refactor!: MCP-only toolset with account discovery, search/execute, and hardened security #682
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a paid licence for organisation-owned | |
| # repositories. The CLI is free, so install and run it directly. Secret | |
| # scanning is a CI gate only — there is no make target for it. | |
| - name: Install gitleaks | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.29.0 | |
| - name: Run Gitleaks | |
| run: gitleaks detect --source . --config .gitleaks.toml | |
| ci: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| # Run the tools directly rather than through make: the make targets write | |
| # to the tree, and CI must verify what was committed, not fix it. | |
| - name: Run Lint | |
| run: | | |
| uv run ruff check . | |
| uv run ruff format --check . | |
| - name: Run Ty | |
| run: uv run ty check stackone_ai | |
| - name: Run Tests | |
| run: uv run pytest | |
| # Enforces the wire contract in docs/SDK-UCA-CONTRACT.md: the schema the SDK | |
| # lists to a model must match the schema the server served, and the request it | |
| # sends must match that schema. --strict-schema fails on any dropped keyword. | |
| # | |
| # StackOneHQ/sdk-conformance is private, so the default GITHUB_TOKEN cannot | |
| # check it out. Set the CONFORMANCE_REPO_TOKEN secret to a PAT or App token with | |
| # read access. Without it this job fails rather than skipping — a skipped | |
| # contract check reads as green while enforcing nothing. | |
| conformance: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout SDK | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: sdk | |
| - name: Check conformance token is configured | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| run: | | |
| if [ -z "$TOKEN" ]; then | |
| echo "::error::CONFORMANCE_REPO_TOKEN is not set. It is required to check out" \ | |
| "the private StackOneHQ/sdk-conformance repository." | |
| exit 1 | |
| fi | |
| - name: Checkout conformance suite | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: StackOneHQ/sdk-conformance | |
| token: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| path: sdk-conformance | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install conformance dependencies | |
| working-directory: sdk-conformance | |
| run: pnpm install --frozen-lockfile | |
| - name: Run conformance suite | |
| working-directory: sdk-conformance | |
| env: | |
| PYTHON_SDK_DIR: ${{ github.workspace }}/sdk | |
| run: pnpm test:python -- --strict-schema | |
| coverage: | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| - name: Run Tests with Coverage | |
| run: uv run pytest --cov --cov-report=term --cov-report=json --cov-report=html | |
| - name: Create Coverage Badge | |
| uses: jaywcjlove/coverage-badges-cli@4e8975aa2628e3329126e7eee36724d07ed86fda # v2.2.0 | |
| with: | |
| source: coverage/coverage.json | |
| output: coverage/badges.svg | |
| jsonPath: totals.percent_covered | |
| - name: Upload coverage artifact | |
| uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v3.0.2 | |
| with: | |
| path: coverage/ | |
| deploy-coverage: | |
| needs: coverage | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 |