Grafana

name: Token Analysis

on:
  pull_request:

permissions: {}

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      pull-requests: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
        with:
          go-version-file: go.mod

      - name: Build server
        run: make build

      - name: Download baseline
        id: download-baseline
        uses: dawidd6/action-download-artifact@9dde25e7413c6123b6062d4c9fc954d6ff005cfc
        with:
          branch: main
          name: token-baseline
          path: baseline
          workflow: token-baseline.yml
          if_no_artifact_found: warn

      - name: Get secrets
        id: get-secrets
        if: github.event.pull_request.head.repo.full_name == github.repository
        uses: grafana/shared-workflows/actions/get-vault-secrets@a37de51f3d713a30a9e4b21bcdfbd38170020593 # get-vault-secrets/v1.3.0
        with:
          # Secrets placed in the ci/repo/grafana/mcp-grafana/<path> path in Vault
          repo_secrets: |
            ANTHROPIC_API_KEY=anthropic:api-key

      - name: Analyze tokens
        uses: sd2k/mcp-tokens-action@014db1a0f233c4559d5b056983855b0b71c99fa2

        with:
          command: ./dist/mcp-grafana
          anthropic-api-key: ${{ env.ANTHROPIC_API_KEY }}
          baseline: ${{ steps.download-baseline.outputs.found_artifact == 'true' && 'baseline/token-baseline.json' || '' }}
          threshold-percent: "5"
          comment: true
          comment-on-pass: true
          github-token: ${{ secrets.GITHUB_TOKEN }}