refactor!: MCP-only toolset with account discovery, search/execute, and hardened security #709
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a paid licence for organisation-owned | |
| # repositories. The CLI is free, so install and run it directly. Secret | |
| # scanning is a CI gate only — there is no make target for it. | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "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/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| env: | |
| GITLEAKS_VERSION: 8.29.0 | |
| - name: Run Gitleaks | |
| run: gitleaks detect --source . --config .gitleaks.toml | |
| ci: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| # Run the tools directly rather than through make: the make targets write | |
| # to the tree, and CI must verify what was committed, not fix it. | |
| - name: Run Lint | |
| run: | | |
| uv run ruff check . | |
| uv run ruff format --check . | |
| - name: Run Ty | |
| run: uv run ty check stackone_ai | |
| - name: Type check examples against the current SDK | |
| run: uv run ty check examples | |
| - name: Run Tests | |
| run: uv run pytest | |
| # Enforces the wire contract in docs/SDK-UCA-CONTRACT.md: the schema the SDK | |
| # lists to a model must match the schema the server served, and the request it | |
| # sends must match that schema. --strict-schema fails on any dropped keyword. | |
| # | |
| # StackOneHQ/sdk-conformance is private, so the default GITHUB_TOKEN cannot | |
| # check it out. Set the CONFORMANCE_REPO_TOKEN secret to a PAT or App token with | |
| # read access. Without it this job fails rather than skipping — a skipped | |
| # contract check reads as green while enforcing nothing. | |
| check-secret: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has-token: ${{ steps.check.outputs.has-token }} | |
| steps: | |
| - id: check | |
| env: | |
| TOKEN: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| run: | | |
| if [ -n "$TOKEN" ]; then | |
| echo "has-token=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has-token=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| conformance: | |
| needs: check-secret | |
| if: needs.check-secret.outputs.has-token == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout SDK | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| path: sdk | |
| - name: Checkout conformance suite | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| repository: StackOneHQ/sdk-conformance | |
| token: ${{ secrets.CONFORMANCE_REPO_TOKEN }} | |
| path: sdk-conformance | |
| persist-credentials: false | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| with: | |
| package_json_file: sdk-conformance/package.json | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install conformance dependencies | |
| working-directory: sdk-conformance | |
| run: pnpm install --frozen-lockfile | |
| - name: Run conformance suite | |
| working-directory: sdk-conformance | |
| env: | |
| PYTHON_SDK_DIR: ${{ github.workspace }}/sdk | |
| run: pnpm test:python -- --strict-schema | |
| # Make this the one required status check. Individually required checks go | |
| # missing when a job is renamed or a matrix entry is added, and nothing notices. | |
| ci-ok: | |
| if: always() | |
| needs: [gitleaks, ci, conformance] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require every job to have passed | |
| run: | | |
| if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then | |
| echo "::error::A required job did not pass: ${{ toJSON(needs.*.result) }}" | |
| exit 1 | |
| fi | |
| coverage: | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 | |
| with: | |
| python-version: "3.13" | |
| enable-cache: true | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 | |
| - name: Setup Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install Python dependencies | |
| run: uv sync --all-extras --locked | |
| - name: Install Node dependencies (MCP mock server) | |
| run: pnpm install --frozen-lockfile | |
| - name: Run Tests with Coverage | |
| run: uv run pytest --cov --cov-report=term --cov-report=json --cov-report=html | |
| - name: Create Coverage Badge | |
| uses: jaywcjlove/coverage-badges-cli@4e8975aa2628e3329126e7eee36724d07ed86fda # v2.2.0 | |
| with: | |
| source: coverage/coverage.json | |
| output: coverage/badges.svg | |
| jsonPath: totals.percent_covered | |
| - name: Upload coverage artifact | |
| uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v3.0.2 | |
| with: | |
| path: coverage/ | |
| deploy-coverage: | |
| needs: coverage | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5 |