Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

MCP Gateway rejects digest-pinned container images: embedded JSON schema disagrees with containerPattern

Open Beginner friendly
  • Is something wrong?
#69,405 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@pelikhan is already working on this.

Since Oct 18, 2026.

  • #69997 by @copilot-swe-agent — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, go
Domain
backend

Research direction

Start with the server container pattern in internal/config/schema/mcp-gateway-config.schema.json and compare it with containerPattern in internal/config/validation_rules.go, which already accepts an optional @sha256 suffix. Append the same digest group to the schema pattern, then add cases to internal/config/validation_schema_test.go showing that both digest forms pass and a short digest fails. Done when the digest-pinned configs load and invalid images are still rejected.

Written by the indexing model from the issue text.

Description

ai-inspected
Analysis

The MCP Gateway (github/gh-aw-mcpg, v0.4.33) rejects digest-pinned server images, so MCP server images cannot be pinned by digest from a workflow. gh-aw's workflow schema allows container: name:tag@sha256:<64 hex>, so it compiles, then fails at gateway startup.

In gh-aw-mcpg the two validators disagree:

  • internal/config/validation_rules.go: containerPattern ends with (@sha256:[a-fA-F0-9]{64})? (accepts digests; validation_string_patterns_test.go has digest cases as valid).
  • internal/config/schema/mcp-gateway-config.schema.json (embedded, applied to the stdin config): the server container pattern ends with (:([a-zA-Z0-9._-]+|latest))?$, no digest. Unchanged from v0.4.28 to v0.4.33.

Reproduce with ghcr.io/github/gh-aw-mcpg:v0.4.33 and an identical minimal config, changing only container:

  • ghcr.io/github/github-mcp-server:v1.0.0: accepted.
  • ...:v1.0.0@sha256:<64 hex> and ...@sha256:<64 hex>: failed to load config: ... jsonschema validation failed ... Location: <root>.
Implementation Plan (in github/gh-aw-mcpg)
  1. internal/config/schema/mcp-gateway-config.schema.json: append (@sha256:[a-fA-F0-9]{64})? to the server container pattern(s), matching containerPattern.
  2. Tests (internal/config/validation_schema_test.go): both digest forms pass schema validation; a short digest fails.
  3. Run make agent-finished before completing.
Acceptance Criteria

A config whose server container is name:tag@sha256:<64 hex> or name@sha256:<64 hex> loads and launches on the gateway; invalid images are still rejected.

Dominant language
Go
Stars
5.4k
Forks
584
Avg merge
3h 20m
Merged PRs (30d)
830

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw

All issues in github/gh-aw

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.