chore: simplify and clean up CI workflows (#617)

- Remove redundant Gradle flags, env vars, and unused settings across
all workflows
- Minimize GitHub Actions permissions to least-privilege
- Drop Windows build matrix (JVM tests covered by Linux)
- Simplify CodeQL workflow (remove matrix, unused permissions, stale
triggers)
- Clean up gradle.properties (remove unused KMP settings)

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
—

## Types of changes
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

.github/workflows/apidocs.yaml

@@ -25,9 +25,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          submodules: true  # Fetch Hugo themes (true OR recursive)
-          fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
 
       - name: Set up JDK ${{ env.JAVA_VERSION }}
         uses: actions/setup-java@v5
@@ -41,7 +38,7 @@ jobs:
 
       - name: Generate Dokka Site
         run: |-
-          ./gradlew clean knit docs:classes docs:knitCheck dokkaGenerate
+          ./gradlew knit docs:classes docs:knitCheck dokkaGenerate
 
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v4

.github/workflows/build.yml

@@ -13,14 +13,12 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 permissions:
-  checks: write
+  contents: read
-  pull-requests: write # only required if `comment: true` was enabled
 
 env:
   JAVA_VERSION: 21
   JAVA_DISTRIBUTION: temurin
-  JAVA_OPTS: "-Dfile.encoding=UTF-8 -Djava.awt.headless=true"
+  GRADLE_OPTS: "-Dorg.gradle.daemon=false"
-  GRADLE_OPTS: "-Dorg.gradle.daemon=false -Dkotlin.compiler.execution.strategy=in-process"
 
 jobs:
   build:
@@ -36,17 +34,12 @@ jobs:
         include:
           - os: ubuntu-latest
             job-name: "Linux Tests"
-            gradle-tasks: "build ktlintCheck koverLog koverHtmlReport koverXmlReport publishToMavenLocal -Pversion=1-SNAPSHOT"
+            gradle-tasks: "build"
-            max-workers: 3
-
-          - os: windows-latest
-            job-name: "Windows Tests"
-            gradle-tasks: "jvmTest -x :integration-test:jvmTest"
             max-workers: 3
 
           - os: macos-latest
             job-name: "iOS Simulator tests"
-            gradle-tasks: "linkIosSimulatorArm64 iosSimulatorArm64Test"
+            gradle-tasks: "iosSimulatorArm64Test"
             max-workers: 2
 
     steps:
@@ -75,19 +68,25 @@ jobs:
           validate-wrappers: true
           add-job-summary: 'always'
           cache-read-only: ${{ github.ref != 'refs/heads/main' }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           gradle-home-cache-includes: |
             caches
             notifications
-            sdks
             ../.konan/**
 
       - name: ${{ matrix.job-name }}
         run: |-
-          ./gradlew ${{ matrix.gradle-tasks }} -x :conformance-test:test --max-workers ${{ matrix.max-workers }} --continue --rerun-tasks --configure-on-demand --parallel
+          ./gradlew ${{ matrix.gradle-tasks }} --max-workers ${{ matrix.max-workers }} --continue --rerun-tasks
+
+      - name: Coverage Report
+        if: ${{ success() && matrix.os == 'ubuntu-latest' }}
+        run: ./gradlew koverLog koverHtmlReport koverXmlReport
+
+      - name: Publish to Maven Local
+        if: ${{ success() && matrix.os == 'ubuntu-latest' }}
+        run: ./gradlew publishToMavenLocal -Pversion=1-SNAPSHOT
 
       - name: Upload Reports
-        if: always()
+        if: failure()
         uses: actions/upload-artifact@v7
         with:
           name: reports-build-${{ matrix.os }}
@@ -100,10 +99,8 @@ jobs:
         with:
           annotate_only: true
           detailed_summary: true
-          flaky_summary: true
           group_suite: true
           include_empty_in_summary: false
-          include_time_in_summary: true
           report_paths: '**/test-results/**/TEST-*.xml'
           truncate_stack_traces: false
 
@@ -127,7 +124,7 @@ jobs:
       - name: Archive Maven Local Repository
         if: ${{ success() && matrix.os == 'ubuntu-latest' }}
         run: |
-          cd ~/.m2/repository && zip -r $GITHUB_WORKSPACE/local-maven-repository.zip .
+          cd ~/.m2/repository/io/modelcontextprotocol && zip -r $GITHUB_WORKSPACE/local-maven-repository.zip .
 
       - name: Upload Maven Local Repository
         if: ${{ success() && matrix.os == 'ubuntu-latest' }}
@@ -159,7 +156,6 @@ jobs:
           validate-wrappers: true
           add-job-summary: 'always'
           cache-read-only: ${{ github.ref != 'refs/heads/main' }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
           gradle-home-cache-includes: |
             caches
             notifications
@@ -168,12 +164,14 @@ jobs:
 
       - name: Run Knit
         run: |-
-          ./gradlew knit docs:classes docs:knitCheck -x :conformance-test:test --max-workers 3 --continue --rerun-tasks --configure-on-demand --parallel
+          ./gradlew knit docs:classes docs:knitCheck --max-workers 3 --continue --rerun-tasks
 
 
   samples:
     needs: [ build ]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -185,8 +183,6 @@ jobs:
 
     name: "Build Sample: ${{ matrix.sample }}"
     timeout-minutes: 10
-    env:
-      JAVA_OPTS: "-Xmx8g -Dfile.encoding=UTF-8 -Djava.awt.headless=true -Dkotlin.daemon.jvm.options=-Xmx6g"
     steps:
       - uses: actions/checkout@v6
 
@@ -215,8 +211,8 @@ jobs:
 
       - name: Extract Maven Local Repository
         run: |
-          mkdir -p ~/.m2/repository
+          mkdir -p ~/.m2/repository/io/modelcontextprotocol
-          unzip -o local-maven-repository.zip -d ~/.m2/repository
+          unzip -o local-maven-repository.zip -d ~/.m2/repository/io/modelcontextprotocol
 
       - name: "Build Sample: ${{ matrix.sample }}"
         working-directory: ./samples/${{ matrix.sample }}

.github/workflows/codeql.yml

@@ -1,16 +1,14 @@
 name: "CodeQL Advanced"
 
 on:
-  push:
-    branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
   schedule:
-    - cron: '0 4 * * 0'
+    - cron: '0 7 * * 1' # Monday 8:00 CET (7:00 UTC)
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: true
 
 env:
   JAVA_VERSION: 21
@@ -18,30 +16,16 @@ env:
 
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
+    name: Analyze
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
-      # required for all workflows
       security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
       contents: read
 
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [ java-kotlin ]
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
 
       - name: Set up JDK ${{ env.JAVA_VERSION }}
         uses: actions/setup-java@v5
@@ -49,11 +33,10 @@ jobs:
           distribution: ${{ env.JAVA_DISTRIBUTION }}
           java-version: ${{ env.JAVA_VERSION }}
 
-      # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:
-          languages: ${{ matrix.language }}
+          languages: java-kotlin
           build-mode: manual
 
       - name: Setup Gradle
@@ -64,18 +47,11 @@ jobs:
 
       - name: Build Kotlin sources
         run: |
-          ./gradlew \
+          ./gradlew compileKotlinJvm :conformance-test:compileKotlin \
-            :kotlin-sdk-core:compileKotlinJvm \
-            :kotlin-sdk-client:compileKotlinJvm \
-            :kotlin-sdk-server:compileKotlinJvm \
-            :kotlin-sdk:compileKotlinJvm \
-            :integration-test:compileKotlinJvm \
-            :conformance-test:testClasses \
-            detekt \
             -Pkotlin.incremental=false \
-            --no-daemon --stacktrace --rerun-tasks
+            --no-daemon --rerun-tasks --stacktrace
 
       - name: Analyze
         uses: github/codeql-action/analyze@v4
         with:
-          category: '/language:${{ matrix.language }}'
+          category: '/language:java-kotlin'

.github/workflows/gradle-publish.yml

@@ -1,10 +1,3 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-# This workflow will build a package using Gradle and then publish it to GitHub packages when a release is created
-# For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Publishing-using-gradle
-
 name: Release
 
 on:
@@ -17,8 +10,7 @@ jobs:
     runs-on: macos-latest
     environment: release
     env:
-      JAVA_OPTS: "-Xmx4g -Dfile.encoding=UTF-8 -XX:MaxMetaspaceSize=768m -Djava.awt.headless=true"
+      GRADLE_OPTS: "-Dorg.gradle.daemon=false"
-      GRADLE_OPTS: "-Dorg.gradle.daemon=false -Dkotlin.compiler.execution.strategy=in-process"
 
     permissions:
       contents: write
@@ -35,21 +27,8 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v5
 
-      - name: Clean Build with Gradle
+      - name: Build
-        run: ./gradlew clean build -x :conformance-test:test --rerun-tasks --max-workers 2 --continue --configure-on-demand --parallel
+        run: ./gradlew build --rerun-tasks --max-workers 2 --continue
-
-      - name: Publish Test Report
-        uses: mikepenz/action-junit-report@v6
-        if: ${{ !cancelled() }}
-        with:
-          annotate_only: true
-          detailed_summary: true
-          flaky_summary: true
-          group_suite: true
-          include_empty_in_summary: false
-          include_time_in_summary: true
-          report_paths: '**/test-results/**/TEST-*.xml'
-          truncate_stack_traces: false
 
       - name: Publish to Maven Central Portal
         id: publish

.github/workflows/samples.yml

@@ -19,6 +19,7 @@ concurrency:
 env:
   JAVA_VERSION: 21
   JAVA_DISTRIBUTION: temurin
+  GRADLE_OPTS: "-Dorg.gradle.daemon=false"
 
 jobs:
   build:
@@ -34,8 +35,6 @@ jobs:
 
     name: Build Sample (${{ matrix.sample }})
     timeout-minutes: 10
-    env:
-      JAVA_OPTS: "-Xmx8g -Dfile.encoding=UTF-8 -Djava.awt.headless=true -Dkotlin.daemon.jvm.options=-Xmx6g"
     steps:
       - uses: actions/checkout@v6
 
@@ -54,10 +53,10 @@ jobs:
 
       - name: "Build Sample: ${{ matrix.sample }}"
         working-directory: ./samples/${{ matrix.sample }}
-        run: ./gradlew --no-daemon build
+        run: ./gradlew build
 
       - name: Upload Reports
-        if: ${{ !cancelled() }}
+        if: failure()
         uses: actions/upload-artifact@v7
         with:
           name: reports-samples-${{ matrix.sample }}

gradle.properties

@@ -1,16 +1,10 @@
 org.gradle.jvmargs=-Xmx4g -Dfile.encoding=UTF-8
 org.gradle.parallel=true
 org.gradle.caching=true
-# Dokka
-org.jetbrains.dokka.experimental.gradle.pluginMode=V2Enabled
-org.jetbrains.dokka.experimental.gradle.pluginMode.noWarn=true
 # Kotlin
 kotlin.code.style=official
 kotlin.daemon.jvmargs=-Xmx4G
-# Build JS targets using npm package manager https://kotlinlang.org/docs/js-project-setup.html#npm-dependencies
-kotlin.js.yarn=false
 # MPP
-kotlin.mpp.enableCInteropCommonization=true
 kotlin.native.ignoreDisabledTargets=true
 
 group=io.modelcontextprotocol