maintainer-action: measure the two MCP tool pins of connector-github on a local machine and post the output (unblocks #28647) #30116

// Measure the toolsSnapshot pins of packages/apps/connector-github (#28647).
// Node >= 18, no dependencies. Reads the token from GITHUB_MCP_TOKEN and never prints it.
import { createHash } from 'node:crypto';

const URL_ = process.env.MCP_URL ?? 'https://api.githubcopilot.com/mcp/';
const INCLUDE = ['search_issues', 'issue_read'];
const token = process.env.GITHUB_MCP_TOKEN;
if (!token) { console.error('GITHUB_MCP_TOKEN is not set'); process.exit(2); }

// The same canonical JSON and digest as packages/connectors/connector-mcp/src/tool-snapshot.ts.
const canonicalJson = (v) => {
  if (Array.isArray(v)) return `[${v.map((e) => (e === undefined ? 'null' : canonicalJson(e))).join(',')}]`;
  if (v !== null && typeof v === 'object') {
    return `{${Object.keys(v).filter((k) => v[k] !== undefined).sort()
      .map((k) => `${JSON.stringify(k)}:${canonicalJson(v[k])}`).join(',')}}`;
  }
  return JSON.stringify(v);
};
const digest = (t) => createHash('sha256')
  .update(canonicalJson({ name: t.name, description: t.description, inputSchema: t.inputSchema }), 'utf8')
  .digest('hex');

let sessionId; let nextId = 1;
async function rpc(method, params, notify = false) {
  const headers = {
    'content-type': 'application/json',
    accept: 'application/json, text/event-stream',
    authorization: `Bearer ${token}`,
    'x-mcp-readonly': 'true',
  };
  if (sessionId) headers['mcp-session-id'] = sessionId;
  const id = notify ? undefined : nextId++;
  const res = await fetch(URL_, { method: 'POST', headers, body: JSON.stringify({ jsonrpc: '2.0', method, params, ...(notify ? {} : { id }) }) });
  sessionId = res.headers.get('mcp-session-id') ?? sessionId;
  if (notify) return undefined;
  if (!res.ok) { console.error(`${method}: HTTP ${res.status}`); process.exit(3); }
  const text = await res.text();
  const bodies = (res.headers.get('content-type') ?? '').includes('text/event-stream')
    ? text.split(/\r?\n/).filter((l) => l.startsWith('data:')).map((l) => l.slice(5).trim()).filter(Boolean)
    : [text];
  const msg = bodies.map((b) => JSON.parse(b)).find((m) => m.id === id);
  if (!msg) { console.error(`${method}: no response with id ${id}`); process.exit(3); }
  if (msg.error) { console.error(`${method}: ${JSON.stringify(msg.error)}`); process.exit(3); }
  return msg.result;
}

await rpc('initialize', { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'objectstack-pin-measure', version: '1' } });
await rpc('notifications/initialized', undefined, true);
const tools = []; let cursor;
do { const r = await rpc('tools/list', cursor ? { cursor } : {}); tools.push(...(r.tools ?? [])); cursor = r.nextCursor; } while (cursor);

const picked = INCLUDE.map((n) => tools.find((t) => t.name === n));
const missing = INCLUDE.filter((n, i) => !picked[i]);
if (missing.length) { console.error(`not listed for this token: ${missing.join(', ')} (served ${tools.length} tools) — the token is under-scoped`); process.exit(4); }

console.log(JSON.stringify({
  measuredAt: new Date().toISOString(),
  url: URL_,
  headers: { 'X-MCP-Readonly': 'true' },
  toolsSnapshot: Object.fromEntries(picked.map((t) => [t.name, digest(t)])),
  tools: picked.map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema })),
}, null, 2));