tba

name: CI on: push: branches: [main] workflow_dispatch: permissions: {} concurrency: group: ${{ github.ref }}-${{ github.workflow }} cancel-in-progress: true jobs: build: name: Build runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write env: _IMAGE_NAME: ghcr.io/withinfocus/tba-mcp-server steps: - name: Check out repository uses: actions/checkout@v6 - name: Get package version id: retrieve-package-version run: | PKG_VERSION=$(jq -r .version package.json) echo "package_version=$PKG_VERSION" >> "$GITHUB_OUTPUT" - name: Get Node version id: retrieve-node-version run: | NODE_NVMRC=$(cat .nvmrc) NODE_VERSION=${NODE_NVMRC/v/''} echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT" - name: Set up Node.js uses: actions/setup-node@v6 with: cache: "npm" cache-dependency-path: "**/package-lock.json" node-version: ${{ steps.retrieve-node-version.outputs.node_version }} - name: Install dependencies run: npm ci - name: Build project run: npm run build - name: Archive build run: | zip -r mcp-server-${{ steps.retrieve-package-version.outputs.package_version }}.zip dist - name: Upload build artifact uses: actions/upload-artifact@v5 with: name: mcp-server-${{ steps.retrieve-package-version.outputs.package_version }}.zip path: mcp-server-${{ steps.retrieve-package-version.outputs.package_version }}.zip if-no-files-found: error - name: Log in to GitHub Container Registry uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Get Docker version id: tag run: | IMAGE_TAG="${GITHUB_REF:11}" IMAGE_TAG="${IMAGE_TAG//\//-}" # slash safe branch name if [[ "$IMAGE_TAG" == "main" ]]; then IMAGE_TAG=dev fi echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT" - name: Generate image tags id: image-tags env: IMAGE_TAG: ${{ steps.tag.outputs.image_tag }} SHA: ${{ github.sha }} run: | TAGS="${{ env._IMAGE_NAME }}:${{ env.IMAGE_TAG }}" echo "primary_tag=$TAGS" >> "$GITHUB_OUTPUT" if [[ "$IMAGE_TAG" == "dev" ]]; then SHORT_SHA="$(git rev-parse --short "${SHA}")" TAGS="$TAGS,${{ env._IMAGE_NAME }}:${{ env.IMAGE_TAG }}-${SHORT_SHA}" fi echo "tags=$TAGS" >> "$GITHUB_OUTPUT" - name: Build and push Docker image uses: docker/build-push-action@v6 with: file: Dockerfile platforms: linux/amd64 push: true tags: ${{ steps.image-tags.outputs.tags }} - name: Log out from GitHub Container Registry run: docker logout ghcr.io scan: name: Scan runs-on: ubuntu-latest permissions: security-events: write strategy: fail-fast: false matrix: language: ["javascript"] steps: - name: Check out repository uses: actions/checkout@v6 - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} - name: Get Node version id: retrieve-node-version run: | NODE_NVMRC=$(cat .nvmrc) NODE_VERSION=${NODE_NVMRC/v/''} echo "node_version=$NODE_VERSION" >> "$GITHUB_OUTPUT" - name: Set up Node.js uses: actions/setup-node@v6 with: cache: "npm" cache-dependency-path: "**/package-lock.json" node-version: ${{ steps.retrieve-node-version.outputs.node_version }} - name: Install dependencies run: npm ci - name: Build project run: npm run build - name: Clean build artifacts run: rm -rf dist - name: Analyze uses: github/codeql-action/analyze@v4