add container lifecycle verification gate to build pipeline

.coderabbit.yaml

@@ -12,12 +12,13 @@ reviews:
   collapse_walkthrough: true
   poem: false
   request_changes_workflow: false
-  high_level_summary: true
+  high_level_summary: false
   high_level_summary_placeholder: "@coderabbitai summary"
   abort_on_close: true
+  review_status: false
 
   auto_review:
-    enabled: true
+    enabled: false
     drafts: false
     base_branches:
       - main

.github/workflows/build-publish.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
 
@@ -36,7 +36,7 @@ jobs:
         run: python -m build --sdist --wheel
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@v6.0.0
         with:
           name: artifacts
           path: dist
@@ -57,7 +57,7 @@ jobs:
 
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v5.0.0
+        uses: actions/download-artifact@v7.0.0
         with:
           name: artifacts
           path: dist

.github/workflows/ci.yml

@@ -38,15 +38,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Install Python
-        uses: actions/setup-python@v6.0.0
+        uses: actions/setup-python@v6.1.0
         with:
           python-version-file: pyproject.toml
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7.1.0
+        uses: astral-sh/setup-uv@v7.1.6
         with:
           enable-cache: true
           prune-cache: false
@@ -83,15 +83,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Install Python
-        uses: actions/setup-python@v6.0.0
+        uses: actions/setup-python@v6.1.0
         with:
           python-version-file: pyproject.toml
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7.1.0
+        uses: astral-sh/setup-uv@v7.1.6
         with:
           enable-cache: true
           prune-cache: false
@@ -112,7 +112,7 @@ jobs:
         run: uv run --locked pytest --cov-report=xml
 
       - name: Upload coverage report
-        uses: codecov/codecov-action@v5.5.1
+        uses: codecov/codecov-action@v5.5.2
         with:
           env_vars: OS,PYTHON
           disable_search: true

.github/workflows/ci_installation.yaml

@@ -7,13 +7,15 @@ on:
     paths:
       - 'src/linux_mcp_server/**'
       - 'scripts/verify_installation.sh'
+      - 'scripts/verify_container_integration.sh'
 
   pull_request:
     branches:
       - main
     paths:
       - 'src/linux_mcp_server/**'
       - 'scripts/verify_installation.sh'
+      - 'scripts/verify_container_integration.sh'
 
 env:
   PIP_DISABLE_PIP_VERSION_CHECK: 1
@@ -41,15 +43,15 @@ jobs:
 
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
 
       - name: Install Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6.0.0
+        uses: actions/setup-python@v6.1.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7.1.0
+        uses: astral-sh/setup-uv@v7.1.6
         with:
           enable-cache: true
           prune-cache: false
@@ -60,5 +62,13 @@ jobs:
           METHOD: ${{ matrix.method }}
           UV_PYTHON: python
         run: |
-          chmod +x scripts/verify_installation.sh
-          ./scripts/verify_installation.sh
+          bash ./scripts/verify_installation.sh
+
+  container_integration_qa:
+    name: Container Integration - Linux
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6.0.1
+      - name: Run Container Integration Test
+        run: |
+          bash ./scripts/verify_container_integration.sh

.github/workflows/docs.yml

@@ -0,0 +1,63 @@
+name: Documentation
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "docs/**"
+      - "src/**"
+      - "mkdocs.yml"
+      - "pyproject.toml"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.1
+
+      - name: Install Python
+        uses: actions/setup-python@v6.1.0
+        with:
+          python-version-file: pyproject.toml
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7.1.6
+        with:
+          enable-cache: true
+          prune-cache: false
+
+      - name: Install dependencies
+        run: uv sync --locked --group docs
+
+      - name: Build documentation
+        run: uv run --locked mkdocs build --strict
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v4.0.0
+        with:
+          path: site
+
+  deploy:
+    if: github.event.repository.fork == false
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4.0.5

.gitignore

@@ -37,6 +37,9 @@ coverage/
 htmlcov/
 .tox/
 
+# Documentation build
+site/
+
 # IDEs
 .vscode/
 .idea/

.tekton/integration-lifecycle.yaml

@@ -0,0 +1,18 @@
+apiVersion: appstudio.redhat.com/v1alpha1
+kind: IntegrationTestScenario
+metadata:
+  name: container-lifecycle-test
+spec:
+  application: linux-mcp-server
+  resolverRef:
+    resolver: git
+    params:
+      - name: url
+        value: https://github.com/rhel-lightspeed/linux-mcp-server.git
+      - name: revision
+        value: main
+      - name: pathInRepo
+        value: .tekton/task-verify-container.yaml
+  params:
+    - name: qa_image_url
+      value: "quay.io/redhat-user-workloads/rhel-lightspeed-tenant/linux-mcp-server-test-suite:latest"

.tekton/integration-protocol.yaml

@@ -0,0 +1,18 @@
+apiVersion: appstudio.redhat.com/v1alpha1
+kind: IntegrationTestScenario
+metadata:
+  name: mcp-protocol-audit
+spec:
+  application: linux-mcp-server
+  resolverRef:
+    resolver: git
+    params:
+      - name: url
+        value: https://github.com/rhel-lightspeed/linux-mcp-server.git
+      - name: revision
+        value: main
+      - name: pathInRepo
+        value: .tekton/task-mcp-protocol-audit.yaml
+  params:
+    - name: qa_image_url
+      value: "quay.io/redhat-user-workloads/rhel-lightspeed-tenant/linux-mcp-server-test-suite:latest"

.tekton/pipeline-build-multiarch.yaml

@@ -226,6 +226,28 @@ spec:
       taskRef:
         name: get-version
 
+    - name: build-qa-toolbox
+      params:
+        - name: IMAGE
+          # We use the same output-image param but append a suffix
+          value: $(params.output-image)-test-suite
+        - name: DOCKERFILE
+          value: Containerfile.qa
+        - name: CONTEXT
+          value: .
+        - name: SOURCE_ARTIFACT
+          value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
+      runAfter:
+        - clone-repository
+      taskRef:
+        resolver: bundles
+        params:
+          - name: name
+            value: buildah-remote-oci-ta
+          - name: bundle
+            # Using the same bundle version you use for build-images 
+            value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.7@sha256:ee5e01eb59a3f70bb1012950fbc4081bac96d3f3517e6d204314484cd2e0059b
+
     - name: build-images
       matrix:
         params:

.tekton/task-mcp-protocol-audit.yaml

@@ -0,0 +1,34 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: mcp-protocol-audit
+spec:
+  description: Audits the MCP server for protocol compliance, tool discovery, and stdout hygiene.
+  params:
+    - name: image_url
+      type: string
+      [cite_start]description: The URL of the image to audit. [cite: 4]
+    - name: qa_image_url
+      default: "quay.io/redhat-user-workloads/rhel-lightspeed-tenant/linux-mcp-server-test-suite:latest"
+
+  sidecars:
+    - name: mcp-server
+      [cite_start]image: $(params.image_url) [cite: 1]
+      command: ["/bin/sh", "-c"]
+      args:
+        - |
+          microdnf install -y socat
+          socat TCP-LISTEN:8080,reuseaddr,fork EXEC:linux-mcp-server,stderr
+
+  steps:
+    - name: validate-tool-discovery
+      image: $(params.qa_image_url)
+      script: |
+        #!/usr/bin/env bash
+        /usrl/local/bin/scripts/mcp_protocol_audit.sh [cite: 4]
+
+    - name: verify-stdout-hygiene
+      image: $(params.qa_image_url)
+      script: |
+        #!/usr/bin/env bash
+        /usr/local/bin/scripts/verify_stdout_hygiene.sh [cite: 4]

.tekton/task-verify-container.yaml

@@ -0,0 +1,33 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: verify-container-lifecycle
+spec:
+  [cite_start]description: Verifies MCP server startup, permissions, and handshake via sidecar. [cite: 4]
+  params:
+    - name: image_url
+      type: string
+    - name: qa_image_url
+      default: "quay.io/redhat-user-workloads/rhel-lightspeed-tenant/linux-mcp-server-test-suite:latest"
+
+  sidecars:
+    - name: server
+      image: $(params.image_url)
+      command: ["/bin/sh", "-c"]
+      args:
+        - |
+          socat TCP-LISTEN:8080,reuseaddr,fork EXEC:linux-mcp-server,stderr 
+
+  steps:
+    - name: verify-user-and-startup
+      image: $(params.qa_image_url)
+      script: |
+        #!/usr/bin/env bash
+        # The QA container probes the sidecar's network port
+        /usr/local/bin/scripts/verify_container_lifecycle.sh
+
+    - name: verify-mcp-handshake
+      image: $(params.qa_image_url)
+      script: |
+        #!/usr/bin/env bash
+        /usr/local/bin/scripts/verify_mcp_handshake.sh