feat(codebase-memory-mcp): add pinned container image - #45
Closed
xnoto wants to merge 2 commits into
Closed
Conversation
Adds the codebase-memory-mcp image (upstream DeusData/codebase-memory-mcp v0.10.8, fully static linux-amd64-portable release asset, archive SHA-256 pinned from the official release checksums.txt) for the upcoming makeitwork-codebase-memory MCPServer backend in kustomize-cluster, which succeeds the repo-search filesystem backend per the owner decision of 2026-09-09.
Infra-security review (2026-09-09): upstream auto-enables the embedded graph-UI HTTP listener (loopback :9749) on first run when the cache directory has no UI config file, which is every start on an emptyDir-backed CBM_CACHE_DIR. Bake --ui=false into the ENTRYPOINT so the listener can never activate regardless of cache state.
Image CI passedPre-commit validation passed. View the workflow run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new container image
codebase-memory-mcpwrapping upstream DeusData/codebase-memory-mcpv0.10.8— a pure-C, self-contained stdio MCP server that indexes mounted repositories into a SQLite knowledge graph (tree-sitter across 162 languages, bundled local embeddings, read-only Cypher queries). It will back themakeitwork-codebase-memoryToolHiveMCPServerinkustomize-cluster/workloads/mcp-gateway, succeeding themakeitwork-repo-searchfilesystem backend (owner decision 2026-09-09).Fixes # N/A — stage 1 of an owner-directed migration; the assessment is recorded in
agent-knowledgedocs/agents/makeitwork/codebase-memory-mcp-gateway-assessment.md.Type of change
Validation
eb0d38e(pre-commit with hadolint, gitleaks, actionlint; detect; build-only buildah build of the new image; registry push correctly skipped for a PR).Pre-PR review gate (both closed):
6eef4965…) against the official v0.10.8checksums.txt(exact match). Raised one High — upstream auto-enables the embedded graph-UI HTTP listener (loopback:9749) on first run when the cache directory has no UI config (upstreamdocs/CONFIGURATION.md§3), which is every start on an emptyDir-backedCBM_CACHE_DIR. Resolved in eb0d38e by baking--ui=falseinto the ENTRYPOINT.Impact and rollout
Producer: merge publishes
ghcr.io/makeitworkcloud/codebase-memory-mcp:{latest,<sha>}. Consumers: none yet — thekustomize-clusterstage-2 PR adding theMCPServeris gated on this merge and will pin the published digest. Upstream moves quickly (~10 releases in three weeks); the README documents the two-ARG bump procedure and requires preserving--ui=false. Rollback: remove the directory and do not select the image; no runtime consumer exists today.Safety and secrets
AI-assisted change: an OpenCode agent materially produced this change, and adversarial plus infrastructure-security reviews were dispatched and closed before merge. Reviewers should verify the pinned checksum, the
--ui=falsemitigation, and hadolint compliance.