FROM node:26-alpine@sha256:e88a35be04478413b7c71c455cd9865de9b9360e1f43456be5951032d7ac1a66 AS ui-build

WORKDIR /app

COPY ui/package*.json ./ui/

RUN cd ui && npm ci

COPY ui/ ./ui/

RUN mkdir -p ./pkg/github/ui_dist && \

cd ui && npm run build

FROM golang:1.27.1-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build

ARG VERSION="dev"

WORKDIR /build

RUN --mount=type=cache,target=/var/cache/apk \

apk add git

COPY . .

COPY --from=ui-build /app/pkg/github/ui_dist/* ./pkg/github/ui_dist/

RUN --mount=type=cache,target=/go/pkg/mod \

--mount=type=cache,target=/root/.cache/go-build \

--mount=type=secret,id=oauth_client_id \

--mount=type=secret,id=oauth_client_secret \

export OAUTH_CLIENT_ID="$(cat /run/secrets/oauth_client_id 2>/dev/null || echo '')" && \

export OAUTH_CLIENT_SECRET="$(cat /run/secrets/oauth_client_secret 2>/dev/null || echo '')" && \

CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION} -X main.commit=$(git rev-parse HEAD) -X main.date=$(date -u +%Y-%m-%dT%H:%M:%SZ) -X github.com/github/github-mcp-server/v2/internal/buildinfo.OAuthClientID=${OAUTH_CLIENT_ID} -X github.com/github/github-mcp-server/v2/internal/buildinfo.OAuthClientSecret=${OAUTH_CLIENT_SECRET}" \

-o /bin/github-mcp-server ./cmd/github-mcp-server

FROM gcr.io/distroless/base-debian12@sha256:fabbf1c0c357a3d42550111351daed089b20a2c954df13ee2fcff60602515e84

LABEL io.modelcontextprotocol.server.name="io.github.github/github-mcp-server"

WORKDIR /server

COPY --from=build /bin/github-mcp-server .

EXPOSE 8082

ENTRYPOINT ["/server/github-mcp-server"]

CMD ["stdio"]