ci: bump berntpopp/genefoundry-router/.github/workflows/_container-ci.yml from 0.7.4 to 0.7.6

[dependabot]

Bumps berntpopp/genefoundry-router/.github/workflows/_container-ci.yml from 0.7.4 to 0.7.6.

Release notes

Sourced from berntpopp/genefoundry-router/.github/workflows/_container-ci.yml's releases.

v0.7.6

Verified GeneFoundry research-use-only container release.

v0.7.5

Verified GeneFoundry research-use-only container release.

Changelog

Sourced from berntpopp/genefoundry-router/.github/workflows/_container-ci.yml's changelog.

Changelog

All notable changes to genefoundry-router are documented here.

[0.8.0] - 2026-08-07

Fixed

• Pin the attested production fleet to GTEx Link 3.1.3, PanelApp Link 0.7.0, and UniProt Link 5.1.0. PanelApp 0.7.0 moves its refresh status from the top-level response into health.refresh; MCP clients consuming that diagnostic shape must read the nested field.
• Canonicalize router-issued OAuth access and refresh token issuers to https://genefoundry.org. Tokens minted by earlier releases with the historical trailing-slash issuer remain valid only through the fixed transition deadline 2026-09-06T00:00:00Z; no arbitrary legacy issuer is accepted. Connectors that cached the old authorization-server identifier may reject the new metadata before token validation and require disconnect/re-add; an issuer-mismatch during discovery is the distinguishing symptom.

Added

• Add durable, bounded SQLite measurement of OAuth refresh rotation. The router classifies successful rotations and a closed set of failure reasons, restores Prometheus counters after restart, and records completed startup/clean-shutdown intervals. Production stores the ledger at /data/genefoundry/refresh-observability.sqlite3 on the existing fastmcp_data volume.
• Add genefoundry-router refresh-report --json. The read-only, aggregate-only report uses a 7-day/50-attempt gate with a 14-day low-volume fallback. Rotation failure is material only when reuse_after_rotation plus upstream_invalid_grant reaches at least 3 events and exceeds 1% of attempts, or at least 2 distinct HMAC-derived clients reauthorize within 15 minutes after a failure.
• Export bounded refresh counters as genefoundry_oauth_refresh_attempts_total{client_class}, genefoundry_oauth_refresh_success_total{client_class}, and genefoundry_oauth_refresh_failures_total{client_class,reason}. Existing /metrics authentication remains unchanged.

Security

• Keep strict one-time refresh-token rotation unchanged while evidence is collected; the observer never replays or accepts a rejected token. Event rows contain only bounded classes, a short hash prefix, request ID, timestamp, and HMAC-derived client identity. Full token hashes exist only in short-lived mode-0600 tombstones and are never emitted in metrics, logs, or reports.
• Domain-separate the client-identity HMAC key from the HS256 OAuth token-signing key, while deriving both from the same stable operator-managed key material.

[0.7.6] - 2026-08-07

... (truncated)

Commits

• 84c6ac1 release: prepare v0.7.6 (#130)
• 418b8b2 fix(observability): stop the log-scrub filter blanking framework diagnostics ...
• f594c69 test(auth): end-to-end private_key_jwt login and authenticated MCP call (#128)
• 9b82667 fix(auth): accept private_key_jwt assertions at the advertised token endpoint...
• See full diff in compare view

[dependabot]

Looks like berntpopp/genefoundry-router/.github/workflows/_container-ci.yml is up-to-date now, so this is no longer needed.

[berntpopp]

Superseded by consolidated PR #55, which passed the full local and remote gates and is merged. Default branch now contains this exact released v0.7.6 workflow pin at 84c6ac1fc0eb26f7dfa093cc6394eee3c44d4222.