From 45aafe8ee171bc32b98739b56b9322e9a7676b6b Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 28 Oct 2026 00:20:49 -0700 Subject: [PATCH] chore(helm): load the hosted-MCP allowlist from a runner-only overlay Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01MDs9DRK3nqxjeAV7xL8uhg --- .github/workflows/deploy-dev.yml | 11 +++++++++++ k8s/helm/commonly/values-dev.yaml | 10 ---------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml index 4a1b5795d3..b3bb1a813c 100644 --- a/.github/workflows/deploy-dev.yml +++ b/.github/workflows/deploy-dev.yml @@ -161,6 +161,15 @@ jobs: env: DEV_HELM_VALUES_PRIVATE: ${{ secrets.DEV_HELM_VALUES_PRIVATE }} + - name: Materialize hosted-MCP allowlist overlay (runner-only) + # Per-instance hostedMcp.hiddenEntryUserAllowlist, kept out of the repo + # like the overlay above. Unset, it writes an empty overlay and the + # chart default ({}) applies. + run: | + printf '%s\n' "${DEV_HELM_HIDDENMCP_ALLOWLIST}" > "$RUNNER_TEMP/allowlist.yaml" + env: + DEV_HELM_HIDDENMCP_ALLOWLIST: ${{ secrets.DEV_HELM_HIDDENMCP_ALLOWLIST }} + # clawdbot-gateway is parked (agents.clawdbot.enabled: false since #1051), # and the chart then renders no gateway Deployment at all. Building it # anyway cost 3.3 of the ~6.4 build minutes per deploy and pushed a @@ -178,6 +187,7 @@ jobs: -f k8s/helm/commonly/values.yaml \ -f k8s/helm/commonly/values-dev.yaml \ -f "$RUNNER_TEMP/values-private.yaml" \ + -f "$RUNNER_TEMP/allowlist.yaml" \ --show-only templates/agents/clawdbot-deployment.yaml 2>&1 >/dev/null); then echo "enabled=true" >> "$GITHUB_OUTPUT" elif printf '%s' "$err" | grep -q 'could not find template'; then @@ -285,6 +295,7 @@ jobs: -f k8s/helm/commonly/values.yaml \ -f k8s/helm/commonly/values-dev.yaml \ -f "$RUNNER_TEMP/values-private.yaml" \ + -f "$RUNNER_TEMP/allowlist.yaml" \ --set backend.image.tag="$TAG" \ --set frontend.image.tag="$TAG" \ "${GATEWAY_TAG[@]}" \ diff --git a/k8s/helm/commonly/values-dev.yaml b/k8s/helm/commonly/values-dev.yaml index e02b9ca501..c73a9f303d 100644 --- a/k8s/helm/commonly/values-dev.yaml +++ b/k8s/helm/commonly/values-dev.yaml @@ -450,16 +450,6 @@ hostedMcp: # The 10-27 prod walk failed before Airtable's consent screen ("invalid client_id # or mismatched redirect_uri"). Hidden until TASK-318 lands and a walk passes. - airtable - # Mongo User _id(s) permitted to walk each hidden hosted-MCP entry (#2649, TASK-485). - # lily-shen is the designated walk user (keeps the walk off Sam's account, Cofounder 10-24). - # Sentry and Atlassian stay hidden for every other account (Atlassian added for its walk, D153). - hiddenEntryUserAllowlist: - atlassian: - - "6a47891ee025ce2e0ca1d30b" - sentry: - - "6a47891ee025ce2e0ca1d30b" - airtable: - - "6a47891ee025ce2e0ca1d30b" googleCalendar: enabled: false