feat: add keycloak with minecraft extension by hbrombeer · Pull Request #49 · groundsgg/containers

hbrombeer · 2026-02-23T18:19:34Z

Pull Request

Description

Type of Change

Related Issues

Fixes #

Testing

Unit tests pass
Manual testing completed
New tests added for new functionality

Checklist

I have performed a self-review of my own code
Tests have been added/updated and pass (if needed)
Documentation has been updated (if needed)

Note

Medium Risk
Introduces a new production identity-provider image build that pulls an external JAR at build time and adds it to automated publish/release pipelines, so supply-chain and runtime behavior need review.

Overview
Adds a new keycloak container image based on Keycloak 26.1 that downloads and bundles the keycloak-minecraft provider during a builder stage, then runs with start --optimized and OCI metadata labels.

Integrates keycloak into repo automation by adding it to CI/build-and-push Docker matrices, enabling Dependabot Docker updates for keycloak/, and registering it with release-please (manifest + config) plus top-level README docs.

^{Written by Cursor Bugbot for commit 4ca5930. Configure here.}

CLAassistant · 2026-02-23T18:19:42Z

All committers have signed the CLA.

hbrombeer · 2026-02-23T18:36:01Z

@claude

claude · 2026-02-23T18:36:38Z

Claude finished @hbrombeer's task in 1m 36s —— View job

Code Review

Overall the PR is well-structured and follows the repo's established patterns. A few issues are worth addressing before merge.

`keycloak/Dockerfile` — Issues

1. No checksum verification for the downloaded JAR (medium severity)

keycloak/Dockerfile:7:

ADD --chmod=644 "https://github.com/groundsgg/keycloak-minecraft/releases/download/v${KEYCLOAK_MINECRAFT_VERSION}/keycloak-minecraft.jar" /opt/keycloak/providers/keycloak-minecraft.jar

There is no SHA-256 or signature verification after downloading the JAR. If the release artifact were replaced (even accidentally), the build would silently include it. Since this is your own org's repo the risk is lower, but adding a digest check would harden the supply chain. Consider adding a --checksum option (Docker BuildKit supports ADD --checksum=sha256:<hash> <url>) or a RUN sha256sum -c step. Fix this →

2. KEYCLOAK_MINECRAFT_VERSION ARG won't be auto-updated by Dependabot

keycloak/Dockerfile:3:

ARG KEYCLOAK_MINECRAFT_VERSION=1.0.0

Dependabot's Docker ecosystem monitor tracks base image tags, not ARG defaults. This means the extension version will never receive automatic PRs. The base Keycloak image will be kept up to date, but the keycloak-minecraft JAR version will not. Worth documenting this or tracking it manually.

3. Missing EXPOSE directive

Keycloak listens on ports 8080 (HTTP) and 8443 (HTTPS) by default, but neither is declared. This is a minor gap — compare with paper/Dockerfile:46 and velocity/Dockerfile:48 which both EXPOSE 25565. Fix this →

4. Missing HEALTHCHECK directive

Both paper/Dockerfile:48-49 and velocity/Dockerfile:50-51 include a HEALTHCHECK. The Keycloak image omits one. Keycloak exposes a health endpoint at /health (or /health/ready) on port 8080 which would be appropriate here. Fix this →

CI/CD Changes — OK

.github/workflows/ci.yml and docker-build-push.yml each add keycloak to the matrix in one line. These are correct and consistent with how paper and velocity are registered.

Dependabot — OK

The new entry for /keycloak is consistent with the other Docker entries. One note: as mentioned above, this will track the quay.io/keycloak/keycloak base image tag but not the KEYCLOAK_MINECRAFT_VERSION ARG.

Release-please — OK

Starting at 0.1.0 is appropriate. The release-please-config.json entry is consistent with other packages.

`keycloak/README.md` — Minor

The README is functional but thinner than other container READMEs. It's missing:

Registry pull command (e.g. docker pull ghcr.io/groundsgg/containers/keycloak)
Required environment variables section (at minimum KC_HOSTNAME, KC_DB* are required to run — currently they're listed as "common configuration" but not flagged as required)

Summary

Severity	Issue
Medium	No checksum verification for downloaded JAR
Low	Missing `EXPOSE 8080 8443`
Low	Missing `HEALTHCHECK`
Info	`KEYCLOAK_MINECRAFT_VERSION` not tracked by Dependabot
Info	README could be more complete

The CI/build pipeline integration, release-please config, and dependabot setup are all done correctly.

README.md

lusu007 · 2026-02-23T18:55:14Z

Regarding Claudes comment:

We should only implement

EXPOSE 8080 8443
a HEALTHCHECK using the Keycloak readiness endpoint
a documentation note clarifying that KEYCLOAK_MINECRAFT_VERSION is not tracked by Dependabot
the missing pull command and required environment variables in the README

Regarding the checksum verification: since the JAR is downloaded from our own GitHub org and versioned via an explicit release tag, I’m comfortable with the current setup and would prefer not to add additional checksum handling at this stage.

- Use /health/ready endpoint for HEALTHCHECK instead of plain TCP check - Enable health endpoint during kc.sh build - Add pull command and dependency update note to README - Mark environment variables as required Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

keycloak/Dockerfile

* add keycloak with minecraft extension * changed from curl to native ADD * feat(keycloak): add healthcheck, expose ports, and clean up README * fix(keycloak): address PR review feedback - Use /health/ready endpoint for HEALTHCHECK instead of plain TCP check - Enable health endpoint during kc.sh build - Add pull command and dependency update note to README - Mark environment variables as required Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * bumped version to 26.5.0 * removed renovate & bumped to 26.5.4 * removed changelog.md --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: add keycloak with minecraft extension (#49) * add keycloak with minecraft extension * changed from curl to native ADD * feat(keycloak): add healthcheck, expose ports, and clean up README * fix(keycloak): address PR review feedback - Use /health/ready endpoint for HEALTHCHECK instead of plain TCP check - Enable health endpoint during kc.sh build - Add pull command and dependency update note to README - Mark environment variables as required Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * bumped version to 26.5.0 * removed renovate & bumped to 26.5.4 * removed changelog.md --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4 to 6 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Hendrik Brombeer <20863417+hbrombeer@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Lukas Jost <lukas.jost@outlook.com>

add keycloak with minecraft extension

4ca5930

hbrombeer requested a review from lusu007 February 23, 2026 18:19

changed from curl to native ADD

dbef6b3

lusu007 requested changes Feb 23, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

hbrombeer and others added 2 commits February 23, 2026 19:57

feat(keycloak): add healthcheck, expose ports, and clean up README

ed35266

hbrombeer requested a review from lusu007 February 23, 2026 19:02

lusu007 requested changes Feb 23, 2026

View reviewed changes

keycloak/Dockerfile Outdated Show resolved Hide resolved

keycloak/Dockerfile Outdated Show resolved Hide resolved

keycloak/Dockerfile Outdated Show resolved Hide resolved

bumped version to 26.5.0

15483ed

hbrombeer requested a review from lusu007 February 23, 2026 19:08

hbrombeer added 2 commits February 23, 2026 20:11

removed renovate & bumped to 26.5.4

59cdacc

removed changelog.md

2524fb1

lusu007 approved these changes Feb 23, 2026

View reviewed changes

lusu007 changed the title ~~add keycloak with minecraft extension~~ feat: add keycloak with minecraft extension Feb 23, 2026

lusu007 merged commit ac325b2 into main Feb 23, 2026
7 checks passed

lusu007 deleted the feat/keycloak branch February 23, 2026 19:18

grounds-bot mentioned this pull request Feb 23, 2026

chore(main): release keycloak 0.1.0 #51

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat: add keycloak with minecraft extension#49

feat: add keycloak with minecraft extension#49
lusu007 merged 7 commits intomainfrom
feat/keycloak

hbrombeer commented Feb 23, 2026 •

edited by cursor bot

Loading

Uh oh!

CLAassistant commented Feb 23, 2026 •

edited

Loading

Uh oh!

hbrombeer commented Feb 23, 2026

Uh oh!

claude bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

lusu007 commented Feb 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

hbrombeer commented Feb 23, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Type of Change

Related Issues

Testing

Checklist

Uh oh!

CLAassistant commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hbrombeer commented Feb 23, 2026

Uh oh!

claude bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review

keycloak/Dockerfile — Issues

CI/CD Changes — OK

Dependabot — OK

Release-please — OK

keycloak/README.md — Minor

Summary

Uh oh!

Uh oh!

lusu007 commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hbrombeer commented Feb 23, 2026 •

edited by cursor bot

Loading

CLAassistant commented Feb 23, 2026 •

edited

Loading

claude bot commented Feb 23, 2026 •

edited

Loading

`keycloak/Dockerfile` — Issues

`keycloak/README.md` — Minor

lusu007 commented Feb 23, 2026 •

edited

Loading