Grafana

name: Update Token Baseline

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions: {}

jobs:
  baseline:
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: go.mod

      - name: Build server
        run: make build

      - id: get-secrets
        uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0
        with:
          # Secrets placed in the ci/repo/grafana/mcp-grafana/<path> path in Vault
          repo_secrets: |
            ANTHROPIC_API_KEY=anthropic:api-key

      - name: Generate token baseline
        uses: sd2k/mcp-tokens-action@014db1a0f233c4559d5b056983855b0b71c99fa2
        with:
          command: ./dist/mcp-grafana
          anthropic-api-key: ${{ env.ANTHROPIC_API_KEY }}
          all-providers: true
          output: token-baseline.json

      - name: Upload baseline artifact
        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
        with:
          name: token-baseline
          path: token-baseline.json
          retention-days: 90