ci: single Gitea Actions pipeline, uv-based image, scoped docker cleanup

Replace lint/test/docker workflows with ci.yml (gitleaks, lint, test-unit, test-integration, test-mcp, build-and-push, docs-check, security). Rebuild the Dockerfile as a digest-pinned multi-stage uv build running as uid 1000, add .dockerignore, a hardened compose file and a gitleaks config. The integration harness now falls back to /etc/hostname and /proc/self to find its own container.

docker-compose.yml

@@ -1,82 +1,59 @@
+# Production deployment of the HTTP transport.
+#
+#   cp .env.example .env   # set GITEA_URL, MCP_BEARER_TOKEN and/or OAuth settings
+#   docker compose up -d
+#
+# The container binds 0.0.0.0 internally; the server refuses to start unless
+# authentication is configured, and the port is published on loopback only.
+# Put a TLS reverse proxy in front of 127.0.0.1:8080 (and set PUBLIC_BASE_URL).
 services:
   aegis-mcp:
-    profiles: ["prod"]
-    build:
-      context: .
-      dockerfile: docker/Dockerfile
+    image: git.hiddenden.cafe/hiddenden/aegisgitea-mcp:${AEGIS_MCP_TAG:-latest}
+    # To build locally instead of pulling the published image:
+    # build:
+    #   context: .
+    #   dockerfile: docker/Dockerfile
     container_name: aegis-gitea-mcp
     restart: unless-stopped
     env_file:
       - .env
     environment:
-      ENVIRONMENT: production
-      MCP_HOST: ${MCP_HOST:-127.0.0.1}
-      ALLOW_INSECURE_BIND: ${ALLOW_INSECURE_BIND:-false}
-    expose:
-      - "8080"
+      # Fixed by the image layout; do not override from .env.
+      MCP_TRANSPORT: http
+      MCP_HOST: 0.0.0.0
+      MCP_PORT: "8080"
+      DATA_DIR: /var/lib/aegis-mcp
+    ports:
+      - "127.0.0.1:8080:8080"
     volumes:
-      - aegis-mcp-logs:/var/log/aegis-mcp
       - aegis-mcp-data:/var/lib/aegis-mcp
-      - ./policy.yaml:/app/policy.yaml:ro
     read_only: true
     tmpfs:
       - /tmp
-    security_opt:
-      - no-new-privileges:true
     cap_drop:
       - ALL
+    security_opt:
+      - no-new-privileges:true
     user: "1000:1000"
-    networks:
-      - proxy
     healthcheck:
       test:
-        [
-          "CMD",
-          "python",
-          "-c",
-          "import httpx; httpx.get('http://127.0.0.1:8080/health', timeout=5)",
-        ]
+        - CMD
+        - python
+        - -c
+        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=5)"
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 10s
-
-  aegis-mcp-dev:
-    profiles: ["dev"]
-    build:
-      context: .
-      dockerfile: docker/Dockerfile
-    container_name: aegis-gitea-mcp-dev
-    restart: unless-stopped
-    env_file:
-      - .env
-    environment:
-      ENVIRONMENT: development
-      MCP_HOST: 127.0.0.1
-      ALLOW_INSECURE_BIND: false
-      LOG_LEVEL: DEBUG
-      EXPOSE_ERROR_DETAILS: true
-    ports:
-      - "127.0.0.1:${MCP_PORT:-8080}:8080"
-    volumes:
-      - ./src:/app/src:ro
-      - ./policy.yaml:/app/policy.yaml:ro
-      - aegis-mcp-logs:/var/log/aegis-mcp
-      - aegis-mcp-data:/var/lib/aegis-mcp
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
-    user: "1000:1000"
-    networks:
-      - proxy
+      start_period: 15s
+    # Optional: join an external reverse proxy network instead of publishing a
+    # port. Uncomment this and the `networks:` block at the bottom, and drop
+    # the `ports:` entry above.
+    # networks:
+    #   - proxy
 
 volumes:
-  aegis-mcp-logs:
-    driver: local
   aegis-mcp-data:
-    driver: local
 
-networks:
-  proxy:
-    external: true
+# networks:
+#   proxy:
+#     external: true