ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      registry_ref:
        description: A version's tag (for example v8.15.4) whose server.json the registry job publishes, for a version an outage of the MCP registry missed. Leave empty to publish the checked-out branch's own.
        required: false
        type: string

permissions:
  contents: write
  id-token: write
  issues: write
  pull-requests: write

env:
  # pnpm/action-setup bootstraps pnpm with `npm install`, which also runs `npm audit` against the registry's legacy audit endpoint. That endpoint is being retired ("This endpoint is being retired. Use the bulk advisory endpoint instead"), and on 2026-10-22 it stalled the bootstrap for five minutes in every job (a green run earlier completed the same step in seven seconds), pushing the Test job past its timeout. The audit of a one-package bootstrap install tells nothing, so it is switched off for every job.
  NPM_CONFIG_AUDIT: "false"

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      # No remote cache configured (would need a TURBO_TOKEN/TURBO_TEAM), so actions/cache is the fallback: it persists turbo's own per-task content hashes across runs so an unchanged task can still skip re-execution here, not just on a developer's machine.
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run lint

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@v6
        with:
          path: .turbo
          key: turbo-${{ runner.os }}-${{ github.job }}-${{ github.sha }}
          restore-keys: |
            turbo-${{ runner.os }}-${{ github.job }}-
      - run: pnpm run build
      - run: pnpm test
      - run: pnpm test:delivery
      - run: pnpm test:smoke

  e2e:
    name: E2E
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - name: Resolve Playwright version
        id: playwright
        run: echo "version=$(pnpm exec playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
      # Browser binaries are versioned by Playwright itself, so the version is the whole cache key.
      - uses: actions/cache@v6
        id: playwright-browsers
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
      - name: Install Playwright browser and system dependencies
        if: steps.playwright-browsers.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium
      # The cache holds only the browser download; the OS libraries it needs live outside it and are not restored, so they are installed on every run.
      - name: Install Playwright system dependencies
        if: steps.playwright-browsers.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium
      - run: pnpm test:e2e

  mutation:
    name: Mutation Testing (${{ matrix.file }})
    # A dispatch that only names a registry_ref is publishing a missed version to the MCP registry, which mutation testing has no part in and which takes hours of runner time, so the matrix is skipped for it.
    if: github.event_name == 'workflow_dispatch' && inputs.registry_ref == ''
    runs-on: ubuntu-latest
    # One job per file instead of one job for all of them: each gets its own runner (its own 4 vCPUs, not shared with the others), so every file's mutants run genuinely in parallel across separate machines rather than sequentially through a single job's own worker pool. The prior single-job run took over an hour and was still going when a too-short timeout cancelled it -- this is the actual fix for that, not just a bigger number. The list grew from the original three files once mesh-store.ts's own logic was split across ten collaborator files -- each now gets its own matrix entry and its own mutation score, matching stryker.config.ts's own mutate list.
    strategy:
      fail-fast: false
      matrix:
        file:
          [
            identity,
            mesh-store,
            wire-mesh-transport,
            agent-registry,
            connection-approval,
            delivery-engine,
            federation-bridge,
            mesh-store-shared,
            peer-lifecycle,
            room-lifecycle,
            room-messaging,
            room-protocol,
            room-wire-extensions,
            stale-agent-checker,
          ]
    # 120 minutes wasn't enough for mesh-store.ts specifically -- it was still running (identity.ts finished in 20 minutes, wire-mesh-transport.ts's own dry run failed in under 2) when that ceiling cancelled it on the first real matrix dispatch. Raised back to the same generous budget the prior single-job run used; a shorter-lived file finishing early costs the other matrix entries nothing, since each runs on its own independent runner.
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - run: pnpm exec stryker run stryker.config.ts --mutate "src/core/${{ matrix.file }}.ts"
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: mutation-report-${{ matrix.file }}
          path: reports/mutation/mutation.html
          retention-days: 30

  pages:
    name: GitHub Pages
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [lint, typecheck, test]
    runs-on: ubuntu-latest
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
      - run: pnpm install --frozen-lockfile
      - run: pnpm build:frontend
      - name: Assemble static site
        run: |
          mkdir -p github-pages
          cp src/bridges/user/web/frontend/index.html github-pages/
          cp -r src/bridges/user/web/dist/* github-pages/
      - uses: actions/upload-pages-artifact@v5
        with:
          path: github-pages
      - uses: actions/deploy-pages@v5
        id: deployment

  release:
    name: Release
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    needs: [lint, typecheck, test, e2e]
    runs-on: ubuntu-latest
    steps:
      # The release commit is a direct push to main, and main's ruleset requires status checks on every change unless the actor is a bypass actor. The default GITHUB_TOKEN is not one, so the push authenticates as the org-wide "exadev" GitHub App instead, which is an Integration bypass actor on this repository's ruleset. GITHUB_TOKEN stays in the semantic-release env below for creating the GitHub release and commenting on issues and pull requests.
      - name: Generate a token for the release push
        id: app-token
        uses: actions/create-github-app-token@v3
        with:
          client-id: Iv23liLMzahHqi38Qo4c
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
      # The token is left persisted in the checkout's git config: semantic-release first tries the repository URL as it stands and only falls back to token-derived URLs when that push is refused, so persisted App credentials are what its push to main authenticates with.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
          token: ${{ steps.app-token.outputs.token }}
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .tool-versions
          # Do NOT set registry-url — it creates an .npmrc that overrides OIDC
      - run: pnpm install --frozen-lockfile
      - run: pnpm run build
      - run: HUSKY=0 pnpm exec semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # The registry publish is separate from the release job so that an outage of the MCP registry fails only this job, never the release: semantic-release stops at the first failing publish step, and a publish step here once left a version on npm and tagged without its GitHub release (run 39670379457, v8.15.4). It is re-runnable and skips a version the registry already lists, so a failed run is fixed by re-running it, and a version missed by an outage is published by dispatching this workflow with `registry_ref` set to that version's tag (a dispatch runs the workflow file of the ref it is dispatched on, and a tag carries the older file without this job, so it is dispatched on main).
  registry:
    name: MCP registry
    if: ${{ !cancelled() && needs.release.result != 'failure' && ((github.ref == 'refs/heads/main' && github.event_name == 'push') || github.event_name == 'workflow_dispatch') }}
    needs: [release]
    runs-on: ubuntu-latest
    # The workflow-level permissions are broad enough for the release job (contents, issues and pull requests, all write). This job runs a third-party-shaped action with the OIDC token that publishes under this repository's registry namespace, so it gets only what the action's own README asks for: a read checkout and the OIDC token. A moved tag on that action then cannot write to this repository.
    permissions:
      contents: read
      id-token: write
    steps:
      # A push to main publishes what the release job just committed, which is main's new tip and not the commit this run started from. The publisher is the pinned `ExaDev/mcp-registry-publish` action, never code from a release tag, so a backfill of an old version runs today's retry handling; a dispatch naming a `registry_ref` takes only that tag's server.json from it.
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.ref == 'refs/heads/main' && 'main' || github.ref }}
      - name: Take the named version's server.json
        if: ${{ inputs.registry_ref != '' }}
        env:
          REGISTRY_REF: ${{ inputs.registry_ref }}
        run: |
          git fetch --depth=1 origin "refs/tags/${REGISTRY_REF}"
          git show FETCH_HEAD:server.json > server.json
      # Pinned to the commit of the release, not the moving major tag: GitHub's secure use guidance is a full-length SHA, since a tag can be moved, and this step holds the registry publishing identity. Dependabot's github-actions updates keep the pin current.
      - uses: ExaDev/mcp-registry-publish@438589653ab51681ce140c2dec1ee58798ed16cd # v1.0.4