Add codemod to migrate MCP per-server network config to top-level

[Copilot]

Per-server MCP network configuration was deprecated in commit 0be4e52. Workflows using this pattern now require top-level network.allowed instead.

Changes

Codemod Implementation (codemod_mcp_network.go)

• Extracts network.allowed domains from all MCP servers
• Merges with existing top-level network.allowed if present
• Removes per-server network blocks
• Deduplicates domains across servers

Behavior

• Skips servers without network.allowed or with empty arrays
• Preserves all other MCP server fields (container, env, allowed tools)
• Only applies when at least one server has network configuration with domains

Example

Before:

mcp-servers:
  server1:
    container: image1
    network:
      allowed: [example.com]
  server2:
    container: image2
    network:
      allowed: [api.com]

After:

network:
  allowed:
    - example.com
    - api.com
mcp-servers:
  server1:
    container: image1
  server2:
    container: image2

Testing

14 test cases covering single/multiple servers, merging scenarios, empty arrays, and field preservation.

Original prompt

Add a codemox to repair mcp network configuration into the top level network configuration.

See the changes in 0be4e52#diff-3d5394416b98c54ed7cfab6bccd87d4d86bc3bac4694f52e30f8bc39ccee6c13

Custom agent used: ci-cleaner
Tidies up the repository CI state by formatting sources, running linters, fixing issues, running tests, and recompiling workflows

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.