gitea-mcp: 初次落地 Gitea MCP Server (.NET 10, V1 only-read)

把 Gitea (git.zhengchentao.win) 通过 MCP 暴露给 Claude.ai：列 repo、读代码、看 commits / issues / PR / orgs / packages / actions。
设计文档见 vault Coding/gitea-mcp/gitea-mcp 设计.md。
代码模板复用 obsidian-mcp（.NET 10 + ModelContextProtocol SDK + JwtBearer）。

19 个只读 Tool（全部 scope=read:gitea）：

Repo / 文件：
- list_repos / read_repo
- list_tree（max_entries=500 防爆）
- read_file（max_bytes=1MB，超出 truncated=true）
- search_code（走 /repos/search-code，indexer 未启用时返回结构化错误说明）

分支 / 提交：
- list_branches / list_commits / read_commit（diff 文件数限 50）

Issue / PR：
- list_issues / read_issue（含评论）
- list_pulls / read_pull（含评论 + 改动文件列表）

Org / Package（用户额外授权 read:organization + read:package）：
- list_orgs / read_org
- list_packages / read_package

Gitea Actions（运维友好）：
- list_workflow_runs / read_run_log

技术栈：
- .NET 10 + ModelContextProtocol SDK 1.0
- HttpClientFactory + Microsoft.Extensions.Http.Resilience（指数 backoff，5xx/429/网络错误重试）
- JwtBearer (HS256, Current+Previous fallback, MapInboundClaims=false)
- aud=gitea, scope=read:gitea, iss=https://auth.zhengchentao.win

Gitea API client：
- Authorization: token <PAT> (admin PAT，仅 read scope)
- BaseUrl=https://git.zhengchentao.win
- 错误映射：401/403 → UnauthorizedAccessException，404 → KeyNotFoundException，5xx → InvalidOperationException
- RepoBlacklist 黑名单（owner/repo 精确匹配，默认空）

部署：
- Dockerfile multi-stage，COPY --chown，non-root user
- .gitea/workflows/build-image.yml：build + deploy 双 job，buildkit v0.13.2
- 容器内 :8080，宿主端口 9092
- 子域名 git-mcp.zhengchentao.win（区别于 Gitea 本体 git.zhengchentao.win）

测试：6/6 单测过（GiteaRepoFilter 黑名单匹配）

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Tools/ActionsTools.cs

@@ -0,0 +1,108 @@
+using GiteaMcp.Services;
+using ModelContextProtocol.Server;
+using System.ComponentModel;
+
+namespace GiteaMcp.Tools;
+
+/// <summary>Gitea Actions Tool：list_workflow_runs / read_run_log</summary>
+[McpServerToolType]
+public class ActionsTools(
+    GiteaApiClient gitea,
+    GiteaRepoFilter filter)
+{
+    [McpServerTool]
+    [Description(
+        "List recent Gitea Actions workflow runs for a repository. " +
+        "Filter by branch name or run status (queued/in_progress/success/failure/cancelled/skipped). " +
+        "Returns: run ID, workflow name, triggering event, branch, status, conclusion, actor, and timestamps. " +
+        "Use read_run_log to get the full log output of a specific run or job.")]
+    public async Task<object> list_workflow_runs(
+        [Description("Repository owner.")] string owner,
+        [Description("Repository name.")] string repo,
+        [Description("Filter by branch name. Optional.")] string? branch = null,
+        [Description("Filter by status: 'queued', 'in_progress', 'success', 'failure', 'cancelled', 'skipped'. Optional.")] string? status = null,
+        [Description("Max runs to return. Default 30.")] int? limit = null,
+        CancellationToken ct = default)
+    {
+        if (filter.IsBlocked($"{owner}/{repo}"))
+            throw new UnauthorizedAccessException($"Repo {owner}/{repo} is on the access blocklist.");
+
+        var lim = Math.Min(limit ?? 30, 100);
+        var result = await gitea.GetWorkflowRunsAsync(owner, repo, branch, status, lim, ct);
+
+        return new
+        {
+            total = result.TotalCount,
+            runs = result.WorkflowRuns.Select(r => new
+            {
+                id = r.Id,
+                name = r.Name,
+                @event = r.Event,
+                branch = r.HeadBranch,
+                sha = r.HeadSha,
+                status = r.Status,
+                conclusion = r.Conclusion,
+                actor = r.Actor?.Login,
+                html_url = r.HtmlUrl,
+                created_at = r.CreatedAt,
+                updated_at = r.UpdatedAt,
+            }).ToList(),
+        };
+    }
+
+    [McpServerTool]
+    [Description(
+        "Get detailed info and log output for a specific Gitea Actions workflow run. " +
+        "Returns: run overview (status, conclusion, timing) + all jobs with their status. " +
+        "Log output is truncated to 1MB; long logs will have '[...log truncated...]' appended. " +
+        "When job_id is provided, fetches that specific job's log; otherwise fetches the run-level log. " +
+        "Use list_workflow_runs to find the run_id.")]
+    public async Task<object> read_run_log(
+        [Description("Repository owner.")] string owner,
+        [Description("Repository name.")] string repo,
+        [Description("Workflow run ID (from list_workflow_runs).")] long run_id,
+        [Description("Specific job ID to fetch logs for. Omit to get the run-level log.")] long? job_id = null,
+        CancellationToken ct = default)
+    {
+        if (filter.IsBlocked($"{owner}/{repo}"))
+            throw new UnauthorizedAccessException($"Repo {owner}/{repo} is on the access blocklist.");
+
+        var runTask = gitea.GetWorkflowRunAsync(owner, repo, run_id, ct);
+        var jobsTask = gitea.GetRunJobsAsync(owner, repo, run_id, ct);
+        var logTask = gitea.GetRunLogAsync(owner, repo, run_id, job_id, ct: ct);
+
+        await Task.WhenAll(runTask, jobsTask, logTask);
+
+        var run = await runTask;
+        var jobList = await jobsTask;
+        var log = await logTask;
+
+        return new
+        {
+            run = new
+            {
+                id = run.Id,
+                name = run.Name,
+                @event = run.Event,
+                branch = run.HeadBranch,
+                sha = run.HeadSha,
+                status = run.Status,
+                conclusion = run.Conclusion,
+                actor = run.Actor?.Login,
+                html_url = run.HtmlUrl,
+                created_at = run.CreatedAt,
+                updated_at = run.UpdatedAt,
+            },
+            jobs = jobList.WorkflowJobs.Select(j => new
+            {
+                id = j.Id,
+                name = j.Name,
+                status = j.Status,
+                conclusion = j.Conclusion,
+                started_at = j.StartedAt,
+                completed_at = j.CompletedAt,
+            }).ToList(),
+            log,
+        };
+    }
+}