From ac85d9e51797235fd9fe5e7f9a7712b1d9e7893a Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 16:51:06 -0800
Subject: [PATCH 1/5] fix: use force push to override GitLab branch

- Remove git pull step that was causing merge conflicts
- Add --force flag to git push to handle branch divergence
- This allows GitHub to override GitLab branch when they diverge
---
 .github/workflows/tests.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9dfa409..fbb4e30 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -81,5 +81,4 @@ jobs:
         git remote add gitlab https://gitlab.com/dk-raas/dkai/mcp-servers/high-command-mcp.git
         git config credential.helper '!f() { echo "username=oauth2"; echo "password=${GITLAB_TOKEN}"; }; f'
         git fetch gitlab main
-        git pull gitlab main --no-edit
-        git push gitlab HEAD:main
+        git push gitlab HEAD:main --force

From 4ee90f9586dff1ac5d90cd676fa6b8b282d8b63b Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 18:02:09 -0800
Subject: [PATCH 2/5] feat: add build stage and fix docker login

- Add separate build stage with language-specific images (Go/Python/Node)
- Fix docker login to use --username flag (per GitLab docs)
- Build artifacts are passed to docker build stage via dependencies
- Add DOCKER_TLS_CERTDIR for Docker-in-Docker support
- Run 'make build' before docker build to prepare app assets
---
 .gitlab-ci.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3f5bd2d..31c712b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,18 +1,38 @@
 stages:
   - build
+  - docker
 
 variables:
   HARBOR_REGISTRY: harbor.dataknife.net
   HARBOR_PROJECT: library
   IMAGE_NAME: high-command-mcp
+  DOCKER_TLS_CERTDIR: "/certs"
 
-docker-build:
+build:
   stage: build
+  image: golang:1.23-alpine
+  script:
+    - apk add --no-cache make git
+    - make build
+  artifacts:
+    paths:
+      - bin/
+    expire_in: 1 hour
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_TAG'
+  tags:
+    - docker
+
+docker-build:
+  stage: docker
   image: docker:latest
   services:
     - docker:dind
+  dependencies:
+    - build
   before_script:
-    - echo "$HARBOR_PASSWORD" | docker login -u "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY
+    - echo "$HARBOR_PASSWORD" | docker login --username "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY
   script:
     - |
       # Build image once

From e5ba95cc9ed8f1eea86c96da6154829fe934a7fd Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sat, 10 Jan 2026 23:07:36 -0800
Subject: [PATCH 3/5] Use DOCKER_AUTH_CONFIG group variable for Harbor
 authentication

- Remove before_script auth generation code
- Rely on DOCKER_AUTH_CONFIG GitLab group variable
- Matches working pattern from proxmox-ve-mcp
---
 .gitlab-ci.yml | 43 +++++++++++++++++++------------------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 31c712b..1769342 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,10 +3,7 @@ stages:
   - docker
 
 variables:
-  HARBOR_REGISTRY: harbor.dataknife.net
-  HARBOR_PROJECT: library
   IMAGE_NAME: high-command-mcp
-  DOCKER_TLS_CERTDIR: "/certs"
 
 build:
   stage: build
@@ -22,38 +19,36 @@ build:
     - if: '$CI_COMMIT_BRANCH == "main"'
     - if: '$CI_COMMIT_TAG'
   tags:
-    - docker
+    - kubernetes
 
-docker-build:
+publish:
   stage: docker
-  image: docker:latest
-  services:
-    - docker:dind
+  image:
+    name: moby/buildkit:rootless
+    entrypoint: [""]
   dependencies:
     - build
-  before_script:
-    - echo "$HARBOR_PASSWORD" | docker login --username "$HARBOR_USERNAME" --password-stdin $HARBOR_REGISTRY
   script:
     - |
-      # Build image once
-      docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest .
+      # Use commit SHA if available, otherwise fall back to pipeline ID
+      IMAGE_TAG="${CI_COMMIT_SHORT_SHA:-$CI_PIPELINE_ID}"
       
-      # Tag with commit SHA
-      docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
-        $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
+      # Build and push images with BuildKit rootless (multiple outputs for multiple tags)
+      OUTPUT_FLAGS="--output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest,push=true"
+      OUTPUT_FLAGS="$OUTPUT_FLAGS --output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$IMAGE_TAG,push=true"
       
-      # Push images
-      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest
-      docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHORT_SHA
-      
-      # Tag with version if tag exists
+      # Add version tag if tag exists
       if [ -n "$CI_COMMIT_TAG" ]; then
-        docker tag $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:latest \
-          $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
-        docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG
+        OUTPUT_FLAGS="$OUTPUT_FLAGS --output type=image,name=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_TAG,push=true"
       fi
+      
+      buildctl-daemonless.sh build \
+        --frontend dockerfile.v0 \
+        --local context=. \
+        --local dockerfile=. \
+        $OUTPUT_FLAGS
   rules:
     - if: '$CI_COMMIT_BRANCH == "main"'
     - if: '$CI_COMMIT_TAG'
   tags:
-    - docker
+    - kubernetes

From 0d6aece0fe09ff880cc4b89497239340aec7e5ed Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sun, 11 Jan 2026 10:26:01 -0800
Subject: [PATCH 4/5] fix: add bash package for Makefile

The Makefile uses SHELL := /bin/bash which requires bash to be
installed. Alpine Linux doesn't include bash by default, so add it
to the apk add command.
---
 .gitlab-ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 1769342..f890b82 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,9 +7,9 @@ variables:
 
 build:
   stage: build
-  image: golang:1.23-alpine
+  image: harbor.dataknife.net/dockerhub/library/golang:1.23-alpine
   script:
-    - apk add --no-cache make git
+    - apk add --no-cache make git bash
     - make build
   artifacts:
     paths:

From 913bd491cd515fab6fc9bdd84199cb616460156d Mon Sep 17 00:00:00 2001
From: Lee Chapman <lee@fullmetal.dev>
Date: Sun, 11 Jan 2026 10:37:13 -0800
Subject: [PATCH 5/5] resolve: merge conflict - keep harbor proxy image and
 bash

Keep our changes:
- Harbor proxy image (harbor.dataknife.net/dockerhub/library/golang:1.23-alpine)
- bash package in apk add (required by Makefile)
---
 .gitlab-ci.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 912ce00..f890b82 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -7,15 +7,9 @@ variables:
 
 build:
   stage: build
-<<<<<<< HEAD
   image: harbor.dataknife.net/dockerhub/library/golang:1.23-alpine
   script:
     - apk add --no-cache make git bash
-=======
-  image: golang:1.23-alpine
-  script:
-    - apk add --no-cache make git
->>>>>>> origin/main
     - make build
   artifacts:
     paths: