Integrate & Rollout goern/forgejo-mcp for Fedora Forge #486

New issue

Open

opened 2026-04-02 08:29:05 +00:00 by humaton · 0 comments

humaton commented

2026-04-02 08:29:05 +00:00

Owner

Summary

To empower Fedora packagers, maintainers, and contributors with AI-assisted workflows, we need to bridge the gap between modern LLM tools and the Fedora Forge. We will evaluate and deploy the open-source goern/forgejo-mcp implementation. This Model Context Protocol (MCP) server will allow local developer AI assistants to securely read repository contents (like RPM spec files), manage pull requests, and analyze issue threads across Fedora packages in real-time.

Details

Integrate & Rollout `goern/forgejo-mcp` for Fedora Forge

Scope Definition

In Scope	Out of Scope
Evaluating the Go-based `goern/forgejo-mcp` server against the Fedora Forge API.	Granting AI agents write permissions to critical Fedora infrastructure or package repositories.
Defining the architecture: Localized contributor setup (STDIO mode) vs. Centralized Fedora Infra deployment (HTTP/SSE).	Integration with external build systems (e.g., Koji, Copr, or Bodhi) outside of the Forge ecosystem.
Establishing access control guidelines via Fedora Forge Personal Access Tokens (PATs).	Developing a custom MCP server from scratch.
Creating onboarding documentation for the Fedora community (Fedora Docs/Wiki).	Full automated package updates triggered directly by AI.

Child Issues & User Stories

Story 1: Tooling Spike & Fedora Forge Compatibility (goern/forgejo-mcp)
- Description: Clone, build, and run the goern/forgejo-mcp project locally. Test the baseline tools (get_my_user_info, file reading, issue querying) specifically against a staging instance of Fedora Forge to ensure compatibility with our specific Forgejo configuration.
Story 2: Define Deployment Architecture for Fedora Contributors
- Description: Determine the recommended topology for the community.
  - Option A (STDIO): Document how individual packagers can run the binary locally within their own IDEs (Cursor/VS Code/Claude Desktop).
  - Option B (HTTP/SSE): Evaluate if Fedora Infrastructure should host a centralized MCP endpoint for web-based AI clients.
- Deliverable: Architecture Decision Record (ADR) submitted to the Fedora Engineering Steering Committee (FESCo) or relevant Infra team.
Story 3: Implement Security Guardrails & Token Policies
- Description: Define strict Personal Access Token (PAT) policies. Ensure contributors are guided to provision tokens with the absolute minimum scopes (e.g., read-only access to their specific namespaces) to prevent accidental AI-triggered modifications to Fedora packages.
Story 4: Infrastructure Automation (If Centralized)
- Description: If an Infra-hosted HTTP/SSE mode is chosen: Create the Ansible playbooks or OpenShift manifests required to deploy goern/forgejo-mcp securely within Fedora Infrastructure.
Story 5: Fedora Community Documentation & Onboarding
- Description: Write a step-by-step guide for Fedora Docs. Include configuration snippets required to setup local MCP clients, demonstrating how an AI assistant can be used to review a spec file or summarize a complex PR on Fedora Forge.

Acceptance Criteria

The goern/forgejo-mcp binary is successfully tested against Fedora Forge and vetted by the infrastructure/engineering teams.
A clear, documented policy exists regarding token management to ensure AI agents cannot perform unauthorized actions on official Fedora repositories.
A Fedora packager can successfully prompt an AI assistant to "Get the contents of the spec file from [Package Repo] on Fedora Forge" and receive an accurate response.
Setup instructions are published to the Fedora documentation and successfully validated by a pilot group of packagers.

Risk Assessment: The primary risk involves supply chain security and token leakage. If a contributor uses an overly permissive token, an AI agent could accidentally push a malformed commit to a Fedora package. Story 3 must explicitly enforce and document read-only token scopes for all community members using the MCP integration.

### Summary To empower Fedora packagers, maintainers, and contributors with AI-assisted workflows, we need to bridge the gap between modern LLM tools and the Fedora Forge. We will evaluate and deploy the open-source **`goern/forgejo-mcp`** implementation. This Model Context Protocol (MCP) server will allow local developer AI assistants to securely read repository contents (like RPM spec files), manage pull requests, and analyze issue threads across Fedora packages in real-time. ### Details ## **Integrate & Rollout `goern/forgejo-mcp` for Fedora Forge** ### **Scope Definition** | In Scope | Out of Scope | | :--- | :--- | | Evaluating the Go-based `goern/forgejo-mcp` server against the Fedora Forge API. | Granting AI agents write permissions to critical Fedora infrastructure or package repositories. | | Defining the architecture: Localized contributor setup (STDIO mode) vs. Centralized Fedora Infra deployment (HTTP/SSE). | Integration with external build systems (e.g., Koji, Copr, or Bodhi) outside of the Forge ecosystem. | | Establishing access control guidelines via Fedora Forge Personal Access Tokens (PATs). | Developing a custom MCP server from scratch. | | Creating onboarding documentation for the Fedora community (Fedora Docs/Wiki). | Full automated package updates triggered directly by AI. | ### **Child Issues & User Stories** * **Story 1: Tooling Spike & Fedora Forge Compatibility (`goern/forgejo-mcp`)** * **Description:** Clone, build, and run the `goern/forgejo-mcp` project locally. Test the baseline tools (`get_my_user_info`, file reading, issue querying) specifically against a staging instance of Fedora Forge to ensure compatibility with our specific Forgejo configuration. * **Story 2: Define Deployment Architecture for Fedora Contributors** * **Description:** Determine the recommended topology for the community. * *Option A (STDIO):* Document how individual packagers can run the binary locally within their own IDEs (Cursor/VS Code/Claude Desktop). * *Option B (HTTP/SSE):* Evaluate if Fedora Infrastructure should host a centralized MCP endpoint for web-based AI clients. * *Deliverable:* Architecture Decision Record (ADR) submitted to the Fedora Engineering Steering Committee (FESCo) or relevant Infra team. * **Story 3: Implement Security Guardrails & Token Policies** * **Description:** Define strict Personal Access Token (PAT) policies. Ensure contributors are guided to provision tokens with the absolute minimum scopes (e.g., read-only access to their specific namespaces) to prevent accidental AI-triggered modifications to Fedora packages. * **Story 4: Infrastructure Automation (If Centralized)** * **Description:** *If an Infra-hosted HTTP/SSE mode is chosen:* Create the Ansible playbooks or OpenShift manifests required to deploy `goern/forgejo-mcp` securely within Fedora Infrastructure. * **Story 5: Fedora Community Documentation & Onboarding** * **Description:** Write a step-by-step guide for Fedora Docs. Include configuration snippets required to setup local MCP clients, demonstrating how an AI assistant can be used to review a spec file or summarize a complex PR on Fedora Forge. ### **Acceptance Criteria** * The `goern/forgejo-mcp` binary is successfully tested against Fedora Forge and vetted by the infrastructure/engineering teams. * A clear, documented policy exists regarding token management to ensure AI agents cannot perform unauthorized actions on official Fedora repositories. * A Fedora packager can successfully prompt an AI assistant to "Get the contents of the spec file from [Package Repo] on Fedora Forge" and receive an accurate response. * Setup instructions are published to the Fedora documentation and successfully validated by a pilot group of packagers. > **Risk Assessment:** The primary risk involves supply chain security and token leakage. If a contributor uses an overly permissive token, an AI agent could accidentally push a malformed commit to a Fedora package. Story 3 must explicitly enforce and document read-only token scopes for all community members using the MCP integration.