Josep Piguillem
748b485c9b
mcp/ exposes both APIs as MCP tools, one per operation in openapi.yaml, named after the Laravel route each lands on (public_projects_index, admin_pages_update, ...). Nothing is written by hand: the tools are derived from the document the target application serves, which the contract tests already hold to the truth. Two transports over one core: - stdio (`node mcp/server.mjs`), registered in .mcp.json, signing in with credentials from the environment and refreshing the token. - Streamable HTTP (`--http`), stateless, deployed as the landing-mcp service. It holds no credentials: each request brings its caller's Pireon Basic credentials or bearer token, so the API applies that person's permissions. Sessions live in memory keyed by a hash, refused credentials are remembered for a minute, and the spec is reloaded every minute so new endpoints appear without a redeploy. Left out on purpose: the token exchange, telemetry, and the contact and apply forms, which notify real people. The preview secret is never sent for anonymous callers, and is unset in the deployment by default. A CI job runs the Node tests, including the HTTP mode end to end against a fake application. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
103 lines
3.4 KiB
YAML
103 lines
3.4 KiB
YAML
name: Tests
|
|
|
|
# Every push and every pull request, on any branch — a failure is cheapest to
|
|
# find here, before it is a review comment or, worse, a deploy.
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
# A second push to the same branch cancels whatever this workflow was still
|
|
# running for the first one: nobody is waiting on results for code that no
|
|
# longer exists.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
# Real PHP requirement per composer.lock, not the ^8.3 composer.json used to
|
|
# claim — the locked Symfony packages require >=8.4.1, so 8.3 fails at
|
|
# `composer install`, and this pins the version the Dockerfile already
|
|
# settled on rather than re-deriving it.
|
|
PHP_VERSION: "8.4"
|
|
# A throwaway key, checked into no secret store because it protects nothing
|
|
# here: sessions and signed URLs in a CI run that is discarded on exit.
|
|
# docker-compose.test.yml uses this exact value for the same reason.
|
|
APP_KEY: "base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
|
|
|
|
jobs:
|
|
# Fast and dependency-free: catches a formatting slip before anything as
|
|
# slow as booting the framework runs at all.
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ env.PHP_VERSION }}
|
|
tools: composer:v2
|
|
coverage: none
|
|
|
|
- uses: ramsey/composer-install@v3
|
|
|
|
- run: ./vendor/bin/pint --test
|
|
|
|
# SQLite, in memory: the fast loop, for feedback in the couple of minutes it
|
|
# actually takes. Postgres is what production runs on, which is what the
|
|
# job below is for.
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ env.PHP_VERSION }}
|
|
extensions: pdo_sqlite, pdo_pgsql, gd, exif, intl, zip, pcntl, opcache
|
|
tools: composer:v2
|
|
coverage: none
|
|
|
|
- uses: ramsey/composer-install@v3
|
|
|
|
- run: php artisan test
|
|
|
|
# Fails if public/api-types.d.ts was committed out of step with
|
|
# openapi.yaml — the one artefact in this repo that is generated and
|
|
# checked in rather than built at deploy time, so nothing else would
|
|
# ever notice it drifting.
|
|
- run: php artisan api:types --check
|
|
|
|
# The one this app's own README insists on before trusting a change: this
|
|
# project stores translations and image variants in JSON columns and
|
|
# queries them by path in about forty places, and SQLite and Postgres do
|
|
# not always agree on what that means. Reuses docker-compose.test.yml
|
|
# verbatim rather than re-describing the same environment in YAML a second
|
|
# time — one place to keep it correct.
|
|
test-postgres:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- run: docker compose -f docker-compose.test.yml run --rm test
|
|
|
|
# The MCP server derives its tools from openapi.yaml, so a change to the
|
|
# document can break it without touching a line under mcp/ — two operations
|
|
# that map to the same tool name, say. Cheap enough to run on every push.
|
|
mcp:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: mcp
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
cache-dependency-path: mcp/package-lock.json
|
|
|
|
- run: npm ci
|
|
|
|
- run: npm test
|