Sigma shipped three overlapping ways to operate a remote server: the
embedded MCP server, sigma-cli, and the sigma-api-operator skill. All
three wrapped the same HTTP API, yet each covered a different subset:
user CRUD existed only in the CLI, system-* only in MCP, and builders,
daemons, webhooks, validators, code repositories and tokens were
reachable only through raw HTTP. MCP was disabled by default and still
carried 1246 lines of production code plus 606 lines of tests to
maintain that partially overlapping surface.
Keep two surfaces instead: sigma-cli for execution and the skill for
API discovery.
- delete pkg/server/mcp and its mcp-go dependency, which also drops the
jsonschema-go, jsonschema/v6 and uritemplate/v3 transitives
- drop ConfigurationMCP, its defaults and the authz/audit skipper
bypasses that existed only to let the MCP endpoint bypass both
- remove the mcp section from conf/config*.yaml, docs/configuration.md,
and the Helm chart values and configmap
- replace docs/mcp.md with docs/cli.md covering sigma-cli login, global
flags, per-resource commands, jq composition and agent usage
- make sigma-cli the preferred path in the sigma-api-operator skill and
rebuild its examples around the resources the CLI does not wrap yet,
using the paths and request schemas from swagger.yaml
Lint was already red on dev for an unrelated reason: golangci-lint
v2.13.0 vendors golang.org/x/tools v0.49.0, which only decodes export
data version 4, so every import of a Go 1.27.2 standard library package
failed typecheck with "export data version 5 is greater than maximum
supported version 4". Bump to v2.15.0 (x/tools v0.52.0) and fix the two
modernize findings it reports for Go 1.27's strings.CutLast.
- .github/workflows/lint.yml: golangci-lint v2.13.0 -> v2.15.0, and
document the export data constraint next to the pin
- pkg/authz/resolver.go, pkg/logger/logger.go: replace LastIndex slicing
with strings.CutLast
- bump github.com/docker/cli v29.9.0 -> v29.9.1
BREAKING CHANGE: the `mcp` configuration section and the /api/v1/mcp
endpoint are gone. Use sigma-cli or the REST API for automation.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- golangci-lint v2.15.0 run --build-tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./... (0 issues)
- golangci-lint config verify
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/authz/... ./pkg/logger/... ./cmd/cli/... ./pkg/app/... ./pkg/background/build/...
- go test -run TestConfiguration -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config/...
- go mod tidy
- make swagen
- helm template sigma ./deploy/sigma
- bun run docs:build
- make build
- make build-cli
Remove the unused Wrap/WrapHandle helpers and the HandlerFunc type; route
registration now passes handler method values directly. Drop the
unreachable application/x-www-form-urlencoded and multipart/form-data
branches in bindBody since every bound endpoint is JSON, and merge
adapter.go into request.go. Add tests for the query/param mapping error
paths, the nil-validator path, and non-JSON bodies, raising the package
coverage to 100%.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/server/
- CI_DATABASE_TYPE=turso go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/server/...
- go tool cover -func: pkg/server 100.0% of statements
Reorder imports across web/src into two blocks separated by a blank line:
third-party packages first, then this repository's @/ and relative modules,
each sorted alphabetically. Document the convention in AGENTS.md.
Verification:
- web: `npx tsc --noEmit`, `npx oxlint`, `npx vite build`
Sync the golangci-lint version, note the new govulncheck workflow, drop
the removed codeql.yml reference, and record that the pkg/storage test
suites are run manually against cloud resources.
The testkit package only provides test helpers, so skip it in the unit-test
package matrix and coverage run, matching the other infrastructure-only
excludes.
Move the cache, counter, lock, and workq mock files from their package
directories into a `mocks` subpackage, matching the existing service and
storage layout. Update the `//go:generate` directives to emit into
`mocks/*_mocks.go` with package `mocks`, regenerate the files, and document
the convention in AGENTS.md.
Verification:
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/infra/...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/infra/...
pkg/validators is the gin request-validation layer: it registers gin's
binding.Validator and is used by the HTTP handlers, so move it to
pkg/server/validators where the rest of the HTTP layer lives.
The only non-server consumer was pkg/background/daemon, which called
validators.Initialize() even though the worker never uses gin binding
validation. Drop that call so the worker does not depend on the server
package; the server still initializes validators through
handlers.Initialize.
Run the self-hosted rs3 service instead of Minio in test.yml and swap the
local helper script, Makefile helm values, and AGENTS.md notes accordingly.
Fix the E2E workflow (refs #426): it only triggered on the `main` branch,
which does not exist in this repository, so the job never ran. Trigger it
on `dev` for both push and pull_request like test.yml, build the image via
the consolidated `make docker-build`, bump the checkout/setup-go actions,
drop the hosted-toolcache cleanup, and refresh the E2E tooling to k6
v2.3.0 and skopeo v1.24.1.
Repair the image startup path as well: start nginx with an explicit
/etc/nginx/nginx.conf and a /dev/stderr error log so the non-root user does
not touch the compiled-in log path, create /etc/sigma with mode 0755 before
copying config.yaml (COPY --chmod made the directory non-traversable), and
disable redis in the shipped default config since cache, locker and work
queue are inmemory.
Replace the codecov/codecov-action step with coverallsapp/github-action,
using COVERALLS_REPO_TOKEN and the golang format for the Go coverprofiles
emitted by `go test -coverprofile`. Update the README badges and the CI
workflow notes so no references to Codecov remain.
Verification:
- Ruby YAML parse of .github/workflows/test.yml
Replace the hand-rolled authz cache (sync.RWMutex + map + dual-index
namespace cache) with the shared pkg/infra/cache Cacher, matching the
existing namespace_cache / repository_cache pattern.
- Inject Config and RedisClientFactory into the authorizer and build the
Cachers via cacher.NewWithOptions in NewAuthorizer (now returns
(Authorizer, error))
- Use read-through Cachers for role and namespace lookups; represent
non-members with negative caching instead of the empty-string sentinel
- Keep the 30s TTL to preserve multi-instance eventual consistency, while
gaining LRU 2Q, singleflight and an optional Redis backend
- Drop pkg/authz/cache.go and rewrite the cache tests as construction
tests (inmemory success, redis-disabled failure)
- Document the New convenience wrapper in pkg/infra/cache/cacher.go
Verification: CI_DATABASE_TYPE=sqlite3 go test ./pkg/authz/... passes
Update go version from 1.26 to 1.27 across all workflows, dockerfile, and project configs. Switch uuid usage to stdlib package instead of external google/uuid. Bump traefik, bun, and various golang/x dependencies versions. Clean up unused direct uuid dependency.
Verification:
go test ./pkg/utils/uuid/...
Switch the Docker Compose stack from MySQL and Minio to PostgreSQL and rs3,
with the compose-specific configuration updated to use PostgreSQL and the rs3
S3 endpoint.
Adapt code for upgraded resty and GitLab client APIs, including the renamed
response parsing option and int64 pagination and ID fields.
Also refresh agent guidance and the Chinese README automation notes.
Verification:
docker compose -f compose.yml config
ruby -e 'require "yaml"; YAML.load_file("conf/config-compose.yaml"); YAML.load_file("compose.yml"); puts "yaml ok"'
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config ./pkg/service/token
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/builder ./pkg/distribution/clients ./pkg/background/daemon/webhook
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/background/daemon/coderepo
make build
Tosone