Grafana

name: Token Analysis on: pull_request: permissions: {} jobs: analyze: runs-on: ubuntu-latest permissions: contents: read id-token: write pull-requests: write steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - name: Set up Go uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0 with: go-version-file: go.mod - name: Build server run: make build - name: Download baseline id: download-baseline uses: dawidd6/action-download-artifact@688efa90a08f3552e7c1420c8313e215164e8b14 with: branch: main name: token-baseline path: baseline workflow: token-baseline.yml if_no_artifact_found: warn - name: Get secrets id: get-secrets if: github.event.pull_request.head.repo.full_name == github.repository uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0 with: # Secrets placed in the ci/repo/grafana/mcp-grafana/<path> path in Vault repo_secrets: | ANTHROPIC_API_KEY=anthropic:api-key - name: Analyze tokens uses: sd2k/mcp-tokens-action@2c121e1bb2ef8bf6c2fc9fe4a342c205b6d37c85 with: command: ./dist/mcp-grafana anthropic-api-key: ${{ env.ANTHROPIC_API_KEY }} baseline: ${{ steps.download-baseline.outputs.found_artifact == 'true' && 'baseline/token-baseline.json' || '' }} threshold-percent: "5" comment: true github-token: ${{ secrets.GITHUB_TOKEN }}