\|--------\|---------\|
	${SUMMARY}
	---
	_This comment is automatically generated and will be updated as the workflow progresses._"

	# Find existing comment
	COMMENT_ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
	--jq '[.[] \| select(.user.login == "github-actions[bot]") \| select(.body \| contains("## MCP Server Tool List Updates (server.json)"))][0].id' \
	2>/dev/null \|\| true)

	if [ -n "$COMMENT_ID" ] && [ "$COMMENT_ID" != "null" ]; then
	gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${COMMENT_ID}" \
	--method PATCH \
	--field body="$COMMENT_BODY"
	else
	gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
	--method POST \
	--field body="$COMMENT_BODY"
	fi
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PR_NUMBER: ${{ github.event.pull_request.number }}

	validate-after-update:
	name: Validate Updated Servers
	needs: update-tools
	if: always()
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
	with:
	ref: ${{ github.head_ref \|\| github.ref }}

	- name: Set up Go
	uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
	with:
	go-version-file: 'go.mod'
	cache: true

	- name: Build catalog
	run: go build -o /tmp/catalog ./cmd/catalog

	- name: Validate all server.json entries
	run: \|
	echo "Validating all catalog entries after updates..."
	/tmp/catalog validate -v

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update ghcr.io/buildkite/buildkite-mcp-server docker tag to v0.11.1 #836

Workflow file

chore(deps): update ghcr.io/buildkite/buildkite-mcp-server docker tag to v0.11.1 #836

Uh oh!

Workflow file for this run