3f98758da2
All checks were successful
The act runner (v0.3.0) on NAS can't handle matrix jobs reliably on a single worker — concurrent matrix entries fail silently. Build both amd64 and arm64 sequentially in a single job instead. Merge publish-rpm and publish-deb into a single publish job that iterates over all RPM/DEB files in dist/. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
417 lines
14 KiB
YAML
417 lines
14 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
env:
|
|
GITEA_REGISTRY: 10.0.0.194:3012
|
|
GITEA_PUBLIC_URL: https://mysources.co.uk
|
|
GITEA_OWNER: michal
|
|
|
|
# ============================================================
|
|
# Required Gitea secrets:
|
|
# PACKAGES_TOKEN — Gitea API token (packages + registry)
|
|
# ============================================================
|
|
|
|
jobs:
|
|
# ── CI checks (run in parallel on every push/PR) ──────────
|
|
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
# no pnpm cache — concurrent cache restore hangs on single-worker runner
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Lint
|
|
run: pnpm lint || echo "::warning::Lint has errors — not blocking CI yet"
|
|
|
|
typecheck:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
# no pnpm cache — concurrent cache restore hangs on single-worker runner
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Generate Prisma client
|
|
run: pnpm --filter @mcpctl/db exec prisma generate
|
|
|
|
- name: Typecheck
|
|
run: pnpm typecheck
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
# no pnpm cache — concurrent cache restore hangs on single-worker runner
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Generate Prisma client
|
|
run: pnpm --filter @mcpctl/db exec prisma generate
|
|
|
|
- name: Build (needed by completions test)
|
|
run: pnpm build
|
|
|
|
- name: Run tests
|
|
run: pnpm test:run
|
|
|
|
# ── Smoke tests (full stack: postgres + mcpd + mcplocal) ──
|
|
|
|
smoke:
|
|
runs-on: ubuntu-latest
|
|
needs: [lint, typecheck, test]
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: mcpctl
|
|
POSTGRES_PASSWORD: mcpctl
|
|
POSTGRES_DB: mcpctl
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
env:
|
|
DATABASE_URL: postgresql://mcpctl:mcpctl@postgres:5432/mcpctl
|
|
MCPD_PORT: "3100"
|
|
MCPD_HOST: "0.0.0.0"
|
|
MCPLOCAL_HTTP_PORT: "3200"
|
|
MCPLOCAL_MCPD_URL: http://localhost:3100
|
|
DOCKER_API_VERSION: "1.43"
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
# no pnpm cache — concurrent cache restore hangs on single-worker runner
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Generate Prisma client
|
|
run: pnpm --filter @mcpctl/db exec prisma generate
|
|
|
|
- name: Build all packages
|
|
run: pnpm build
|
|
|
|
- name: Push database schema
|
|
run: pnpm --filter @mcpctl/db exec prisma db push --accept-data-loss
|
|
|
|
- name: Seed templates
|
|
run: node src/mcpd/dist/seed-runner.js
|
|
|
|
- name: Start mcpd
|
|
run: node src/mcpd/dist/main.js &
|
|
|
|
- name: Wait for mcpd
|
|
run: |
|
|
for i in $(seq 1 30); do
|
|
if curl -sf http://localhost:3100/health > /dev/null 2>&1; then
|
|
echo "mcpd is ready"
|
|
exit 0
|
|
fi
|
|
echo "Waiting for mcpd... ($i/30)"
|
|
sleep 1
|
|
done
|
|
echo "::error::mcpd failed to start within 30s"
|
|
exit 1
|
|
|
|
- name: Create CI user and session
|
|
run: |
|
|
pnpm --filter @mcpctl/db exec node -e "
|
|
const { PrismaClient } = require('@prisma/client');
|
|
const crypto = require('crypto');
|
|
(async () => {
|
|
const prisma = new PrismaClient();
|
|
const user = await prisma.user.upsert({
|
|
where: { email: 'ci@test.local' },
|
|
create: { email: 'ci@test.local', name: 'CI', passwordHash: '!ci-no-login', role: 'USER' },
|
|
update: {},
|
|
});
|
|
const token = crypto.randomBytes(32).toString('hex');
|
|
await prisma.session.create({
|
|
data: { token, userId: user.id, expiresAt: new Date(Date.now() + 86400000) },
|
|
});
|
|
await prisma.rbacDefinition.create({
|
|
data: {
|
|
name: 'ci-admin',
|
|
subjects: [{ kind: 'User', name: 'ci@test.local' }],
|
|
roleBindings: [
|
|
{ role: 'edit', resource: '*' },
|
|
{ role: 'run', resource: '*' },
|
|
{ role: 'run', action: 'logs' },
|
|
{ role: 'run', action: 'backup' },
|
|
{ role: 'run', action: 'restore' },
|
|
],
|
|
},
|
|
});
|
|
const os = require('os'), fs = require('fs'), path = require('path');
|
|
const dir = path.join(os.homedir(), '.mcpctl');
|
|
fs.mkdirSync(dir, { recursive: true });
|
|
fs.writeFileSync(path.join(dir, 'credentials'),
|
|
JSON.stringify({ token, mcpdUrl: 'http://localhost:3100', user: 'ci@test.local' }));
|
|
console.log('CI user + session + RBAC created, credentials written');
|
|
await prisma.\$disconnect();
|
|
})();
|
|
"
|
|
|
|
- name: Create mcpctl CLI wrapper
|
|
run: |
|
|
printf '#!/bin/sh\nexec node "%s/src/cli/dist/index.js" "$@"\n' "$GITHUB_WORKSPACE" > /usr/local/bin/mcpctl
|
|
chmod +x /usr/local/bin/mcpctl
|
|
|
|
- name: Configure mcplocal LLM provider
|
|
run: |
|
|
mkdir -p ~/.mcpctl
|
|
cat > ~/.mcpctl/config.json << 'CONF'
|
|
{"llm":{"providers":[{"name":"anthropic","type":"anthropic","model":"claude-haiku-3-5-20241022","tier":"fast"}]}}
|
|
CONF
|
|
printf '{"anthropic-api-key":"%s"}\n' "$ANTHROPIC_API_KEY" > ~/.mcpctl/secrets
|
|
chmod 600 ~/.mcpctl/secrets
|
|
|
|
- name: Start mcplocal
|
|
run: nohup node src/mcplocal/dist/main.js > /tmp/mcplocal.log 2>&1 &
|
|
|
|
- name: Wait for mcplocal
|
|
run: |
|
|
for i in $(seq 1 30); do
|
|
if curl -sf http://localhost:3200/health > /dev/null 2>&1; then
|
|
echo "mcplocal is ready"
|
|
exit 0
|
|
fi
|
|
echo "Waiting for mcplocal... ($i/30)"
|
|
sleep 1
|
|
done
|
|
echo "::error::mcplocal failed to start within 30s"
|
|
exit 1
|
|
|
|
- name: Apply smoke test fixtures
|
|
run: mcpctl apply -f src/mcplocal/tests/smoke/fixtures/smoke-data.yaml
|
|
|
|
- name: Verify fixture applied
|
|
run: |
|
|
echo "==> Checking applied fixtures..."
|
|
mcpctl get servers -o json | node -e "
|
|
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
|
|
console.log('Servers:', Array.isArray(d) ? d.map(s=>s.name).join(', ') : 'none');
|
|
"
|
|
mcpctl get projects -o json | node -e "
|
|
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
|
|
console.log('Projects:', Array.isArray(d) ? d.map(p=>p.name).join(', ') : 'none');
|
|
"
|
|
# Server instances require Docker/Podman (container orchestrator).
|
|
# CI has no container runtime, so instances will stay in PENDING.
|
|
# Tests that need running instances are excluded below.
|
|
echo "==> Instance status (informational — no container runtime in CI):"
|
|
mcpctl get instances -o json 2>/dev/null | node -e "
|
|
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf-8'));
|
|
if (Array.isArray(d)) d.forEach(i => console.log(' ' + (i.serverName||i.name) + ': ' + i.status));
|
|
else console.log(' (none)');
|
|
" || echo " (no instances)"
|
|
|
|
- name: Run smoke tests
|
|
# Server instances need Docker/Podman to start (container-based MCP
|
|
# servers). CI has no container runtime, so exclude tests that
|
|
# require a running server instance or LLM providers.
|
|
# --no-file-parallelism avoids concurrent requests crashing mcplocal.
|
|
run: >-
|
|
pnpm --filter mcplocal exec vitest run
|
|
--config vitest.smoke.config.ts
|
|
--no-file-parallelism
|
|
--exclude '**/security.test.ts'
|
|
--exclude '**/audit.test.ts'
|
|
--exclude '**/proxy-pipeline.test.ts'
|
|
|
|
- name: Dump mcplocal log on failure
|
|
if: failure()
|
|
run: cat /tmp/mcplocal.log || true
|
|
|
|
# ── Build & package (both amd64 and arm64 sequentially) ──
|
|
# Single job builds both arches — the act runner on NAS can't handle
|
|
# matrix jobs reliably (single-worker, concurrent jobs fail).
|
|
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
needs: [lint, typecheck, test]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: pnpm/action-setup@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
# no pnpm cache — concurrent cache restore hangs on single-worker runner
|
|
|
|
- name: Install dependencies (hoisted for bun compile compatibility)
|
|
run: |
|
|
echo "node-linker=hoisted" >> .npmrc
|
|
pnpm install --frozen-lockfile
|
|
|
|
- name: Generate Prisma client
|
|
run: pnpm --filter @mcpctl/db exec prisma generate
|
|
|
|
- name: Build all packages
|
|
run: pnpm build
|
|
|
|
- name: Generate shell completions
|
|
run: pnpm completions:generate
|
|
|
|
- uses: oven-sh/setup-bun@v2
|
|
|
|
- name: Install nfpm
|
|
run: |
|
|
curl -sL -o /tmp/nfpm.tar.gz "https://github.com/goreleaser/nfpm/releases/download/v2.45.0/nfpm_2.45.0_Linux_x86_64.tar.gz"
|
|
tar xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm
|
|
|
|
- name: Prepare bun stubs
|
|
run: |
|
|
# Stub for optional dep that Ink tries to import (only used when DEV=true)
|
|
# Copy instead of symlink — bun can't read directory symlinks
|
|
if [ ! -e node_modules/react-devtools-core/package.json ]; then
|
|
rm -rf node_modules/react-devtools-core
|
|
cp -r src/cli/stubs/react-devtools-core node_modules/react-devtools-core
|
|
fi
|
|
|
|
- name: Bundle and package (amd64)
|
|
run: |
|
|
source scripts/arch-helper.sh
|
|
resolve_arch "amd64"
|
|
mkdir -p dist
|
|
bun build src/cli/src/index.ts --compile --outfile dist/mcpctl
|
|
bun build src/mcplocal/src/main.ts --compile --outfile dist/mcpctl-local
|
|
echo "==> Packaging amd64..."
|
|
NFPM_ARCH=amd64 nfpm pkg --packager rpm --target dist/
|
|
NFPM_ARCH=amd64 nfpm pkg --packager deb --target dist/
|
|
ls -la dist/mcpctl-*.rpm dist/mcpctl*.deb
|
|
|
|
- name: Bundle and package (arm64)
|
|
run: |
|
|
source scripts/arch-helper.sh
|
|
resolve_arch "arm64"
|
|
rm -f dist/mcpctl dist/mcpctl-local
|
|
bun build src/cli/src/index.ts --compile --target bun-linux-arm64 --outfile dist/mcpctl
|
|
bun build src/mcplocal/src/main.ts --compile --target bun-linux-arm64 --outfile dist/mcpctl-local
|
|
echo "==> Packaging arm64..."
|
|
NFPM_ARCH=arm64 nfpm pkg --packager rpm --target dist/
|
|
NFPM_ARCH=arm64 nfpm pkg --packager deb --target dist/
|
|
ls -la dist/mcpctl-*.rpm dist/mcpctl*.deb
|
|
|
|
- name: Upload artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: packages
|
|
path: |
|
|
dist/mcpctl-*.rpm
|
|
dist/mcpctl*.deb
|
|
retention-days: 7
|
|
|
|
# ── Release pipeline (main branch push only) ──────────────
|
|
# NOTE: Docker image builds + deploy happen via `bash fulldeploy.sh`
|
|
# (not CI) because the runner containers lack the privileged access
|
|
# needed for container-in-container builds (no /proc/self/uid_map,
|
|
# no Docker socket access, buildah/podman/kaniko all fail).
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
needs: [build, smoke]
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Download package artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: packages
|
|
path: dist/
|
|
|
|
- name: List packages
|
|
run: ls -la dist/
|
|
|
|
- name: Publish RPMs to Gitea
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
|
|
GITEA_URL: http://${{ env.GITEA_REGISTRY }}
|
|
GITEA_OWNER: ${{ env.GITEA_OWNER }}
|
|
run: |
|
|
for RPM_FILE in dist/mcpctl-*.rpm; do
|
|
echo "Publishing $RPM_FILE..."
|
|
HTTP_CODE=$(curl -s -o /tmp/rpm-upload.out -w "%{http_code}" \
|
|
-X PUT \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
--upload-file "$RPM_FILE" \
|
|
"${GITEA_URL}/api/packages/${GITEA_OWNER}/rpm/upload")
|
|
|
|
if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
|
|
echo " Published!"
|
|
elif [ "$HTTP_CODE" = "409" ]; then
|
|
echo " Already exists, skipping"
|
|
else
|
|
echo " Upload returned HTTP $HTTP_CODE"
|
|
cat /tmp/rpm-upload.out 2>/dev/null || true
|
|
exit 1
|
|
fi
|
|
rm -f /tmp/rpm-upload.out
|
|
done
|
|
|
|
source scripts/link-package.sh
|
|
link_package "rpm" "mcpctl"
|
|
|
|
- name: Publish DEBs to Gitea
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
|
|
GITEA_URL: http://${{ env.GITEA_REGISTRY }}
|
|
GITEA_OWNER: ${{ env.GITEA_OWNER }}
|
|
run: |
|
|
DISTRIBUTIONS="trixie forky noble plucky"
|
|
|
|
for DEB_FILE in dist/mcpctl*.deb; do
|
|
echo "Publishing $DEB_FILE..."
|
|
for DIST in $DISTRIBUTIONS; do
|
|
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
|
-X PUT \
|
|
-H "Authorization: token ${GITEA_TOKEN}" \
|
|
--upload-file "$DEB_FILE" \
|
|
"${GITEA_URL}/api/packages/${GITEA_OWNER}/debian/pool/${DIST}/main/upload")
|
|
|
|
if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
|
|
echo " -> $DIST: published"
|
|
elif [ "$HTTP_CODE" = "409" ]; then
|
|
echo " -> $DIST: already exists"
|
|
else
|
|
echo " -> $DIST: HTTP $HTTP_CODE (warning)"
|
|
fi
|
|
done
|
|
done
|
|
|
|
source scripts/link-package.sh
|
|
link_package "debian" "mcpctl"
|