Function registerCompileTool

pkg/cli/mcp_tools_readonly.go:90–264

registerCompileTool registers the compile tool with the MCP server. manifestCacheFile is the path to a temp JSON file containing pre-cached gh-aw-manifests collected at server startup; it is passed to each compile subprocess via --prior-manifest-file so the compiler uses tamper-proof manifests for s

(server *mcp.Server, execCmd execCmdFunc, manifestCacheFile string)

// enforcement.  An empty string disables this feature.
// Returns an error if schema generation fails, which causes the server to stop registering tools.
func registerCompileTool(server *mcp.Server, execCmd execCmdFunc, manifestCacheFile string) error {
	// Generate schema with elicitation defaults
	compileSchema, err := GenerateSchema[compileArgs]()
	if err != nil {
		mcpLog.Printf("Failed to generate compile tool schema: %v", err)
		return err
	}
	// Add elicitation default: strict defaults to true (most common case)
	if err := AddSchemaDefault(compileSchema, "strict", true); err != nil {
		mcpLog.Printf("Failed to add default for strict: %v", err)
	}

	mcp.AddTool(server, &mcp.Tool{
		Name: "compile",
		Annotations: &mcp.ToolAnnotations{
			IdempotentHint:  true,
			DestructiveHint: boolPtr(false),
			OpenWorldHint:   boolPtr(false),
		},
		Description: `Compile Markdown workflows to GitHub Actions YAML with optional static analysis tools.

⚠️  IMPORTANT: Any change to .github/workflows/*.md files MUST be compiled using this tool.
This tool generates .lock.yml files from .md workflow files. The .lock.yml files are what GitHub Actions
actually executes, so failing to compile after modifying a .md file means your changes won't take effect.

Workflows use strict mode validation by default (unless frontmatter sets strict: false).
Strict mode enforces: action pinning to SHAs, explicit network config, safe-outputs for write operations,
and refuses write permissions and deprecated fields. Use the strict parameter to override frontmatter settings.

Returns JSON array with validation results for each workflow:
- workflow: Name of the workflow file
- valid: Boolean indicating if compilation was successful
- errors: Array of error objects with type, message, and optional line number
- warnings: Array of warning objects
- compiled_file: Path to the generated .lock.yml file`,
		InputSchema: compileSchema,
		Icons: []mcp.Icon{
			{Source: "📋"},
		},
	}, func(ctx context.Context, req *mcp.CallToolRequest, args compileArgs) (*mcp.CallToolResult, any, error) {
		// Check for cancellation before starting
		select {
		case <-ctx.Done():
			return nil, nil, newMCPError(jsonrpc.CodeInternalError, "request cancelled", ctx.Err().Error())
		default:
		}

		// dockerUnavailableWarning is set when Docker is not accessible but the compile
		// should still proceed without the static-analysis tools.  After the compile
		// attempt, the warning is appended to workflow results in the JSON output so
		// the caller knows linting was skipped, while preserving each workflow's
		// valid/invalid status.
		var dockerUnavailableWarning string

		// Check if any static analysis tools are requested that require Docker images
		if args.Zizmor || args.Poutine || args.Actionlint || args.RunnerGuard {
			// Check if Docker images are available; if not, start downloading and return retry message
			if err := CheckAndPrepareDockerImages(ctx, args.Zizmor, args.Poutine, args.Actionlint, args.RunnerGuard); err != nil {