Sigma shipped three overlapping ways to operate a remote server: the
embedded MCP server, sigma-cli, and the sigma-api-operator skill. All
three wrapped the same HTTP API, yet each covered a different subset:
user CRUD existed only in the CLI, system-* only in MCP, and builders,
daemons, webhooks, validators, code repositories and tokens were
reachable only through raw HTTP. MCP was disabled by default and still
carried 1246 lines of production code plus 606 lines of tests to
maintain that partially overlapping surface.
Keep two surfaces instead: sigma-cli for execution and the skill for
API discovery.
- delete pkg/server/mcp and its mcp-go dependency, which also drops the
jsonschema-go, jsonschema/v6 and uritemplate/v3 transitives
- drop ConfigurationMCP, its defaults and the authz/audit skipper
bypasses that existed only to let the MCP endpoint bypass both
- remove the mcp section from conf/config*.yaml, docs/configuration.md,
and the Helm chart values and configmap
- replace docs/mcp.md with docs/cli.md covering sigma-cli login, global
flags, per-resource commands, jq composition and agent usage
- make sigma-cli the preferred path in the sigma-api-operator skill and
rebuild its examples around the resources the CLI does not wrap yet,
using the paths and request schemas from swagger.yaml
Lint was already red on dev for an unrelated reason: golangci-lint
v2.13.0 vendors golang.org/x/tools v0.49.0, which only decodes export
data version 4, so every import of a Go 1.27.2 standard library package
failed typecheck with "export data version 5 is greater than maximum
supported version 4". Bump to v2.15.0 (x/tools v0.52.0) and fix the two
modernize findings it reports for Go 1.27's strings.CutLast.
- .github/workflows/lint.yml: golangci-lint v2.13.0 -> v2.15.0, and
document the export data constraint next to the pin
- pkg/authz/resolver.go, pkg/logger/logger.go: replace LastIndex slicing
with strings.CutLast
- bump github.com/docker/cli v29.9.0 -> v29.9.1
BREAKING CHANGE: the `mcp` configuration section and the /api/v1/mcp
endpoint are gone. Use sigma-cli or the REST API for automation.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- golangci-lint v2.15.0 run --build-tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./... (0 issues)
- golangci-lint config verify
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/authz/... ./pkg/logger/... ./cmd/cli/... ./pkg/app/... ./pkg/background/build/...
- go test -run TestConfiguration -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config/...
- go mod tidy
- make swagen
- helm template sigma ./deploy/sigma
- bun run docs:build
- make build
- make build-cli
Upgrade github.com/anchore/grype to v0.120.0, github.com/aws/smithy-go to
v1.28.2, github.com/lmittmann/tint to v1.2.1, and the go.opentelemetry.io
modules (otel, otel/sdk, otel/trace, otlptracegrpc, otlptracehttp, otelgin,
otelhttp) to v1.47.0/v0.72.0, together with the transitive bumps they pull
in. Install tzdata in the alpine runtime image so named timezones are
available at runtime.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
Update github.com/sigstore/cosign from v2.6.5 to v3.1.3 and switch the
import path in the signing bootstrap to the v3 module. go.sum also picks
up the transitive lib/pq and go.step.sm/crypto bumps.
Verification:
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- go vet -tags "..." ./pkg/app/bootstrap/...
Fix and complete Swagger annotations for the HTTP handlers so the
generated OpenAPI spec matches the registered routes and request
types:
- Correct path parameter types from number/int64 to string, since all
resource IDs are UUID strings.
- Fix wrong router paths and methods (builders, coderepos, tags,
webhooks, users, validators) and add missing path parameters.
- Fix request/response schema references (builder runner list, oauth2
callback, webhook get/log) and a few summary/description typos.
- Add annotations for previously undocumented endpoints: artifacts,
analytics, builder runner actions, and user self/signup/recovery.
- Rename the users and coderepos path parameters to user_id/repo_id and
align the route registrations and request struct tags accordingly;
mark BuilderRunnerItem.Log as swaggertype string so swag can parse it.
- Regenerate tools/skill/sigma-api-operator/swagger.yaml. The
distribution handlers are intentionally left undocumented.
Verification:
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/server/handlers/users/ ./pkg/server/handlers/coderepos/ -run TestInitialize -count=1
- go tool swag fmt && go tool swag init --output tools/skill/sigma-api-operator --outputTypes yaml
- go build -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/server/handlers/... ./pkg/api/...
- gofmt -l pkg/server/handlers pkg/api
Add golang.org/x/vuln/cmd/govulncheck to the go.mod tool set and run it
in a dedicated workflow with the project build tags. The report is
written to GITHUB_STEP_SUMMARY and the step is non-blocking so findings
are reported without failing CI.
Verification:
- go tool govulncheck -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./...
- Update go.mod/go.sum (grype, syft, aws-sdk-go-v2, distribution,
gin contrib, validator and others).
- Update web/package.json and web/bun.lock (shikijs, react-router-dom,
lucide-react, oxlint, esbuild, vite and others).
- Ignore the local `.delta/` directory in .gitignore.
Run the self-hosted rs3 service instead of Minio in test.yml and swap the
local helper script, Makefile helm values, and AGENTS.md notes accordingly.
Fix the E2E workflow (refs #426): it only triggered on the `main` branch,
which does not exist in this repository, so the job never ran. Trigger it
on `dev` for both push and pull_request like test.yml, build the image via
the consolidated `make docker-build`, bump the checkout/setup-go actions,
drop the hosted-toolcache cleanup, and refresh the E2E tooling to k6
v2.3.0 and skopeo v1.24.1.
Repair the image startup path as well: start nginx with an explicit
/etc/nginx/nginx.conf and a /dev/stderr error log so the non-root user does
not touch the compiled-in log path, create /etc/sigma with mode 0755 before
copying config.yaml (COPY --chmod made the directory non-traversable), and
disable redis in the shipped default config since cache, locker and work
queue are inmemory.
Update direct and indirect Go module versions, including aws-sdk-go-v2,
goose, ClickHouse, Azure SDK and golang.org/x/exp, and refresh the web
toolchain (react 19.3, vite 8.3, typescript 7, shadcn, tailwind).
Switch the web Vite `@` alias from `__dirname` to `import.meta.dirname`
to align with the ESM config runtime.
Verification: not run (dependency-only change).
Move generated mocks out of the `mocks/` subpackages and into the
source packages as `*_mocks.go` files for `pkg/distribution/clients`
and `pkg/service/password`, updating the go:generate directives to
emit `-package=clients` / `-package=password`. Update the import in
`pkg/service/users/users_test.go` to reference the new location.
Also:
- add `go.uber.org/mock/mockgen` to the tool directives and refresh
module dependencies
- bump CI service images (mysql 9, postgres 18-alpine) and drop the
removed mocks packages from the coverage exclusion list
- clean up .gitignore and ignore local tool artifacts (.pi/,
skills-lock.json)
Verification:
- go vet -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/service/users/ ./pkg/service/password/ ./pkg/distribution/clients/
- go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/service/users/
Update all direct and indirect Go module dependencies to their latest compatible versions, including security patches and feature updates across the codebase.
Complete migration from legacy React toastify/headlessui to shadcn/ui components, update Tailwind CSS setup, add path aliases, and replace old icon libraries with lucide-react. Also update dependencies to modern versions and clean up unused files and styles.
Update go version from 1.26 to 1.27 across all workflows, dockerfile, and project configs. Switch uuid usage to stdlib package instead of external google/uuid. Bump traefik, bun, and various golang/x dependencies versions. Clean up unused direct uuid dependency.
Verification:
go test ./pkg/utils/uuid/...
Switch the Docker Compose stack from MySQL and Minio to PostgreSQL and rs3,
with the compose-specific configuration updated to use PostgreSQL and the rs3
S3 endpoint.
Adapt code for upgraded resty and GitLab client APIs, including the renamed
response parsing option and int64 pagination and ID fields.
Also refresh agent guidance and the Chinese README automation notes.
Verification:
docker compose -f compose.yml config
ruby -e 'require "yaml"; YAML.load_file("conf/config-compose.yaml"); YAML.load_file("compose.yml"); puts "yaml ok"'
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/config ./pkg/service/token
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/builder ./pkg/distribution/clients ./pkg/background/daemon/webhook
go test -tags "netgo,timetzdata,exclude_graphdriver_btrfs,containers_image_openpgp" ./pkg/background/daemon/coderepo
make build
Tosone