PSGO-268: TypeScript rewrite — Phase 0 scaffold

.dockerignore

@@ -0,0 +1,25 @@
+node_modules
+dist
+.git
+.github
+__tests__
+tests
+src/keboola_mcp_server
+3.10.venv
+3.12.venv
+.venv
+.tox
+.mypy_cache
+.pytest_cache
+*.venv
+coverage.xml
+.coverage
+test-results.xml
+feature_spec
+docs
+*.md
+!README.md
+.env
+.mcp.json
+uv.lock
+pyproject.toml

.github/actions/export-kbc-projects/action.yml

@@ -0,0 +1,30 @@
+name: 'Export kbc projects with secrets'
+description: 'Generates projects.json from .github/ci/projects.json, substituting TEST_KBC_PROJECT_* secrets'
+inputs:
+  secrets:
+    description: workflow secrets (pass `toJSON(secrets)`)
+    required: true
+outputs:
+  projects-file:
+    description: Absolute path to the generated projects.json
+    value: ${{ steps.gen.outputs.projects-file }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Generate projects.json file, replace secrets
+      id: gen
+      shell: bash
+      run: |
+        # Export every TEST_KBC_PROJECT_* secret as an env var, then envsubst the template.
+        jqQuery='to_entries[] | select(.key | startswith("TEST_KBC_PROJECT_")) | "\(.key)=\(.value|tostring) "'
+        export $(
+        (jq -r -j "$jqQuery") << EndOfSecrets
+          ${{ inputs.secrets }}
+        EndOfSecrets
+        )
+
+        envsubst < .github/ci/projects.json > projects.json
+
+        # Stable mtime so test caching is not invalidated by regeneration.
+        touch -d '1970-01-01T00:00:01' projects.json
+        echo "projects-file=$(pwd)/projects.json" >> "$GITHUB_OUTPUT"

.github/ci/projects.json

@@ -0,0 +1,37 @@
+[
+  {
+    "host": "connection.europe-west3.gcp.keboola.com",
+    "project": 3053,
+    "stagingStorage": "gcs",
+    "backend": "snowflake",
+    "token": "$TEST_KBC_PROJECT_3053_TOKEN"
+  },
+  {
+    "host": "connection.europe-west3.gcp.keboola.com",
+    "project": 3054,
+    "stagingStorage": "gcs",
+    "backend": "snowflake",
+    "token": "$TEST_KBC_PROJECT_3054_TOKEN"
+  },
+  {
+    "host": "connection.europe-west3.gcp.keboola.com",
+    "project": 3056,
+    "stagingStorage": "gcs",
+    "backend": "bigquery",
+    "token": "$TEST_KBC_PROJECT_3056_TOKEN"
+  },
+  {
+    "host": "connection.europe-west3.gcp.keboola.com",
+    "project": 3057,
+    "stagingStorage": "gcs",
+    "backend": "bigquery",
+    "token": "$TEST_KBC_PROJECT_3057_TOKEN"
+  },
+  {
+    "host": "connection.europe-west3.gcp.keboola.com",
+    "project": 3055,
+    "stagingStorage": "gcs",
+    "backend": "snowflake",
+    "token": "$TEST_KBC_PROJECT_3055_TOKEN"
+  }
+]

.github/dependabot.yml

@@ -4,13 +4,11 @@
 # Cooldown (supply-chain hardening): Dependabot will not open an update PR for a
 # version until it has been published for at least `default-days` days. Most
 # malicious package releases are detected and yanked within this window, so we
-# avoid pulling a freshly published (potentially compromised) version. This
-# mirrors the `exclude-newer = "7 days"` setting in pyproject.toml [tool.uv],
-# which guards manual `uv lock` regeneration.
+# avoid pulling a freshly published (potentially compromised) version.
 version: 2
 updates:
-  # Python dependencies managed via uv / pyproject.toml + uv.lock
-  - package-ecosystem: "uv"
+  # npm dependencies managed via package.json + package-lock.json
+  - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"