Update issue_read and issue_write to support issue fields

.github/actions/build-ui/action.yml

@@ -0,0 +1,38 @@
+name: Build UI
+description: Restore cached UI HTML artifacts, or set up Node and run script/build-ui on cache miss.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache UI artifacts
+      id: cache-ui
+      uses: actions/cache@v5
+      with:
+        path: |
+          pkg/github/ui_dist/get-me.html
+          pkg/github/ui_dist/issue-write.html
+          pkg/github/ui_dist/pr-write.html
+        key: ui-dist-v1-${{ hashFiles('ui/package-lock.json', 'ui/package.json', 'ui/index.html', 'ui/tsconfig*.json', 'ui/vite.config.ts', 'ui/src/**', 'ui/scripts/**') }}
+        enableCrossOsArchive: true
+
+    - name: Set up Node.js
+      if: steps.cache-ui.outputs.cache-hit != 'true'
+      uses: actions/setup-node@v6
+      with:
+        node-version: "20"
+        cache: npm
+        cache-dependency-path: ui/package-lock.json
+
+    - name: Build UI
+      if: steps.cache-ui.outputs.cache-hit != 'true'
+      shell: bash
+      run: script/build-ui
+
+    - name: Report UI cache status
+      shell: bash
+      run: |
+        if [ "${{ steps.cache-ui.outputs.cache-hit }}" = "true" ]; then
+          echo "UI artifacts restored from cache (skipped build)."
+        else
+          echo "UI artifacts rebuilt from source."
+        fi

.github/copilot-instructions.md

@@ -243,7 +243,6 @@ All workflows run on push/PR unless noted. Located in `.github/workflows/`:
 - **GITHUB_HOST** - For GitHub Enterprise Server (prefix with `https://`)
 - **GITHUB_TOOLSETS** - Comma-separated toolset list (overrides --toolsets flag)
 - **GITHUB_READ_ONLY** - Set to "1" for read-only mode
-- **GITHUB_DYNAMIC_TOOLSETS** - Set to "1" for dynamic toolset discovery
 - **UPDATE_TOOLSNAPS** - Set to "true" when running tests to update snapshots
 - **GITHUB_MCP_SERVER_E2E_TOKEN** - Token for e2e tests
 - **GITHUB_MCP_SERVER_E2E_DEBUG** - Set to "true" for in-process e2e debugging
@@ -273,7 +272,7 @@ server.json         - MCP server registry metadata
 `cmd/github-mcp-server/main.go` - Uses cobra for CLI, viper for config, supports:
 - `stdio` command (default) - MCP stdio transport
 - `generate-docs` command - Documentation generation
-- Flags: --toolsets, --read-only, --dynamic-toolsets, --gh-host, --log-file
+- Flags: --toolsets, --read-only, --gh-host, --log-file
 
 ## Important Reminders
 

.github/workflows/code-scanning.yml

@@ -78,17 +78,17 @@ jobs:
           go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
           cache: false
 
-      - name: Set up Node.js
-        if: matrix.language == 'go' || matrix.language == 'javascript'
-        uses: actions/setup-node@v4
+      - name: Set up Node.js (for JavaScript CodeQL)
+        if: matrix.language == 'javascript'
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           cache: "npm"
           cache-dependency-path: ui/package-lock.json
 
       - name: Build UI
         if: matrix.language == 'go'
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@v4

.github/workflows/docker-publish.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 #v4.1.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2
         with:
           cosign-release: "v2.2.4"
 
@@ -60,7 +60,7 @@ jobs:
       # https://github.com/docker/login-action
       - name: Log into registry ${{ env.REGISTRY }}
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -93,7 +93,7 @@ jobs:
           key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
 
       - name: Inject go-build-cache
-        uses: reproducible-containers/buildkit-cache-dance@1b8ab18fbda5ad3646e3fcc9ed9dd41ce2f297b4 # v3.3.2
+        uses: reproducible-containers/buildkit-cache-dance@5422eac04292c961a382e0f584ea0f03ad9da723 # v3.4.0
         with:
           cache-map: |
             {

.github/workflows/docs-check.yml

@@ -16,15 +16,8 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v6
 
-    - name: Set up Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: "20"
-        cache: "npm"
-        cache-dependency-path: ui/package-lock.json
-
     - name: Build UI
-      run: script/build-ui
+      uses: ./.github/actions/build-ui
 
     - name: Set up Go
       uses: actions/setup-go@v6

.github/workflows/go.yml

@@ -25,16 +25,8 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        shell: bash
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6

.github/workflows/goreleaser.yml

@@ -16,15 +16,8 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -35,7 +28,7 @@ jobs:
         run: go mod download
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89
         with:
           distribution: goreleaser
           # GoReleaser version
@@ -47,7 +40,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate signed build provenance attestations for workflow artifacts
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-path: |
             dist/*.tar.gz

.github/workflows/license-check.yml

@@ -32,15 +32,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh pr checkout ${{ github.event.pull_request.number }}
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
-
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
 
       - name: Set up Go
         uses: actions/setup-go@v6

.github/workflows/lint.yml

@@ -14,13 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "npm"
-          cache-dependency-path: ui/package-lock.json
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'

.github/workflows/mcp-diff.yml

@@ -19,52 +19,48 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
         with:
-          node-version: '20'
+          go-version-file: go.mod
 
       - name: Build UI
-        run: script/build-ui
+        uses: ./.github/actions/build-ui
+
+      - name: Stash UI artifacts for baseline checkout
+        # mcp-server-diff checks the baseline ref out into a separate working
+        # directory and runs install_command there. Without these prebuilt
+        # artifacts, pkg/github/ui_dist/ would be empty on the baseline side
+        # and UIAssetsAvailable() would return false, producing a false-positive
+        # diff that "adds" _meta.ui to MCP Apps tools on every PR.
+        run: |
+          mkdir -p "${RUNNER_TEMP}/ui_dist"
+          cp pkg/github/ui_dist/*.html "${RUNNER_TEMP}/ui_dist/"
+
+      - name: Generate diff configurations
+        id: configs
+        # The generator imports pkg/github so any new entry in
+        # AllowedFeatureFlags is automatically diffed without touching this
+        # workflow. See script/print-mcp-diff-configs/main.go.
+        run: |
+          {
+            echo 'configurations<<MCP_DIFF_EOF'
+            go run ./script/print-mcp-diff-configs
+            echo 'MCP_DIFF_EOF'
+          } >> "$GITHUB_OUTPUT"
 
       - name: Run MCP Server Diff
         uses: SamMorrowDrums/mcp-server-diff@v2.3.5
         with:
-          setup_go: "true"
-          install_command: go mod download
+          setup_go: "false"
+          install_command: |
+            go mod download
+            mkdir -p pkg/github/ui_dist
+            cp "${RUNNER_TEMP}"/ui_dist/*.html pkg/github/ui_dist/
           start_command: go run ./cmd/github-mcp-server stdio
           env_vars: |
             GITHUB_PERSONAL_ACCESS_TOKEN=test-token
-          configurations: |
-            [
-              {"name": "default", "args": ""},
-              {"name": "read-only", "args": "--read-only"},
-              {"name": "dynamic-toolsets", "args": "--dynamic-toolsets"},
-              {"name": "read-only+dynamic", "args": "--read-only --dynamic-toolsets"},
-              {"name": "toolsets-repos", "args": "--toolsets=repos"},
-              {"name": "toolsets-issues", "args": "--toolsets=issues"},
-              {"name": "toolsets-context", "args": "--toolsets=context"},
-              {"name": "toolsets-pull_requests", "args": "--toolsets=pull_requests"},
-              {"name": "toolsets-repos,issues", "args": "--toolsets=repos,issues"},
-              {"name": "toolsets-issues,context", "args": "--toolsets=issues,context"},
-              {"name": "toolsets-all", "args": "--toolsets=all"},
-              {"name": "tools-get_me", "args": "--tools=get_me"},
-              {"name": "tools-get_me,list_issues", "args": "--tools=get_me,list_issues"},
-              {"name": "toolsets-repos+read-only", "args": "--toolsets=repos --read-only"},
-              {"name": "toolsets-all+dynamic", "args": "--toolsets=all --dynamic-toolsets"},
-              {"name": "toolsets-repos+dynamic", "args": "--toolsets=repos --dynamic-toolsets"},
-              {"name": "toolsets-repos,issues+dynamic", "args": "--toolsets=repos,issues --dynamic-toolsets"},
-              {
-                "name": "dynamic-tool-calls",
-                "args": "--dynamic-toolsets",
-                "custom_messages": [
-                  {"id": 10, "name": "list_toolsets_before", "message": {"jsonrpc": "2.0", "id": 10, "method": "tools/call", "params": {"name": "list_available_toolsets", "arguments": {}}}},
-                  {"id": 11, "name": "get_toolset_tools", "message": {"jsonrpc": "2.0", "id": 11, "method": "tools/call", "params": {"name": "get_toolset_tools", "arguments": {"toolset": "repos"}}}},
-                  {"id": 12, "name": "enable_toolset", "message": {"jsonrpc": "2.0", "id": 12, "method": "tools/call", "params": {"name": "enable_toolset", "arguments": {"toolset": "repos"}}}},
-                  {"id": 13, "name": "list_toolsets_after", "message": {"jsonrpc": "2.0", "id": 13, "method": "tools/call", "params": {"name": "list_available_toolsets", "arguments": {}}}}
-                ]
-              }
-            ]
+          configurations: ${{ steps.configs.outputs.configurations }}
 
       - name: Add interpretation note
         if: always()
@@ -78,3 +74,61 @@ jobs:
           echo "- New tools/toolsets added" >> $GITHUB_STEP_SUMMARY
           echo "- Tool descriptions updated" >> $GITHUB_STEP_SUMMARY
           echo "- Capability changes (intentional improvements)" >> $GITHUB_STEP_SUMMARY
+
+  mcp-diff-http:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build UI
+        uses: ./.github/actions/build-ui
+
+      - name: Stash UI artifacts for baseline checkout
+        # See the stdio job above for rationale: the action's baseline checkout
+        # has no UI artifacts unless we hand them over via RUNNER_TEMP.
+        run: |
+          mkdir -p "${RUNNER_TEMP}/ui_dist"
+          cp pkg/github/ui_dist/*.html "${RUNNER_TEMP}/ui_dist/"
+
+      - name: Generate diff configurations
+        id: configs
+        # See script/print-mcp-diff-configs/main.go. The http-headers variant
+        # points every config at a shared HTTP server started by the action
+        # and carries per-config settings via X-MCP-* headers, mirroring how
+        # the remote server is invoked in production (server-side defaults +
+        # per-user header overrides).
+        run: |
+          {
+            echo 'configurations<<MCP_DIFF_EOF'
+            go run ./script/print-mcp-diff-configs -transport http-headers
+            echo 'MCP_DIFF_EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Run MCP Server Diff (streamable-http)
+        uses: SamMorrowDrums/mcp-server-diff@v2.3.5
+        with:
+          setup_go: "false"
+          install_command: |
+            go mod download
+            mkdir -p pkg/github/ui_dist
+            cp "${RUNNER_TEMP}"/ui_dist/*.html pkg/github/ui_dist/
+          http_start_command: go run ./cmd/github-mcp-server http --port 8082
+          http_startup_wait_ms: "5000"
+          configurations: ${{ steps.configs.outputs.configurations }}
+
+      - name: Add interpretation note
+        if: always()
+        run: |
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "---" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "ℹ️ **Note:** This job exercises the streamable-http transport against a shared server, with per-config settings supplied via X-MCP-* request headers." >> $GITHUB_STEP_SUMMARY

.gitignore

@@ -17,9 +17,9 @@ bin/
 .DS_Store
 
 # binary
-github-mcp-server
-mcpcurl
-e2e.test
+/github-mcp-server
+/mcpcurl
+/e2e.test
 
 .history
 conformance-report/

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20-alpine@sha256:09e2b3d9726018aecf269bd35325f46bf75046a643a66d28360ec71132750ec8 AS ui-build
+FROM node:26-alpine@sha256:e71ac5e964b9201072425d59d2e876359efa25dc96bb1768cb73295728d6e4ea AS ui-build
 WORKDIR /app
 COPY ui/package*.json ./ui/
 RUN cd ui && npm ci
@@ -7,7 +7,7 @@ COPY ui/ ./ui/
 RUN mkdir -p ./pkg/github/ui_dist && \
     cd ui && npm run build
 
-FROM golang:1.25.9-alpine@sha256:5caaf1cca9dc351e13deafbc3879fd4754801acba8653fa9540cea125d01a71f AS build
+FROM golang:1.25.10-alpine@sha256:8d22e29d960bc50cd025d93d5b7c7d220b1ee9aa7a239b3c8f55a57e987e8d45 AS build
 ARG VERSION="dev"
 
 # Set the working directory
@@ -30,7 +30,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
     -o /bin/github-mcp-server ./cmd/github-mcp-server
 
 # Make a stage to run the app
-FROM gcr.io/distroless/base-debian12@sha256:9dce90e688a57e59ce473ff7bc4c80bc8fe52d2303b4d99b44f297310bbd2210
+FROM gcr.io/distroless/base-debian12@sha256:58695f439f772a00009c8f6be4c183f824c1f556d74b313c30900f167e4772f8
 
 # Add required MCP server annotation
 LABEL io.modelcontextprotocol.server.name="io.github.github/github-mcp-server"