mathias/gitea-mcp

Fork 0

T

mathiasandClaude Sonnet 5 43714047be

CD / Lint / Test / Vet (push) Successful in 9s

Details

CD / Build & Import (push) Successful in 25s

Details

CD / Deploy via GitOps (push) Has been skipped

Details

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59 )

Allowlist.Check now takes ctx: when the caller authenticated with
their own Gitea PAT (pass-through, v0.12.0), it skips the static
GITEA_MCP_ALLOWED_OWNERS check entirely — Gitea's own permission
model already gates that caller's access more precisely than a coarse
owner-name list can. The static list still applies unchanged for the
shared static-token/JWT path, where it's the only defense against the
service token's blast radius.

Mechanical: every tool call site already had ctx in scope, so this is
a signature-only change at 41 call sites, no other tool behavior
changes. Closes the "Deferred" item from #59.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-22 08:31:43 +02:00

.context

chore(context): re-sync adapters from root AGENT.md (skills → mathias/skills repo)

2026-07-04 00:39:35 +02:00

.gitea/workflows

ci(cd): skip docs-only pushes; move HOW_GITEA_MCP_WORKS into docs/

2026-07-07 00:43:46 +02:00

.githooks

chore: adopt trunk-based development

2026-05-17 09:44:52 +02:00

.skills

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

cmd/gitea-mcp

feat(auth): per-caller Gitea PAT pass-through (#59 )

2026-07-22 08:22:50 +02:00

docs

ci(cd): skip docs-only pushes; move HOW_GITEA_MCP_WORKS into docs/

2026-07-07 00:43:46 +02:00

internal

fix(auth): owner allowlist trusts pass-through-authenticated callers (#59 )

2026-07-22 08:31:43 +02:00

scripts

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.aider.conf.yml

feat(auth): JWT-or-static middleware + /.well-known/oauth-protected-resource (issue #5 )

2026-05-12 11:30:52 +02:00

.aider.conventions.md

chore(context): re-sync adapters from root AGENT.md (skills → mathias/skills repo)

2026-07-04 00:39:35 +02:00

.cursorrules

chore(context): re-sync adapters from root AGENT.md (skills → mathias/skills repo)

2026-07-04 00:39:35 +02:00

.gitignore

feat: initial scaffold with /healthz

2026-05-04 20:13:41 +02:00

AGENTS.md

chore(context): re-sync adapters from root AGENT.md (skills → mathias/skills repo)

2026-07-04 00:39:35 +02:00

CLAUDE.md

chore(housekeeping): canonical git.d-ma.be host + honest version string

2026-07-03 23:58:34 +02:00

Dockerfile

build(version): inject real build version via ldflags (#47 )

2026-07-04 08:28:05 +02:00

go.mod

feat(auth): trust the k8s cluster OIDC issuer for ServiceAccount tokens (ADR-0011 D1)

2026-07-07 00:16:39 +02:00

go.sum

feat(auth): trust the k8s cluster OIDC issuer for ServiceAccount tokens (ADR-0011 D1)

2026-07-07 00:16:39 +02:00

README.md

chore: adopt trunk-based development

2026-05-17 09:44:52 +02:00

Taskfile.yml

chore: adopt trunk-based development

2026-05-17 09:44:52 +02:00

README.md

gitea-mcp

Streamable HTTP MCP service exposing Gitea repo operations to Claude apps. See ~/dev/AI/infra/docs/superpowers/specs/2026-05-04-gitea-mcp-gitops-workflow-design.md.

Quickstart

task setup:hooks   # installs .githooks/pre-push — runs task check before every push
task check         # context sync + lint + test + vet
task build         # produces bin/gitea-mcp

This repo uses Trunk-Based Development. Commit directly to main. The pre-push hook enforces the quality gate locally; CI re-runs task check on every push.