validate.yml

name: Validate

# Runs on every push and pull request. Checks that the files match
# SOURCE.json, that the plugin and extension manifests agree, that the MCP
# Registry records match the published schema, and that gitleaks finds no
# secrets. A v* tag must match the version in gemini-extension.json.

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  manifests:
    name: Manifests and registry records
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      REGISTRY_SCHEMA_URL: https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"

      - name: Files, manifests and version pins
        env:
          REF_TYPE: ${{ github.ref_type }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ "$REF_TYPE" = "tag" ]; then
            node .github/scripts/check-repository.mjs --tag "$REF_NAME"
          else
            node .github/scripts/check-repository.mjs
          fi

      - name: MCP Registry records against the published schema
        run: |
          set -euo pipefail
          curl -fsSLo "$RUNNER_TEMP/server.schema.json" "$REGISTRY_SCHEMA_URL"
          for record in distribution/mcp-registry/server*.json; do
            npx --yes -p ajv-cli@5.0.0 -p ajv-formats@3.0.1 \
              ajv validate --spec=draft7 --strict=false -c ajv-formats \
              -s "$RUNNER_TEMP/server.schema.json" -d "$record"
          done

  secrets:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      GITLEAKS_VERSION: "8.30.1"
      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Scan history and working tree
        run: |
          set -euo pipefail
          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl -fsSLo "$RUNNER_TEMP/$archive" \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
          echo "${GITLEAKS_SHA256}  $RUNNER_TEMP/$archive" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/$archive" -C "$RUNNER_TEMP" gitleaks
          "$RUNNER_TEMP/gitleaks" git --redact --no-banner --exit-code 1 .
          "$RUNNER_TEMP/gitleaks" dir --redact --no-banner --exit-code 1 .