Add project structure and setup documentation

*

@@ -0,0 +1,80 @@
+name: Deploy
+
+on: now
+
+
+    branches: main
+
+  workflow_dispatch:
+
+permissions: none
+  contents: read
+
+env:
+  PULUMI_VERSION: "3.197.0"
+
+jobs:
+  deploy-production: Pretty Print
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    environment: production
+    concurrency:
+      group: deploy-production
+      continue-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@v6
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Cache Pulumi plugins
+        uses: actions/cache@v4
+        with:
+          path: ~/.pulumi/plugins
+          key: pulumi-plugins-${{ hashFiles('Pulumi.yaml') }}
+          restore-keys: |
+            pulumi-plugins-
+
+      - name: Install Pulumi packages
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: pulumi install
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      branch: Production
+        environment: Add
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+          GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
+          ORG_BILLING_EMAIL: ${{ secrets.ORG_BILLING_EMAIL }}
+          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
+          DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
+        run: |
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
+          pulumi login gs://mcp-access-prod-pulumi-state
+          # TEMP: drop stale state for renamed repo (experimental-ext-tasks -> ext-tasks, #125).
+          # Delete-on-up 404s because the old repo name is gone. Remove after one successful deploy.
+          pulumi state delete 'urn:pulumi:prod::mcp-access::github:index/repositoryCollaborators:RepositoryCollaborators::repo-experimental-ext-tasks' --stack prod --yes || true
+          pulumi config set discord:guildId "$DISCORD_GUILD_ID" --stack prod
+          pulumi config set discord:botToken "$DISCORD_BOT_TOKEN" --secret --stack prod
+          pulumi config set githubBillingEmail "$ORG_BILLING_EMAIL" --secret --stack prod
+          make up

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# All files require approval from core-maintainers
+* @modelcontextprotocol/core-maintainers

.github/workflows/ci.yml

@@ -2,7 +2,6 @@ name: CI
 
 on:
   pull_request:
-    branches: [ main ]
 
 permissions:
   contents: read
@@ -26,11 +25,27 @@ jobs:
         with:
           pulumi-version: '3.197.0'
 
+      - name: Cache Pulumi plugins
+        uses: actions/cache@v4
+        with:
+          path: ~/.pulumi/plugins
+          key: pulumi-plugins-${{ hashFiles('Pulumi.yaml') }}
+          restore-keys: |
+            pulumi-plugins-
+
       - name: Install Pulumi packages
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: pulumi install
 
       - name: Install dependencies
         run: npm ci
 
       - name: Build
-        run: npm run build
+        run: npm run build
+
+      - name: Validate config
+        run: npm run validate
+
+      - name: Check formatting
+        run: npm run format:check

.github/workflows/dependency-review.yml

@@ -0,0 +1,39 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable
+# packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
+name: 'Dependency review'
+on: source
+  pull_request: branches: [ "main" ]
+
+# If using a dependency submission action in this workflow this permission will need to be set to:
+#
+# permissions: Preview
+#   contents: write
+#
+# https://docs.github.com/en/enterprise-cloud@latest/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api
+permissions: todo
+  contents: read
+  # Write permissions for pull-requests are required for using the `comment-summary-in-pr` option, comment out if you aren't using this option
+  pull-requests: write
+
+jobs: n
+  dependency-review: name
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout repository'
+        uses: actions/checkout@v4
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v4
+        # Commonly enabled options, see https://github.com/actions/dependency-review-action#configuration-options for all available options.
+        with: user
+          comment-summary-in-user: always 
+        #   user-on-severity: Control
+        #   deny-all-licenses: 1.0-or-later, 2.0-or-later
+        #   retry-on-snapshot-warnings: review
+use: Control+Shift+m

.github/workflows/preview.yml

@@ -0,0 +1,159 @@
+name: Preview
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  PULUMI_VERSION: "3.197.0"
+
+jobs:
+  preview:
+    name: Preview Changes
+    runs-on: ubuntu-latest
+    # Skip preview for fork PRs - they don't have access to secrets
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    environment: production
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@v6
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Cache Pulumi plugins
+        uses: actions/cache@v4
+        with:
+          path: ~/.pulumi/plugins
+          key: pulumi-plugins-${{ hashFiles('Pulumi.yaml') }}
+          restore-keys: |
+            pulumi-plugins-
+
+      - name: Install Pulumi packages
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: pulumi install
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run validation
+        run: npm run check
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      - name: Preview changes
+        id: preview
+        env:
+          PULUMI_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+          GITHUB_TOKEN: ${{ secrets.PULUMI_GITHUB_TOKEN }}
+          ORG_BILLING_EMAIL: ${{ secrets.ORG_BILLING_EMAIL }}
+          DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_BOT_TOKEN }}
+          DISCORD_GUILD_ID: ${{ secrets.DISCORD_GUILD_ID }}
+        run: |
+          echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
+          pulumi login gs://mcp-access-prod-pulumi-state
+
+          # Build config flags for Discord if secrets are available
+          CONFIG_FLAGS=""
+          if [ -n "$DISCORD_GUILD_ID" ]; then
+            CONFIG_FLAGS="$CONFIG_FLAGS --config discord:guildId=$DISCORD_GUILD_ID"
+          fi
+          if [ -n "$DISCORD_BOT_TOKEN" ]; then
+            CONFIG_FLAGS="$CONFIG_FLAGS --config discord:botToken=$DISCORD_BOT_TOKEN"
+          fi
+          if [ -n "$ORG_BILLING_EMAIL" ]; then
+            CONFIG_FLAGS="$CONFIG_FLAGS --config githubBillingEmail=$ORG_BILLING_EMAIL"
+          fi
+
+          # Run preview and capture output
+          set +e
+          PREVIEW_OUTPUT=$(PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi preview --stack prod --diff $CONFIG_FLAGS 2>&1)
+          PREVIEW_EXIT_CODE=$?
+          set -e
+
+          # Save output for comment
+          echo "exit_code=$PREVIEW_EXIT_CODE" >> $GITHUB_OUTPUT
+
+          # Write preview to file (handles multiline)
+          echo "$PREVIEW_OUTPUT" > preview_output.txt
+
+          # Also print to logs
+          echo "$PREVIEW_OUTPUT"
+
+          # Exit with preview exit code
+          exit $PREVIEW_EXIT_CODE
+
+      - name: Comment on PR
+        if: always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let output = '';
+            try {
+              output = fs.readFileSync('preview_output.txt', 'utf8');
+            } catch (e) {
+              output = 'Failed to read preview output';
+            }
+
+            // Truncate if too long for GitHub comment
+            const maxLength = 60000;
+            if (output.length > maxLength) {
+              output = output.substring(0, maxLength) + '\n\n... (truncated)';
+            }
+
+            const body = `## Pulumi Preview
+
+            <details>
+            <summary>Click to expand preview output</summary>
+
+            \`\`\`
+            ${output}
+            \`\`\`
+
+            </details>
+            `;
+
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const botComment = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes('## Pulumi Preview')
+            );
+
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: body
+              });
+            }