fix: ship Node 24.22.1 root certificates in Docker image and mark it deprecated on Docker Hub

.github/workflows/publish.yml

@@ -18,7 +18,6 @@ jobs:
           release-type: node
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: actions/checkout@v4
-        if: ${{ steps.release.outputs.release_created }}
       - uses: actions/setup-node@v6
         with:
           cache: 'npm'
@@ -77,3 +76,14 @@ jobs:
           context: .
           push: true
           tags: octopusdeploy/mcp-server:latest,octopusdeploy/mcp-server:${{ steps.release.outputs.tag_name }}
+      # Docker Hub shows the repository overview, not image labels. Push the overview and short
+      # description on every push to main; the deprecation notice then appears without waiting for a
+      # release. The overview is a separate file because README.md exceeds Docker Hub's 25,000-byte limit.
+      - name: Update Docker Hub description
+        uses: peter-evans/dockerhub-description@v4
+        with:
+          username: octopusdeploy
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: octopusdeploy/mcp-server
+          short-description: "DEPRECATED: use the Remote MCP Server in Octopus Server 2026.3 and later."
+          readme-filepath: ./docs/DOCKERHUB.md

Dockerfile

@@ -1,5 +1,5 @@
 # Build stage
-FROM node:24-alpine AS builder
+FROM node:24.22.1-alpine AS builder
 
 WORKDIR /app
 
@@ -12,15 +12,22 @@ COPY . .
 RUN npm run build
 
 # Production dependencies stage
-FROM node:24-alpine AS prod-deps
+FROM node:24.22.1-alpine AS prod-deps
 
 WORKDIR /app
 
 COPY package*.json ./
 
 RUN npm ci --only=production && npm cache clean --force
 
-FROM gcr.io/distroless/nodejs24-debian12 AS production
+# The debian12 distroless image stopped receiving Node updates at 24.14.0; use debian13.
+# Pinned by digest because distroless publishes no Node version tags. This digest ships Node 24.22.1.
+FROM gcr.io/distroless/nodejs24-debian13@sha256:c23cc7262662efd642cd9c9d61783d10f600321f7bafdd37c8a82365ffaa2aa6 AS production
+
+LABEL org.opencontainers.image.title="Octopus Deploy MCP Server (deprecated)" \
+      org.opencontainers.image.description="Deprecated. Use the Remote MCP Server in Octopus Server 2026.3 and later: https://octopus.com/docs/octopus-ai/mcp/remote" \
+      org.opencontainers.image.source="https://github.com/OctopusDeploy/mcp-server" \
+      org.opencontainers.image.documentation="https://octopus.com/docs/octopus-ai/mcp/remote"
 
 WORKDIR /app
 

docs/DOCKERHUB.md

@@ -0,0 +1,15 @@
+# Octopus Deploy MCP Server (deprecated)
+
+> **Deprecated:** This MCP server is deprecated and no longer recommended for new installations. The Remote MCP Server is built into Octopus Server 2026.3 and later. See the [Remote MCP Server documentation](https://octopus.com/docs/octopus-ai/mcp/remote).
+
+The Octopus MCP Server gives your AI assistant tools to inspect, query, and diagnose problems in your Octopus Deploy instance.
+
+## Usage
+
+Supply credentials through environment variables. Credentials passed as command-line flags would be visible in the host process list.
+
+```bash
+docker run -i --rm -e OCTOPUS_API_KEY=your-key -e OCTOPUS_SERVER_URL=https://your-octopus.com octopusdeploy/mcp-server
+```
+
+For full configuration, tools, and security guidance, see the [GitHub repository](https://github.com/OctopusDeploy/mcp-server).