141 lines
4.1 KiB
YAML
141 lines
4.1 KiB
YAML
# `v1/main` is the deprecated maintenance line: it publishes straight from this
|
|
# branch to the `v1-latest` dist-tag and never merges into `main`, which now
|
|
# carries v2. Keep these filters pinned to `v1/main` — a stale `main` entry here
|
|
# describes a topology that no longer exists, and would start matching the moment
|
|
# anything put a v1-shaped tree back on that branch.
|
|
#
|
|
# (For `push`, GitHub runs the workflow file from the pushed commit, so this file
|
|
# is only ever consulted for `v1/main` regardless. The filter states intent.)
|
|
on:
|
|
push:
|
|
branches:
|
|
- v1/main
|
|
pull_request:
|
|
branches:
|
|
- v1/main
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
- name: Check formatting
|
|
run: npm run prettier-check
|
|
|
|
- name: Check version consistency
|
|
run: npm run check-version
|
|
|
|
- name: Check linting
|
|
working-directory: ./client
|
|
run: npm run lint
|
|
|
|
- name: Run client tests
|
|
working-directory: ./client
|
|
run: npm test
|
|
|
|
- name: Run server tests
|
|
working-directory: ./server
|
|
run: npm test
|
|
|
|
- run: npm run build
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
# OIDC trusted publishing requires npm >=11.5.1; Node 22's bundled npm is 10.x.
|
|
- name: Ensure npm CLI supports OIDC trusted publishing
|
|
run: npm install -g npm@^11.5.1
|
|
|
|
# `publish-all` pins `--tag v1-latest` on all four packages.
|
|
#
|
|
# Do NOT drop the flag: without an explicit tag npm assigns `latest`, so a
|
|
# v1 security release would drag `latest` back from v2 and every
|
|
# `npx @modelcontextprotocol/inspector` would silently get deprecated v1.
|
|
#
|
|
# Do NOT "simplify" the tag to `v1`: npm rejects any dist-tag that parses
|
|
# as a SemVer range, and `v1` does (`npm error Tag name must not be a
|
|
# valid SemVer range: v1`). That would fail the publish outright.
|
|
- run: npm run publish-all
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: "true"
|
|
|
|
publish-github-container-registry:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Log in to the Container registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build and push Docker image
|
|
id: push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
- name: Generate artifact attestation
|
|
uses: actions/attest-build-provenance@v4
|
|
with:
|
|
subject-name: ghcr.io/${{ github.repository }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|
|
push-to-registry: true
|