ci: publish official aiofmp MCP server image to GHCR + tidy repo boundaries

.dockerignore

@@ -0,0 +1,26 @@
+# Source layout we don't need inside the image.
+tests/
+examples/
+scripts/
+docs/
+.github/
+.git/
+.gitignore
+.gitmessage
+
+# Local state that must NOT bleed into the image.
+.cache/
+.venv/
+.fmp_key
+harvester.yaml
+**/__pycache__/
+*.pyc
+
+# Editor / OS noise
+.DS_Store
+.idea/
+.vscode/
+
+# CHANGELOG/LICENSE are fine inside the image but not strictly needed.
+CHANGELOG.md
+uv.lock

.github/workflows/docker-publish.yml

@@ -0,0 +1,93 @@
+name: Publish container image
+
+# Builds the aiofmp MCP server image (the root Dockerfile) and pushes it to
+# ghcr.io/<owner>/aiofmp-mcp-server. Multi-arch (amd64 + arm64) via Buildx/QEMU.
+#
+# Triggers:
+#   - workflow_run: after the "Release" workflow finishes on main. This is the
+#     reliable "publish with the next release" hook: semantic-release creates the
+#     vX.Y.Z tag with GITHUB_TOKEN, and a token-pushed tag does NOT re-trigger a
+#     `push: tags` workflow (GitHub's loop guard), so we key off the Release run.
+#   - push tags 'v*': covers tags pushed by a human (or a PAT-based release).
+#   - workflow_dispatch: publish any version on demand (e.g. backfill 1.4.0).
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+    branches: [main]
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image version tag (defaults to the version in pyproject.toml)"
+        required: false
+
+permissions:
+  contents: read
+  packages: write            # push to GitHub Container Registry with GITHUB_TOKEN
+
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  docker:
+    name: Build & push to ghcr.io
+    runs-on: ubuntu-latest
+    # Skip when the upstream Release run failed; always run for tags / manual dispatch.
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        # Default ref is correct for every trigger: the tag for a tag push, main HEAD
+        # (post version-bump) for a workflow_run, the dispatch branch for manual runs.
+
+      - name: Set up QEMU (arm64 emulation)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive version
+        id: version
+        run: |
+          set -euo pipefail
+          v="${{ github.event.inputs.version }}"
+          if [ -z "$v" ]; then
+            v="$(grep -m1 '^version' pyproject.toml | sed -E 's/^version *= *"([^"]+)".*/\1/')"
+          fi
+          echo "version=$v" >> "$GITHUB_OUTPUT"
+          echo "Publishing aiofmp-mcp-server version: $v"
+
+      - name: Container image metadata (tags + OCI labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/aiofmp-mcp-server
+          tags: |
+            type=raw,value=${{ steps.version.outputs.version }}
+            type=raw,value=latest
+
+      - name: Build & push (linux/amd64, linux/arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.version.outputs.version }}
+          provenance: true
+          sbom: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -212,4 +212,8 @@ __marimo__/
 /harvester.yaml
 
 # Scratch files used to draft PR bodies — safe to ignore
-/.pr-body-*.md
+/.pr-body-*.md
+
+# Trail MCP deployment artifacts (k3s manifests + trail Dockerfile) belong with the
+# trail project, not this repo. Kept on disk locally for the live deployment, ignored here.
+/deploy/

Dockerfile

@@ -0,0 +1,56 @@
+# aiofmp MCP server image.
+#
+# Built from the source tree so a local `docker compose build` and the published
+# ghcr.io image (see .github/workflows/docker-publish.yml, which builds this same
+# file at each release tag) stay identical. `VERSION` is stamped in by CI from the
+# release tag; local builds fall back to "dev".
+
+FROM python:3.13-slim AS base
+
+ARG VERSION=dev
+LABEL org.opencontainers.image.title="aiofmp-mcp-server" \
+      org.opencontainers.image.description="Asynchronous Financial Modeling Prep API client with MCP server" \
+      org.opencontainers.image.source="https://github.com/codemug/aiofmp" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="${VERSION}"
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORKDIR /app
+
+# Install the package + its runtime deps. Copying just the metadata + the
+# package tree (not tests/, examples/, scripts/, docs/) keeps the image small
+# without losing the editable-install layout the entry points expect.
+COPY pyproject.toml README.md ./
+COPY aiofmp ./aiofmp
+
+RUN pip install .
+
+# Non-root runtime user. Cache + state dirs are owned by it so the bind-mount
+# from the host (./.cache → /cache) stays writable.
+RUN useradd --create-home --uid 1000 aiofmp \
+    && mkdir -p /cache \
+    && chown -R aiofmp:aiofmp /cache /app
+USER aiofmp
+
+EXPOSE 3000
+
+# Cache is on by default. The env var is the actual contract get_fmp_client()
+# reads, so we set it at the container level (not via --cached) — that way
+# any process inside the container (including `docker exec`) sees the same
+# state as the running server.
+ENV AIOFMP_CACHED=true \
+    AIOFMP_CACHE_FILE_PATH=/cache
+
+# TCP liveness on the MCP port: FastMCP returns 406 to a plain GET on /mcp/, so a
+# successful connect (not an HTTP response) is the right signal that uvicorn is up.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD python -c "import socket,sys; s=socket.socket(); s.settimeout(3); s.connect(('127.0.0.1',3000)); s.close()" || exit 1
+
+ENTRYPOINT ["aiofmp-mcp-server"]
+# CLI flags here set transport/host/port (env-set MCP_* vars are clobbered
+# by the CLI's own defaults, so they must be passed as args).
+CMD ["--transport", "http", "--host", "0.0.0.0", "--port", "3000"]