deps: bump github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.7.0 #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: test (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| # Current stable, NOT go-version-file. The go.mod directive is a | |
| # *floor* (go 1.25.0), and setup-go treats it as an exact version — | |
| # which pinned CI to the oldest 1.25 patch, a toolchain carrying 9 | |
| # known stdlib CVEs. govulncheck caught exactly that. The declared | |
| # floor is verified separately by the minimum-go-version job below. | |
| go-version: stable | |
| - name: Verify go.mod is tidy | |
| run: | | |
| go mod tidy | |
| git diff --exit-code -- go.mod go.sum | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "These files need gofmt:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - name: Build | |
| run: go build ./... | |
| - name: Vet | |
| run: go vet ./... | |
| # The flock + atomic-rename concurrency contract is the core of this tool, | |
| # and TestConcurrentWriters exercises it with real parallel writers, so the | |
| # race detector is not optional here. | |
| - name: Test (race) | |
| run: go test -race -count=1 ./... | |
| cross-compile: | |
| name: cross-compile | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: stable | |
| # These are the release targets. Catching a build break here is much | |
| # cheaper than finding it during a tagged release. | |
| - name: Build all release targets | |
| run: | | |
| for target in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64; do | |
| echo "==> $target" | |
| GOOS=${target%/*} GOARCH=${target#*/} go build -o /dev/null ./... | |
| done | |
| # Proves the version claimed in go.mod and the README is actually buildable, | |
| # so `go install` on the oldest supported toolchain works. This is a | |
| # compatibility check, not a security one — that patch release may well lag | |
| # behind current stdlib fixes, which is precisely why govulncheck runs on | |
| # stable instead of here. | |
| minimum-go-version: | |
| name: minimum Go version | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - run: go build ./... | |
| - run: go test -count=1 ./... | |
| lint: | |
| name: lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: stable | |
| - uses: golangci/golangci-lint-action@v9 | |
| with: | |
| # Pinned, not "latest": a new release adding a check would otherwise | |
| # turn an unrelated PR red. Bump deliberately. | |
| version: v2.12.2 | |
| vulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version: stable | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... |