From 5ae478272f037f32ef17577d0c00522907c24477 Mon Sep 17 00:00:00 2001 From: admin Date: Sat, 29 Aug 2026 20:31:09 -0700 Subject: [PATCH] =?UTF-8?q?Add=20FlowAgent=20MCP=20image=20(Dockerfile=20+?= =?UTF-8?q?=20entrypoint)=20=E2=80=94=20build=20only,=20not=20wired=20to?= =?UTF-8?q?=20any=20stack=20yet?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Part 1/3 of FlowAgent (Power Automate MCP) integration into the mcpo service (NOT mcpo-critical). This PR only adds the image build artifacts; it does not modify ai.yaml, mcpo/config.json, or the Woodpecker deploy pipeline, so no live service is affected by merging this alone. Background: mcpo/config.json previously had a dead/abandoned "powerautomate" entry (npm package powerautomate-mcp, never onboarded to the secrets pipeline) that will be replaced by this in a follow-up PR. This build produces a self-contained image with: - azure-cli, for non-interactive `az login --service-principal` at container start (see entrypoint.sh) - FlowAgent's self-contained MCP engine (server/mcp.mjs from microsoft/power-platform-skills — official MIT-licensed Microsoft repo), pinned via FLOWAGENT_REF build arg rather than tracking `main`, so builds stay reproducible until deliberately bumped. Requires (added in follow-up PRs, not yet live): - Woodpecker secrets: flowagent_azure_client_id, flowagent_azure_tenant_id, flowagent_azure_client_secret (Pattern C, Docker secrets via _FILE) - Azure AD App Registration with Power Automate + Dataverse permissions, admin-consented (manual, outside GitOps — see secrets/flowagent.secrets.example) --- mcpo/flowagent/Dockerfile | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 mcpo/flowagent/Dockerfile diff --git a/mcpo/flowagent/Dockerfile b/mcpo/flowagent/Dockerfile new file mode 100644 index 0000000..edfa2d2 --- /dev/null +++ b/mcpo/flowagent/Dockerfile @@ -0,0 +1,21 @@ +FROM ghcr.io/open-webui/mcpo:main + +# Azure CLI — required for non-interactive service-principal auth +# (`az login --service-principal`) performed by entrypoint.sh at container +# start. FlowAgent's auth model is Azure CLI + MSAL; see +# https://github.com/microsoft/power-platform-skills/blob/main/plugins/power-automate/references/connection-patterns.md +RUN apk add --no-cache py3-pip curl \ + && pip install --no-cache-dir --break-system-packages azure-cli + +# FlowAgent self-contained MCP bundle (stdio transport, all tools inlined, +# Node 18+ only — no npm install / remote host needed at runtime). +# Pinned to a ref (commit SHA or tag), NOT `main`, for reproducible builds. +# Bump deliberately via PR when upstream ships updates: +# https://github.com/microsoft/power-platform-skills/tree/main/plugins/power-automate/server +ARG FLOWAGENT_REF=main +RUN mkdir -p /app/flowagent \ + && curl -fsSL "https://raw.githubusercontent.com/microsoft/power-platform-skills/${FLOWAGENT_REF}/plugins/power-automate/server/mcp.mjs" \ + -o /app/flowagent/mcp.mjs + +COPY entrypoint.sh /app/flowagent/entrypoint.sh +RUN chmod +x /app/flowagent/entrypoint.sh