tfmcp 0.2.1

Terraform Model Context Protocol Tool - A CLI tool to manage Terraform through MCP
Documentation
name: Rust CI

on:
  push:
    branches:
      - main
    tags:
      - 'v*.*.*'
  pull_request:
    branches:
      - main

env:
  CARGO_TERM_COLOR: always
  RUSTFLAGS: "-Dwarnings" # 警告をエラーとして扱う
  RUSTDOCFLAGS: "-Dwarnings"

jobs:
  msrv:
    name: Rust 1.88 MSRV
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install minimum supported Rust
        uses: dtolnay/rust-toolchain@1.88.0

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Check minimum supported Rust
        run: cargo check --locked --all-targets --all-features

  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: "1.15.8"
          terraform_wrapper: false

      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Clippy
        run: cargo clippy --all-targets --all-features -- -D warnings

      - name: Run tests
        run: cargo test --locked --all-features --verbose

      - name: Build
        run: cargo build --locked --all-features --verbose

      - name: Install cargo-coupling
        run: cargo +stable install cargo-coupling --version 0.3.7 --locked

      - name: Install similarity-rs
        run: cargo +stable install similarity-rs --version 0.5.0 --locked

      - name: Check module coupling
        run: cargo coupling --check --min-grade B --max-critical 0 --max-circular 0 --fail-on high --max-deps 40

      - name: Check duplicate Rust functions
        run: similarity-rs src --skip-test --threshold 0.90 --min-lines 8 --fail-on-duplicates

      - name: Validate MCP Registry metadata
        run: jq . server.json

      - name: Package dry run
        run: cargo package --locked --allow-dirty

      - name: Publish dry run
        run: cargo publish --dry-run --locked --allow-dirty

  test-platform:
    name: Test on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt, clippy

      - name: Rust Cache
        uses: Swatinem/rust-cache@v2

      - name: Install Terraform
        uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: "1.15.8"
          terraform_wrapper: false

      - name: Test
        run: cargo test --locked --all-features

  security:
    name: Security audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: cargo install cargo-audit --version 0.22.2 --locked

      - name: Run security audit
        run: cargo audit

  coverage:
    name: Code coverage
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview

      - name: Install cargo-llvm-cov
        run: |
          curl -LsSf https://github.com/taiki-e/cargo-llvm-cov/releases/latest/download/cargo-llvm-cov-x86_64-unknown-linux-gnu.tar.gz | tar xzf - -C ~/.cargo/bin

      - name: Generate code coverage
        run: cargo llvm-cov --lcov --output-path lcov.info

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v5
        with:
          files: ./lcov.info
          fail_ci_if_error: false
          token: ${{ secrets.CODECOV_TOKEN }}

  container:
    name: Publish OCI image
    runs-on: ubuntu-latest
    needs: [msrv, check, test-platform, security]
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract OCI metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/nwiizo/tfmcp
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest

      - name: Build and publish OCI image
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            TFMCP_VERSION=${{ steps.meta.outputs.version }}
            TFMCP_REVISION=${{ github.sha }}

      - name: Verify versioned image
        run: docker buildx imagetools inspect "ghcr.io/nwiizo/tfmcp:${GITHUB_REF_NAME#v}"