fix(webmcp): arm the tool inspector for the session, not the URL #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| tags: ["v*-rc.*"] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Optional provider automation. The canonical release path is the direct | |
| # operator command documented in docs/WEB.md; this workflow never writes the | |
| # projection or deploys production. | |
| verify: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout web pipeline | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Production no longer depends on Actions, but the live replica mirror | |
| # still carries provider credentials and remains worth auditing. | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 | |
| with: | |
| version: "0.11.32" | |
| python-version: "3.13" | |
| enable-cache: false | |
| - name: Audit GitHub Actions contracts | |
| run: uvx zizmor@1.29.0 --offline --min-severity medium --no-progress . | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 # zizmor: ignore[cache-poisoning] | |
| with: | |
| bun-version: 1.3.12 | |
| - name: Install | |
| run: bun install --frozen-lockfile | |
| - name: Static contracts | |
| run: bun run check | |
| - name: Lint and tests | |
| run: bun run lint && bun run test | |
| # `check` covers typecheck, but nothing here compiles an app, so a break | |
| # that only a real build catches can stay green on main. `bun run build` | |
| # builds `@vela/problems`, which reads a projection database at build | |
| # time and fails closed without one — CI holds no such credential and | |
| # should not. The deterministic local seed (`bun run dev:demo`) is the | |
| # intended way to give this step a real build; until it lands, only the | |
| # brand pipeline is compiled here. | |
| - name: Build brand assets | |
| run: bun run --filter @vela/brand build | |
| - name: Patch hygiene | |
| run: bun run format:check |