ci: validate the local-first MCP fork

Replace inherited hosted-service CI/CD with a single read-only workflow that installs from the frozen lockfile, verifies the MCP package, and fails on any production dependency advisory. Pin every action to a verified full commit SHA, use Node 24 with pnpm caching, and bound job duration.

Remove Upstash-specific npm release, canary, ECR, MCP Registry, and issue-triage workflows because this fork does not own their credentials or deployment targets. This prevents false failures and avoids retaining unused privileged automation.

Expand the root README with the implemented automatic ingestion, hybrid retrieval, commit-bound reads, freshness and migration behavior, top-1000 prewarm, evaluation harness, local security boundaries, and client configuration while keeping the presentation plain.

Validated MCP lint, build, typecheck, 20 tests, edited-file formatting, frozen installation, and a production audit with no known vulnerabilities.

Author: DeepWiki Dev

.github/workflows/canary-release.yml

@@ -1,4 +1,4 @@
-name: Test
+name: CI
 
 on:
   pull_request:
@@ -15,58 +15,51 @@ on:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  test:
+  verify:
+    name: Build, test, and audit
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
+    timeout-minutes: 15
 
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: "20"
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Set up pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm dependencies
-        uses: actions/cache@v6
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version: "24"
+          cache: pnpm
 
-      - name: Install Dependencies
+      - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Lint
-        run: pnpm lint:check
+        run: pnpm --filter @upstash/context7-mcp lint:check
 
       - name: Format
-        run: pnpm format:check
+        run: pnpm --filter @upstash/context7-mcp format:check
 
       - name: Build
-        run: pnpm build
+        run: pnpm --filter @upstash/context7-mcp build
 
       - name: Typecheck
-        run: pnpm typecheck
+        run: pnpm --filter @upstash/context7-mcp typecheck
+
+      - name: Test local MCP
+        run: pnpm --filter @upstash/context7-mcp test
 
-      - name: Test
-        run: pnpm test
-        env:
-          AWS_REGION: ${{ secrets.AWS_REGION }}
-          AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
-          CONTEXT7_API_KEY: ${{ secrets.CONTEXT7_API_KEY }}
+      - name: Audit production dependencies
+        run: pnpm audit --prod --audit-level low