@neverinfamous/mysql-mcp 2.1.0 → 2.3.0

package/.github/workflows/docker-publish.yml

@@ -2,10 +2,9 @@ name: Build and Push Docker Images
 
 on:
   push:
-    branches: [ master ]
-    tags: [ 'v*' ]
+    tags: ["v*"]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 env:
   REGISTRY: docker.io
@@ -14,10 +13,10 @@ env:
 permissions:
   contents: read
   packages: write
-  security-events: write  # For security scanning
-  pull-requests: write    # For PR comments
-  id-token: write        # For supply chain attestations
-  attestations: write    # For generating attestations
+  security-events: write # For security scanning
+  pull-requests: write # For PR comments
+  id-token: write # For supply chain attestations
+  attestations: write # For generating attestations
 
 jobs:
   # Quality gate - must pass before any builds
@@ -25,32 +24,70 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-    
+
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type check
+        run: npm run typecheck
+
+      - name: Run tests
+        run: npm test
 
-    - name: Set up Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: '20'
-        cache: 'npm'
+  # Security gate - CodeQL must pass before any builds
+  codeql:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
-    - name: Install dependencies
-      run: npm ci
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Check for JS/TS files
+        id: check-files
+        run: |
+          if find . -type f \( -name "*.js" -o -name "*.jsx" -o -name "*.ts" -o -name "*.tsx" -o -name "*.mjs" -o -name "*.cjs" \) | grep -q .; then
+            echo "has_code=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_code=false" >> $GITHUB_OUTPUT
+          fi
 
-    - name: Lint
-      run: npm run lint
+      - name: Initialize CodeQL
+        if: steps.check-files.outputs.has_code == 'true'
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+          queries: security-extended,security-and-quality
 
-    - name: Type check
-      run: npm run typecheck
+      - name: Autobuild
+        if: steps.check-files.outputs.has_code == 'true'
+        uses: github/codeql-action/autobuild@v4
 
-    - name: Run tests
-      run: npm test
+      - name: Perform CodeQL Analysis
+        if: steps.check-files.outputs.has_code == 'true'
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:javascript-typescript"
 
   # Build each platform on native architecture (avoids QEMU emulation issues)
   build-platform:
-    needs: quality-gate
+    needs: [quality-gate, codeql]
     strategy:
       fail-fast: false
       matrix:
@@ -59,89 +96,89 @@ jobs:
             runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
-    
+
     runs-on: ${{ matrix.runner }}
     permissions:
       contents: read
       packages: write
       id-token: write
       attestations: write
-    
+
     outputs:
       version: ${{ steps.version.outputs.version }}
-    
+
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Log in to Docker Hub
-      if: github.event_name != 'pull_request'
-      uses: docker/login-action@v3
-      continue-on-error: true
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-
-    - name: Read version from VERSION file
-      id: version
-      run: |
-        if [ -f "VERSION" ]; then
-          VERSION=$(head -1 VERSION | tr -d '[:space:]')
-        fi
-        if [ -z "$VERSION" ]; then
-          VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
-        fi
-        if [ -z "$VERSION" ]; then
-          VERSION="1.0.0"
-        fi
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-        echo "Detected version: $VERSION"
-
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-        flavor: |
-          latest=false
-          suffix=-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
-        tags: |
-          type=sha,prefix=sha-,format=short
-
-    - name: Build and push platform image
-      id: build
-      uses: docker/build-push-action@v6
-      with:
-        context: .
-        file: Dockerfile
-        platforms: ${{ matrix.platform }}
-        push: ${{ github.event_name != 'pull_request' }}
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha,scope=${{ matrix.platform }}
-        cache-to: type=gha,scope=${{ matrix.platform }},mode=max
-        provenance: mode=max
-        sbom: true
-
-    - name: Export digest
-      if: github.event_name != 'pull_request'
-      run: |
-        mkdir -p /tmp/digests
-        digest="${{ steps.build.outputs.digest }}"
-        touch "/tmp/digests/${digest#sha256:}"
-
-    - name: Upload digest
-      if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v6
-      with:
-        name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
-        path: /tmp/digests/*
-        if-no-files-found: error
-        retention-days: 1
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        continue-on-error: true
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Read version from VERSION file
+        id: version
+        run: |
+          if [ -f "VERSION" ]; then
+            VERSION=$(head -1 VERSION | tr -d '[:space:]')
+          fi
+          if [ -z "$VERSION" ]; then
+            VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
+          fi
+          if [ -z "$VERSION" ]; then
+            VERSION="1.0.0"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Detected version: $VERSION"
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=false
+            suffix=-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          tags: |
+            type=sha,prefix=sha-,format=short
+
+      - name: Build and push platform image
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          cache-to: type=gha,scope=${{ matrix.platform }},mode=max
+          provenance: mode=max
+          sbom: true
+
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v6
+        with:
+          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
 
   # Security scan on amd64 image only (runs in parallel)
   security-scan:
@@ -151,42 +188,42 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    
+
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Build image for scanning
-      uses: docker/build-push-action@v6
-      with:
-        context: .
-        file: Dockerfile
-        platforms: linux/amd64
-        push: false
-        load: true
-        tags: local-scan:latest
-        cache-from: type=gha,scope=linux/amd64
-
-    - name: Docker Scout security scan
-      timeout-minutes: 10
-      run: |
-        curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
-        docker images local-scan:latest
-        echo "🔍 Running Docker Scout security scan"
-        if timeout 480 docker scout cves local-scan:latest > scout_output.txt 2>&1; then
-          echo "📊 Scan completed successfully"
-          cat scout_output.txt
-          if grep -E "(CRITICAL|HIGH)" scout_output.txt | grep -v "0  " > /dev/null; then
-            echo "⚠️ Critical or high severity vulnerabilities detected (informational)"
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image for scanning
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: local-scan:latest
+          cache-from: type=gha,scope=linux/amd64
+
+      - name: Docker Scout security scan
+        timeout-minutes: 10
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
+          docker images local-scan:latest
+          echo "🔍 Running Docker Scout security scan"
+          if timeout 480 docker scout cves local-scan:latest > scout_output.txt 2>&1; then
+            echo "📊 Scan completed successfully"
+            cat scout_output.txt
+            if grep -E "(CRITICAL|HIGH)" scout_output.txt | grep -v "0  " > /dev/null; then
+              echo "⚠️ Critical or high severity vulnerabilities detected (informational)"
+            else
+              echo "✅ No critical/high severity vulnerabilities"
+            fi
           else
-            echo "✅ No critical/high severity vulnerabilities"
+            echo "⚠️ Docker Scout scan timed out or failed"
           fi
-        else
-          echo "⚠️ Docker Scout scan timed out or failed"
-        fi
 
   # Merge platform images into multi-arch manifest
   merge-and-push:
@@ -199,87 +236,87 @@ jobs:
       id-token: write
       attestations: write
       deployments: write
-    
+
     environment:
       name: ${{ github.ref == 'refs/heads/master' && 'production' || '' }}
       url: https://hub.docker.com/r/writenotenow/mysql-mcp
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-
-    - name: Download digests
-      uses: actions/download-artifact@v7
-      with:
-        path: /tmp/digests
-        pattern: digests-*
-        merge-multiple: true
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-
-    - name: Log in to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        registry: ${{ env.REGISTRY }}
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-
-    - name: Read version
-      id: version
-      run: |
-        if [ -f "VERSION" ]; then
-          VERSION=$(head -1 VERSION | tr -d '[:space:]')
-        fi
-        if [ -z "$VERSION" ]; then
-          VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
-        fi
-        if [ -z "$VERSION" ]; then
-          VERSION="1.0.0"
-        fi
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-    - name: Extract metadata for manifest
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-        flavor: |
-          latest=auto
-        tags: |
-          type=semver,pattern=v{{version}}
-          type=raw,value=v${{ steps.version.outputs.version }},enable={{is_default_branch}}
-          type=raw,value=latest,enable={{is_default_branch}}
-          type=sha,prefix=sha-,format=short
-
-    - name: Create and push manifest
-      working-directory: /tmp/digests
-      run: |
-        docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-          $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
-
-    - name: Inspect manifest
-      run: |
-        docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-
-    # Update Docker Hub description
-    - name: Update Docker Hub Description
-      if: github.ref == 'refs/heads/master'
-      uses: peter-evans/dockerhub-description@v5
-      continue-on-error: true
-      timeout-minutes: 5
-      with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-        repository: ${{ env.IMAGE_NAME }}
-        readme-filepath: ./DOCKER_README.md
-        short-description: "MySQL MCP with 191 tools, OAuth 2.1, HTTP Streamable, Smart Tool Filtering & Connection Pooling."
-
-    - name: Deployment Summary
-      if: github.ref == 'refs/heads/master'
-      run: |
-        echo "✅ Successfully published Docker images to production"
-        echo "🐳 Registry: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-        echo "🏷️ Tags: ${{ steps.meta.outputs.tags }}"
-        echo "📝 Commit: ${{ github.sha }}"
-        echo "👤 Published by: ${{ github.actor }}"
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Download digests
+        uses: actions/download-artifact@v7
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Read version
+        id: version
+        run: |
+          if [ -f "VERSION" ]; then
+            VERSION=$(head -1 VERSION | tr -d '[:space:]')
+          fi
+          if [ -z "$VERSION" ]; then
+            VERSION=$(grep -oP '"version":\s*"\K[0-9.]+' package.json | head -1)
+          fi
+          if [ -z "$VERSION" ]; then
+            VERSION="1.0.0"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Extract metadata for manifest
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: |
+            latest=auto
+          tags: |
+            type=semver,pattern=v{{version}}
+            type=raw,value=v${{ steps.version.outputs.version }},enable={{is_default_branch}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-,format=short
+
+      - name: Create and push manifest
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
+
+      - name: Inspect manifest
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
+
+      # Update Docker Hub description
+      - name: Update Docker Hub Description
+        if: github.ref == 'refs/heads/master'
+        uses: peter-evans/dockerhub-description@v5
+        continue-on-error: true
+        timeout-minutes: 5
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+          repository: ${{ env.IMAGE_NAME }}
+          readme-filepath: ./DOCKER_README.md
+          short-description: "MySQL MCP Server: 193 tools, Code Mode, Tool Filtering, Connection Pooling, HTTP/SSE & OAuth 2.1"
+
+      - name: Deployment Summary
+        if: github.ref == 'refs/heads/master'
+        run: |
+          echo "✅ Successfully published Docker images to production"
+          echo "🐳 Registry: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          echo "🏷️ Tags: ${{ steps.meta.outputs.tags }}"
+          echo "📝 Commit: ${{ github.sha }}"
+          echo "👤 Published by: ${{ github.actor }}"

package/.github/workflows/publish-npm.yml

@@ -19,7 +19,7 @@ jobs:
     environment:
       name: npm
       url: https://www.npmjs.com/package/@neverinfamous/mysql-mcp
-    
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -27,9 +27,9 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '22.x'
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'npm'
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+          cache: "npm"
 
       - name: Install dependencies
         run: npm ci
@@ -70,6 +70,16 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Verify publication
+        continue-on-error: true
         run: |
-          sleep 10
-          npm view @neverinfamous/mysql-mcp version
+          echo "Waiting for npm registry propagation..."
+          for i in 1 2 3; do
+            sleep 30
+            echo "Attempt $i: Checking npm registry..."
+            if npm view @neverinfamous/mysql-mcp version --registry https://registry.npmjs.org 2>/dev/null; then
+              echo "✅ Package verified on npm registry"
+              exit 0
+            fi
+            echo "Package not yet visible, retrying..."
+          done
+          echo "⚠️ Package may still be propagating to npm registry. This is informational only."