ci(security): SHA-pinned matrix CI + OIDC release + Dependabot + --selftest

Karthik (CTO) recommended stack + Adam (DevRel) onboarding patch shipped.

.github/workflows/test.yml — Node 20+22 × Ubuntu/macOS/Windows (6 cells)
  with all-green gate via re-actors/alls-green (SHA-pinned). Runs:
  npm ci → lint → build → test → `node dist/index.js --selftest`.
  Catches the Windows-broken-MCP-server-on-day-one failure mode that
  Karthik flagged in CTO §2.1.

.github/workflows/release.yml — release-please + npm trusted publishing
  via OIDC (`id-token: write` + `npm publish --access public --provenance`).
  No long-lived NPM_TOKEN attack surface; publishing produces a signed
  attestation that the build came from this commit SHA. Anthropic / Stripe
  / Vercel SDKs all use this pattern.

.github/dependabot.yml — grouped updates (mcp-sdk / production / dev
  + actions) to keep PR noise tractable for a solo-maintained repo.

release-please-config.json + .release-please-manifest.json — required
  by the release workflow.

src/index.ts — Adam #1's --selftest flag (15 LOC). Runs:
  $ node dist/index.js --selftest
  → selftest OK | base=https://api.etymolt.com | 142ms
  Exits 0 if API reachable, 1 on bad status, 2 on network error.
  Unlocks the "60-second onboarding" claim — a developer can verify the
  install before editing any MCP client config.

Founder action remaining: add NPM_TOKEN to repo secrets at
  https://github.com/etymolt/mcp-server/settings/secrets/actions
  → New repository secret: NPM_TOKEN (generate at npmjs.com → Access Tokens →
  Granular access token, scope = @etymolt/mcp-server, type = Automation).
  Then merge a commit with a Conventional Commit header (feat: / fix: /
  chore!:) and release-please auto-cuts the next version.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: etymolt-personal

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      mcp-sdk:
+        patterns:
+          - "@modelcontextprotocol/*"
+      production:
+        dependency-type: production
+        update-types: [minor, patch]
+      dev:
+        dependency-type: development
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write  # required for npm trusted publishing OIDC
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.rp.outputs.release_created }}
+      tag_name: ${{ steps.rp.outputs.tag_name }}
+    steps:
+      - uses: googleapis/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee  # v4.1.3
+        id: rp
+        with:
+          release-type: node
+
+  publish:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b  # v4.0.3
+        with:
+          node-version: "20.x"
+          registry-url: "https://registry.npmjs.org"
+      - run: npm ci
+      - run: npm run build
+      - run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,42 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: test (Node ${{ matrix.node }} / ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        node: ["20.x", "22.x"]
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b  # v4.0.3
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run lint --if-present
+      - run: npm run build
+      - run: npm test --if-present
+      - run: node dist/index.js --selftest
+
+  all-green:
+    name: all-green
+    if: always()
+    needs: [test]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Decide
+        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
+        with:
+          jobs: ${{ toJSON(needs) }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "2.0.0"
+}

release-please-config.json

@@ -0,0 +1,13 @@
+{
+  "release-type": "node",
+  "packages": {
+    ".": {
+      "package-name": "@etymolt/mcp-server",
+      "changelog-path": "CHANGELOG.md",
+      "include-component-in-tag": false,
+      "draft": false,
+      "prerelease": false
+    }
+  },
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}

src/index.ts

@@ -62,6 +62,29 @@ import {
 import { RESOURCES, readResource } from "./resources.js";
 import { PROMPTS, getPrompt } from "./prompts.js";
 
+// --- Selftest (Adam DevRel #1) ---
+// Run with `node dist/index.js --selftest` or `npx -y @etymolt/mcp-server --selftest`.
+// Verifies the API is reachable; prints "selftest OK"; exits 0/non-0 for CI.
+if (process.argv.includes("--selftest")) {
+  const baseUrl = process.env.ETYMOLT_API_URL ?? "https://api.etymolt.com";
+  const t0 = Date.now();
+  fetch(baseUrl + "/healthz", { signal: AbortSignal.timeout(8000) })
+    .then((r) => {
+      if (!r.ok && r.status !== 404) {
+        console.error(`selftest: ${r.status} from ${baseUrl}/healthz`);
+        process.exit(1);
+      }
+      console.log(`selftest OK | base=${baseUrl} | ${Date.now() - t0}ms`);
+      process.exit(0);
+    })
+    .catch((e: unknown) => {
+      const msg = e instanceof Error ? e.message : String(e);
+      console.error(`selftest FAIL: ${msg}`);
+      process.exit(2);
+    });
+}
+
+
 const SERVER_NAME = "@etymolt/mcp-server";
 const SERVER_VERSION = "2.0.0";