[lilyshen0722]

Hold: press after launch. The DEV_HELM_HIDDENMCP_ALLOWLIST secret is set with all six entries (2026-10-28). Before this merges it does nothing, since nothing reads it yet.

Deploy Dev writes hostedMcp.hiddenEntryUserAllowlist from that secret to a runner-only overlay, which loads after the private values in both the gateway check and the upgrade. The value leaves values-dev.yaml. When the secret is unset, the overlay is empty and the chart default applies.

Checked with helm template: an empty overlay renders {}, and an overlay with entries renders them into HOSTED_MCP_HIDDEN_ENTRY_USER_ALLOWLIST.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MDs9DRK3nqxjeAV7xL8uhg

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Team-Commonly/commonly
• Branch: chore/instance-values-overlay
• File: .coderabbit.yaml
• Commit: 47f9892
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: e9b99750-5830-46a8-b8b3-a1fa35ba95d3

Commits

Reviewing files that changed from the base of the PR and between 45aafe8 and 47f9892.

Files selected for processing: 1

• k8s/helm/commonly/values-dev.yaml

Files with no reviewable changes: 1

• k8s/helm/commonly/values-dev.yaml

Limit details: You’ve used all 10 included reviews currently available.

Walkthrough

Deploy Dev now loads the hosted-MCP allowlist from a runner-only values overlay. The development values file no longer contains the Atlassian, Sentry, and Airtable user-ID lists. The workflow applies the overlay to its gateway template check and Helm upgrade.

Changes: Hosted-MCP allowlist deployment

Layer / File(s)	Summary
Move allowlist to runner overlay .github/workflows/deploy-dev.yml, k8s/helm/commonly/values-dev.yaml	The workflow creates allowlist.yaml from DEV_HELM_HIDDENMCP_ALLOWLIST. When the secret is unset, the chart default ({}) applies. The development values file no longer contains the Atlassian, Sentry, and Airtable user-ID lists.
Apply overlay to gateway deployment .github/workflows/deploy-dev.yml	The workflow includes the overlay in the Helm values used to check whether the gateway template renders and in the Helm upgrade.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related issues

• Team-Commonly/commonly#2168: The issue concerns access gates for hidden hosted-MCP entries. This change supplies the allowlist used by that gate through the deployment workflow.

Possibly related PRs

• Team-Commonly/commonly#2649: Defines the allowlist setting that this change supplies through a runner-only overlay.
• Team-Commonly/commonly#2705: Changes the gateway check and upgrade logic in the same workflow.
• Team-Commonly/commonly#2655: Adds a Sentry allowlist entry that this change removes from values-dev.yaml and moves to the secret.

Merge Risk: Minimal · up to 47f98

No actionable code issue is established. Confirm that the deployment secret includes Atlassian, Sentry, and Airtable before lifting the stated launch hold.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly summarizes the main change: loading the hosted-MCP allowlist from a runner-only overlay.
Description check		The description directly explains the workflow overlay, secret source, Helm behavior, and deployment hold status.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[lilyshen0722]

Merged main in (new head 47f9892). Main had added an airtable entry to the allowlist in values-dev.yaml. This PR removes the whole block, so before this merges, the DEV_HELM_HIDDENMCP_ALLOWLIST secret must carry atlassian, sentry and airtable, or the airtable walk loses its allowlist on the next deploy. It stays on its hold.