Releasing 0.8.0

.changesets/feat_auth_token_passthrough_disable.md

@@ -0,0 +1,3 @@
+### feat: Configuration for disabling authorization token passthrough - @swcollard PR #336
+
+A new optional new MCP Server configuration parameter, `transport.auth.disable_auth_token_passthrough`, which is `false` by default, that when true, will no longer pass through validated Auth tokens to the GraphQL API.

.changesets/maint_codecov.md

@@ -0,0 +1,3 @@
+### Configure Codecov with coverage targets - @DaleSeo PR #337
+
+This PR adds `codecov.yml` to set up Codecov with specific coverage targets and quality standards. It helps define clear expectations for code quality. It also includes some documentation about code coverage in `CONTRIBUTING.md` and adds the Codecov badge to `README.md`.

.changesets/maint_coverage.md

@@ -0,0 +1,3 @@
+### Implement Test Coverage Measurement and Reporting - @DaleSeo PR #335
+
+This PR adds the bare minimum for code coverage reporting using [cargo-llvm-cov](https://crates.io/crates/cargo-llvm-cov) and integrates with [Codecov](https://www.codecov.io/). It adds a new `coverage` job to the CI workflow that generates and uploads coverage reporting in parallel with existing tests. The setup mirrors that of Router, except it uses `nextest` instead of the built-in test runner and CircleCI instead of GitHub Actions.

.changesets/maint_nc_rmcp_update.md

@@ -0,0 +1,3 @@
+### chore: update RMCP dependency ([328](https://github.com/apollographql/apollo-mcp-server/issues/328))
+
+Update the RMCP dependency to the latest version, pulling in newer specification changes.

.changesets/maint_nc_rust_toolchain_pin.md

@@ -0,0 +1,3 @@
+### ci: Pin stable rust version ([Issue #287](https://github.com/apollographql/apollo-mcp-server/issues/287))
+
+Pins the stable version of Rust to the current latest version to ensure backwards compatibility with future versions.

.github/renovate.json5

@@ -1,22 +1,49 @@
 {
+  // Allow for intellisense in editors
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+
+  // List of rules to apply
   extends: [
+    // Recommended best practices from renovate itself
+    // See: https://docs.renovatebot.com/upgrade-best-practices/#whats-in-the-configbest-practices-preset
+    "config:best-practices",
+
+    // Apply our own internal best practices
+    // See: https://github.com/apollographql/apollo-mcp-server/commits/main/.github/renovate.json5
     "github>apollographql/renovate-config-apollo-open-source:default.json5",
+
+    // Update to the latest rust stable version as it releases.
+    // See: https://github.com/Turbo87/renovate-config/blob/master/rust/updateToolchain.json
     "github>Turbo87/renovate-config//rust/updateToolchain",
   ],
+
+  // Globally disable all automatic update PRs from renovate
   packageRules: [
     {
       enabled: false,
       matchPackageNames: ["*"],
     },
   ],
+
   // Automating Nix upgrades is currently in beta and opt-in only.
   // https://docs.renovatebot.com/modules/manager/nix/
   nix: {
     enabled: true,
   },
+
+  // Globally enable vulnerability alerts
+  //
+  // Note: This needs extra configuration at the repository level, which is described in the link
+  // below.
+  //
+  // See: https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts
   vulnerabilityAlerts: {
     enabled: true,
   },
+
+  // Disable automatically updating lock files to latest versions once a week.
+  //
+  // See: https://docs.renovatebot.com/configuration-options/#lockfilemaintenance
   lockFileMaintenance: {
     enabled: false,
   },

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       actions: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: nixbuild/nix-quick-install-action@v30
@@ -55,7 +55,7 @@ jobs:
       actions: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: nixbuild/nix-quick-install-action@v30
@@ -81,7 +81,7 @@ jobs:
       actions: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: nixbuild/nix-quick-install-action@v30
@@ -107,7 +107,7 @@ jobs:
       actions: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: nixbuild/nix-quick-install-action@v30
@@ -124,3 +124,22 @@ jobs:
           gc-max-store-size: 5G
       - name: Run Tests
         run: 'nix develop --command bash -c "cargo test"'
+
+  coverage:
+    name: Run Coverage
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Generate code coverage
+        run: cargo llvm-cov --all-features --workspace --codecov --output-path codecov.json
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
+          files: codecov.json
+          fail_ci_if_error: true

.github/workflows/prep-release.yml

@@ -47,7 +47,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GH_PAT }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

.github/workflows/release-bins.yml

@@ -42,7 +42,7 @@ jobs:
       attestations: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.ref }}
       - uses: nixbuild/nix-quick-install-action@v30

.github/workflows/release-container.yml

@@ -32,7 +32,7 @@ jobs:
       attestations: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           ref: ${{ github.ref }}
 

.github/workflows/sync-develop.yml

@@ -51,7 +51,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GH_PAT }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_PAT }}

.github/workflows/verify-changeset.yml

@@ -1,6 +1,7 @@
 name: Verify Changeset
 on:
   pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
     branches-ignore:
       - main
       - release/**
@@ -19,7 +20,7 @@ on:
 
 jobs:
   verify-changeset:
-    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-changeset') && !startsWith(github.head_ref, 'sync/') && !startsWith(github.head_ref, 'conflict/') }}
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-changeset') && !startsWith(github.head_ref, 'sync/') && !startsWith(github.head_ref, 'conflict/') && !github.event.pull_request.draft }}
     name: Verify
     runs-on: ubuntu-24.04
     permissions:

CONTRIBUTING.md

@@ -57,4 +57,21 @@ It’s important that every piece of code in Apollo packages is reviewed by at l
 2. Simplicity. Is this the simplest way to achieve the intended goal? If there are too many files, redundant functions, or complex lines of code, suggest a simpler way to do the same thing. In particular, avoid implementing an overly general solution when a simple, small, and pragmatic fix will do.
 3. Testing. Please make sure that the tests ensure that the code won’t break when other stuff change around it. The error messages in the test should help identify what is broken exactly and how. The tests should test every edge case if possible. Please make sure you get as much coverage as possible.
 4. No unnecessary or unrelated changes. PRs shouldn’t come with random formatting changes, especially in unrelated parts of the code. If there is some refactoring that needs to be done, it should be in a separate PR from a bug fix or feature, if possible.
-5. Please run `cargo test`, `cargo clippy`, and `cargo fmt` prior to creating a PR.
+5. Please run `cargo test`, `cargo clippy`, and `cargo fmt` prior to creating a PR.
+
+### Code Coverage
+
+Apollo MCP Server uses comprehensive code coverage reporting to ensure code quality and test effectiveness. 
+The project uses [cargo-llvm-cov](https://crates.io/crates/cargo-llvm-cov) for generating code coverage reports and [Codecov](https://www.codecov.io/) for coverage analysis and reporting. Coverage is automatically generated and reported on every pull request through GitHub Actions.
+
+#### Coverage Targets
+
+The project maintains the following coverage targets, configured in `codecov.yml`:
+
+- **Project Coverage**: Automatically maintained - should increase overall coverage on each PR
+- **Patch Coverage**: 80% - requires 80% coverage on all new/modified code
+
+These targets help ensure that:
+
+- The overall codebase coverage doesn't decrease over time
+- New code is well-tested before being merged