Skip to content

Commit 366022f

Browse files
adityamparikhadityamparikh
authored
feat: Add security and docs (#17)
1 parent 9f47616 commit 366022f

28 files changed

Lines changed: 4988 additions & 141 deletions

‎.env.example‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# Auth0 Configuration
17+
# Copy this file to .env and fill in your Auth0 credentials
18+
19+
################################################################################
20+
# TOKEN SCRIPT CONFIGURATION (for scripts/get-auth0-token.sh)
21+
################################################################################
22+
23+
# Your Auth0 domain (e.g., your-tenant.auth0.com)
24+
# Find this in: Auth0 Dashboard > Applications > Your App > Settings > Domain
25+
AUTH0_DOMAIN=your-tenant.auth0.com
26+
27+
# Your Auth0 Client ID
28+
# Find this in: Auth0 Dashboard > Applications > Your App > Settings > Client ID
29+
AUTH0_CLIENT_ID=your-client-id-here
30+
31+
# Your Auth0 Client Secret
32+
# Find this in: Auth0 Dashboard > Applications > Your App > Settings > Client Secret
33+
# IMPORTANT: Keep this secret! Never commit this file with real values to version control
34+
AUTH0_CLIENT_SECRET=your-client-secret-here
35+
36+
# Your Auth0 API Audience/Identifier
37+
# This is the identifier you set when creating your Auth0 API
38+
# Find this in: Auth0 Dashboard > Applications > APIs > Your API > Identifier
39+
# Example: https://solr-mcp-api
40+
AUTH0_AUDIENCE=https://solr-mcp-api
41+
42+
################################################################################
43+
# APPLICATION CONFIGURATION (for Solr MCP Server)
44+
################################################################################
45+
46+
# OAuth2 Resource Server Configuration
47+
# IMPORTANT: Must end with a trailing slash /
48+
OAUTH2_ISSUER_URI=https://your-tenant.auth0.com/
49+
50+
# Profile Configuration
51+
# Use 'http' profile to enable OAuth2 security (required for OAuth2)
52+
# Use 'stdio' profile for standard input/output mode (no OAuth2)
53+
PROFILES=http

‎.github/workflows/atr-release-test.yml‎

Lines changed: 439 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/atr-release.yml‎

Lines changed: 470 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/build-and-publish.yml‎

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,50 @@
1313
# See the License for the specific language governing permissions and
1414
# limitations under the License.
1515

16+
# ╔═══════════════════════════════════════════════════════════════════════════╗
17+
# ║ CONTINUOUS DEPLOYMENT WORKFLOW ║
18+
# ║ (Development Builds) ║
19+
# ╚═══════════════════════════════════════════════════════════════════════════╝
20+
#
21+
# PURPOSE: Automated development builds and Docker image publishing for CI/CD
22+
#
23+
# WHEN TO USE:
24+
# -----------
25+
# ✅ Automatic on every merge to main
26+
# ✅ Testing pull requests (build + test only, no publish)
27+
# ✅ Development/testing Docker images
28+
# ❌ DO NOT use for official ASF releases (use release-publish.yml instead)
29+
#
30+
# COMPARISON WITH OTHER WORKFLOWS:
31+
# --------------------------------
32+
# build-and-publish.yml (THIS FILE):
33+
# - Purpose: Development CI/CD
34+
# - Trigger: Automatic (push/PR)
35+
# - Docker Hub: Personal namespace
36+
# - ASF Vote: Not required
37+
# - Use for: Daily development work
38+
#
39+
# release-publish.yml:
40+
# - Purpose: Official ASF releases
41+
# - Trigger: Manual (after vote)
42+
# - Docker Hub: apache/solr-mcp
43+
# - ASF Vote: Required (72 hours)
44+
# - Use for: Production releases
45+
#
46+
# nightly-build.yml:
47+
# - Purpose: Nightly builds
48+
# - Trigger: Scheduled (2 AM UTC)
49+
# - Docker Hub: apache/solr-mcp-nightly
50+
# - Use for: Latest unstable builds
51+
#
52+
# atr-release.yml:
53+
# - Purpose: Future ATR automation
54+
# - Trigger: Manual (after prerequisites)
55+
# - Status: Blocked (needs automated signing)
56+
# - Use for: When ATR is ready
57+
#
58+
# ────────────────────────────────────────────────────────────────────────────
59+
#
1660
# GitHub Actions Workflow: Build and Publish
1761
# ===========================================
1862
#
@@ -50,17 +94,24 @@
5094

5195
name: Build and Publish
5296

97+
# Triggers for this workflow
98+
# - push: runs on commits to main and on version tags (v*)
99+
# - pull_request: runs on PRs targeting main (build/test only; no publishing)
100+
# - workflow_dispatch: allows manual execution from the Actions UI
53101
on:
54102
push:
55103
branches:
56-
- main
104+
- main # Build + publish dev images on main merges
57105
tags:
58-
- 'v*' # Trigger on version tags like v1.0.0, v2.1.3, etc.
106+
- 'v*' # CAUTION (ASF): tag pushes will publish images; prefer using release-publish.yml for post-vote releases
59107
pull_request:
60108
branches:
61-
- main
62-
workflow_dispatch: # Allow manual workflow runs from GitHub UI
109+
- main # Build + test validation for incoming changes
110+
workflow_dispatch: # Manual runs for maintainers
63111

112+
# Global environment used by all jobs in this workflow
113+
# - JAVA_VERSION: JDK version to install for Gradle builds
114+
# - JAVA_DISTRIBUTION: Vendor/distribution of the JDK (Temurin is Eclipse Adoptium)
64115
env:
65116
JAVA_VERSION: '25'
66117
JAVA_DISTRIBUTION: 'temurin'
@@ -162,6 +213,7 @@ jobs:
162213
name: Publish Docker Images
163214
runs-on: ubuntu-latest
164215
needs: build # Wait for build job to complete successfully
216+
# Conditional: do not publish images for pull_request events to avoid leaking credentials or pushing unvetted builds
165217
if: github.event_name != 'pull_request' # Skip for PRs
166218

167219
# Grant permissions for GHCR publishing

‎.github/workflows/nightly-build.yml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# ╔═══════════════════════════════════════════════════════════════════════════╗
17+
# ║ NIGHTLY BUILD WORKFLOW ║
18+
# ║ (Latest Unstable Builds) ║
19+
# ╚═══════════════════════════════════════════════════════════════════════════╝
20+
#
21+
# PURPOSE: Automated nightly builds for testing latest changes
22+
#
23+
# WHEN TO USE:
24+
# -----------
25+
# ✅ Automatic daily at 2 AM UTC
26+
# ✅ For testing latest main branch changes
27+
# ✅ Provides unstable/preview builds
28+
# ✅ Publishes to apache/solr-mcp-nightly
29+
# ❌ DO NOT use for production releases
30+
#
31+
# COMPARISON WITH OTHER WORKFLOWS:
32+
# --------------------------------
33+
# nightly-build.yml (THIS FILE):
34+
# - Purpose: Nightly builds
35+
# - Trigger: Scheduled (2 AM UTC)
36+
# - Docker Hub: apache/solr-mcp-nightly
37+
# - Stability: Unstable/preview
38+
# - Use for: Testing latest changes
39+
#
40+
# build-and-publish.yml:
41+
# - Purpose: Development CI/CD
42+
# - Trigger: Automatic (push/PR)
43+
# - Docker Hub: Personal namespace
44+
# - Use for: Daily development work
45+
#
46+
# release-publish.yml:
47+
# - Purpose: Official ASF releases
48+
# - Trigger: Manual (after vote)
49+
# - Docker Hub: apache/solr-mcp
50+
# - Stability: Stable/production
51+
# - Use for: Production releases
52+
#
53+
# atr-release.yml:
54+
# - Purpose: Future ATR automation
55+
# - Status: Blocked (needs automated signing)
56+
# - Use for: When ATR is ready
57+
#
58+
# ────────────────────────────────────────────────────────────────────────────
59+
#
60+
# Nightly Build Workflow for Apache Solr MCP
61+
# ===========================================
62+
#
63+
# This workflow creates nightly builds for the Solr MCP project and publishes
64+
# them to Apache's nightly infrastructure and Docker Hub preview registry.
65+
#
66+
# Schedule:
67+
# ---------
68+
# Runs daily at 2 AM UTC or on manual trigger
69+
#
70+
# Artifacts Published:
71+
# --------------------
72+
# 1. Source tarball to https://nightlies.apache.org/solr/mcp/
73+
# 2. Docker image to apache/solr-mcp-nightly on Docker Hub
74+
# 3. Build artifacts to GitHub releases (pre-release)
75+
76+
name: Nightly Build
77+
78+
# Triggers for the workflow
79+
# - schedule: runs automatically via cron at a fixed time (02:00 UTC daily)
80+
# - workflow_dispatch: allow maintainers to run the workflow manually and pass inputs
81+
on:
82+
schedule:
83+
# Run at 2 AM UTC every day
84+
- cron: '0 2 * * *'
85+
workflow_dispatch: # Allow manual trigger
86+
inputs:
87+
# Optional input to skip Docker publishing if you only want to build artifacts
88+
skip_docker:
89+
description: 'Skip Docker publishing'
90+
required: false
91+
type: boolean
92+
default: false
93+
94+
# Environment variables used by steps below
95+
# - JAVA_VERSION: selects the JDK version used to build and run Gradle
96+
# - JAVA_DISTRIBUTION: selects the vendor (Temurin = Eclipse Adoptium)
97+
env:
98+
JAVA_VERSION: '25'
99+
JAVA_DISTRIBUTION: 'temurin'
100+
101+
jobs:
102+
nightly-build:
103+
name: Nightly Build and Publish
104+
runs-on: ubuntu-latest
105+
106+
# Permissions required by this job:
107+
# - contents:write → needed to create GitHub pre-releases and upload assets
108+
# - packages:write → needed when pushing container images to registries
109+
permissions:
110+
contents: write
111+
packages: write
112+
113+
steps:
114+
- name: Checkout code
115+
uses: actions/checkout@v4
116+
117+
- name: Set up JDK ${{ env.JAVA_VERSION }}
118+
uses: actions/setup-java@v4
119+
with:
120+
java-version: ${{ env.JAVA_VERSION }}
121+
distribution: ${{ env.JAVA_DISTRIBUTION }}
122+
cache: 'gradle'
123+
124+
- name: Grant execute permission for gradlew
125+
run: chmod +x gradlew
126+
127+
- name: Generate nightly version
128+
id: version
129+
run: |
130+
# Generate version with date stamp
131+
DATE_STAMP=$(date +%Y%m%d)
132+
SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
133+
NIGHTLY_VERSION="nightly-${DATE_STAMP}-${SHORT_SHA}"
134+
echo "version=$NIGHTLY_VERSION" >> $GITHUB_OUTPUT
135+
echo "date=$DATE_STAMP" >> $GITHUB_OUTPUT
136+
137+
- name: Build project
138+
run: ./gradlew build
139+
140+
- name: Create source distribution
141+
run: |
142+
# Create source tarball
143+
mkdir -p build/distributions
144+
tar czf build/distributions/solr-mcp-${{ steps.version.outputs.version }}-src.tar.gz \
145+
--exclude='.git' \
146+
--exclude='build' \
147+
--exclude='.gradle' \
148+
--exclude='*.iml' \
149+
--exclude='.idea' \
150+
.
151+
152+
# Generate SHA512 checksum
153+
cd build/distributions
154+
sha512sum solr-mcp-${{ steps.version.outputs.version }}-src.tar.gz > \
155+
solr-mcp-${{ steps.version.outputs.version }}-src.tar.gz.sha512
156+
157+
- name: Build and publish Docker image to apache/solr-mcp-nightly
158+
if: ${{ !inputs.skip_docker }}
159+
run: |
160+
# Build and push to apache/solr-mcp-nightly
161+
# Note: Requires DOCKERHUB_APACHE_USERNAME and DOCKERHUB_APACHE_TOKEN secrets
162+
# These should be set up with Apache PMC credentials
163+
if [[ -n "${{ secrets.DOCKERHUB_APACHE_USERNAME }}" ]]; then
164+
./gradlew jib \
165+
-Djib.to.image=apache/solr-mcp-nightly:${{ steps.version.outputs.version }} \
166+
-Djib.to.auth.username=${{ secrets.DOCKERHUB_APACHE_USERNAME }} \
167+
-Djib.to.auth.password=${{ secrets.DOCKERHUB_APACHE_TOKEN }} \
168+
-Djib.to.tags=${{ steps.version.outputs.version }},latest-nightly
169+
fi
170+
171+
- name: Upload to Apache Nightlies
172+
if: ${{ secrets.APACHE_NIGHTLIES_USER != '' }}
173+
run: |
174+
# Upload to Apache nightlies infrastructure
175+
# Requires APACHE_NIGHTLIES_USER and APACHE_NIGHTLIES_KEY secrets
176+
# These are typically available to Apache committers
177+
178+
# Create directory structure
179+
UPLOAD_DIR="solr/mcp/${{ steps.version.outputs.date }}"
180+
181+
# Use rsync or scp to upload to nightlies.apache.org
182+
# This is a placeholder - actual implementation depends on Apache infra access
183+
echo "Would upload to: https://nightlies.apache.org/${UPLOAD_DIR}/"
184+
echo "Files to upload:"
185+
ls -la build/distributions/
186+
187+
- name: Create GitHub pre-release
188+
uses: softprops/action-gh-release@v1
189+
with:
190+
tag_name: nightly-${{ steps.version.outputs.date }}
191+
name: Nightly Build ${{ steps.version.outputs.date }}
192+
prerelease: true
193+
draft: false
194+
files: |
195+
build/distributions/solr-mcp-*.tar.gz
196+
build/distributions/solr-mcp-*.sha512
197+
build/libs/solr-mcp-*.jar
198+
body: |
199+
## Nightly Build
200+
201+
**Date**: ${{ steps.version.outputs.date }}
202+
**Commit**: ${{ github.sha }}
203+
204+
### Docker Image
205+
```bash
206+
docker pull apache/solr-mcp-nightly:${{ steps.version.outputs.version }}
207+
```
208+
209+
### Source Distribution
210+
- [solr-mcp-${{ steps.version.outputs.version }}-src.tar.gz](https://github.com/${{ github.repository }}/releases/download/nightly-${{ steps.version.outputs.date }}/solr-mcp-${{ steps.version.outputs.version }}-src.tar.gz)
211+
212+
**Note**: This is a nightly build and not an official Apache release.
213+
214+
- name: Clean up old nightly releases
215+
run: |
216+
# Keep only the last 7 nightly builds
217+
# This helps manage storage and keeps releases clean
218+
gh release list --limit 100 | grep "^nightly-" | tail -n +8 | cut -f1 | while read tag; do
219+
echo "Deleting old nightly release: $tag"
220+
gh release delete "$tag" --yes --cleanup-tag
221+
done
222+
env:
223+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)