Repository navigation
103 lines (88 loc) · 3.64 KB
/
Copy pathexamples.yml
File metadata and controls
103 lines (88 loc) · 3.64 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: Examples
# Keeps examples/ honest:
# 1. lint — YAML-lint every example workflow so a broken copy-paste template
# can never merge.
# 2. check — re-run `mcp-warden check` against each committed lock under
# examples/pinned-servers/ so the example locks stay green (a drifted
# upstream server or a stale lock fails this job).
#
# All third-party actions are pinned to a full 40-char commit SHA with a version
# comment (enforced by tests/test_workflow_pins.py).
on:
push:
branches: [main]
pull_request:
branches: [main]
# Least-privilege: both jobs only read the repo.
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# --------------------------------------------------------------------------
# Job 1: YAML-lint the example workflows.
# --------------------------------------------------------------------------
lint:
name: YAML lint example workflows
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python 3.11
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"
- name: Install yamllint
run: pip install "yamllint==1.35.1"
# Lint the example workflow / CI / config YAML. The relaxed ruleset focuses
# on syntactic validity and basic hygiene rather than strict formatting,
# since these are copy-paste templates authored for readability.
- name: Lint example YAML
run: |
yamllint -d relaxed \
examples/github-actions \
examples/gitlab-ci \
examples/pre-commit
# --------------------------------------------------------------------------
# Job 2: re-check the committed example locks.
#
# Launches each real, openly-available server via its PINNED ref and verifies
# the committed warden.lock still matches the live surface. No paid creds, no
# secrets — every server is public.
# --------------------------------------------------------------------------
check-locks:
name: Re-check committed example locks
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Set up Python 3.11
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.11"
# Node provides npx for the @modelcontextprotocol/* servers.
- name: Set up Node 22
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: "22"
- name: Install mcp-warden
run: pip install -e .
- name: "check: server-everything (npx, pinned @2026.1.26)"
run: |
mcp-warden check \
--lock examples/pinned-servers/server-everything/warden.lock \
--timeout 120 \
-- npx -y @modelcontextprotocol/server-everything@2026.1.26
- name: "check: server-memory (npx, pinned @2026.1.26)"
run: |
mcp-warden check \
--lock examples/pinned-servers/server-memory/warden.lock \
--timeout 120 \
-- npx -y @modelcontextprotocol/server-memory@2026.1.26
- name: "check: server-sequential-thinking (npx, pinned @2025.12.18)"
run: |
mcp-warden check \
--lock examples/pinned-servers/server-sequential-thinking/warden.lock \
--timeout 120 \
-- npx -y @modelcontextprotocol/server-sequential-thinking@2025.12.18