ophis/.github/workflows/mcp-deploy.yml at main · ophis-fi/ophis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: Deploy @ophis/mcp-server to Cloudflare Workers

# Build + typecheck + unit-test on PRs; build + deploy to Cloudflare Workers on
# push to main.
#
# Deploy uses CLOUDFLARE_WORKERS_TOKEN — a LEAST-PRIVILEGE, account-scoped token
# with only "Workers Scripts: Edit" + "Workers Routes: Edit" (created 2026-05-29).
# The other CF deploys (Pages) use the separate Pages/DNS-scoped
# CLOUDFLARE_API_TOKEN, which cannot deploy Workers. The custom domain
# mcp.ophis.fi is already provisioned, so the Workers-Routes scope is sufficient
# for re-asserting it on each deploy.

on:
  push:
    branches: [main]
    paths:
      - 'apps/mcp-server/**'
      - 'packages/sdk/**'
      - '.github/workflows/mcp-deploy.yml'
  pull_request:
    paths:
      - 'apps/mcp-server/**'
      - 'packages/sdk/**'

permissions:
  contents: read

concurrency:
  group: mcp-deploy-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build-deploy:
    name: build + test + deploy
    runs-on: ubuntu-latest
    steps:
      # Action SHAs pinned (mirrors ci.yml). Tag refs are mutable; SHAs are not.
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: |
            pnpm-lock.yaml

      # --ignore-scripts: this job later runs `wrangler deploy` with the
      # CLOUDFLARE_WORKERS_TOKEN on the same runner, so no third-party dependency
      # lifecycle script should execute next to that token (mirrors
      # sdk-release.yml). Safe here: the root workspace has no own postinstall,
      # the SDK build is invoked explicitly below, and the test step is plain
      # `vitest run` (no workerd/miniflare native runtime needed).
      # Future option if a build ever needs a native dep script: split into a
      # secret-free build job + a deploy job (upload/download artifact).
      - run: pnpm install --frozen-lockfile --ignore-scripts

      # The MCP Worker imports @ophis/sdk from its built dist/.
      - run: pnpm --filter @ophis/sdk build

      - run: pnpm --filter @ophis/mcp-server typecheck
      - run: pnpm --filter @ophis/mcp-server test

      - name: wrangler deploy
        if: github.ref == 'refs/heads/main'
        working-directory: apps/mcp-server
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_WORKERS_TOKEN }}
          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
        # Run the lockfile-pinned local wrangler (apps/mcp-server devDep ^4.95.0,
        # installed by the frozen-lockfile step above) instead of the floating
        # `npx wrangler@4` tag. This step carries the deploy token, so it must not
        # fetch a compromised future 4.x release; dependabot tracks the pin via package.json.
        run: pnpm exec wrangler deploy