ci: SHA-pinned matrix + OIDC release + Dependabot + --selftest

.github/dependabot.yml

@@ -2,25 +2,20 @@ version: 2
 updates:
   - package-ecosystem: npm
     directory: "/"
-    schedule:
-      interval: weekly
-      day: monday
+    schedule: { interval: weekly, day: monday }
     open-pull-requests-limit: 5
     groups:
       mcp-sdk:
-        patterns:
-          - "@modelcontextprotocol/*"
+        patterns: ["@modelcontextprotocol/*"]
       production:
         dependency-type: production
         update-types: [minor, patch]
       dev:
         dependency-type: development
         update-types: [minor, patch]
-
   - package-ecosystem: github-actions
     directory: "/"
-    schedule:
-      interval: weekly
+    schedule: { interval: weekly }
     open-pull-requests-limit: 3
     groups:
       actions:

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
-  id-token: write  # required for npm trusted publishing OIDC
+  id-token: write
 
 jobs:
   release-please:

.github/workflows/test.yml

@@ -36,7 +36,6 @@ jobs:
     needs: [test]
     runs-on: ubuntu-latest
     steps:
-      - name: Decide
-        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
+      - uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe  # v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}

.release-please-manifest.json

@@ -1,3 +1 @@
-{
-  ".": "2.0.0"
-}
+{ ".": "2.0.0" }

release-please-config.json

@@ -4,9 +4,7 @@
     ".": {
       "package-name": "@etymolt/mcp-server",
       "changelog-path": "CHANGELOG.md",
-      "include-component-in-tag": false,
-      "draft": false,
-      "prerelease": false
+      "include-component-in-tag": false
     }
   },
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"

src/index.ts

@@ -62,6 +62,30 @@ import {
 import { RESOURCES, readResource } from "./resources.js";
 import { PROMPTS, getPrompt } from "./prompts.js";
 
+// --- Selftest (Adam DevRel) ---
+// `node dist/index.js --selftest` or `npx -y @etymolt/mcp-server --selftest`.
+// Verifies the API is reachable; prints "selftest OK"; exits 0/non-0 for CI.
+// Unlocks the README's "60-second onboarding" claim.
+if (process.argv.includes("--selftest")) {
+  const baseUrl = process.env.ETYMOLT_API_URL ?? "https://api.etymolt.com";
+  const t0 = Date.now();
+  fetch(baseUrl + "/healthz", { signal: AbortSignal.timeout(8000) })
+    .then((r) => {
+      if (!r.ok && r.status !== 404) {
+        console.error(`selftest: ${r.status} from ${baseUrl}/healthz`);
+        process.exit(1);
+      }
+      console.log(`selftest OK | base=${baseUrl} | ${Date.now() - t0}ms`);
+      process.exit(0);
+    })
+    .catch((e: unknown) => {
+      const msg = e instanceof Error ? e.message : String(e);
+      console.error(`selftest FAIL: ${msg}`);
+      process.exit(2);
+    });
+}
+
+
 // --- Selftest (Adam DevRel #1) ---
 // Run with `node dist/index.js --selftest` or `npx -y @etymolt/mcp-server --selftest`.
 // Verifies the API is reachable; prints "selftest OK"; exits 0/non-0 for CI.