1212 IMAGE_NAME : ${{ github.repository }}
1313
1414jobs :
15+ # Phase 1: Core Tests and Quality Checks (run in parallel)
1516 test :
1617 name : Test
1718 runs-on : ubuntu-latest
4748 - name : Run unit tests
4849 run : make test
4950
50- - name : Run integration tests
51- run : make test-integration
52-
5351 - name : Generate coverage report
5452 run : make test-coverage
5553
@@ -85,10 +83,126 @@ jobs:
8583 version : latest
8684 args : --timeout=5m
8785
86+ security :
87+ name : Security Scan
88+ runs-on : ubuntu-latest
89+
90+ steps :
91+ - name : Checkout code
92+ uses : actions/checkout@v4
93+ with :
94+ token : ${{ secrets.GITHUB_TOKEN }}
95+
96+ - name : Run Trivy vulnerability scanner
97+ uses : aquasecurity/trivy-action@master
98+ with :
99+ scan-type : ' fs'
100+ scan-ref : ' .'
101+ format : ' sarif'
102+ output : ' trivy-results.sarif'
103+
104+ - name : Upload Trivy scan results to GitHub Security tab
105+ uses : github/codeql-action/upload-sarif@v3
106+ if : always()
107+ continue-on-error : true
108+ with :
109+ sarif_file : ' trivy-results.sarif'
110+
111+ stdio-transport-test :
112+ name : STDIO Transport Test
113+ runs-on : ubuntu-latest
114+
115+ steps :
116+ - name : Checkout code
117+ uses : actions/checkout@v4
118+
119+ - name : Set up Go
120+ uses : actions/setup-go@v4
121+ with :
122+ go-version : ' 1.21'
123+
124+ - name : Set up Python
125+ uses : actions/setup-python@v4
126+ with :
127+ python-version : ' 3.x'
128+
129+ - name : Install Python dependencies
130+ run : pip install requests
131+
132+ - name : Download dependencies
133+ run : make deps
134+
135+ - name : Build server
136+ run : make build
137+
138+ - name : Test STDIO transport
139+ run : python3 scripts/test_stdio_integration.py
140+
141+ sse-transport-test :
142+ name : SSE Transport Test
143+ runs-on : ubuntu-latest
144+
145+ steps :
146+ - name : Checkout code
147+ uses : actions/checkout@v4
148+
149+ - name : Set up Go
150+ uses : actions/setup-go@v4
151+ with :
152+ go-version : ' 1.21'
153+
154+ - name : Set up Python
155+ uses : actions/setup-python@v4
156+ with :
157+ python-version : ' 3.x'
158+
159+ - name : Install Python dependencies
160+ run : pip install requests
161+
162+ - name : Download dependencies
163+ run : make deps
164+
165+ - name : Build server
166+ run : make build
167+
168+ - name : Test SSE transport
169+ run : python3 scripts/test_sse_integration.py --port 8081
170+
171+ http-streams-transport-test :
172+ name : HTTP Streams Transport Test
173+ runs-on : ubuntu-latest
174+
175+ steps :
176+ - name : Checkout code
177+ uses : actions/checkout@v4
178+
179+ - name : Set up Go
180+ uses : actions/setup-go@v4
181+ with :
182+ go-version : ' 1.21'
183+
184+ - name : Set up Python
185+ uses : actions/setup-python@v4
186+ with :
187+ python-version : ' 3.x'
188+
189+ - name : Install Python dependencies
190+ run : pip install requests
191+
192+ - name : Download dependencies
193+ run : make deps
194+
195+ - name : Build server
196+ run : make build
197+
198+ - name : Test HTTP Streams transport
199+ run : python3 scripts/test_http_streams_integration.py --port 8082
200+
201+ # Phase 2: Build Jobs (after core tests pass)
88202 build :
89203 name : Build
90204 runs-on : ubuntu-latest
91- needs : [test, lint]
205+ needs : [test, lint, security, stdio-transport-test, sse-transport-test, http-streams-transport-test ]
92206
93207 strategy :
94208 matrix :
@@ -122,7 +236,7 @@ jobs:
122236 docker :
123237 name : Build and Push Docker Image
124238 runs-on : ubuntu-latest
125- needs : [test, lint]
239+ needs : [test, lint, security, stdio-transport-test, sse-transport-test, http-streams-transport-test ]
126240 if : github.event_name != 'pull_request'
127241
128242 permissions :
@@ -167,6 +281,7 @@ jobs:
167281 cache-from : type=gha
168282 cache-to : type=gha,mode=max
169283
284+ # Phase 3: Release (last, after everything else passes)
170285 release :
171286 name : Create Release
172287 runs-on : ubuntu-latest
@@ -179,6 +294,15 @@ jobs:
179294 steps :
180295 - name : Checkout code
181296 uses : actions/checkout@v4
297+ with :
298+ fetch-depth : 0
299+
300+ - name : Check if tag is on main branch
301+ run : |
302+ if ! git branch --contains ${{ github.ref }} | grep -q "main"; then
303+ echo "Tag is not on main branch, skipping release"
304+ exit 78
305+ fi
182306
183307 - name : Download all artifacts
184308 uses : actions/download-artifact@v4
0 commit comments