ci: Update MCP login to use inline private key#51
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Performed full review of 75f2975...88bdad3
Tip
⚡ Quick Actions
This review was generated by Mesa.
Actions:
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
1 files reviewed | 1 comments | Review on Mesa | Edit Reviewer Settings
| run: | | ||
| echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem | ||
| ./mcp-publisher login dns -domain onkernel.com -private-key-file key.pem | ||
| ./mcp-publisher login dns -domain onkernel.com --private-key $(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n') |
There was a problem hiding this comment.
This openssl command chain is fragile and may break with different key formats or openssl versions. The grep pattern 'priv:' and text processing with tail/tr assumes a specific output format that isn't guaranteed. Consider using a more robust approach like openssl pkey -in key.pem -traditional to output the key in a standard format, or stick with the file-based approach which is more reliable and standard practice for CI/CD workflows.
Agent: 🤖 General
TL;DR
Updated the CI workflow to use an inline private key for MCP authentication instead of a file.
Why we made these changes
Using an inline private key from a GitHub secret simplifies the authentication process in our CI workflow. It removes the need to manage a key file on the runner, which can be prone to permission issues and adds unnecessary complexity.
What changed?
.github/workflows/publish-mcp.ymlto pass the private key for MCP login directly from a GitHub secret, removing the step that created a key file.Description generated by Mesa. Update settings