mcp-publish.yml

name: Publish to MCP Registry

env:
  UV_MALWARE_CHECK: '1' # abort any uv resolution that hits an OSV malicious-package record

# Publishes server.json to the official MCP registry once the PyPI package for the
# tag is available. Authenticates with GitHub OIDC (no stored secrets); the registry
# verifies ownership via the io.github.astrogilda/* namespace and the mcp-name marker
# in the package README. The PyPI release itself is handled by release.yml.

permissions: {}

# Serialize publishes; never cancel one mid-flight.
concurrency:
  group: mcp-publish

on:
  release:
    types: [published]
  workflow_dispatch:  # manual re-publish (e.g. after a transient registry or PyPI-timing failure)

jobs:
  publish-mcp:
    name: Publish server.json to the MCP registry
    runs-on: ubuntu-latest
    permissions:
      id-token: write # the registry authenticates this workflow via GitHub OIDC
      contents: read # checkout of server.json and the version stamp

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install mcp-publisher
        run: |
          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher

      - name: Wait for the PyPI release to be available
        # The PyPI publish (release.yml) and this workflow both trigger on the
        # release event and run in parallel. The registry validates that the
        # version in server.json exists on PyPI, so this must wait for the new
        # version to appear or it fails with a 404. Poll for up to 20 minutes.
        run: |
          version="$(python3 -c "import json; print(json.load(open('server.json'))['version'])")"
          echo "Waiting for tsbootstrap ${version} on PyPI..."
          for attempt in $(seq 1 80); do
            if curl -sfL "https://pypi.org/pypi/tsbootstrap/${version}/json" >/dev/null; then
              echo "tsbootstrap ${version} is available on PyPI."
              exit 0
            fi
            echo "  attempt ${attempt}/80: not on PyPI yet, sleeping 15s..."
            sleep 15
          done
          echo "Timed out waiting for tsbootstrap ${version} on PyPI." >&2
          exit 1

      - name: Authenticate to the MCP registry
        run: ./mcp-publisher login github-oidc

      - name: Publish server to the MCP registry
        run: ./mcp-publisher publish