Chore/ci

[radu-mocanu]

• add ci github actions
• fix types and linting errors

Development Package

• Add this package as a dependency in your pyproject.toml:

[project]
dependencies = [
  # Exact version:
  "uipath-mcp==0.0.98.dev1001240045",

  # Any version from PR
  "uipath-mcp>=0.0.98.dev1001240000,<0.0.98.dev1001250000"
]

[[tool.uv.index]]
name = "testpypi"
url = "https://test.pypi.org/simple/"
publish-url = "https://test.pypi.org/legacy/"
explicit = true

[tool.uv.sources]
uipath-mcp = { index = "testpypi" }

To fix the problem, you should prevent the checkout and execution of untrusted PR code in a privileged context. The best practice is to separate the untrusted PR handling from privileged workflows. Specifically:

1. Remove any direct fetching or checking out of PR HEAD code in a privileged workflow.
2. Instead, perform commit linting in a workflow triggered by pull_request (unprivileged) rather than via workflow_call or pull_request_target.
3. If you need to communicate results to privileged workflows, use artifacts and the workflow_run pattern as described in the background.
4. For the workflow in question, you should remove the step that fetches and checks out the PR branch and instead run commitlint only on trusted code or in an unprivileged context.

Specifically, in .github/workflows/commitlint.yml, you should remove or adjust the step:

git fetch origin pull/${{ github.event.pull_request.number }}/head:pr_branch

and not run commitlint on untrusted PR code when triggered from a privileged context.

---