Merge branch 'github:main' into main

Author: yevheniidehtiar

.github/workflows/code-scanning.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -52,13 +52,13 @@ jobs:
             threat-models: [  ]
       - name: Setup proxy for registries
         id: proxy
-        uses: github/codeql-action/start-proxy@v3
+        uses: github/codeql-action/start-proxy@v4
         with:
           registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}
           language: ${{ matrix.language }}
 
       - name: Configure
-        uses: github/codeql-action/resolve-environment@v3
+        uses: github/codeql-action/resolve-environment@v4
         id: resolve-environment
         with:
           language: ${{ matrix.language }}
@@ -70,10 +70,10 @@ jobs:
           cache: false
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         env:
           CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
           CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}

.github/workflows/docker-publish.yml

@@ -46,7 +46,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 #v3.10.0
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad #v4.0.0
         with:
           cosign-release: "v2.2.4"
 

.github/workflows/moderator.yml

@@ -0,0 +1,28 @@
+name: AI Moderator
+on:
+  issues:
+    types: [opened]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  spam-detection:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+      models: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/ai-moderator@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          spam-label: 'spam'
+          ai-label: 'ai-generated'
+          minimize-detected-comments: true
+          enable-spam-detection: true
+          enable-link-spam-detection: true
+          enable-ai-detection: true

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25.1-alpine AS build
+FROM golang:1.25.3-alpine AS build
 ARG VERSION="dev"
 
 # Set the working directory

cmd/github-mcp-server/main.go

@@ -100,6 +100,7 @@ func init() {
 func initConfig() {
 	// Initialize Viper configuration
 	viper.SetEnvPrefix("github")
+	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 	viper.AutomaticEnv()
 
 }

docs/installation-guides/install-gemini-cli.md

@@ -14,7 +14,7 @@ For security, avoid hardcoding your token. Create or update `~/.gemini/.env` (wh
 
 ```bash
 # ~/.gemini/.env
-GITHUB_PAT=your_token_here
+GITHUB_MCP_PAT=your_token_here
 ```
 
 </details>
@@ -30,9 +30,18 @@ After securely storing your PAT, you can add the GitHub MCP server configuration
 
 > **Note:** For the most up-to-date configuration options, see the [main README.md](../../README.md).
 
-### Method 1: Remote Server (Recommended)
+### Method 1: Gemini Extension (Recommended)
 
-The simplest way is to use GitHub's hosted MCP server:
+The simplest way is to use GitHub's hosted MCP server via our gemini extension.
+
+`gemini extensions install https://github.com/github/github-mcp-server`
+
+> [!NOTE]
+> You will still need to have a personal access token with the appropriate scopes called `GITHUB_MCP_PAT` in your environment.
+
+### Method 2: Remote Server
+
+You can also connect to the hosted MCP server directly. After securely storing your PAT, configure Gemini CLI with:
 
 ```json
 // ~/.gemini/settings.json
@@ -41,14 +50,14 @@ The simplest way is to use GitHub's hosted MCP server:
         "github": {
             "httpUrl": "https://api.githubcopilot.com/mcp/",
             "headers": {
-                "Authorization": "Bearer $GITHUB_PAT"
+                "Authorization": "Bearer $GITHUB_MCP_PAT"
             }
         }
     }
 }
 ```
 
-### Method 2: Local Docker
+### Method 3: Local Docker
 
 With docker running, you can run the GitHub MCP server in a container:
 
@@ -67,14 +76,14 @@ With docker running, you can run the GitHub MCP server in a container:
                 "ghcr.io/github/github-mcp-server"
             ],
             "env": {
-                "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_PAT"
+                "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_MCP_PAT"
             }
         }
     }
 }
 ```
 
-### Method 3: Binary
+### Method 4: Binary
 
 You can download the latest binary release from the [GitHub releases page](https://github.com/github/github-mcp-server/releases) or build it from source by running `go build -o github-mcp-server ./cmd/github-mcp-server`.
 
@@ -88,7 +97,7 @@ Then, replacing `/path/to/binary` with the actual path to your binary, configure
             "command": "/path/to/binary",
             "args": ["stdio"],
             "env": {
-                "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_PAT"
+                "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_MCP_PAT"
             }
         }
     }

gemini-extension.json

@@ -0,0 +1,13 @@
+{
+	"name": "github",
+	"version": "1.0.0",
+	"mcpServers": {
+		"github": {
+			"description": "Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.",
+			"httpUrl": "https://api.githubcopilot.com/mcp/",
+			"headers": {
+				"Authorization": "Bearer $GITHUB_MCP_PAT"
+			}
+		}
+	}
+}

internal/ghmcp/server.go

@@ -106,7 +106,24 @@ func NewMCPServer(cfg MCPServerConfig) (*server.MCPServer, error) {
 		},
 	}
 
-	enabledToolsets, invalidToolsets := cleanToolsets(cfg.EnabledToolsets, cfg.DynamicToolsets)
+	enabledToolsets := cfg.EnabledToolsets
+
+	// If dynamic toolsets are enabled, remove "all" from the enabled toolsets
+	if cfg.DynamicToolsets {
+		enabledToolsets = github.RemoveToolset(enabledToolsets, github.ToolsetMetadataAll.ID)
+	}
+
+	// Clean up the passed toolsets
+	enabledToolsets, invalidToolsets := github.CleanToolsets(enabledToolsets)
+
+	// If "all" is present, override all other toolsets
+	if github.ContainsToolset(enabledToolsets, github.ToolsetMetadataAll.ID) {
+		enabledToolsets = []string{github.ToolsetMetadataAll.ID}
+	}
+	// If "default" is present, expand to real toolset IDs
+	if github.ContainsToolset(enabledToolsets, github.ToolsetMetadataDefault.ID) {
+		enabledToolsets = github.AddDefaultToolset(enabledToolsets)
+	}
 
 	if len(invalidToolsets) > 0 {
 		fmt.Fprintf(os.Stderr, "Invalid toolsets ignored: %s\n", strings.Join(invalidToolsets, ", "))
@@ -465,57 +482,3 @@ func (t *bearerAuthTransport) RoundTrip(req *http.Request) (*http.Response, erro
 	req.Header.Set("Authorization", "Bearer "+t.token)
 	return t.transport.RoundTrip(req)
 }
-
-// cleanToolsets cleans and handles special toolset keywords:
-// - Duplicates are removed from the result
-// - Removes whitespaces
-// - Validates toolset names and returns invalid ones separately
-// - "all": Returns ["all"] immediately, ignoring all other toolsets
-// - when dynamicToolsets is true, filters out "all" from the enabled toolsets
-// - "default": Replaces with the actual default toolset IDs from GetDefaultToolsetIDs()
-// Returns: (validToolsets, invalidToolsets)
-func cleanToolsets(enabledToolsets []string, dynamicToolsets bool) ([]string, []string) {
-	seen := make(map[string]bool)
-	result := make([]string, 0, len(enabledToolsets))
-	invalid := make([]string, 0)
-	validIDs := github.GetValidToolsetIDs()
-
-	// Add non-default toolsets, removing duplicates and trimming whitespace
-	for _, toolset := range enabledToolsets {
-		trimmed := strings.TrimSpace(toolset)
-		if trimmed == "" {
-			continue
-		}
-		if !seen[trimmed] {
-			seen[trimmed] = true
-			if trimmed != github.ToolsetMetadataDefault.ID && trimmed != github.ToolsetMetadataAll.ID {
-				// Validate the toolset name
-				if validIDs[trimmed] {
-					result = append(result, trimmed)
-				} else {
-					invalid = append(invalid, trimmed)
-				}
-			}
-		}
-	}
-
-	hasDefault := seen[github.ToolsetMetadataDefault.ID]
-	hasAll := seen[github.ToolsetMetadataAll.ID]
-
-	// Handle "all" keyword - return early if not in dynamic mode
-	if hasAll && !dynamicToolsets {
-		return []string{github.ToolsetMetadataAll.ID}, invalid
-	}
-
-	// Expand "default" keyword to actual default toolsets
-	if hasDefault {
-		for _, defaultToolset := range github.GetDefaultToolsetIDs() {
-			if !seen[defaultToolset] {
-				result = append(result, defaultToolset)
-				seen[defaultToolset] = true
-			}
-		}
-	}
-
-	return result, invalid
-}