mcp-keycloak

name: CI on: push: branches: - 'master' pull_request: branches: - 'master' permissions: contents: read jobs: lint-and-format: runs-on: ubuntu-latest steps: - name: ⚙️ Harden Runner uses: step-security/harden-runner@v2 with: egress-policy: audit - name: ⚙️ Checkout the project uses: actions/checkout@v4 - name: ⚙️ Install uv uses: astral-sh/setup-uv@v4 with: version: "latest" - name: ⚙️ Set up Python run: | uv python install 3.12 uv sync --all-extras --dev - name: ⚙️ Run ruff format check run: | uv run ruff format --check . - name: ⚙️ Run ruff linter run: | uv run ruff check . security-scan: runs-on: ubuntu-latest steps: - name: ⚙️ Harden Runner uses: step-security/harden-runner@v2 with: egress-policy: audit - name: ⚙️ Checkout the project uses: actions/checkout@v4 - name: ⚙️ Install uv uses: astral-sh/setup-uv@v4 with: version: "latest" - name: ⚙️ Set up Python run: | uv python install 3.12 uv sync --all-extras --dev - name: ⚙️ Add security tools run: | uv add --dev bandit safety - name: ⚙️ Run bandit security scan run: | uv run bandit -r src/ -f json -o bandit-report.json || true uv run bandit -r src/ - name: ⚙️ Run safety check run: | uv run safety check --json || true - name: ⚙️ Upload security reports uses: actions/upload-artifact@v4 if: always() with: name: security-reports path: | bandit-report.json retention-days: 7 build-test: runs-on: ubuntu-latest needs: [lint-and-format, security-scan] steps: - name: ⚙️ Harden Runner uses: step-security/harden-runner@v2 with: egress-policy: audit - name: ⚙️ Checkout the project uses: actions/checkout@v4 with: fetch-depth: 0 # Full history for UV build - name: ⚙️ Install uv uses: astral-sh/setup-uv@v4 with: version: "latest" - name: ⚙️ Set up Python run: uv python install 3.12 - name: ⚙️ Build package run: | uv build --sdist --wheel - name: ⚙️ Check package run: | uv add --dev twine uv run twine check dist/* - name: ⚙️ Test package installation run: | uv venv test-env source test-env/bin/activate pip install dist/*.whl mcp-keycloak --help