stacklok / toolhive

64%

main: 64%

LAST BUILD ON BRANCH harden-ci-agent-workflows

branch: harden-ci-agent-workflows

CHANGE BRANCH

x

Reset

• harden-ci-agent-workflows
• 2012-respect-x-forwarded
• 2023-inbound-network-permissions
• 2160-podman-mac
• 2680
• 3655-e2e-skills-tests
• 400-bad-client
• 404-on-not-found-workload
• accessor-helper-package
• action-ensure-all-have-run
• add-anonymous-usage-metrics
• add-antigravity-client
• add-bug-triage-agent
• add-buildargs-to-protocol-builds
• add-claude-agents
• add-command-examples
• add-distributable-skills-ci
• add-embedding-engine
• add-flatpak-install-method
• add-gemini-cli-support
• add-ginkgolinter
• add-grafana-cli-example
• add-group-support-to-skills-api
• add-groups
• add-inputschema-to-toolmatch
• add-insecure-http-oidc-support
• add-k8s-export-format
• add-license-headers
• add-mcp-meta-field-support
• add-mcp-tasks-parser-support
• add-mcpgroup-proposal
• add-mcpregistry-controller-tests
• add-mcpserver-shortnames
• add-missing-api-validation
• add-mistral-codex-clients
• add-mpe
• add-netwok-isolation-examples
• add-oidc-resolver
• add-optimizer-metrics
• add-pr-size-labeler
• add-proxy
• add-proxy-logs-endpoint
• add-proxy-port-registry-support
• add-registry-groups-cli-support
• add-remote-mcp-e2e-tests
• add-remoteproxy-external-resource-tests
• add-retrydelay-to-errorhandling-crd
• add-rfc8707-resource-parameter-refresh-token
• add-schema-version-sync-test
• add-stackers
• add-tool-definitions-extension-proposal
• add-toolhive-meta
• add-toolhive-meta-schema
• add-ubi-latest-tag
• add-usage-metrics-config-api-endpoint
• add-vmcp-host-port-flags
• add-vmcp-overrides-composite-e2e-tests
• add-vmcp-yaml-loader-transform-tests
• add-vmcp-yardstick-e2e-tests
• add-vulncheck
• add_vmcp_config
• adding-endpoints
• addports
• adds-auth-runconfig
• adds-codecov-exclusions
• adds-database-details
• adds-global-config-otel
• adds-kubernetes-registry
• adds-missing-tests
• adds-rbac-registry-server
• adds-release-pr-actions
• adds-release-tag-action
• adds-remote-proxy-int-tests
• adds-slack-alert-toolhive
• adds-subagents
• adds-tests
• adopt-env-from-toolhive-core
• adopt-httperr-from-toolhive-core
• adopt-validation-from-toolhive-core
• algisn-versions
• alternative-workaround
• api-e2e-concurrency-bug
• api-e2e-phase-i
• api-e2e-phase-ii
• api-e2e-phase-iii
• api-e2e-phase-iv
• api-e2e-phase-ix
• api-e2e-phase-v
• api-e2e-phase-vi
• api-e2e-phase-vii
• api-e2e-phase-viii
• api-e2e-state-cleanup
• api-e2e-testcontainer
• api-e2e-tests
• api-proxy-port
• aponce/optimizer-circuit-breaker-acceptance-test
• aponce/optimizer-multibackend-acceptance-test
• aponcedeleonch/rename-optimizer-examples
• aponcedeleonch/tei-batch-chunking
• aron/fix-oauth-issues
• aron/redis-tls-support
• aron/retoken-issue
• atomic-writes-file-locking-secrets
• audit-max-size
• audit-restore
• audit_docs
• audit_leak_shutdown
• auth-discovery
• auth-proxy-10-1-1-shared-discovery-types
• auth-proxy-multi-user-storage
• auth-proxy-oauth-userinfo
• auth-proxy-pr-1-storage
• auth-proxy-pr-10-1-handlers-infra
• auth-proxy-pr-10-2-1-client-cap-max
• auth-proxy-pr-10-2-2-dcr-harden
• auth-proxy-pr-10-2-handlers-token
• auth-proxy-pr-10-3-handlers-authorize
• auth-proxy-pr-10-4-handlers-dcr
• auth-proxy-pr-11-1-dedupe-and-relax-dcr
• auth-proxy-pr-11-config
• auth-proxy-pr-11-config-userinfo
• auth-proxy-pr-11-core-authserver
• auth-proxy-pr-11-key-management
• auth-proxy-pr-12-integration-test-1
• auth-proxy-pr-14-upstream-iface
• auth-proxy-pr-15-oidc-plumbing
• auth-proxy-pr-2-session
• auth-proxy-pr-3-client
• auth-proxy-pr-4-dcr
• auth-proxy-pr-5-upstream
• auth-proxy-pr-6-crypto
• auth-proxy-pr-7-1-oidc-methods
• auth-proxy-pr-7-oidc-1
• auth-proxy-pr-7-upstream-fetcher
• auth-proxy-pr-7-upstream-http-client
• auth-proxy-pr-7-upstream-http-error
• auth-proxy-pr-7-upstream-oauth
• auth-proxy-pr-8-in-memory-storage
• auth-proxy-pr-9-oauth2-server-config-jwks
• auth-refactored
• auth-server-addition-proposal
• auth-server-race-test
• auth-server_iss_234_2026-02-02
• auth-server_issue-226_2026-01-28
• auth-server_issue-227_2026-01-29
• auth-server_issue-229_2026-01-28
• auth-server_issue-230_2026-01-30
• auth-server_issue-230b_2026-01-30
• authenticated-token-source-monitoring
• authserver-oauth-constants
• authserver-respect-insecure-validation
• authz-filter-content-length
• authz-log-skip-on-auth-failure
• auto-add-remote-server-to-clients
• auto-update-branches
• autoupdate-permission-issue
• aws_sts-pr-1-cel
• aws_sts-pr-2-mapper
• aws_sts-pr-3-tokenexchange
• aws_sts-pr-4--sign
• aws_sts-pr-5-middleware
• aws_sts-pr-5a-middleware
• aws_sts-pr-5b-runner-wiring
• aws_sts-pr-6-fixups-fix-1-misc
• aws_sts-pr-6-fixups-fix-2-no-regex
• aws_sts-pr-6-fixups-fix-3-priorities
• aws_sts-pr-7-crds-v2
• backends_discovery_in_status
• bad_example
• bearer-token-api
• bearer-token-pr1-foundation
• bearer-token-pr2-secrets
• bearer-token-pr3-discovery
• bearer-token-pr4-unauthenticated-state
• bearer-token-pr6-cli-wire-up
• bearer-token-support-kubernetes
• bearer_auth
• bearer_token_util
• brand-refresh
• build-env-cli-templates
• build-env-config-foundation
• build-env-secrets-implementation
• build-env-secrets-proposal
• bump-arch-docs
• bump-codeowners
• bump-go
• bump-go-1-25-3
• bump-operator-versions
• bump-registry
• bump-yardstick-server
• cburns/2289-mcpremoteproxy-error-reporting
• cburns/2289-remaining-validations
• change-codecov
• change-default-proxy-mode-streamable-http
• change-default-proxy-mode-to-streamable-http
• change-otel-metric-defaults
• chart-crds-version
• chore/add-codeowners
• chore/add-skills-types
• chore/bump-toolhive-core-and-catalog
• chore/change-renovate-commit-msg
• chore/ci-task-ensure-docs-proposal-names-format
• chore/decouple-transport-from-runtime
• chore/e2e-labels-matrix
• chore/enable-parallel-lint-runners
• chore/fix-thv-2207-proposal-name
• chore/move-testkit-under-test
• chore/refactor-runconfig-builder-into-options
• chore/refactor-runconfigbuilder-to-option
• chore/rename-design-docs
• chore/use-testkit-client
• ci-arch
• ci-tidy-names
• ci-workflow-updates
• ci/add-renovate-config-validation
• claude-agent
• claude-commands_2025-10-21
• claude-helm
• claude-helm-skill
• claude-prompt-pr-split
• claude/issue-1452-20250827-1021
• claude/issue-2119-20251008-1230
• claude/issue-2385-20251030-1527
• claude/issue-2507-20251107-1918
• claude/issue-2643-20251118-2153
• claude_skills
• cleanup-pid-after-migration
• cleanup/client-filtering-followup
• cleanup/remove-dead-mcpserverconfig
• cli-practices-docs
• cli-registry-auth
• cli/thv-start-command
• client-list-consolidation
• client_id_not_required
• code-reviewer-agent
• complex-data
• composite-tool-refs-resolution
• concurrent-restart-keyring-race-condition
• config-map-ref
• config-refactor-phase2-validation
• configure-telemetry-namespace
• consistent-error-comparison
• consistent-workload-naming
• consolidate-pr-size-workflows
• containerfile-preflight
• continue-vmcp-crd
• contrib-guidelines-update
• converge-registry
• convert-reg-server-config-to-cm
• converts-mcpgroup-e2e-tests-to-int
• copilot/sub-pr-2906
• corrects-errors
• cosign_bundle_signing
• coveralls
• debug/stdio-operator-e2e
• decouple-configmap-operator
• default-callback-port
• default_mcp_port
• defaults-in-cli-docs
• delete-doc
• dependabot/github_actions/github/codeql-action-4
• dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.0.11
• dependabot/go_modules/github.com/olekukonko/tablewriter-1.1.0
• dependabot/go_modules/github.com/sigstore/rekor-1.5.0
• dependabot/go_modules/github.com/sigstore/sigstore-1.10.4
• dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.3.1
• dependabot/go_modules/github.com/theupdateframework/go-tuf/v2-2.4.1
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/sigs.k8s.io/controller-runtime-0.22.1
• dependencies/update-inspector
• deprecate-regup
• deprecated-fields
• disable-failing-vmcp-e2e
• disable-labels-for-forked-repos
• disable-selinux-labeling
• docs-update-remote-auth
• docs/add-mcpgroup-to-operator-arch
• docs/arch
• docs/clarify-docs-file-name-format
• docs/contributor-expectations
• docs/crd-overview-diagram
• docs/operator-e2e-tests-and-task-improvements
• docs/otel-telemetry-documentation
• docs/runconfig-proposal
• docs/runtime-authoring-guide
• docs/security-documentation
• docs/update-go-version
• docs/update-middleware-documentation
• docs/vmcp-architecture-updates
• document-spdx-headers
• domain-model-diagram
• downgrade-go-1.24
• drop-rh-ubi-images
• drop-test-silent
• drop-unused-fields
• dynamicwebhook1
• e2e_dedup
• e2e_less_boilerplate
• e2e_no_hardcoded_version
• edit-api-port-reuse
• enable-configmap
• enforce-structured-logs-k8s
• enforce-xl-pr-justification
• enhancement/Add-ExcludeAll-option-for-tool-filtering-in-VirtualMCPServer-aggregation
• ensure-version-output
• env-secrets
• envtest_pin
• error-handling-cleanup
• error-handling-linting
• error-levels-api
• error-levels-config-secret
• error-levels-logs-proxy
• error-levels-proxy
• error-levels-transport-telemetry-auth
• error-no-config
• exclude-mocks
• export-detail-api-inconsistencies
• extensible-runtime-registry
• external-auth-controller-impl
• fail-fast
• feat/add-continue-client
• feat/add-e2e-tests-for-tool-override-1515
• feat/add-kiro
• feat/add-proxy-mode-to-workload-api
• feat/add-tool-annotations
• feat/add-tool-middleware-config-to-cli
• feat/add-tool-middleware-config-to-http-api
• feat/add_debug_k8s_proxy
• feat/add_invalid_config_tests
• feat/add_k8s_vmcp_e2e_tests
• feat/add_missing_vmcp_k8s_docs
• feat/add_resource_url_k8s
• feat/add_tool_filter_mcptoolconfig
• feat/add_virtualmcpcompositetooldefinition_crd
• feat/add_vmcp_examples
• feat/add_vmcp_status
• feat/build-auth-files
• feat/cli-desktop-validation
• feat/config-field-framework
• feat/configurable-session-affinity
• feat/deprecate-sse-proxy-mode-for-stdio-transport
• feat/disable-workload-rbac
• feat/discover_auth
• feat/excludeall-vmcp-tools
• feat/hide-registered-clients-in-setup
• feat/improve-client-config-file-logic
• feat/inspector-auto-cleanup
• feat/interactive-wizard
• feat/issue-1638-configmap
• feat/issue-1638-state-storage
• feat/issue-2850-user-identity
• feat/issue-2980
• feat/issue-2980-backend
• feat/issue-2980-cli
• feat/issue-2980-composite-workflow
• feat/issue-2999
• feat/issue-3000
• feat/issue-3001
• feat/issue-3004
• feat/issue-3036-healthcheck
• feat/issue-3036-healthcheck-1
• feat/issue-3036-healthcheck-2
• feat/issue-3036-healthcheck-3
• feat/issue-3036-healthcheck-circuitbreaker
• feat/issue-3036-healthcheck-circuitbreaker-remove-unhealthy
• feat/issue-3036-healthcheck-partial-mode
• feat/k8s-configmap-runconfig-1638
• feat/make-registry-auth-configurable
• feat/mcp-backend-session-affinity
• feat/mcp-server-secrets-management
• feat/more_vmcp_tests
• feat/operator-audit-config
• feat/operator-authz-configmap
• feat/otel-use-config-framework
• feat/private-package-registries-proposal
• feat/registry-auth-serve-mode
• feat/registry-export-phase1
• feat/remove-tooltype-and-rename-createdat
• feat/remove-tooltype-field
• feat/request-body-size-limit
• feat/restart-mcpserver-annotation-1880
• feat/session-storage-http-streaming
• feat/session-storage-interface-phase2
• feat/session-storage-pluggable
• feat/skill-api-stubs
• feat/skill-cli-stubs
• feat/skill-clients-field
• feat/skill-install-git-refs
• feat/skill-install-git-refs-v2
• feat/skill-install-git-refs-v3
• feat/skill-installer
• feat/skill-oci-build-push
• feat/skill-stubs
• feat/sort-client-setup
• feat/status-command
• feat/sticky-sessions
• feat/sync_mvmcp_crd
• feat/telemetry-tool-error-capture
• feat/test_composite_tools
• feat/test_group_membership
• feat/test_vmcp_inline_auth
• feat/token-exchange-env-var
• feat/update-mcp-parser-latest-spec
• feat/vmcp-audit-log_output_destination
• feat/vmcp-elicitation-support
• feat/vmcp-routing-interfaces
• feat/vmcp_auth_strategies_incompatible
• feat/vmcp_binary
• feat/vmcp_composition_multistep
• feat/vmcp_composition_multistep_2
• feat/vmcp_controller_tests
• feat/vmcp_crd
• feat/vmcp_discovered_backend_tracking
• feat/vmcp_k8s_controller
• feat/vmcp_service
• feat/vmcp_status_collector
• feat/watch_vmcp_tool_composition
• feature/add-mcpremoteproxy-crd
• feature/client-skill-metadata
• feature/docker-workload-tests
• feature/github-oauth-provider
• feature/header-injection-auth
• feature/increase-session-ttl
• feature/mcpremoteproxy-implementation
• feature/oidc-env-secret-support-clean
• feature/remove-info-logger
• feature/secretkeyref-oidc
• feature/telemetry-configmap-support
• feature/toolconfig-crd
• fix--registry-remote-server-running
• fix-2466-auth-constants
• fix-3043-convert-secretgo-subcommands-from-run-to
• fix-3044-standardize-cli-output-messages-to-use-w
• fix-3048-improve-error-messages-with-actionable-r
• fix-3049-add-default-values-to-cli-flag-help-text
• fix-3108-ensure-toolhive-errors-are-wra-1229-0001
• fix-address-already-in-use-on-restart
• fix-api-timeout-large-images
• fix-api-validation-413
• fix-atlassian-issuer-mismatch
• fix-auditor-middleware-transport
• fix-auth-401-rfc6750-json-response
• fix-auth-flags-for-registry
• fix-build-ubi-image
• fix-chainsaw-install_2025-10-21
• fix-ci-docs
• fix-client-registration
• fix-converters
• fix-crd-doc-anchors
• fix-crd-docs
• fix-create-release-pr-stale-branch-cleanup
• fix-dashboard-uid
• fix-docker-restart
• fix-docs
• fix-double-pod
• fix-duplicate-listing
• fix-duplicate-operator-e2e-runs
• fix-duplicate-workload
• fix-encrypted-tests-context-deadline-exceeded
• fix-endpoint-ctx
• fix-flacky-tests
• fix-flaky-mcpremoteproxy-test
• fix-flaky-usagemetrics-test
• fix-flaky-vmcp-e2e-tests
• fix-git-test-race-condition
• fix-goose-client
• fix-goreleaser
• fix-group-case-insensitive
• fix-health-check-retry
• fix-host-networking
• fix-info-output
• fix-inspector
• fix-issuer
• fix-lint-issues
• fix-linter-cyclomatic-complexity
• fix-mcp-server-tests-no-runtime
• fix-mcpremoteproxy-health-probe-timing
• fix-mkp-example
• fix-mockgen
• fix-oauth-issuer-discovery
• fix-oauth-secret-empty-check
• fix-observedgeneration-composite-tool-fes
• fix-oci-tag-validation-use-library
• fix-oidc-discovery-race
• fix-operator-datarace-logger
• fix-operator-proxy-usage-metrics
• fix-port-issue
• fix-pr-size-workflow-yaml
• fix-proxy-mode
• fix-race-detector-test-failures
• fix-registry
• fix-registry-fallback-error
• fix-registry-info-custom-metadata
• fix-registry-schema-id
• fix-releaseo-bin-version
• fix-releaser-warns
• fix-remote-servers-tests
• fix-renovate-kindest-node-patch-only
• fix-restart
• fix-rfc7591-scope-format
• fix-runconfig-save-race-condition-on-workload-edit
• fix-scopes-type
• fix-serviceaccount-configmap-mode
• fix-silent
• fix-skill-and-installer-tests-using-real-temp-dir
• fix-skill-names-spec-compliance
• fix-spdy-eof-hang
• fix-sse-endpoint-rewrite-e2e-tests
• fix-staticcheck-nil-pointer
• fix-stdio-tests
• fix-swagger-embedded-struct-fields
• fix-thvignore-tmpcopyup
• fix-tool-call
• fix-trans
• fix-type-picking
• fix-ubi-image-arch
• fix-utilruntime-must
• fix-validate-oci-tag-or-reference
• fix-version-discrepency
• fix-vmcp-composite-tool-parameters-json-schema
• fix-vmcp-controller-readiness-check
• fix-vmcp-health-test-flakiness
• fix-vmcp-name-mapping-conflict-resolution
• fix-vmcp-output-config-yaml-parsing
• fix-vmcp-patch
• fix-vmcp-race
• fix-vmcp-schema-double-nesting
• fix-warns
• fix-workload-delete-race-condition
• fix/2314-mcpremoteproxy-reconcile-spec-changes
• fix/add-debug-logs-to-detached-process
• fix/auth_discovery_test
• fix/bump-go-1.25.7
• fix/ci-lint-and-test-timeout
• fix/ci-security-scan-workflow
• fix/ci-typecheck-and-keyctl-flake
• fix/cli-cmd-context-3045
• fix/configurable-health-check-4084
• fix/configurable-proxy-timeout-4061
• fix/container-exit-reconnection
• fix/crd-helm-release-namespace-annotation
• fix/ct-install-all-charts
• fix/dcr-audience-whitelist
• fix/dcr-refresh-token-grant
• fix/dcr-response-scope
• fix/default-registry-format
• fix/defensive_auth
• fix/discovery-cache-partial-results
• fix/e2e-proxy-sse-test-failures
• fix/e2e_test_conflict
• fix/egress-proxy-arm64-build
• fix/env-var-nil-pointer-1469
• fix/error-wrapping-cli
• fix/fix-authz-middleware-tools-list
• fix/fix-authz-tools-list
• fix/fix-sse-response-processor-rewrite
• fix/flaky-cleanup-loop-test
• fix/flaky-e2e-lifecycle-tool-discovery
• fix/flaky-e2e-port-allocation-race
• fix/flaky-proxy-port-test
• fix/flaky-registry-api-image-test
• fix/go-version-1.25.6-vulnerabilities
• fix/goreleaser-cli-docs-path
• fix/gosec-lint-nosec-annotations
• fix/health-check-zombie-process
• fix/helm-chart-publish-path
• fix/histogram-bucket-boundaries
• fix/host-header-rewriting
• fix/issue-1874-proxy-mode
• fix/issue-1957-oidc-issuer-mismatch
• fix/issue-2843
• fix/jsonschema-v6-upgrade
• fix/keyctl-password-retry-3332
• fix/log-middleware-names
• fix/mcpserver-auth-audit-persistence
• fix/mcpserver-crd-size-reduction
• fix/mcpserver-remote-path
• fix/mcpserver-url-proxymode
• fix/middleware-flusher-interface
• fix/move_vmcp_e2e_tests
• fix/nil-pointer-panic-protocol-scheme-3940
• fix/oauth-token-refresh-context-cancellation
• fix/openshift-serviceaccount-secret-accumulation
• fix/operator-context-aware-logging
• fix/otel-insecure-config
• fix/otel-service-version-runtime
• fix/otel-workload-name-as-service-name
• fix/persist-dcr-credentials
• fix/persist-oauth-tokens
• fix/preload-yardstick-image-operator-e2e
• fix/prm-scope-defaults
• fix/proposal-naming-validation-for-updates
• fix/proxy-connection-health-monitoring
• fix/proxy-mode-sse-label
• fix/proxy-port-consistency
• fix/proxy-shutdown-followups
• fix/proxy-shutdown-mutex-3969
• fix/proxy-stale-connection-3179
• fix/proxyrunner-syncmap-oom-4062
• fix/proxyrunner-tools-override-middleware
• fix/recovery-abort-handler
• fix/recovery-middleware-errAbortHandler
• fix/referencing-servers-status-2641
• fix/release-workflow-create-missing-release
• fix/remote-e2e-mock-mcp-server
• fix/remote-server-stability
• fix/remote-workload-health-status-callback
• fix/remote-workload-url-population
• fix/remove-pointer-to-interface-2169
• fix/remove_header_value_env
• fix/remove_mixed_mode
• fix/remove_token_cache_config
• fix/renovate-kindest-node-patch-only
• fix/security-md-casing-local
• fix/set-correct-content-length
• fix/skill-install-resolve-local-store
• fix/speed_e2e_tests
• fix/squid-error-loop
• fix/staticcheck-sa5011-nil-pointer
• fix/streamable-session-lazy-channels
• fix/test_backend_health
• fix/token_exchange_crds
• fix/tool-middleware-connection-hang
• fix/tool-middleware-json-buffer-flushes
• fix/userinfo-omitempty
• fix/vmcp-backend-capability-name-translation
• fix/vmcp-config-ergonomics
• fix/vmcp-embedded-resource-content
• fix/vmcp-parameter-defaults
• fix/vmcp-podtemplatespec-infinite-reconcile
• fix/vmcp-trace-context-propagation
• fix/wait-for-initialize-before-client-update
• fix/waitforpodsready-logic-bug
• fix/www-authenticate-scope
• fix/yaml-unmarshal-embedded-structs
• fix/zombie-process-detection
• fix/zombie-supervisor-processes
• fix_anonymous_auth
• fix_audit_user
• fix_ci
• fix_ci_oauth
• fix_e2e_lifecycle_tests
• fix_git_clone
• fix_gitpath
• fix_logging
• fix_registy_api
• fix_used_port
• fixes-e2e-tests
• fixes-flaky-order-assertion
• fixes-flaky-test
• fixes-mocks
• fixes-release
• fixes-test-port
• fixes-tests
• flag-shorthands
• gives-claude-permissions-write
• go-24-dev-guide
• go-mod-tidy
• golang-build-ubi
• google-oauth
• goose
• goreleaser-cosign-v3
• groups-crd-storage
• groups-integration-for-skills-3654
• groups-registry-alt
• groups-registry-proposal
• hack/fix-mcp-port-host-network-linux
• header-pass-1-middleware
• header-pass-2-runconfig
• header-pass-3-cli
• header-pass-4-crds
• header-pass-5-crds
• helm-chart-contributing
• hide-coverage
• identity-unify
• idiomatic-async-handling
• ignore-coverage
• imageignore
• implement-proper-health-checks
• implements-providers-strategies
• improve-optimizer-tool-descriptions
• improve-secrets-decrypt-error-logging
• improve-test-coverage-and-fix-label-validation
• includes-vmcp-renovate
• incorrecttransport
• inherit-secret-codecov
• inline-crds
• installs-go-claude
• int-tests
• integration-tests-fix
• iss-3599_upstream-token-exchange
• issue-1638-add-configmap-flag
• issue-1638-add-proxymode
• issue-1638-configmap-add-audit
• issue-1638-configmap-add-authn
• issue-1638-configmap-add-authz
• issue-1638-configmap-use
• issue-1638-use-configmap
• issue-1696-v1
• issue-1700
• issue-1717
• issue-1871
• issue-1873
• issue-1873-v1
• issue-1898
• issue-1941
• issue-1947
• issue-2114
• issue-2114-telemetry
• issue-2117
• issue-2166
• issue-2623-alternate
• issue-2640
• issue-2660
• issue-2680
• issue-2772
• issue-2781-vmcp-debug-level
• issue-2784
• issue-2784-followup
• issue-2786-centralize-e2e-images
• issue-2831
• issue-2838
• issue-2854-status-reporter
• issue-2873-vmcp-default-resources
• issue-2941
• issue-2985
• issue-3003
• issue-3003-v1
• issue-3016
• issue-3018
• issue-3036
• issue-3036-v1
• issue-3036-v1-fix
• issue-3036-v1-fix1
• issue-3036-v1-new
• issue-3036-v2
• issue-3062
• issue-3097
• issue-3109
• issue-3147
• issue-3147-status-reporter
• issue-3147-v1
• issue-3149
• issue-3149-v1
• issue-3149-v2
• issue-3149-v3
• issue-3149-v4
• issue-3168
• issue-3360
• issue-3360-remove-webhooks
• issue-3676-runtime-image-api
• issue-3731/sqlite-fts5-store
• issue-3731/toolstore-interface
• issue-3732/semantic-search-store
• issue-3733/pr1-auto-deploy-embedding-v2
• issue-3733/pr2-real-tei-client
• issue-3762/search-config-params
• issue-3865
• issue-3865-v1
• issue-3866
• issue-3866-v1
• issue-3867
• issue-3867-v1
• issue-3867-v2
• issue-3867-v3
• issue-3867-v4
• issue-3870
• issue-3871
• issue-3872
• issue-3874
• issue-3875
• issue-3876
• issue-3985
• issue-772-remove-none-secrets-provider
• issue_156_2025-11-13
• issue_156_docs_2025-11-14
• issue_176_2025-11-20
• issue_2503_2025-11-17
• issue_2623_2025-11-17
• issue_2714_2025-11-25
• issue_2771_2025-12-01
• issue_3628_as-redis-token-storage
• issue_3629_as-redis-integration-tests
• issue_3630_as-controller
• issue_3790_as-redis-docs
• issue_3792_as-crd
• issuer-mistmatch
• jaormx/skill-concurrency-protection
• jaormx/skill-md-parser-validator
• jaormx/skill-state-management
• jaormx/skills-api-e2e-tests
• jaosorior/add-toolhive-release-skill
• jaosorior/custom-package-mirrors-proposal
• jaosorior/skill-api-contract-changes
• jaosorior/skill-service-api-handlers
• jaosorior/skills-http-client
• jaosorior/sqlite-skill-store-factory-wiring
• jaosorior/vmcp-composition-workflow-engine
• jd/vmcp-default-resource-limits
• jerm/2025-12-16-fix-docs
• jerm/2025-12-17-docs-for-errors
• jerm/2025-12-18-fix-config-plumbing
• jerm/2025-12-22-fix-typing
• jerm/2025-12-23-delete-raw-config
• jerm/2025-12-23-fix-annotation-patching
• jerm/2025-12-23-remove-large-file
• jerm/2026-01-05-camelCaseConfig
• jerm/2026-01-06-add-vmcp-config-to-spec
• jerm/2026-01-06-migrate-audit
• jerm/2026-01-06-migrate-basic-config
• jerm/2026-01-06-migrate-telemetry
• jerm/2026-01-07-api-error-handler
• jerm/2026-01-07-recovery-middleware
• jerm/2026-01-08-fix-doc-gen
• jerm/2026-01-08-fix-generate-all-types
• jerm/2026-01-09-remaining-migrations
• jerm/2026-01-12-fix-samplingRate
• jerm/2026-01-13-config-for-optimizer
• jerm/2026-01-13-optimizer-in-vmcp
• jerm/2026-01-14-config-todo-cleanup
• jerm/2026-01-15-vmcp-optimizer-integration
• jerm/2026-01-16-telem-migrate-2
• jerm/2026-01-21-fix-3383
• jerm/2026-01-21-test-failures
• jerm/2026-01-22-fix-wait-for-sts
• jerm/2026-01-26-fix-deployment-loop
• jerm/2026-01-27-fix-authz-dropped
• jerm/2026-01-28-deploy-vmcp-locally-skill
• jerm/2026-01-28-fix-composite-tool-validate
• jerm/2026-02-05-fix-3636
• jerm/2026-02-06-add-tool-call-labels
• jerm/2026-03-09-testing-optimizer-composite-tools
• jerm/arguments-supports-types
• jerm/composite-tools-default-results
• jerm/debugging-flakes
• jerm/fix-2761
• jerm/fix-foreground-shutdown
• jerm/fix-graceful-shutdown
• jerm/fromjson
• jerm/improving-asserting
• jerm/jerm/refactor-telemetry-conversion
• jerm/maybe-deflake-tests
• jerm/support-structured-content
• jerm/vmcp-o11y
• jesseo.colima-runtime-support
• json-escape-issue
• k8s-ca-certs
• k8s-groups_2025-10-15
• k8s-util-digest
• k8s_and
• k8s_registry
• kill-patch-coverage
• kind-dns-issues
• labels-workflow
• lazy_discovery
• lint-cache
• lint-fix
• list-filtering
• lock-file-cleanup
• log-api-response-limit
• log-limit-take-ii
• logger
• logging-guidelines
• main
• maintainers
• make-remote-healthcheck-optional
• mcp-auto-transport-fallback
• mcp-optimizer-hide
• mcp-remote-proxy-int-tests
• mcpregistry-configmap-label-selector-proposal
• mcpremoteproxy-group-discovery
• mcpremoteproxy-status-conditions
• merge-integration-tests
• meta-mcp-in-registry
• migrate-pid-files
• migrate-pid-files-iii
• migrate-proposals-to-rfcs-repo
• migrate-secret-empty
• migrate_oauth_config
• misc
• missed-main-test
• mockgen-install
• mocks-for-skills
• move-crds-to-crds-directory
• move-packages
• move-verifier
• move-workload-update-logic-into-manager
• moves-configmap-retrieval
• moves-e2e-ext-auth-test-to-int-test
• moves-tool-config
• multi-cm-source
• multi-ds-operator
• multiple-rm-arguments
• multiple-rm-stop-arguments
• network-isolation-e2e
• no_best_effort
• no_local_auth_in_k8s
• no_pass_through
• oauth-proxy-simple-redirect-check
• oauth/mcp-wellknown-uri-fallback
• oci-pull-install
• oidc-registration-endpoint-fallback
• oidc_refactor
• op-img-micro-to-minimal
• opencode-client
• operator-bearer-token-crd-types
• operator-build-epel10-golang-update
• operator-crds-optional-virtualmcp
• operator-feature-flags
• operator-surface-reconcile-errors
• operator-zap-init
• optimize-e2e-workflow-binary-build
• optimizer-enablers
• optimizer-examples-and-nits
• optimizer-implementation
• optimizer-integration
• optimizer-metrics-and-logs
• optimizer-pr3-docs
• optimizer-token-metrics
• optimizer/add-logging
• optimizer/remove-score-field
• otel-custom-attributes
• otel-defaults
• otel-example
• otel-skill
• otel/add-standard-metrics
• otel/add-use-legacy-attributes-flag
• otel/client-spans-trace-injection
• otel/code-quality-b3-b6-b10-t1
• otel/fix-telemetry-bugs-b1-b2-b4
• otel/meta-trace-context-s1
• otel/pr1-span-attributes
• otel/pr2a-attribute-rename
• otel/pr2a-attribute-rename-v2
• otel/pr2a-feature-flag-legacy
• otel/pr2b-new-attributes
• otel/pr2b-new-attributes-v2
• otel/propagation-foundation
• otel/redact-config-headers
• otel/spec-compliance-s2-s4-s5-s6
• otel/standard-metrics-attributes
• otel/vmcp-client-spec-compliance
• path-clean-windows-destination
• pgpass-improvements
• pid-file-private
• pid-in-state-file
• pid-in-state-file-ii
• pins-envtest
• pins-registry-server-image
• poc
• poc-faster-build
• podtemplate-registry
• podtemplate-spec-registry
• podtemplate-user
• port-auth-cm-e2e-test
• port-authz-cm-ref-e2e-test
• port-examples
• port-validation
• post_review
• pr-3272
• pr1-annotation-context-authorizer
• pr2-secret-aware-hash-and-watching
• preserve-release-actor
• prm_discovery
• prm_no_jwks_uri
• prm_with_path
• proposal-mcp-registry-upstream-support
• proposal/deployment-architecture-k8s
• proposal/dynamic-webhook-middleware
• proposal/kubernetes-registry-source
• proposal/operator-registry-gateway-api-integration
• proposal/operator-valkey-integration
• proposal/remote-mcp-proxy
• proposal/shared-key-auth-localhost
• proposal/virtual-mcp-server
• proxy-header
• proxy-log-context-cancel
• proxy-refactor-shared-logic
• proxymode-direct-transports
• pvc-source
• race-condition
• re-run-sizer
• rebalance-e2e-test-matrix
• refactor-atomic-write-to-fileutils
• refactor-config-editor-file-locking
• refactor-config-map
• refactor-rbac
• refactor-rbac-operator
• refactor-remoteproxy-int-tests
• refactor-sse-processor
• refactor-status-collector
• refactor-telemetry
• refactor-telemetry-runconfog
• refactor/auth-resolution-logic
• refactor/ca-cert-config-pattern
• refactor/consolidate-k8s-client
• refactor/consolidate-oauth-package
• refactor/docker-api-adapter-tests
• refactor/extract-common-controller-helpers
• refactor/move-git-package
• refactor/move-remote-auth-to-auth-package
• refactor/optimizer-extract-internal-packages
• refactor/phase1-extract-common-helpers
• refactor/rename-mcp-client-config
• refactor/rename-mcp-client-to-ai-client
• refactor/typed-backend-auth-strategy
• refactor/use-defaultAuthzKey-constant
• refactor_proposal
• refines-helm-chart-process
• refines-helm-publish
• reg-server-configmap
• reg-server-configmap-operator
• reg-server-git-auth
• registry-auth-proposal
• registry-docs
• registry-e2e-test-updates
• registry-groups-updated
• registry-health-check-fix
• registry-server-config
• registry-server-config-type
• registry-service-and-error-handling
• registry-updates
• registry-validation-and-errors
• registry_apisource
• registry_cm
• registry_crds
• registry_filter
• registry_fix_sync
• registry_githandler
• registry_no_serverCount
• registry_promote
• registry_sync
• registry_tests
• reinstate-stale-config-fix
• release/v0.10.1
• release/v0.10.2
• release/v0.11.0
• release/v0.11.1
• release/v0.11.2
• release/v0.8.3
• release/v0.9.0
• release/v0.9.1
• release/v0.9.2
• release/v0.9.3
• release/v0.9.4
• releaser-thv-fix
• relocate-monitor-errors
• remote-health-checks
• remote-mcp-server-health-check-failure
• remote-mcp-server-restart-fix
• remote-server-apis
• remote-server-proxy-url-in-list
• remote-workload-proxy-stuck
• remote-workload-restart-port-bind
• remote-workload-spurious-warning
• remove-background-context
• remove-flag-driven-oidc
• remove-get-claims-from-context
• remove-helm-chart-skill
• remove-invalid-apply-rbac-verb
• remove-legacy-converters
• remove-old-converter
• remove-old-status-methods
• remove-registry-api
• remove-run-from-interface
• remove-secret-provider-depdendency
• remove-startup-migrations
• remove-steptype-conditional
• removes-auto-sync-operator
• removes-binary
• removes-datasources
• removes-duplicated-configmap
• removes-e2e-test-configmap
• removes-e2e-tests-authz-configmap
• removes-filters
• removes-flag-driven-config-more
• removes-flag-driven-config-patch
• removes-flags-proxyrunner
• removes-not-allowed-item
• removes-otel-test
• removes-registry-server-image-loading
• removes-retryo-on-conflict
• removes-test-integartion-verbosity
• removes-unused-flags
• removes-unused-functions
• rename
• rename-registry-type
• renames-test-suites
• reno
• renovate-go-mod-tags
• renovate/actions-cache-5.x
• renovate/actions-cache-digest
• renovate/actions-checkout-6.x
• renovate/actions-checkout-digest
• renovate/actions-download-artifact-digest
• renovate/actions-github-script-8.x
• renovate/actions-setup-go-6.x
• renovate/actions-setup-go-digest
• renovate/actions-setup-python-6.x
• renovate/actions-setup-python-digest
• renovate/actions-upload-artifact-digest
• renovate/add-kindest-node-patch-updates
• renovate/alpine-3.x
• renovate/anchore-sbom-action-0.x
• renovate/anthropics-claude-code-action-digest
• renovate/aquasecurity-trivy-action-0.x
• renovate/aws-sdk-go-v2-monorepo
• renovate/docker-build-push-action-6.x
• renovate/docker-login-action-3.x
• renovate/docker-metadata-action-5.x
• renovate/docker-setup-buildx-action-3.x
• renovate/dockerfile-template-base-images
• renovate/ghcr.io-stacklok-thv-registry-api-0.x
• renovate/github-codeql-action-4.x
• renovate/github.com-1password-onepassword-sdk-go-0.x
• renovate/github.com-cedar-policy-cedar-go-1.x
• renovate/github.com-charmbracelet-bubbletea-1.x
• renovate/github.com-charmbracelet-lipgloss-2.x
• renovate/github.com-docker-docker-28.x
• renovate/github.com-go-chi-chi-v5-5.x
• renovate/github.com-go-git-go-billy-v5-5.x
• renovate/github.com-go-git-go-git-v5-5.x
• renovate/github.com-go-jose-go-jose-v3-4.x
• renovate/github.com-gofrs-flock-0.x
• renovate/github.com-golang-jwt-jwt-v5-5.x
• renovate/github.com-google-go-containerregistry-0.x
• renovate/github.com-lestrrat-go-httprc-v3-3.x
• renovate/github.com-lestrrat-go-jwx-v3-3.x
• renovate/github.com-mark3labs-mcp-go-0.x
• renovate/github.com-modelcontextprotocol-registry-1.x
• renovate/github.com-olekukonko-tablewriter-1.x
• renovate/github.com-onsi-ginkgo-v2-2.x
• renovate/github.com-onsi-gomega-1.x
• renovate/github.com-pressly-goose-v3-3.x
• renovate/github.com-prometheus-client_golang-1.x
• renovate/github.com-redis-go-redis-v9-9.x
• renovate/github.com-santhosh-tekuri-jsonschema-v5-6.x
• renovate/github.com-sigstore-sigstore-go-1.x
• renovate/github.com-sigstore-sigstore-go-digest
• renovate/github.com-spf13-cobra-1.x
• renovate/github.com-spf13-pflag-1.x
• renovate/github.com-spf13-viper-1.x
• renovate/github.com-stacklok-toolhive-catalog-0.x
• renovate/github.com-stacklok-toolhive-core-0.x
• renovate/github.com-swaggo-swag-v2-2.x
• renovate/go.uber.org-zap-1.x
• renovate/golang-1.x
• renovate/golang.ngrok.com-ngrok-v2-2.x
• renovate/golang.org-x-crypto-0.x
• renovate/golang.org-x-exp-jsonrpc2-digest
• renovate/golang.org-x-mod-0.x
• renovate/golang.org-x-net-0.x
• renovate/golang.org-x-oauth2-0.x
• renovate/golang.org-x-sync-0.x
• renovate/golang.org-x-sys-0.x
• renovate/golang.org-x-term-0.x
• renovate/golang.org-x-time-0.x
• renovate/golangci-golangci-lint-action-9.x
• renovate/goreleaser-goreleaser-action-7.x
• renovate/helm-chart-testing-action-2.x
• renovate/helm-kind-action-1.x
• renovate/helm-kind-action-digest
• renovate/k8s.io-utils-digest
• renovate/kindest-node-1.x
• renovate/kindestnode-patch-versions
• renovate/kubernetes-go
• renovate/kyverno-action-install-chainsaw-0.x
• renovate/major-dockerfile-template-base-images
• renovate/major-github-artifact-actions
• renovate/modernc.org-sqlite-1.x
• renovate/opentelemetry-go-monorepo
• renovate/peter-evans-create-pull-request-8.x
• renovate/peter-evans-create-pull-request-digest
• renovate/python-3.x
• renovate/registry.access.redhat.com-ubi10-go-toolset-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-micro-10.x
• renovate/registry.access.redhat.com-ubi10-ubi-minimal-10.x
• renovate/sigs.k8s.io-controller-runtime-0.x
• renovate/sigstore-cosign-installer-3.x
• renovate/sigstore-cosign-installer-4.x
• renovate/slackapi-slack-github-action-2.x
• renovate/stacklok-releaseo-0.x
• research-141
• research-67
• retrydelay_harden
• revert-2882-renovate/alpine-3.x
• revert-3711-release/v0.9.3
• revert-accidental-merge
• revert-signal-handler
• revert_py3.14
• reverts-cosign-installer-bump
• reverts-mocks
• review_model
• rfc8707
• rm-dependabot
• rm-docker-img-manager
• rotate-kindest-images
• runner-bearer-token-secret-resolution
• runtime-tagged-images
• schema/add-tool-definitions
• scope_strategy
• scopes-cli
• scopes-k8s
• scopes-vmcp
• scopes_advertising
• secrets-k8s-helpers
• shared-helpers
• signing-key-alg_2026-02-06
• simplify-verifier
• single-workload-list
• skill-cli-lifecycle-commands
• skill-cli-packaging-commands
• skill-cli-read-commands
• skill-tweak
• skills-api-handlers-3651
• skills-mcp
• skip-mocks
• skip-update
• slog-api
• slog-auth-authz
• slog-authserver
• slog-container-config
• slog-final-cmd-cleanup
• slog-leaf-packages
• slog-runner
• slog-services
• slog-transport
• slog-vmcp
• spdx-headers-middleware
• spec-generation
• speed-up-ci-unit-tests
• speeds-e2e-tests
• speeds-e2e-tests-operator
• split_out_podtemplate
• sse-channel-full
• state-management-bug
• status-endpoint
• stop-reading-pid-files-tests
• stop-writing-to-pids
• strip-endpoint-prefix-from-request-paths
• suppResourceLink
• support-colima
• support_orbstack
• swagger-update-registry
• swap-zap-for-slog
• task-docs-helm
• task-test-fail-only
• te-token
• telemetry-providers
• telemetry-refactor
• temp-disable-e2e-test
• test-filtering
• test/add-testkit
• test/docker-high-roi
• test/token-exchange-integration
• test_timeout
• tests/docker-runtime-query-coverage
• thv-k8s-rework
• thv-proxy-remote-bearer-file
• thv-proxy-swap
• thv-registry-api
• thv-registry-api-file
• thv-registry-deploy-from-controller
• thv-registry-enforce
• thv-te-cli
• thv-te-iface
• thv-te-mware
• thv-te-proposal
• thv-vmcp-minor
• thv-vmcp-te
• toml-array-of-tables
• toml-client-configs
• toml-nested-tables
• toml-support
• tool-annotations-propagation
• tracing-operatpr
• trae-ide-client
• transport-interface-methods
• transport-mock
• trigger-docs
• typo
• unified-workload-manager
• unit-test-failure-client
• unit-test-race-condition-auth-server
• unpins-registry-server
• unused-registry-message
• update-alpine-base
• update-claude-code-action
• update-codeowners
• update-converters
• update-docs-workflow
• update-error-levels-client
• update-error-levels-group-build
• update-error-levels-workload
• update-inspector
• update-k8s-examples
• update-k8s-test-versions
• update-maintainers
• update-mcp-agent-spec-2025-11-25
• update-mcp-protocol-expert-2025-11-25
• update-mcp-protocol-expert-agent
• update-operator-crds
• update-readme
• update-readmes
• update-registry-from-release
• update-swaggo
• update-task-helm-deployment
• update-toolhive-expert-agent
• update-upstream-registry-schema
• update-workload-context-cancellation
• updates-registry-int-tests
• upgrade-go
• upgrades-golang
• upstream-refresh/0-middleware-401
• upstream_registry
• use-extension-types
• use-new-update-url
• use-package-distribution
• use-status-file-for-pids
• use-ubuntu-slim-runners
• use_thv_client_secret
• validate-composite-tool-ref-status
• validate-group-case
• validate_headers
• vault-annotations
• vault-te-proposal
• vault_fix
• version-file
• vmcp-capability-merging-routing
• vmcp-composite-workflow-integration
• vmcp-conflict-resolution
• vmcp-external-auth-discovery
• vmcp-handler-extract
• vmcp-integration
• vmcp-local-deploy
• vmcp-partial-capabilities
• vmcp-rbac-mcpremoteproxies
• vmcp-server-shutdown-error
• vmcp/add-cache-and-registry-tests
• vmcp/capability-discovery
• vmcp/cli-serve-command-and-session-management
• vmcp_auth
• vmcp_no_req_client_secret_env
• vmcp_operational_fix
• vmcp_out_strategies
• vscode-server-config
• vuln
• warn-secret-users-on-update
• webhook-marker
• work-around-stale-config
• workaround-session-mcp-go
• workload-log-cleanup
• workload-manager-tests
• workload-name-validation
• worktree-agent-a1f9c7fe
• worktree-agent-a692c1e3
• worktree-pr-template
• wrap-crds
• wrong-place
• yaml-v3
• zed

Build # 22763470758

Build Type

Pull #4034

github

Committed by web-flow

Commit Message

Merge 610802250 into 3aefbc8bc

Pull Request Pull Request #4034: Harden CI workflows against prompt injection and supply chain attacks

Run Details

47105 of 73743 relevant lines covered (63.88%)

76.09 hits per line