Conversation
This reverts commit 7b97462. Signed-off-by: Roi Glinik <groi.tech@gmail.com>
WalkthroughThis PR updates the GitHub MCP addon container image tag in the Helm Holmes chart from version 1.0.4 to 1.0.1, affecting the deployed GitHub MCP server container version in the Helm values configuration. ChangesGitHub MCP Version Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Docker images ready for
Use these tags to pull the images for testing. 📋 Copy commandsgcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/holmes:4b20637b3
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/holmes:4b20637b3 me-west1-docker.pkg.dev/robusta-development/development/holmes-dev:4b20637b3
docker push me-west1-docker.pkg.dev/robusta-development/development/holmes-dev:4b20637b3
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/holmes-operator:4b20637b3
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/holmes-operator:4b20637b3 me-west1-docker.pkg.dev/robusta-development/development/holmes-operator-dev:4b20637b3
docker push me-west1-docker.pkg.dev/robusta-development/development/holmes-operator-dev:4b20637b3Patch Helm values in one line (choose the chart you use): HolmesGPT chart: helm upgrade --install holmesgpt ./helm/holmes \
--set registry=me-west1-docker.pkg.dev/robusta-development/development \
--set image=holmes-dev:4b20637b3 \
--set operator.registry=me-west1-docker.pkg.dev/robusta-development/development \
--set operator.image=holmes-operator-dev:4b20637b3Robusta wrapper chart: helm upgrade --install robusta robusta/robusta \
--reuse-values \
--set holmes.registry=me-west1-docker.pkg.dev/robusta-development/development \
--set holmes.image=holmes-dev:4b20637b3 \
--set holmes.operator.registry=me-west1-docker.pkg.dev/robusta-development/development \
--set holmes.operator.image=holmes-operator-dev:4b20637b3 |
✅ Results of HolmesGPT evalsAutomatically triggered by commit f2ec2f0 on branch Results of HolmesGPT evals
Benchmark Comparison DetailsMaster baseline: latest master-* experiment (post-merge regression eval)
Benchmark baseline: latest ci-benchmark experiment on master
Time comparison (seconds):
Cost comparison:
Total tokens comparison:
Cached tokens comparison:
Turns comparison:
Tool calls comparison:
Comparison indicators:
📖 Legend
🔄 Re-run evals manually
Option 1: Comment on this PR with Or with more options (one per line): Run evals on a different branch (e.g., master) for comparison:
Quick re-run: Use Option 2: Trigger via GitHub Actions UI → "Run workflow" Option 3: Add PR labels to include extra evals (applies to both automatic runs and
Examples: 🏷️ Valid tags
🤖 Valid models
Commands: CLI: |
✅ Deploy Preview for holmes-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@helm/holmes/values.yaml`:
- Line 442: Add an inline comment above the image line that explains and
justifies the rollback of image: "github-mcp:1.0.1": state the exact upstream
issue(s)/PR(s) (e.g., links to github-mcp issues/PRs) that made 1.0.4
unacceptable, confirm that 1.0.1 (or a specific later 1.0.x) resolves those
issues, and note any verification performed (digest/SBOM scan or upstream
security advisory) proving no unresolved CVE; if a newer fixed 1.0.x exists,
prefer and document that instead of reverting to 1.0.1.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 04ac283c-e602-4d2b-b4fc-a26acf0b369f
📒 Files selected for processing (1)
helm/holmes/values.yaml
| enabled: false | ||
|
|
||
| image: "github-mcp:1.0.4" | ||
| image: "github-mcp:1.0.1" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check for release notes, issues, or advisories related to github-mcp versions 1.0.1 and 1.0.4
echo "=== Checking for github-mcp version information ==="
# Search for any references to version 1.0.4 or known issues in the repository
echo -e "\n--- Searching for mentions of github-mcp 1.0.4 in the repository ---"
rg -i "github-mcp.*1\.0\.4" -C 3
echo -e "\n--- Searching for mentions of github-mcp 1.0.1 in the repository ---"
rg -i "github-mcp.*1\.0\.1" -C 3
# Check commit messages for context on the original bump to 1.0.4
echo -e "\n--- Checking git history for PR `#2124` (original bump to 1.0.4) ---"
git log --all --grep="2124" --oneline -n 10
# Look for any TODO, FIXME, or issue comments related to github-mcp
echo -e "\n--- Checking for TODO/FIXME comments related to github-mcp ---"
rg -i "(TODO|FIXME|HACK|XXX|BUG).*github.*mcp" -C 2
# Check if there are any related GitHub issues or PRs mentioned in comments
echo -e "\n--- Searching for issue/PR references in yaml files ---"
rg "#\d{4}" helm/holmes/values.yaml -C 2Repository: HolmesGPT/holmesgpt
Length of output: 50377
🌐 Web query:
github-mcp docker image version 1.0.4 known issues bugs
💡 Result:
For github-mcp Docker image version 1.0.4 (GitHub MCP Server v1.0.4), the known issues/bugs that show up in the project’s issue tracker and release notes are: 1) Orphaned Docker containers when the MCP client disconnects ungracefully (can lead to later sessions hanging) - When using the Docker-based stdio transport (docker run -i --rm), containers are not cleaned up if the MCP client crashes/force-closes/restarts without gracefully shutting down the MCP connection, and concurrent MCP tool calls may hang as orphaned containers accumulate [1]. - A PR to detect ungraceful stdin close was proposed, but ultimately closed as wontfix; the discussion also points out that this behavior may already be handled by the SDK and/or requires broader handling beyond the server itself [2]. 2) Docker daemon not running / not reachable on the host (server fails to start) - The server requires Docker only for the Docker-based installation method; if Docker isn’t running or the daemon/socket isn’t reachable, you’ll see errors like “docker: Cannot connect to the Docker daemon …” [3]. 3) Unable to pull the Docker image from GHCR (auth/permissions/denied manifest) - When Docker tries to pull the image and GHCR denies access, you can get errors like denied on manifest HEAD and the server exits (exit code 125). The reported likely causes include missing GHCR auth, missing read:packages scope on the token, org package visibility/SSO restrictions, or corporate proxy interference [4]. 4) “Create/list/search issue for github repo is not working” (HTTP 500 during issue operations) - A user reported that with the GitHub MCP server Docker image, creating an issue returned a 500 Internal Server Error when calling POST /search_issues, even though other repository/branch operations worked [5]. What v1.0.4 specifically changed (from the v1.0.4 release notes) - The release v1.0.4 includes changes such as improving dependabot error messaging, adding Xcode installation documentation, fixing MCP Apps metadata handling by deferring the _meta.ui strip to per-request RegisterTools, adding an IFC label for get_me, preventing inputs from being stripped from the actions_run_trigger tool schema, and handling lightweight tags in get_tag [6]. Practical takeaways for “known issues” in v1.0.4 Docker usage - If you see later calls hanging after a client crash/kill, check for orphaned containers as described in the disconnect/leak issue [1]. - If the server can’t start locally, confirm Docker Desktop/daemon is running and reachable [3]. - If it can’t start due to pull failures, verify GHCR authentication and token scopes (read:packages) [4].
Citations:
- 1: Docker containers leak when MCP client disconnects ungracefully, causing subsequent sessions to hang github/github-mcp-server#2323
- 2: fix: detect ungraceful stdin close and self-terminate github/github-mcp-server#2325
- 3: Cannot connect to the Docker daemon github/github-mcp-server#232
- 4: Unable to download the docker image github/github-mcp-server#192
- 5: Create/list/search issue for github repo is not working github/github-mcp-server#633
- 6: https://github.com/github/github-mcp-server/releases/tag/v1.0.4
🌐 Web query:
github-mcp docker image version 1.0.1 security vulnerabilities
💡 Result:
I couldn’t find any authoritative, version-specific security-vulnerability list for the GitHub MCP Server Docker image tagged 1.0.1 (e.g., a CVE/SBOM for that exact image). What I did find are (a) the 1.0.1 release notes and (b) repo-level Docker/security work that indicates what kinds of container vulnerabilities/scanner alerts were addressed. 1) What changed in GitHub MCP Server v1.0.1 The upstream GitHub MCP Server v1.0.1 release includes fixes for content-type rejection for application/json and browser-based MCP client re-allowing via CORS, plus dependency bumps (including Golang and CI/build tooling). No Docker-image CVE list is provided in the release notes itself. [1] 2) Docker/image security finding that was addressed via scanner alerts (supply-chain) A later upstream PR explicitly states that Docker base images were pinned to SHA256 digests to resolve code scanning alerts related to “unpinned Docker images” (supply-chain / deterministic build issues). The PR lists base images and the intent to address security scanning alerts. [2] 3) How to interpret this for “security vulnerabilities” for the 1.0.1 Docker image - The sources above do not enumerate specific CVEs that affect the 1.0.1 Docker image. - They do show that upstream maintainers have actively used security scanning/code scanning alerts to drive container hardening (pinning base images to digests). [2] - Therefore, the best grounded conclusion is: as of the sources found, there is evidence of container hardening work due to scanner alerts, but no concrete, version-pinned vulnerability disclosure for “Docker image version 1.0.1”. [2][1] 4) Practical next steps (so you can get a definitive “v1.0.1 image vulnerabilities” answer) To produce a definitive list for exactly the v1.0.1 Docker image, you’d need one of: - The image digest for the 1.0.1 tag in ghcr.io and then run an SBOM/CVE scan on that digest (e.g., Docker Scout/Trivy) or - An official advisory/SBOM for that image build. If you share the exact image reference/digest you mean for “1.0.1” (e.g., ghcr.io/github/github-mcp-server: and/or sha256 digest), I can re-run targeted searches for an SBOM/advisory or corroborating scanner findings tied to that digest.
Citations:
- 1: https://github.com/github/github-mcp-server/releases/tag/v1.0.1
- 2: fix: pin Docker base images to SHA256 digests github/github-mcp-server#2040
Document & justify github-mcp image revert (1.0.4 → 1.0.1)
Reverting github-mcp from 1.0.4 back to 1.0.1 in helm/holmes/values.yaml (line 442) is an operationally significant downgrade, but the change lacks any explanation of the specific problem that made 1.0.4 unacceptable.
- If this revert is due to upstream v1.0.4 issues (e.g., orphaned Docker containers causing later sessions/tool calls to hang: Docker containers leak when MCP client disconnects ungracefully, causing subsequent sessions to hang github/github-mcp-server#2323, or HTTP 500 during issue create/search: Create/list/search issue for github repo is not working github/github-mcp-server#633), link the exact upstream issue/PR(s) and state that
1.0.1addresses them. - Add an inline comment above line 442 documenting the exact reason for pinning
1.0.1to avoid1.0.4. - For security: no authoritative, version-specific CVE/advisory list was found for
1.0.1; require evidence via digest/SBOM-based scanning (or an upstream security advisory link) rather than “no advisories found”. - If a forward version exists (e.g., a
1.0.xrelease with the fix), prefer it over a rollback to1.0.1.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@helm/holmes/values.yaml` at line 442, Add an inline comment above the image
line that explains and justifies the rollback of image: "github-mcp:1.0.1":
state the exact upstream issue(s)/PR(s) (e.g., links to github-mcp issues/PRs)
that made 1.0.4 unacceptable, confirm that 1.0.1 (or a specific later 1.0.x)
resolves those issues, and note any verification performed (digest/SBOM scan or
upstream security advisory) proving no unresolved CVE; if a newer fixed 1.0.x
exists, prefer and document that instead of reverting to 1.0.1.
1 participant
Summary
github-mcpaddon image tag from1.0.4back to1.0.1inhelm/holmes/values.yaml.Test plan
github-mcp:1.0.11.0.1Summary by CodeRabbit