Skip to content

chore(helm): load the hosted-MCP allowlist from a runner-only overlay #2950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lilyshen0722 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(helm): load the hosted-MCP allowlist from a runner-only overlay #2950

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
45aafe8
chore(helm): load the hosted-MCP allowlist from a runner-only overlay
lilyshen0722 Oct 28, 2026
47f9892
Merge remote-tracking branch 'origin/main' into swe/2950
lilyshen0722 Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/deploy-dev.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,15 @@ jobs:
env:
DEV_HELM_VALUES_PRIVATE: ${{ secrets.DEV_HELM_VALUES_PRIVATE }}

- name: Materialize hosted-MCP allowlist overlay (runner-only)
# Per-instance hostedMcp.hiddenEntryUserAllowlist, kept out of the repo
# like the overlay above. Unset, it writes an empty overlay and the
# chart default ({}) applies.
run: |
printf '%s\n' "${DEV_HELM_HIDDENMCP_ALLOWLIST}" > "$RUNNER_TEMP/allowlist.yaml"
env:
DEV_HELM_HIDDENMCP_ALLOWLIST: ${{ secrets.DEV_HELM_HIDDENMCP_ALLOWLIST }}

# clawdbot-gateway is parked (agents.clawdbot.enabled: false since #1051),
# and the chart then renders no gateway Deployment at all. Building it
# anyway cost 3.3 of the ~6.4 build minutes per deploy and pushed a
Expand All @@ -178,6 +187,7 @@ jobs:
-f k8s/helm/commonly/values.yaml \
-f k8s/helm/commonly/values-dev.yaml \
-f "$RUNNER_TEMP/values-private.yaml" \
-f "$RUNNER_TEMP/allowlist.yaml" \
--show-only templates/agents/clawdbot-deployment.yaml 2>&1 >/dev/null); then
echo "enabled=true" >> "$GITHUB_OUTPUT"
elif printf '%s' "$err" | grep -q 'could not find template'; then
Expand Down Expand Up @@ -285,6 +295,7 @@ jobs:
-f k8s/helm/commonly/values.yaml \
-f k8s/helm/commonly/values-dev.yaml \
-f "$RUNNER_TEMP/values-private.yaml" \
-f "$RUNNER_TEMP/allowlist.yaml" \
--set backend.image.tag="$TAG" \
--set frontend.image.tag="$TAG" \
"${GATEWAY_TAG[@]}" \
Expand Down
8 changes: 0 additions & 8 deletions k8s/helm/commonly/values-dev.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,14 +450,6 @@ hostedMcp:
# The 10-27 prod walk failed before Airtable's consent screen ("invalid client_id
# or mismatched redirect_uri"). Hidden until TASK-318 lands and a walk passes.
- airtable
# Mongo User _id(s) permitted to walk each hidden hosted-MCP entry (#2649).
hiddenEntryUserAllowlist:
atlassian:
- "6a47891ee025ce2e0ca1d30b"
sentry:
- "6a47891ee025ce2e0ca1d30b"
airtable:
- "6a47891ee025ce2e0ca1d30b"
googleCalendar:
enabled: false

Expand Down
Loading