mcp-context-forge/.github/workflows/lint-web.yml at 1efbfe06dbd6eb031f189ede26c5d3f85b26d38f · IBM/mcp-context-forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
# ===============================================================
# 🕸️  Web Lint & Static Analysis - Frontend Code Quality Gate
# ===============================================================
# Authors: Mihai Criveti
#   - runs each web linter in its own matrix job for visibility
#   - mirrors the actual CLI commands used locally (no `make`)
#   - ensures fast-failure isolation: one failure doesn't hide others
#   - installs tools per-job without package.json
#   - logs are grouped and plain-text for readability
# ---------------------------------------------------------------

name: Web Lint & Static Analysis

on:
  push:
    branches: ["main"]
    paths:
      - "mcpgateway/static/**"
      - "mcpgateway/templates/**"
      - ".github/workflows/lint-web.yml"
  pull_request:
    types: [opened, synchronize, ready_for_review]
    branches: ["main"]
    paths:
      - "mcpgateway/static/**"
      - "mcpgateway/templates/**"
      - ".github/workflows/lint-web.yml"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  lint-web:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    strategy:
      fail-fast: false
      matrix:
        include:
          # -------------------------------------------------------
          # 🧼 HTML/CSS/JS Linters & Validators
          # -------------------------------------------------------
          - id: htmlhint
            cmd: |
              npm install --no-save --legacy-peer-deps htmlhint
              npx htmlhint "mcpgateway/templates/*.html"

          - id: stylelint
            cmd: |
              npm install --no-save --legacy-peer-deps stylelint stylelint-config-standard @stylistic/stylelint-config stylelint-order
              npx stylelint "mcpgateway/static/*.css"

          - id: eslint
            cmd: |
              npm install --no-save eslint neostandard eslint-config-prettier eslint-plugin-prettier prettier
              npx eslint "mcpgateway/static/*.js"

          # -------------------------------------------------------
          # 🔒 Security Scanners
          # -------------------------------------------------------
          - id: retire
            cmd: |
              npm install --no-save --legacy-peer-deps retire
              npx retire --path mcpgateway/static

          - id: npm-audit
            cmd: |
              if [ ! -f package.json ]; then
                npm init -y >/dev/null
              fi
              npm audit --audit-level=high || true

          # -------------------------------------------------------
          # 🔍 Additional Code Quality Tools
          # -------------------------------------------------------
          - id: jshint
            cmd: |
              npm install --no-save --legacy-peer-deps jshint
              if [ -f .jshintrc ]; then
                npx jshint --config .jshintrc "mcpgateway/static/*.js"
              else
                npx jshint --esversion=11 "mcpgateway/static/*.js"
              fi

          - id: jscpd
            cmd: |
              npm install --no-save --legacy-peer-deps jscpd
              npx jscpd "mcpgateway/static/" "mcpgateway/templates/"

          # - id: markuplint
          #   cmd: |
          #     npm install --no-save --legacy-peer-deps markuplint
          #     npx markuplint mcpgateway/templates/*

    name: ${{ matrix.id }}
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      # -----------------------------------------------------------
      # 0️⃣  Checkout
      # -----------------------------------------------------------
      - name: ⬇️  Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false
          fetch-depth: 1

      # -----------------------------------------------------------
      # 1️⃣  Node.js Setup
      # -----------------------------------------------------------
      - name: 📦  Install Node.js 20
        run: |
          sudo apt-get update
          sudo apt-get install -y ca-certificates curl gnupg
          sudo mkdir -p /etc/apt/keyrings
          curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
            | sudo gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
          echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_20.x nodistro main" \
            | sudo tee /etc/apt/sources.list.d/nodesource.list > /dev/null
          sudo apt-get update
          sudo apt-get install -y nodejs
          node --version
          npm --version

      # -----------------------------------------------------------
      # 🔧  Configure npm
      # -----------------------------------------------------------
      - name: 🔧  Upgrade npm to minimum required version
        run: sudo npm install -g npm@^11.10.0

      - name: 🔧  Configure npm registry
        run: npm config set registry https://registry.npmjs.org/

      # -----------------------------------------------------------
      # 2️⃣  Run Linter (install and execute in one step)
      # -----------------------------------------------------------
      - name: 🔍  Run ${{ matrix.id }}
        run: ${{ matrix.cmd }}

  # -------------------------------------------------------
  # 🐍 Python-based JS Security Scanner (separate job)
  # -------------------------------------------------------
  nodejsscan:
    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
    name: nodejsscan
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      # -----------------------------------------------------------
      # 0️⃣  Checkout
      # -----------------------------------------------------------
      - name: ⬇️  Checkout source
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
        with:
          persist-credentials: false
          fetch-depth: 1

      # -----------------------------------------------------------
      # 1️⃣  Python Setup
      # -----------------------------------------------------------
      - name: 🐍  Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.12"
          cache: pip

      # -----------------------------------------------------------
      # 2️⃣  Install nodejsscan
      # -----------------------------------------------------------
      - name: 🔧  Install nodejsscan
        run: |
          python3 -m pip install --upgrade pip
          pip install nodejsscan

      # -----------------------------------------------------------
      # 3️⃣  Run nodejsscan
      # -----------------------------------------------------------
      - name: 🔒  Run nodejsscan
        run: |
          nodejsscan --directory ./mcpgateway/static