name: MCP Compliance
on:
push:
branches: [ "main", "debug/*", "feature/*", "claude/*", "copilot/*" ]
paths:
- 'src/mcp/**'
- 'sdk/**'
- 'scripts/ci/ensure-mcp-compliance.sh'
- '.github/workflows/mcp-compliance.yml'
pull_request:
branches: [ main ]
paths:
- 'src/mcp/**'
- 'sdk/**'
- 'scripts/ci/ensure-mcp-compliance.sh'
- '.github/workflows/mcp-compliance.yml'
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# Security: Explicit permissions following principle of least privilege
permissions:
contents: read
jobs:
mcp-compliance:
name: MCP Protocol Compliance
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Free Disk Space (Ubuntu)
uses: jlumbroso/free-disk-space@main
with:
tool-cache: false
android: true
dotnet: true
haskell: true
large-packages: true
docker-images: true
swap-storage: true
- name: Install Rust
uses: dtolnay/rust-toolchain@1.92.0
- name: Setup Bun
uses: oven-sh/setup-bun@v2
with:
bun-version: "1.3.4"
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: Cache Rust dependencies
uses: actions/cache@v4
with:
path: |
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
target/
key: ${{ runner.os }}-cargo-1.92.0-v2-${{ hashFiles('**/Cargo.lock', 'migrations/**') }}
restore-keys: |
${{ runner.os }}-cargo-1.92.0-v2-
- name: Install MCP Validator
run: |
echo "📦 Installing MCP Validator..."
git clone --depth 1 https://github.com/Janix-ai/mcp-validator.git validator
cd validator
python3 -m venv venv
source venv/bin/activate
pip install --no-cache-dir -r requirements.txt
echo "✅ MCP Validator installed"
- name: Install SDK dependencies
working-directory: sdk
run: bun install --frozen-lockfile
- name: Build bridge
working-directory: sdk
run: bun run build
- name: Validate SDK types exist
working-directory: sdk
run: |
echo "🔍 Validating SDK TypeScript types..."
if [ ! -f "src/types.ts" ]; then
echo "❌ ERROR: src/types.ts not found"
echo "📝 Run 'bun run generate-types' locally and commit the generated types"
exit 1
fi
if grep -q "PLACEHOLDER" "src/types.ts"; then
echo "⚠️ WARNING: types.ts contains placeholder content"
echo "📝 Run 'bun run generate-types' with a running server and commit the real types"
echo " For CI: Types should be pre-generated and committed to the repository"
exit 1
fi
echo "✅ SDK types validated successfully"
- name: Check disk space before validation
run: |
echo "Disk space before validation:"
df -h
- name: Run MCP compliance validation
run: ./scripts/ci/ensure-mcp-compliance.sh
env:
# CI detection variables for bridge
CI: "true"
GITHUB_ACTIONS: "true"
# Pierre server configuration
HTTP_PORT: 8080
DATABASE_URL: "sqlite::memory:"
PIERRE_MASTER_ENCRYPTION_KEY: "rEFe91l6lqLahoyl9OSzum9dKa40VvV5RYj8bHGNTeo="
PIERRE_ALLOW_INTERACTIVE_OAUTH: "false"
PIERRE_RSA_KEY_SIZE: "2048"
- name: Clean up validation artifacts
if: always()
run: |
rm -rf validator/reports/*.md 2>/dev/null || true
rm -rf /tmp/pierre-mcp-server-*.log 2>/dev/null || true
echo "Final disk space:"
df -h
