Make build no-network

[brikin01]

Fulfills STESOL-572

Summary

Enforces network-isolated RUN instructions when building the final MCP image. Also reintroduces the weekly embeddings build on Sundays (at 09:17 UTC), producing a promotion PR ready for review on Monday.

• Adds network: none to the release build.
• Adds --network none to AMD64 and Arm64 integration builds.
• Explicitly marks every Dockerfile RUN instruction with --network=none.
• Updates the local build example and documents input rollback.
• Adds a policy test covering Dockerfile, release, and integration network settings.

The action-pin unit test was removed because the repository now enables GitHub’s Require actions to be pinned to a full-length commit SHA setting. This centrally enforces the rule across every workflow.

Guarantee and scope

Commands executed by final-image RUN instructions cannot access the network and must use the prepared, digest-pinned build inputs. BuildKit may still contact registries (i.e. GHCR) to pull those pinned images.

Validation

Release workflow dry run succeeded: https://github.com/arm/mcp/actions/runs/32075135766

[Copilot]

Pull request overview

Enforces network isolation for final MCP image builds.

Changes:

• Disables networking in Dockerfile, release, integration, and local builds.
• Adds policy tests and removes redundant action-pin testing.
• Documents build-input rollback procedures.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Updates local build and rollback guidance.
mcp-local/Dockerfile	Marks remaining RUN instructions network-disabled.
mcp-local/tests/test_build_inputs.py	Adds network-isolation policy coverage.
.github/workflows/integration-tests.yml	Disables build networking across architectures.
.github/workflows/build-mcp-image.yml	Disables networking for release builds.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.