Problem

The News Article Generator workflow (.github/workflows/news-article-generator.lock.yml) fails because the riksdag-regering MCP server is configured as a local stdio process running via Docker (npx -y riksdag-regering-mcp). When run locally, riksdag-regering-mcp requires SUPABASE_URL and SUPABASE_ANON_KEY environment variables, which are not passed to the Docker container. This causes the MCP server to crash immediately:

Fel vid start av server: Error: SUPABASE_URL and SUPABASE_ANON_KEY (or SUPABASE_SERVICE_ROLE_KEY) environment variables must be set
    at initSupabase (riksdag-regering-mcp/dist/utils/supabase.js:13:15)

See failing job: https://github.com/Hack23/riksdagsmonitor/actions (job ID 63340233799)

Solution: Switch to HTTP mode (Option A)

The repository's Copilot coding agent already successfully uses riksdag-regering as an HTTP MCP server via .github/copilot-mcp.json:

"riksdag-regering": {
  "type": "http",
  "url": "https://riksdag-regering-ai.onrender.com/mcp",
  "tools": ["*"]
}

The remote Render-hosted server has Supabase credentials configured on the server side, so no secrets need to be stored in the repository.

Changes Required

1. Update .github/workflows/news-article-generator.md (the source file)

In the frontmatter section, change the mcp-servers block from a local command-based server to an HTTP server. The current configuration is:

mcp-servers:
  riksdag-regering:
    command: npx
    args:
      - -y
      - riksdag-regering-mcp

This needs to be changed to use HTTP transport pointing to https://riksdag-regering-ai.onrender.com/mcp. Based on the gh-aw markdown workflow spec, this should be:

mcp-servers:
  riksdag-regering:
    url: https://riksdag-regering-ai.onrender.com/mcp

Also in the steps section, remove the npm install -g riksdag-regering-mcp line since the MCP server is now accessed remotely:

Current:

steps:
  - name: Setup Node.js
    uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
    with:
      node-version: '24'
  
  - name: Install dependencies
    run: |
      npm ci --prefer-offline --no-audit
      npm install -g riksdag-regering-mcp

Change to:

steps:
  - name: Setup Node.js
    uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
    with:
      node-version: '24'
  
  - name: Install dependencies
    run: |
      npm ci --prefer-offline --no-audit

2. After editing the .md file, recompile the lock file

The .lock.yml is auto-generated. The header says:

# This file was automatically generated by gh-aw (v0.43.5). DO NOT EDIT.
# To update this file, edit the corresponding .md file and run:
#   gh aw compile

So the lock file (.github/workflows/news-article-generator.lock.yml) needs to be regenerated by running gh aw compile. However, since the coding agent may not have gh aw installed, the lock file should also be updated directly with the corresponding changes:

In the lock file's "Start MCP gateway" step (around line 493-534), change the riksdag-regering MCP server config from:

"riksdag-regering": {
  "type": "stdio",
  "container": "node:lts-alpine",
  "entrypoint": "npx",
  "entrypointArgs": [
    "npx",
    "-y",
    "riksdag-regering-mcp"
  ],
  "tools": [
    "*"
  ]
}

To HTTP mode:

"riksdag-regering": {
  "type": "http",
  "url": "https://riksdag-regering-ai.onrender.com/mcp",
  "tools": [
    "*"
  ]
}

Also in the lock file:

• In the "Install dependencies" step (line 119-122), remove the npm install -g riksdag-regering-mcp line
• In the "Download container images" step (line 214), remove node:lts-alpine from the image list since it's no longer needed for the riksdag-regering MCP server
• Add riksdag-regering-ai.onrender.com to the --allow-domains list in the "Execute GitHub Copilot CLI" step (around line 667) so the firewall allows outbound HTTP to the Render-hosted MCP server

Important Notes

• The .md file is the source of truth — it gets compiled into the .lock.yml
• The .lock.yml should ideally be regenerated via gh aw compile, but if that's not available, manual edits matching the .md changes are acceptable
• This matches exactly how the Copilot coding agent already successfully connects to the same MCP server (via .github/copilot-mcp.json)
• No new secrets are needed — the remote server handles Supabase authentication internally