chore: OpenSSF Scorecard quick wins

.github/workflows/release.yml

@@ -42,6 +42,14 @@ jobs:
 
       - run: npm run build
 
+      # semantic-release and its npm publishing plugin bundle a copy of the
+      # `npm` CLI, whose own bundled deps periodically surface advisories
+      # (e.g. brace-expansion, picomatch). Install them at release time
+      # only, not as devDependencies, so `npm audit` on the main branch
+      # never sees those transitive CLIs.
+      - name: Install semantic-release (ephemeral)
+        run: npm install --no-save --no-package-lock semantic-release@^25 @semantic-release/changelog@^6 @semantic-release/git@^10
+
       - name: Release
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -73,8 +81,6 @@ jobs:
         with:
           context: .
           push: true
-          build-args: |
-            VERSION=${{ steps.version.outputs.version }}
           tags: |
             ghcr.io/${{ github.repository }}:latest
             ghcr.io/${{ github.repository }}:${{ steps.version.outputs.version }}

Dockerfile

@@ -1,8 +1,19 @@
-FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS base
+# syntax=docker/dockerfile:1
+FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS builder
 
-ARG VERSION
-RUN test -n "${VERSION}" && npm install -g "@pavel-kalmykov/bitbucket-server-mcp@${VERSION}"
+WORKDIR /src
+COPY package.json package-lock.json tsconfig.json ./
+RUN npm ci --ignore-scripts
+COPY src/ ./src/
+RUN npm run build
+
+FROM node:22-alpine@sha256:8ea2348b068a9544dae7317b4f3aafcdc032df1647bb7d768a05a5cad1a7683f AS runtime
+
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev --ignore-scripts
+COPY --from=builder /src/build/ ./build/
 
 USER node
 
-ENTRYPOINT ["bitbucket-server-mcp"]
+ENTRYPOINT ["node", "/app/build/entry.js"]