From 2f53346b8cebee8875f70ac948748ca149cb3264 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 7 Sep 2026 22:21:10 +0200 Subject: [PATCH] docs(check): say plainly that CI can never verify the MCP env wiring infra#368 added jq to the gitea-runner image on the stated grounds that check-mcp-env would then verify in CI instead of skipping. Verified after rolling baked-v16: jq IS present now, the `SKIP: jq not installed` branch is gone -- and the check still reports unverified, because CI has no ~/.op-env. The env-file branch was always the binding one. It holds live credentials, so it is not on the runner and must not be, which means this check can only ever verify on a host that has one. Putting ~/.op-env on the runner to turn the NOTE green would be trading a real secret for a green tick. So the message now says so, at the point someone reads it. The risk otherwise is not the skip -- it is a future reader seeing a passing pipeline and concluding the MCP wiring is covered. It is covered on developer hosts only. jq was still worth adding: it is a genuine dependency of this checker, the runner's tool-contract.txt now asserts it, and a future image built without it is a red pod at roll time rather than a silently degraded check. Bump-Type: patch Co-Authored-By: Claude Opus 5 --- bin/check-mcp-env | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/bin/check-mcp-env b/bin/check-mcp-env index b20d8e7..a46d151 100755 --- a/bin/check-mcp-env +++ b/bin/check-mcp-env @@ -41,7 +41,17 @@ if [ ! -f "$CONFIG" ]; then fi if [ ! -f "$ENVFILE" ]; then + # EXPECTED IN CI, and permanently so. The env-file holds live credentials, so + # it is not on the runner and must not be -- which means this check can only + # ever verify on a host that has one. infra#368 added jq to the runner image + # believing that would let CI verify; it removed the jq branch below and + # changed nothing else, because this branch is the binding one. + # + # Said plainly so nobody concludes CI covers this. It does not, it cannot, + # and putting ~/.op-env on the runner to make it would be trading a real + # secret for a green tick. echo "ERROR: no such env-file: $ENVFILE -- cannot verify MCP variables" >&2 + echo " (expected in CI: this check only verifies on a host with ~/.op-env)" >&2 exit 2 fi