publish.yml

name: Publish to PyPI and MCP Registry

on:
  push:
    tags:
      - "*-mcp-v*"

permissions:
  contents: read

jobs:
  parse-tag:
    runs-on: ubuntu-latest
    outputs:
      server: ${{ steps.parse.outputs.server }}
      version: ${{ steps.parse.outputs.version }}
    steps:
      - name: Parse tag
        id: parse
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          # Extract server name (everything before -v) and version (after -v)
          SERVER="${TAG%-v*}"
          VERSION="${TAG##*-v}"
          echo "server=${SERVER}" >> "$GITHUB_OUTPUT"
          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
          echo "Parsed tag: server=${SERVER}, version=${VERSION}"

      - uses: actions/checkout@v6

      - name: Verify version matches tag
        working-directory: servers/${{ steps.parse.outputs.server }}
        run: |
          TOML_VERSION=$(python3 -c "
          import re
          with open('pyproject.toml') as f:
              match = re.search(r'^version\s*=\s*\"(.+?)\"', f.read(), re.MULTILINE)
              print(match.group(1))
          ")
          TAG_VERSION="${{ steps.parse.outputs.version }}"
          if [[ "${TOML_VERSION}" != "${TAG_VERSION}" ]]; then
            echo "::error::Version mismatch: pyproject.toml has ${TOML_VERSION}, tag has ${TAG_VERSION}"
            exit 1
          fi
          echo "Version verified: ${TOML_VERSION}"

  test:
    needs: parse-tag
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - uses: actions/checkout@v6

      - uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: "servers/${{ needs.parse-tag.outputs.server }}/uv.lock"

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: uv sync --group dev

      - name: Run unit tests
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: uv run pytest tests/ --ignore=tests/test_live.py -v --tb=short

  publish:
    needs: [parse-tag, test]
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - uses: astral-sh/setup-uv@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Build package
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: uv build

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          packages-dir: servers/${{ needs.parse-tag.outputs.server }}/dist/

  mcp-registry:
    needs: [parse-tag, publish]
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v6

      - name: Check for server.json
        id: check
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: |
          if [ -f server.json ]; then
            echo "exists=true" >> "$GITHUB_OUTPUT"
          else
            echo "exists=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Install mcp-publisher
        if: steps.check.outputs.exists == 'true'
        env:
          MCP_PUBLISHER_VERSION: "1.8.0"
        run: |
          OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
          ARCH="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')"
          ASSET="mcp-publisher_${OS}_${ARCH}.tar.gz"
          # Pinned sha256 checksums from the v1.8.0 release's
          # registry_1.8.0_checksums.txt (covers both mcp-publisher_* and
          # registry_* assets despite the "registry_" filename prefix).
          # Only linux runners are expected here (job runs on ubuntu-latest).
          case "${ASSET}" in
            mcp-publisher_linux_amd64.tar.gz)
              SHA256="1370446bbe74d562608e8005a6ccce02d146a661fbd78674e11cc70b9618d6cf"
              ;;
            mcp-publisher_linux_arm64.tar.gz)
              SHA256="c978982c60e1b4903a976de090f04dc4fac4a320daa50704fcad2dbc93433d62"
              ;;
            *)
              echo "::error::No pinned checksum recorded for ${ASSET}; refusing to install mcp-publisher unverified"
              exit 1
              ;;
          esac
          curl -L -o mcp-publisher.tar.gz \
            "https://github.com/modelcontextprotocol/registry/releases/download/v${MCP_PUBLISHER_VERSION}/${ASSET}"
          echo "${SHA256}  mcp-publisher.tar.gz" | sha256sum -c -
          tar xz -f mcp-publisher.tar.gz mcp-publisher

      - name: Update version in server.json
        if: steps.check.outputs.exists == 'true'
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: |
          VERSION="${{ needs.parse-tag.outputs.version }}"
          jq --arg v "$VERSION" '(.version = $v) | (.packages[].version = $v)' server.json > server.tmp && mv server.tmp server.json

      - name: Authenticate to MCP Registry
        if: steps.check.outputs.exists == 'true'
        run: ./mcp-publisher login github-oidc

      - name: Publish to MCP Registry
        if: steps.check.outputs.exists == 'true'
        working-directory: servers/${{ needs.parse-tag.outputs.server }}
        run: $GITHUB_WORKSPACE/mcp-publisher publish