ci(mcp-diff): add insiders + per-feature configs

The mcp-diff matrix now includes:
  - --insiders (and --insiders --read-only)
  - one config per github.AllowedFeatureFlags entry, generated by
    script/print-mcp-diff-configs so new user-controllable flags get
    diffed automatically without editing the workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

.github/workflows/mcp-diff.yml

@@ -19,32 +19,35 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
       - name: Build UI
         uses: ./.github/actions/build-ui
 
+      - name: Generate diff configurations
+        id: configs
+        # The generator imports pkg/github so any new entry in
+        # AllowedFeatureFlags is automatically diffed without touching this
+        # workflow. See script/print-mcp-diff-configs/main.go.
+        run: |
+          {
+            echo 'configurations<<MCP_DIFF_EOF'
+            go run ./script/print-mcp-diff-configs
+            echo 'MCP_DIFF_EOF'
+          } >> "$GITHUB_OUTPUT"
+
       - name: Run MCP Server Diff
         uses: SamMorrowDrums/mcp-server-diff@v2.3.5
         with:
-          setup_go: "true"
+          setup_go: "false"
           install_command: go mod download
           start_command: go run ./cmd/github-mcp-server stdio
           env_vars: |
             GITHUB_PERSONAL_ACCESS_TOKEN=test-token
-          configurations: |
-            [
-              {"name": "default", "args": ""},
-              {"name": "read-only", "args": "--read-only"},
-              {"name": "toolsets-repos", "args": "--toolsets=repos"},
-              {"name": "toolsets-issues", "args": "--toolsets=issues"},
-              {"name": "toolsets-context", "args": "--toolsets=context"},
-              {"name": "toolsets-pull_requests", "args": "--toolsets=pull_requests"},
-              {"name": "toolsets-repos,issues", "args": "--toolsets=repos,issues"},
-              {"name": "toolsets-issues,context", "args": "--toolsets=issues,context"},
-              {"name": "toolsets-all", "args": "--toolsets=all"},
-              {"name": "tools-get_me", "args": "--tools=get_me"},
-              {"name": "tools-get_me,list_issues", "args": "--tools=get_me,list_issues"},
-              {"name": "toolsets-repos+read-only", "args": "--toolsets=repos --read-only"}
-            ]
+          configurations: ${{ steps.configs.outputs.configurations }}
 
       - name: Add interpretation note
         if: always()

script/print-mcp-diff-configs/main.go

@@ -0,0 +1,61 @@
+// Command print-mcp-diff-configs emits the full configuration matrix consumed
+// by the mcp-server-diff GitHub Action. The matrix is composed of three parts:
+//
+//  1. Hand-curated baseline configs (default, read-only, common toolset combos)
+//  2. Insiders configs (--insiders, --insiders --read-only) — meta flag that
+//     expands to the curated insiders feature set
+//  3. One config per entry in github.AllowedFeatureFlags — automatically kept
+//     in sync with the Go source so any new user-controllable feature flag
+//     gets diffed without touching the workflow
+//
+// Usage: go run ./script/print-mcp-diff-configs
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"sort"
+
+	"github.com/github/github-mcp-server/pkg/github"
+)
+
+type config struct {
+	Name string `json:"name"`
+	Args string `json:"args"`
+}
+
+func main() {
+	configs := []config{
+		{Name: "default", Args: ""},
+		{Name: "read-only", Args: "--read-only"},
+		{Name: "toolsets-repos", Args: "--toolsets=repos"},
+		{Name: "toolsets-issues", Args: "--toolsets=issues"},
+		{Name: "toolsets-context", Args: "--toolsets=context"},
+		{Name: "toolsets-pull_requests", Args: "--toolsets=pull_requests"},
+		{Name: "toolsets-repos,issues", Args: "--toolsets=repos,issues"},
+		{Name: "toolsets-issues,context", Args: "--toolsets=issues,context"},
+		{Name: "toolsets-all", Args: "--toolsets=all"},
+		{Name: "tools-get_me", Args: "--tools=get_me"},
+		{Name: "tools-get_me,list_issues", Args: "--tools=get_me,list_issues"},
+		{Name: "toolsets-repos+read-only", Args: "--toolsets=repos --read-only"},
+		{Name: "insiders", Args: "--insiders"},
+		{Name: "insiders+read-only", Args: "--insiders --read-only"},
+	}
+
+	flags := append([]string(nil), github.AllowedFeatureFlags...)
+	sort.Strings(flags)
+	for _, f := range flags {
+		configs = append(configs, config{
+			Name: "feature-" + f,
+			Args: "--features=" + f,
+		})
+	}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(configs); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}