Vlad MocanuandClaude Opus 4.6
b03ccb518c
- Add bot_email action input for custom git commit email on Forgejo - Update claude.yml to use CLAUDE_BOT_TOKEN with bot_id/bot_name/bot_email - Update git-config.ts to use provided email over noreply format - Add "Dedicated Bot User" setup guide to docs/forgejo.md - Update CLAUDE.md with bot identity documentation Infrastructure (done outside code): - claude-bot user created (ID 48, non-admin, with avatar) - Claude team with write access in all 12 orgs - CLAUDE_BOT_TOKEN org-level secret in all 12 orgs Progress: ~85% complete - pending E2E validation after merge Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
487 lines
15 KiB
TypeScript
487 lines
15 KiB
TypeScript
import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
|
|
import { prepareMcpConfig } from "../src/mcp/install-mcp-server";
|
|
import * as core from "@actions/core";
|
|
import type { ParsedGitHubContext } from "../src/github/context";
|
|
import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "../src/github/constants";
|
|
|
|
describe("prepareMcpConfig", () => {
|
|
let consoleInfoSpy: any;
|
|
let consoleWarningSpy: any;
|
|
let setFailedSpy: any;
|
|
let processExitSpy: any;
|
|
let fetchSpy: any;
|
|
|
|
// Create a mock context for tests
|
|
const mockContext: ParsedGitHubContext = {
|
|
runId: "test-run-id",
|
|
eventName: "issue_comment",
|
|
eventAction: "created",
|
|
repository: {
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
full_name: "test-owner/test-repo",
|
|
},
|
|
actor: "test-actor",
|
|
payload: {} as any,
|
|
entityNumber: 123,
|
|
isPR: false,
|
|
inputs: {
|
|
prompt: "",
|
|
triggerPhrase: "@claude",
|
|
assigneeTrigger: "",
|
|
labelTrigger: "",
|
|
branchPrefix: "",
|
|
useStickyComment: false,
|
|
useCommitSigning: false,
|
|
sshSigningKey: "",
|
|
botId: String(CLAUDE_APP_BOT_ID),
|
|
botName: CLAUDE_BOT_LOGIN,
|
|
botEmail: "",
|
|
allowedBots: "",
|
|
allowedNonWriteUsers: "",
|
|
trackProgress: false,
|
|
includeFixLinks: true,
|
|
includeCommentsByActor: "",
|
|
excludeCommentsByActor: "",
|
|
},
|
|
};
|
|
|
|
const mockPRContext: ParsedGitHubContext = {
|
|
...mockContext,
|
|
eventName: "pull_request",
|
|
isPR: true,
|
|
entityNumber: 456,
|
|
};
|
|
|
|
const mockContextWithSigning: ParsedGitHubContext = {
|
|
...mockContext,
|
|
inputs: {
|
|
...mockContext.inputs,
|
|
useCommitSigning: true,
|
|
},
|
|
};
|
|
|
|
beforeEach(() => {
|
|
consoleInfoSpy = spyOn(core, "info").mockImplementation(() => {});
|
|
consoleWarningSpy = spyOn(core, "warning").mockImplementation(() => {});
|
|
setFailedSpy = spyOn(core, "setFailed").mockImplementation(() => {});
|
|
processExitSpy = spyOn(process, "exit").mockImplementation(() => {
|
|
throw new Error("Process exit");
|
|
});
|
|
// Mock fetch so checkActionsReadPermission succeeds (returns 200 for actions API)
|
|
fetchSpy = spyOn(global, "fetch").mockResolvedValue(
|
|
new Response(JSON.stringify({ workflow_runs: [] }), { status: 200 }),
|
|
);
|
|
|
|
// Set up required environment variables
|
|
if (!process.env.GITHUB_ACTION_PATH) {
|
|
process.env.GITHUB_ACTION_PATH = "/test/action/path";
|
|
}
|
|
});
|
|
|
|
afterEach(() => {
|
|
consoleInfoSpy.mockRestore();
|
|
consoleWarningSpy.mockRestore();
|
|
setFailedSpy.mockRestore();
|
|
processExitSpy.mockRestore();
|
|
fetchSpy.mockRestore();
|
|
});
|
|
|
|
test("should return comment server when commit signing is disabled", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
context: mockContext,
|
|
mode: "tag",
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers).toBeDefined();
|
|
expect(parsed.mcpServers.github).not.toBeDefined();
|
|
expect(parsed.mcpServers.github_file_ops).not.toBeDefined();
|
|
expect(parsed.mcpServers.github_comment).toBeDefined();
|
|
expect(parsed.mcpServers.github_comment.env.GITHUB_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
});
|
|
|
|
test("should include file ops server when commit signing is enabled", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContextWithSigning,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers).toBeDefined();
|
|
expect(parsed.mcpServers.github).not.toBeDefined();
|
|
expect(parsed.mcpServers.github_file_ops).toBeDefined();
|
|
expect(parsed.mcpServers.github_file_ops.env.GITHUB_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
expect(parsed.mcpServers.github_file_ops.env.BRANCH_NAME).toBe(
|
|
"test-branch",
|
|
);
|
|
});
|
|
|
|
test("should include github MCP server when mcp__github__ tools are allowed", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: ["mcp__github__create_issue", "mcp__github__create_pr"],
|
|
mode: "tag",
|
|
context: mockContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers).toBeDefined();
|
|
expect(parsed.mcpServers.github).toBeDefined();
|
|
expect(parsed.mcpServers.github.command).toBe("docker");
|
|
expect(parsed.mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
});
|
|
|
|
test("should include inline comment server for PRs when tools are allowed", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: ["mcp__github_inline_comment__create_inline_comment"],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers).toBeDefined();
|
|
expect(parsed.mcpServers.github_inline_comment).toBeDefined();
|
|
expect(parsed.mcpServers.github_inline_comment.env.GITHUB_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
expect(parsed.mcpServers.github_inline_comment.env.PR_NUMBER).toBe("456");
|
|
});
|
|
|
|
test("should include comment server when no GitHub tools are allowed and signing disabled", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers).toBeDefined();
|
|
expect(parsed.mcpServers.github).not.toBeDefined();
|
|
expect(parsed.mcpServers.github_file_ops).not.toBeDefined();
|
|
expect(parsed.mcpServers.github_comment).toBeDefined();
|
|
});
|
|
|
|
test("should set GITHUB_ACTION_PATH correctly", async () => {
|
|
process.env.GITHUB_ACTION_PATH = "/test/action/path";
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContextWithSigning,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_file_ops.args).toContain(
|
|
"/test/action/path/src/mcp/github-file-ops-server.ts",
|
|
);
|
|
});
|
|
|
|
test("should use current working directory when GITHUB_WORKSPACE is not set", async () => {
|
|
delete process.env.GITHUB_WORKSPACE;
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContextWithSigning,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_file_ops.env.REPO_DIR).toBe(process.cwd());
|
|
});
|
|
|
|
test("should include CI server when context.isPR is true and DEFAULT_WORKFLOW_TOKEN exists", async () => {
|
|
process.env.DEFAULT_WORKFLOW_TOKEN = "workflow-token";
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_ci).toBeDefined();
|
|
expect(parsed.mcpServers.github_ci.env.GITHUB_TOKEN).toBe("workflow-token");
|
|
expect(parsed.mcpServers.github_ci.env.PR_NUMBER).toBe("456");
|
|
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
});
|
|
|
|
test("should not include github_ci server when context.isPR is false", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_ci).not.toBeDefined();
|
|
});
|
|
|
|
test("should not include github_ci server when actions:read permission is missing", async () => {
|
|
process.env.DEFAULT_WORKFLOW_TOKEN = "workflow-token";
|
|
// Simulate 403 from actions API
|
|
fetchSpy.mockResolvedValue(
|
|
new Response(
|
|
JSON.stringify({ message: "Resource not accessible by integration" }),
|
|
{ status: 403 },
|
|
),
|
|
);
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_ci).not.toBeDefined();
|
|
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
});
|
|
|
|
test("should not include github_ci server when DEFAULT_WORKFLOW_TOKEN is missing", async () => {
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_ci).not.toBeDefined();
|
|
});
|
|
|
|
describe("Forgejo platform routing", () => {
|
|
let savedPlatform: string | undefined;
|
|
let savedForgejo: string | undefined;
|
|
let savedServerUrl: string | undefined;
|
|
|
|
beforeEach(() => {
|
|
savedPlatform = process.env.PLATFORM;
|
|
savedForgejo = process.env.FORGEJO;
|
|
savedServerUrl = process.env.GITHUB_SERVER_URL;
|
|
// Set platform to forgejo for all tests in this block
|
|
process.env.PLATFORM = "forgejo";
|
|
});
|
|
|
|
afterEach(() => {
|
|
if (savedPlatform !== undefined) {
|
|
process.env.PLATFORM = savedPlatform;
|
|
} else {
|
|
delete process.env.PLATFORM;
|
|
}
|
|
if (savedForgejo !== undefined) {
|
|
process.env.FORGEJO = savedForgejo;
|
|
} else {
|
|
delete process.env.FORGEJO;
|
|
}
|
|
if (savedServerUrl !== undefined) {
|
|
process.env.GITHUB_SERVER_URL = savedServerUrl;
|
|
} else {
|
|
delete process.env.GITHUB_SERVER_URL;
|
|
}
|
|
});
|
|
|
|
test("should skip GitHub public MCP server on Forgejo", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: ["mcp__github__create_issue", "mcp__github__create_pr"],
|
|
mode: "tag",
|
|
context: mockContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
// The Docker-based GitHub MCP server should NOT be included on Forgejo
|
|
expect(parsed.mcpServers.github).not.toBeDefined();
|
|
});
|
|
|
|
test("should include CI server on Forgejo without permission check", async () => {
|
|
process.env.DEFAULT_WORKFLOW_TOKEN = "forgejo-workflow-token";
|
|
// Simulate a 403 from the permission check — on Forgejo this should be
|
|
// skipped entirely, so the CI server is still included.
|
|
fetchSpy.mockResolvedValue(
|
|
new Response(
|
|
JSON.stringify({
|
|
message: "Resource not accessible by integration",
|
|
}),
|
|
{ status: 403 },
|
|
),
|
|
);
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
// CI server should be included on Forgejo even though the permission
|
|
// check would fail — the check is skipped entirely.
|
|
expect(parsed.mcpServers.github_ci).toBeDefined();
|
|
expect(parsed.mcpServers.github_ci.env.GITHUB_TOKEN).toBe(
|
|
"forgejo-workflow-token",
|
|
);
|
|
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
});
|
|
|
|
test("should not call checkActionsReadPermission on Forgejo", async () => {
|
|
process.env.DEFAULT_WORKFLOW_TOKEN = "forgejo-workflow-token";
|
|
fetchSpy.mockClear();
|
|
|
|
await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
// fetch should not have been called — the permission check is skipped
|
|
expect(fetchSpy).not.toHaveBeenCalled();
|
|
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
});
|
|
|
|
test("should keep server names as github_* on Forgejo", async () => {
|
|
process.env.DEFAULT_WORKFLOW_TOKEN = "forgejo-workflow-token";
|
|
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: {
|
|
...mockPRContext,
|
|
inputs: { ...mockPRContext.inputs, useCommitSigning: true },
|
|
},
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
// Server names must stay as github_* to match hardcoded tool names
|
|
expect(parsed.mcpServers.github_comment).toBeDefined();
|
|
expect(parsed.mcpServers.github_file_ops).toBeDefined();
|
|
expect(parsed.mcpServers.github_ci).toBeDefined();
|
|
|
|
delete process.env.DEFAULT_WORKFLOW_TOKEN;
|
|
});
|
|
|
|
test("should include comment server on Forgejo in tag mode", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: [],
|
|
mode: "tag",
|
|
context: mockContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_comment).toBeDefined();
|
|
expect(parsed.mcpServers.github_comment.env.GITHUB_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
});
|
|
|
|
test("should include inline comment server on Forgejo for PRs", async () => {
|
|
const result = await prepareMcpConfig({
|
|
githubToken: "test-token",
|
|
owner: "test-owner",
|
|
repo: "test-repo",
|
|
branch: "test-branch",
|
|
baseBranch: "main",
|
|
allowedTools: ["mcp__github_inline_comment__create_inline_comment"],
|
|
mode: "tag",
|
|
context: mockPRContext,
|
|
});
|
|
|
|
const parsed = JSON.parse(result);
|
|
expect(parsed.mcpServers.github_inline_comment).toBeDefined();
|
|
expect(parsed.mcpServers.github_inline_comment.env.GITHUB_TOKEN).toBe(
|
|
"test-token",
|
|
);
|
|
});
|
|
});
|
|
});
|