ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  DOCKER_REGISTRY: ghcr.io
  IMAGE_NAME: ghcr.io/codealive-ai/codealive-mcp
  # All tool versions below were published more than seven days before this release.
  PYTHON_VERSION: '3.11.15'
  NODE_VERSION: '24.18.0'
  UV_VERSION: '0.11.28'
  MCPB_VERSION: '2.1.2'

permissions:
  contents: read
  packages: write

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install "uv==${UV_VERSION}"
          uv sync --locked --extra test

      - name: Audit locked dependencies
        run: uv audit

      - name: Run tests
        run: |
          uv run python -m pytest src/tests/ -v --cov=src --cov-report=term-missing --cov-report=xml --junitxml=junit/test-results.xml

      - name: Upload test results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: pytest-results
          path: |
            junit/test-results.xml
            coverage.xml

  package:
    name: Package Extension
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: ${{ env.NODE_VERSION }}

      - name: Validate MCPB manifest
        run: npx -y "@anthropic-ai/mcpb@${MCPB_VERSION}" validate manifest.json

      - name: Build MCPB bundle
        run: |
          mkdir -p dist
          npx -y "@anthropic-ai/mcpb@${MCPB_VERSION}" pack . dist/codealive-mcp.mcpb

      - name: Verify MCPB bundle contents
        run: |
          python scripts/verify_mcpb.py dist/codealive-mcp.mcpb

      - name: Upload MCPB artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: codealive-mcpb
          path: dist/codealive-mcp.mcpb

  docker:
    name: Build & Push Docker
    needs: [test, package]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Calculate Docker version
        id: docker_version
        if: github.event_name == 'push'
        run: |
          set -euo pipefail
          LATEST_TAG=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1 || true)
          if [ -z "$LATEST_TAG" ]; then
            VERSION="0.1.0.dev${{ github.run_number }}+g${GITHUB_SHA::7}"
          elif [ "$(git rev-list --count "${LATEST_TAG}..HEAD")" = "0" ]; then
            VERSION="${LATEST_TAG#v}"
          else
            CURRENT="${LATEST_TAG#v}"
            IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
            NEXT_PATCH="$((PATCH + 1))"
            COMMITS_SINCE_TAG=$(git rev-list --count "${LATEST_TAG}..HEAD")
            VERSION="${MAJOR}.${MINOR}.${NEXT_PATCH}.dev${COMMITS_SINCE_TAG}+g${GITHUB_SHA::7}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Docker version: $VERSION"

      - name: Login to GitHub Container Registry
        if: github.event_name == 'push'
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.DOCKER_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # PR: build only (no push) to validate Dockerfile — single platform for speed
      - name: Build Docker image (PR validation)
        if: github.event_name == 'pull_request'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          push: false
          load: true
          file: ./Dockerfile
          tags: ${{ env.IMAGE_NAME }}:pr-${{ github.event.number }}
          cache-from: type=gha

      # Push to main: build multi-platform and push the production GHCR tag.
      - name: Build and push Docker image (GHCR)
        if: github.event_name == 'push'
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          push: true
          platforms: linux/amd64,linux/arm64
          file: ./Dockerfile
          build-args: VERSION=${{ steps.docker_version.outputs.version }}
          tags: |
            ${{ env.IMAGE_NAME }}:main
            ${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
          labels: |
            io.modelcontextprotocol.server.name=io.github.CodeAlive-AI/codealive-mcp
            org.opencontainers.image.revision=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha