chore(template): sync from mcp-ecosystem#3
Conversation
There was a problem hiding this comment.
Pull request overview
Syncs shared repo baselines from verygoodplugins/mcp-ecosystem by adding standardized JS/TS tooling config (lint/test/format) and GitHub automation, plus aligning dependency versions to the shared template.
Changes:
- Add Vitest, ESLint (flat config), and Prettier configuration files.
- Add GitHub workflows for CI, security scanning, release automation, PR title validation, and Dependabot auto-merge.
- Update runtime/dev dependency baselines in
package.json.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
vitest.config.ts |
Adds Vitest config with V8 coverage settings. |
package.json |
Bumps baseline deps (SDK/dotenv/zod/typescript/tsx/etc.). |
eslint.config.mjs |
Adds ESLint flat config with TypeScript rules and console restrictions. |
.prettierrc |
Adds Prettier formatting defaults. |
.github/workflows/security.yml |
Adds CodeQL + dependency audit workflow. |
.github/workflows/release-please.yml |
Adds release-please + trusted npm publish workflow. |
.github/workflows/pr-title.yml |
Enforces Conventional Commit PR titles. |
.github/workflows/dependabot-auto-merge.yml |
Auto-approves/auto-merges Dependabot PRs under conditions. |
.github/workflows/ci.yml |
Adds CI running install, lint, build, test, coverage. |
.github/dependabot.yml |
Adds Dependabot config with grouping/ignore rules. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| run: npm run lint | ||
|
|
||
| - name: Build | ||
| run: npm run build | ||
|
|
||
| - name: Test | ||
| run: npm test | ||
|
|
||
| - name: Test coverage | ||
| run: npm run test:coverage | ||
| continue-on-error: true |
There was a problem hiding this comment.
This workflow runs npm run lint, npm test, and npm run test:coverage, but package.json currently doesn't define lint, test, or test:coverage scripts. This will cause CI to fail with "Missing script" errors unless those scripts (and their toolchain deps) are added.
| run: npm run lint | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| run: npm test | |
| - name: Test coverage | |
| run: npm run test:coverage | |
| continue-on-error: true | |
| run: npm run lint --if-present | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| run: npm run test --if-present | |
| - name: Test coverage | |
| run: npm run test:coverage --if-present |
| manifest-file: ".release-please-manifest.json" | ||
| config-file: "release-please-config.json" |
There was a problem hiding this comment.
The manifest-file and config-file referenced here do not exist in the repository (.release-please-manifest.json, release-please-config.json). release-please-action will fail at runtime unless these files are added or the workflow is switched to non-manifest configuration.
| manifest-file: ".release-please-manifest.json" | |
| config-file: "release-please-config.json" | |
| release-type: "node" |
| coverage: { | ||
| provider: 'v8', | ||
| reporter: ['text', 'json', 'html'], | ||
| exclude: ['node_modules/', 'dist/', 'tests/', '*.config.*'], |
There was a problem hiding this comment.
Coverage excludes dist/, but this repo’s build output directory is build/ (see .gitignore). Consider excluding build/ instead (or in addition) so generated JS doesn’t affect coverage results.
| exclude: ['node_modules/', 'dist/', 'tests/', '*.config.*'], | |
| exclude: ['node_modules/', 'dist/', 'build/', 'tests/', '*.config.*'], |
| files: ['src/**/*.ts'], | ||
| rules: { | ||
| // MCP stdio servers must not write to stdout outside the protocol. | ||
| 'no-console': ['error', { allow: ['error', 'warn'] }], | ||
| // Allow unused vars prefixed with underscore |
There was a problem hiding this comment.
no-console is enforced for all src/**/*.ts with only error/warn allowed, but src/cli.ts uses console.log for normal CLI output. This will make lint fail once wired up. Consider scoping the stricter no-console rule to the stdio server entrypoint (e.g., src/server.ts) or adding an override/exception for src/cli.ts.
| "devDependencies": { | ||
| "@types/fs-extra": "^11.0.4", | ||
| "@types/node": "^22.10.0", | ||
| "@types/node": "^22.10.5", | ||
| "rimraf": "^5.0.5", | ||
| "tsx": "^4.7.1", | ||
| "typescript": "^5.3.3" | ||
| "tsx": "^4.19.2", | ||
| "typescript": "^5.7.3" |
There was a problem hiding this comment.
The repo now includes ESLint/Vitest/Prettier configs and CI runs npm run lint/npm test/npm run test:coverage, but the required toolchain deps are not listed here (e.g., eslint, @eslint/js, typescript-eslint, vitest, @vitest/coverage-v8, etc.). As-is, installs/tests in CI will fail once those scripts are added (and vitest/config / @eslint/js imports will be unresolved). Add the missing devDependencies (and corresponding npm scripts) or remove the configs/workflow steps that rely on them.
Sync shared workflow/config/template baselines from
verygoodplugins/mcp-ecosystem.04bc3912026-04-22scripts/apply-templates.sh --forcescripts/sync-template-baseline.mjsThis PR is generated from the ecosystem source of truth to reduce per-repo Dependabot drift.