fix: resolve remaining a2a ci failures

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: lucarlig

Containerfile.lite

@@ -135,7 +135,6 @@ RUN if [ "$ENABLE_RUST" = "true" ]; then \
 # Build the experimental Rust A2A runtime binary (only if ENABLE_RUST=true)
 RUN if [ "$ENABLE_RUST" = "true" ]; then \
         cargo build --release -p contextforge_a2a_runtime && \
-        cp /build/target/release/contextforge_a2a_runtime /build/target/release/contextforge-a2a-runtime && \
         echo "✅ Rust A2A runtime built successfully"; \
     else \
         echo "⏭️  Skipping Rust A2A runtime build"; \

mcpgateway/main.py

@@ -81,7 +81,7 @@
 from mcpgateway.common.models import ListResourceTemplatesResult, LogLevel, Root
 from mcpgateway.common.validators import SecurityValidator
 from mcpgateway.config import settings
-from mcpgateway.db import refresh_slugs_on_startup, SessionLocal
+from mcpgateway.db import A2AAgent as DbA2AAgent, A2APushNotificationConfig, A2ATask as DbA2ATask, refresh_slugs_on_startup, SessionLocal
 from mcpgateway.db import Tool as DbTool
 from mcpgateway.handlers.sampling import SamplingHandler
 from mcpgateway.middleware.compression import SSEAwareCompressMiddleware
@@ -111,6 +111,7 @@
 from mcpgateway.schemas import (
     A2AAgentCreate,
     A2AAgentRead,
+    A2APushNotificationConfigCreate,
     A2AAgentUpdate,
     CursorPaginatedA2AAgentsResponse,
     CursorPaginatedGatewaysResponse,
@@ -143,6 +144,7 @@
     ToolUpdate,
 )
 from mcpgateway.services.a2a_service import A2AAgentError, A2AAgentNameConflictError, A2AAgentNotFoundError, A2AAgentService
+from mcpgateway.services.a2a_server_service import A2AServerService
 from mcpgateway.services.cancellation_service import cancellation_service
 from mcpgateway.services.completion_service import CompletionService
 from mcpgateway.services.content_security import ContentSizeError, ContentTypeError
@@ -8962,19 +8964,12 @@ async def handle_internal_a2a_agent_resolve(request: Request, agent_name: str):
 
     db = SessionLocal()
     try:
-        # First-Party
-        from mcpgateway.db import A2AAgent as DbA2AAgent  # pylint: disable=import-outside-toplevel
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
-        agent = db.query(DbA2AAgent).filter(DbA2AAgent.name == agent_name, DbA2AAgent.enabled == True).first()  # noqa: E712
+        agent = db.query(DbA2AAgent).filter(DbA2AAgent.name == agent_name, DbA2AAgent.enabled.is_(True)).first()
         if not agent:
-            # First-Party
-            from mcpgateway.services.a2a_server_service import A2AServerService  # pylint: disable=import-outside-toplevel
-
-            server_service = A2AServerService()
-            server_agent = server_service.resolve_server_agent(db, agent_name, user_email=user_email, token_teams=token_teams)
+            a2a_server_service = A2AServerService()
+            server_agent = a2a_server_service.resolve_server_agent(db, agent_name, user_email=user_email, token_teams=token_teams)
             if server_agent:
                 return ORJSONResponse(status_code=200, content=server_agent)
             return ORJSONResponse(status_code=404, content={"error": f"agent '{agent_name}' not found"})
@@ -9023,27 +9018,18 @@ async def handle_internal_a2a_agent_card(request: Request, agent_name: str):
 
     db = SessionLocal()
     try:
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
 
         # Check agent visibility before building the card to avoid loading
         # sensitive relationship data for agents the caller cannot see.
-        # First-Party
-        from mcpgateway.db import A2AAgent as DbA2AAgent  # pylint: disable=import-outside-toplevel
-
-        agent = db.query(DbA2AAgent).filter(DbA2AAgent.name == agent_name, DbA2AAgent.enabled == True).first()  # noqa: E712
+        agent = db.query(DbA2AAgent).filter(DbA2AAgent.name == agent_name, DbA2AAgent.enabled.is_(True)).first()
         card = None
         if agent is not None and service._check_agent_access(agent, user_email, token_teams):  # pylint: disable=protected-access
             card = service.get_agent_card(db, agent_name)
         if card is None:
-            # First-Party
-            from mcpgateway.services.a2a_server_service import A2AServerService  # pylint: disable=import-outside-toplevel
-
-            server_service = A2AServerService()
-            card = server_service.get_server_agent_card(db, agent_name, user_email=user_email, token_teams=token_teams)
+            a2a_server_service = A2AServerService()
+            card = a2a_server_service.get_server_agent_card(db, agent_name, user_email=user_email, token_teams=token_teams)
         if card is None:
             return ORJSONResponse(status_code=404, content={"error": f"agent '{agent_name}' not found"})
         return ORJSONResponse(status_code=200, content=card)
@@ -9078,9 +9064,6 @@ async def handle_internal_a2a_tasks_get(request: Request):
         if agent_id is not None and not isinstance(agent_id, str):
             return ORJSONResponse(status_code=400, content={"error": "agent_id must be a string"})
 
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         task = service.get_task(db, task_id, agent_id=agent_id, user_email=user_email, token_teams=token_teams)
@@ -9120,9 +9103,6 @@ async def handle_internal_a2a_tasks_list(request: Request):
         limit = min(int(body.get("limit", 100)), 1000)
         offset = max(int(body.get("offset", 0)), 0)
 
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         tasks = service.list_tasks(db, agent_id=agent_id, state=state, limit=limit, offset=offset, user_email=user_email, token_teams=token_teams)
@@ -9158,9 +9138,6 @@ async def handle_internal_a2a_tasks_cancel(request: Request):
         if agent_id is not None and not isinstance(agent_id, str):
             return ORJSONResponse(status_code=400, content={"error": "agent_id must be a string"})
 
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         task = service.cancel_task(db, task_id, agent_id=agent_id, user_email=user_email, token_teams=token_teams)
@@ -9195,10 +9172,6 @@ async def handle_internal_a2a_push_create(request: Request):
             return ORJSONResponse(status_code=400, content={"error": "a2a_agent_id, task_id, and webhook_url are required"})
 
         # Validate webhook URL through the schema to enforce SSRF protection.
-        # First-Party
-        from mcpgateway.schemas import A2APushNotificationConfigCreate  # pylint: disable=import-outside-toplevel
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         try:
             validated = A2APushNotificationConfigCreate(**body)
         except Exception as validation_err:
@@ -9239,9 +9212,6 @@ async def handle_internal_a2a_push_get(request: Request):
         if not task_id:
             return ORJSONResponse(status_code=400, content={"error": "task_id is required"})
 
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         cfg = service.get_push_config(db, task_id, agent_id=agent_id)
@@ -9277,9 +9247,6 @@ async def handle_internal_a2a_push_list(request: Request):
         agent_id = body.get("agent_id")
         task_id = body.get("task_id")
 
-        # First-Party
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         configs = service.list_push_configs(db, agent_id=agent_id, task_id=task_id)
@@ -9314,10 +9281,6 @@ async def handle_internal_a2a_push_delete(request: Request):
         if not config_id:
             return ORJSONResponse(status_code=400, content={"error": "config_id is required"})
 
-        # First-Party
-        from mcpgateway.db import A2APushNotificationConfig  # pylint: disable=import-outside-toplevel
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         cfg = db.query(A2APushNotificationConfig).filter(A2APushNotificationConfig.id == config_id).first()
@@ -9355,10 +9318,6 @@ async def handle_internal_a2a_events_flush(request: Request):
         if not events:
             return ORJSONResponse(status_code=200, content={"count": 0})
 
-        # First-Party
-        from mcpgateway.db import A2ATask as DbA2ATask  # pylint: disable=import-outside-toplevel
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
 
@@ -9403,10 +9362,6 @@ async def handle_internal_a2a_events_replay(request: Request):
         if not task_id:
             return ORJSONResponse(status_code=400, content={"error": "task_id required"})
 
-        # First-Party
-        from mcpgateway.db import A2ATask as DbA2ATask  # pylint: disable=import-outside-toplevel
-        from mcpgateway.services.a2a_service import A2AAgentService  # pylint: disable=import-outside-toplevel
-
         user_email, token_teams = _get_internal_a2a_scope_context(request)
         service = A2AAgentService()
         task_row = db.query(DbA2ATask).filter(DbA2ATask.task_id == task_id).first()

mcpgateway/services/a2a_protocol.py

@@ -366,9 +366,7 @@ def prepare_a2a_invocation(
                     # If decoding fails (corrupted data, wrong key, invalid encoding, truncated input,
                     # or invalid nonce/cipher parameters), use the raw value as the API key
                     #
-                    # TODO:  Is this a logic failure?  Perhaps the gateway should
-                    # ensure all API Key style auths are encoded -- or vice versa
-                    #
+                    # Keep backward compatibility with older raw API key rows.
                     headers.setdefault("Authorization", f"Bearer {auth_value}")
             else:
                 decoded = decode_auth(auth_value)

mcpgateway/services/a2a_server_service.py

@@ -107,7 +107,7 @@ def get_server_agent_card(
             >>> service.get_server_agent_card(db, "no-such-server") is None
             True
         """
-        server_query = select(DbServer).where(DbServer.name == server_name, DbServer.enabled == True)  # noqa: E712
+        server_query = select(DbServer).where(DbServer.name == server_name, DbServer.enabled.is_(True))
         server = db.execute(server_query).scalar_one_or_none()
         if not server:
             return None
@@ -178,7 +178,7 @@ def resolve_server_agent(
             >>> service.resolve_server_agent(db, "no-such-server") is None
             True
         """
-        server_query = select(DbServer).where(DbServer.name == server_name, DbServer.enabled == True)  # noqa: E712
+        server_query = select(DbServer).where(DbServer.name == server_name, DbServer.enabled.is_(True))
         server = db.execute(server_query).scalar_one_or_none()
         if not server:
             return None
@@ -225,7 +225,7 @@ def select_downstream_agent(self, db: Session, server_id: str) -> Optional[str]:
             .join(server_a2a_association, server_a2a_association.c.a2a_agent_id == DbA2AAgent.id)
             .where(
                 server_a2a_association.c.server_id == server_id,
-                DbA2AAgent.enabled == True,  # noqa: E712
+                DbA2AAgent.enabled.is_(True),
             )
             .order_by(DbA2AAgent.name)
             .limit(1)
@@ -331,7 +331,7 @@ def _find_a2a_interface(self, db: Session, server_id: str) -> Optional[DbServerI
             select(DbServerInterface)
             .where(
                 DbServerInterface.server_id == server_id,
-                DbServerInterface.enabled == True,  # noqa: E712
+                DbServerInterface.enabled.is_(True),
                 func.lower(DbServerInterface.protocol).like("a2a%"),
             )
             .order_by(DbServerInterface.created_at.desc())

mcpgateway/services/a2a_service.py

@@ -361,7 +361,7 @@ def _visible_agent_ids(
         if token_teams is None and user_email is None:
             return None
 
-        query = db.query(DbA2AAgent.id).filter(DbA2AAgent.enabled == True)  # noqa: E712
+        query = db.query(DbA2AAgent.id).filter(DbA2AAgent.enabled.is_(True))
 
         # Build visibility predicate matching _check_agent_access rules.
         visibility_filters = [DbA2AAgent.visibility == "public"]
@@ -1055,7 +1055,7 @@ def get_agent_card(self, db: Session, agent_name: str) -> Optional[Dict[str, Any
             >>> service.get_agent_card(db, "missing") is None
             True
         """
-        query = select(DbA2AAgent).where(DbA2AAgent.name == agent_name, DbA2AAgent.enabled == True)  # noqa: E712
+        query = select(DbA2AAgent).where(DbA2AAgent.name == agent_name, DbA2AAgent.enabled.is_(True))
         agent = db.execute(query).scalar_one_or_none()
         if not agent:
             return None

tests/unit/mcpgateway/services/test_a2a_service.py

@@ -3550,6 +3550,7 @@ def test_get_push_config_found(self, service, mock_db):
         cfg = MagicMock()
         mock_query = MagicMock()
         mock_query.filter.return_value = mock_query
+        mock_query.order_by.return_value = mock_query
         mock_query.first.return_value = cfg
         mock_db.query.return_value = mock_query
 
@@ -3564,6 +3565,7 @@ def test_get_push_config_not_found(self, service, mock_db):
         """get_push_config returns None when no config exists for the task."""
         mock_query = MagicMock()
         mock_query.filter.return_value = mock_query
+        mock_query.order_by.return_value = mock_query
         mock_query.first.return_value = None
         mock_db.query.return_value = mock_query
 
@@ -3576,6 +3578,7 @@ def test_get_push_config_with_agent_id(self, service, mock_db):
         cfg = MagicMock()
         mock_query = MagicMock()
         mock_query.filter.return_value = mock_query
+        mock_query.order_by.return_value = mock_query
         mock_query.first.return_value = cfg
         mock_db.query.return_value = mock_query