Merge pull request 'feat(gitea): rebuild gitea-mcp on a shell-bearing base' (#122) from feat/gitea-mcp-shell-base into main

deploy/Dockerfile.gitea-mcp

@@ -26,18 +26,11 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-# Pinned by DIGEST, not :latest. `latest` moves, and a rebuild that silently
+COPY --from=docker.gitea.com/gitea-mcp-server:latest /app/gitea-mcp /usr/local/bin/gitea-mcp
-# ships a different server version is indistinguishable from a broken rebuild —
-# chased exactly that here when a probe started failing after a rebuild.
-# This digest is gitea-mcp-server 1.6.0 (label org.opencontainers.image.version),
-# the build that was running when this image was introduced.
-# To bump: skopeo inspect docker://docker.gitea.com/gitea-mcp-server:latest
-COPY --from=docker.gitea.com/gitea-mcp-server@sha256:dda8d56e6a91fa89cad186becc27c7aa83d74acdd5dc69f89af840d7bb78a631 /app/gitea-mcp /usr/local/bin/gitea-mcp
 
 WORKDIR /app
 
-# CMD, not ENTRYPOINT — matching upstream, which sets Cmd ["/app/gitea-mcp"] and
+# Kept as ENTRYPOINT so the plain (non-injected) path behaves exactly like
-# no entrypoint. mcpd maps a server's `command` to k8s `args`, which REPLACES
+# upstream. mcpd REPLACES this with the sourcing wrapper when the server opts
-# Cmd but only appends to an ENTRYPOINT; keeping the same form means the plain
+# into injected delivery — that is why a shell has to exist in the image.
-# (non-injected) path behaves byte-identically to upstream.
+ENTRYPOINT ["/usr/local/bin/gitea-mcp"]
-CMD ["/usr/local/bin/gitea-mcp"]