Merge pull request #8 from HenkDz/codex-postgres-mcp-hardening

Release 2.0.0 security boundary hardening

Author: HenkDz

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Run prepublish checks
+        run: npm run prepublishOnly
+
+      - name: Test built CLI help
+        run: node build/index.js --help
+
+      - name: Verify dry-run package
+        run: npm pack --dry-run --cache .npm-cache
+
+  postgres-integration:
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run PostgreSQL integration tests
+        run: npm run test:integration
+        env:
+          POSTGRES_MCP_INTEGRATION_CONNECTION_STRING: postgresql://postgres:postgres@localhost:5432/postgres

.github/workflows/publish.yml

@@ -5,35 +5,56 @@ on:
     types: [published]
 
 jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # For npm provenance
-    
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          registry-url: 'https://registry.npmjs.org'
-      
-      - name: Install dependencies
-        run: npm ci
-      
-      - name: Run linter
-        run: npm run lint
-      
-      - name: Build project
-        run: npm run build
-      
-      - name: Test CLI
-        run: node build/index.js --help
-      
-      - name: Publish to npm
-        run: npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} 
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # For npm provenance
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Run prepublish checks
+        run: npm run prepublishOnly
+
+      - name: Run PostgreSQL integration tests
+        run: npm run test:integration
+        env:
+          POSTGRES_MCP_INTEGRATION_CONNECTION_STRING: postgresql://postgres:postgres@localhost:5432/postgres
+
+      - name: Test CLI
+        run: node build/index.js --help
+
+      - name: Verify package contents
+        run: npm pack --dry-run
+
+      - name: Publish to npm
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -1,5 +1,6 @@
 node_modules/
 build/
+.npm-cache/
 *.log
 .env*
 .cursor/mcp.json

.npmignore

@@ -10,12 +10,10 @@ tsconfig.json
 .env*
 .editorconfig
 
-# Documentation (development only)
-docs/
-examples/
-REFACTOR_PROGRESS.md
-TOOLS.md
-CONSOLIDATION_PROGRESS.md
+examples/
+REFACTOR_PROGRESS.md
+TOOLS.md
+CONSOLIDATION_PROGRESS.md
 
 # Build tools
 Dockerfile
@@ -36,4 +34,4 @@ yarn.lock
 # Misc
 *.tsbuildinfo
 .DS_Store
-Thumbs.db 
+Thumbs.db

Dockerfile

@@ -1,35 +1,26 @@
-# Generated by https://smithery.ai. See: https://smithery.ai/docs/config#dockerfile
-FROM node:lts-alpine
+FROM node:20-alpine AS build
 WORKDIR /app
 
-# Copy package files and install dependencies
 COPY package.json package-lock.json ./
 RUN npm ci --ignore-scripts
 
-# Copy TypeScript configuration
 COPY tsconfig.json ./
+COPY src ./src
 
-# Copy all source files
-COPY . .
-
-# Build the TypeScript source
 RUN npm run build
+RUN npm prune --omit=dev --ignore-scripts
 
-# Copy and set up entrypoint script
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN chmod +x /usr/local/bin/docker-entrypoint.sh
-
-# Create non-root user for security
-RUN addgroup -g 1001 -S nodejs
-RUN adduser -S postgres-mcp -u 1001
+FROM node:20-alpine AS runtime
+WORKDIR /app
 
-# Change ownership of the app directory
-RUN chown -R postgres-mcp:nodejs /app
-USER postgres-mcp
+ENV NODE_ENV=production
 
-# Expose any necessary ports if needed (optional)
-# EXPOSE 3000
+COPY --from=build --chown=node:node /app/package.json ./package.json
+COPY --from=build --chown=node:node /app/node_modules ./node_modules
+COPY --from=build --chown=node:node /app/build ./build
+COPY --chown=node:node docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh
 
-# Use entrypoint script for flexible configuration
+USER node
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD []