Grafana

name: Update Token Baseline on: push: branches: [main] workflow_dispatch: permissions: {} jobs: baseline: runs-on: ubuntu-latest permissions: actions: write contents: read id-token: write steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - name: Set up Go uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 with: go-version-file: go.mod - name: Build server run: make build - id: get-secrets uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0 with: # Secrets placed in the ci/repo/grafana/mcp-grafana/<path> path in Vault repo_secrets: | ANTHROPIC_API_KEY=anthropic:api-key - name: Generate token baseline uses: sd2k/mcp-tokens-action@2c121e1bb2ef8bf6c2fc9fe4a342c205b6d37c85 with: command: ./dist/mcp-grafana anthropic-api-key: ${{ env.ANTHROPIC_API_KEY }} all-providers: true output: token-baseline.json - name: Upload baseline artifact uses: actions/upload-artifact@v6 with: name: token-baseline path: token-baseline.json retention-days: 90