@coffeerunhobby/mcp-ha-connect 1.5.4 → 1.5.6

package/.github/workflows/ci.yml

@@ -9,6 +9,10 @@ name: CI
 on:
   push:
     branches: [main, dev]
+    # Version tags trigger the full gate + auto-create the GitHub Release (see
+    # the `release` job) — v1.5.4 sat tag-only for two weeks because the manual
+    # `gh release create` step kept getting skipped.
+    tags: ['v*']
   pull_request:
     branches: [main, dev]
   # Lets you re-run it by hand from the Actions tab.
@@ -28,8 +32,9 @@ jobs:
       # we want to see both results.
       fail-fast: false
       matrix:
-        # The two LTS lines we support (package.json engines: ">=20").
-        node-version: ['20.x', '22.x']
+        # The LTS lines we support (package.json engines: ">=20"). 24.x is the
+        # Docker image's actual runtime (since v1.5.6); 26 is the next LTS (2026-10).
+        node-version: ['20.x', '22.x', '24.x', '26.x']
 
     name: node ${{ matrix.node-version }}
 
@@ -67,3 +72,66 @@ jobs:
       #    floor in vitest.config.ts — a coverage DROP fails the build.
       - name: Test + coverage gate
         run: npm run test:coverage
+
+  docker-smoke:
+    # Boot-test the ACTUAL image: build it, point it at a mock Home Assistant,
+    # and require /health to answer. Motivation: v1.5.5 shipped without ever
+    # having been run — its first boot was in production on the NAS (where the
+    # node:26 base then failed its first fetch). A release must never again be
+    # the image's first boot.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build image
+        run: docker build -t mcp-smoke:ci .
+
+      - name: Boot against a mock HA and assert /health
+        run: |
+          set -eu
+          docker network create smoke
+          # Mock HA: 200 {"message":"API running."} — the same body the real
+          # /api/ startup check (checkApi) expects.
+          docker run -d --name mockha --network smoke node:24-alpine \
+            node -e 'require("http").createServer((q,s)=>{s.writeHead(200,{"Content-Type":"application/json"});s.end(JSON.stringify({message:"API running."}))}).listen(8123,()=>console.log("mock HA up"))'
+          docker run -d --name mcp --network smoke \
+            -e MCP_SERVER_USE_HTTP=true \
+            -e MCP_HTTP_PORT=3000 -e MCP_HTTP_BIND_ADDR=0.0.0.0 \
+            -e MCP_HTTP_ENABLE_HEALTHCHECK=true -e MCP_HTTP_HEALTHCHECK_PATH=/health \
+            -e MCP_AUTH_METHOD=bearer -e MCP_AUTH_SECRET=ci-smoke-dummy-secret-0123456789 \
+            -e HA_PLUGIN_ENABLED=true -e HA_URL=http://mockha:8123 -e HA_TOKEN=ci-dummy \
+            -e AI_PLUGIN_ENABLED=false -e OMADA_PLUGIN_ENABLED=false \
+            mcp-smoke:ci
+          for i in $(seq 1 15); do
+            if docker run --rm --network smoke curlimages/curl:latest -sf http://mcp:3000/health >/dev/null 2>&1; then
+              echo "smoke OK: image boots, startup HA check passes, /health answers"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "SMOKE FAILED — container logs:"
+          docker logs mcp
+          exit 1
+
+  release:
+    # Auto-create the GitHub Release when a `v*` tag passes BOTH gates above —
+    # the test matrix AND the image boot-test. Notes are auto-generated from the
+    # commits since the previous release; polish them in the web UI afterwards
+    # if the release deserves prose.
+    # Idempotent: if the Release already exists (created by hand), this no-ops.
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [build-test-lint, docker-smoke]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1 || \
+            gh release create "$GITHUB_REF_NAME" --latest --generate-notes --title "$GITHUB_REF_NAME"

package/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 
-FROM node:25-alpine AS deps
+FROM node:24-alpine AS deps
 WORKDIR /app
 COPY package*.json ./
 # npm ci installs exactly from the committed package-lock.json (reproducible) and
@@ -8,13 +8,13 @@ COPY package*.json ./
 # above pulls in package-lock.json, so the lockfile is present in this stage.
 RUN npm ci
 
-FROM node:25-alpine AS build
+FROM node:24-alpine AS build
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN npm run build
 
-FROM node:25-alpine AS runtime
+FROM node:24-alpine AS runtime
 
 # OCI metadata labels
 LABEL org.opencontainers.image.title="MCP-HA-Connect"
@@ -27,14 +27,24 @@ LABEL org.opencontainers.image.licenses="MIT"
 
 WORKDIR /app
 ENV NODE_ENV=production
-RUN apk add --no-cache curl
+# apk upgrade: pick up Alpine security patches even when the node base tag lags
+# (the 2026-07 Trivy scan's 24 libssl/libcrypto CVEs were exactly this rot).
+RUN apk upgrade --no-cache && apk add --no-cache curl
 COPY package*.json ./
-# Reproducible prod-only install from the lockfile (drops devDependencies).
-RUN npm ci --omit=dev
+# Reproducible prod-only install from the lockfile (drops devDependencies), then
+# strip the package managers from the runtime image: nothing invokes npm/yarn after
+# this line, and the npm CLI's vendored deps were the only Trivy findings left on
+# v1.5.5 (undici 6.26.0 inside /usr/local/lib/node_modules/npm).
+RUN npm ci --omit=dev && \
+    rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx \
+           /usr/local/bin/corepack /opt/yarn* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+           /root/.npm
 COPY --from=build /app/dist ./dist
 
 # M10: drop root. The official node image ships a non-root `node` user (uid 1000).
 # Built artifacts under /app are world-readable, so no chown is required; the
 # server listens on 3000 (>1024) which needs no privileged capability.
 USER node
-CMD ["node", "--experimental-quic", "dist/index.js"]
+# --experimental-quic was dropped 2026-07-10: nothing in src/ uses QUIC, and the
+# flag tied the image to a specific Node major (25, now EOL) for no benefit.
+CMD ["node", "dist/index.js"]

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "1.5.3";
+export declare const VERSION = "1.5.6";

package/dist/version.js

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.5.3';
+export const VERSION = '1.5.6';
 //# sourceMappingURL=version.js.map

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Home Assistant MCP Wrapper",
-    "version": "1.5.4",
+    "version": "1.5.6",
     "description": "REST endpoints that wrap MCP tools for Home Assistant integration. Raw JSON-RPC passthrough available at POST / for n8n compatibility."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",

package/src/version.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.5.4';
+export const VERSION = '1.5.6';