Registry #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Registry | |
| on: | |
| workflow_run: | |
| workflows: [Release] | |
| types: [completed] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Released tag to publish (e.g. v1.1.0)" | |
| required: true | |
| verify_only: | |
| description: "Stop after the DNS ownership verification, publish nothing" | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish: | |
| # Publishes the released version to the MCP registry. It runs after the | |
| # Release workflow so the OCI image the entry references already exists | |
| # when the registry validates it; the manual dispatch covers tags | |
| # released before this workflow existed. The signing key lives in the | |
| # mcp-registry environment, admitted from main only — and workflow_run | |
| # always executes the default branch's workflow file, so a PR branch can | |
| # neither alter this job nor reach the secret. | |
| if: >- | |
| github.repository == 'GaijinEntertainment/go-gerrit-mcp' && | |
| (github.event_name == 'workflow_dispatch' || | |
| (github.event.workflow_run.conclusion == 'success' && | |
| startsWith(github.event.workflow_run.head_branch, 'v'))) | |
| runs-on: ubuntu-latest | |
| environment: mcp-registry | |
| env: | |
| TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.event.workflow_run.head_branch }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ env.TAG }} | |
| - name: Stamp server.json with the released version | |
| run: | | |
| version="${TAG#v}" | |
| jq --arg v "$version" ' | |
| .version = $v | |
| | .packages[0].identifier = "ghcr.io/gaijinentertainment/go-gerrit-mcp:" + $v | |
| ' server.json > server.json.stamped | |
| mv server.json.stamped server.json | |
| - name: Install mcp-publisher | |
| # Unpinned on purpose: the publisher tracks the live registry API, | |
| # and an old pinned binary is likelier to break than a fresh one. | |
| run: | | |
| curl -fsSL https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz \ | |
| | tar xz mcp-publisher | |
| - name: Verify domain ownership | |
| # login performs the full DNS proof: it signs a challenge with the | |
| # private key and the registry checks it against the TXT record, so | |
| # a verify_only dispatch exercises everything short of publishing. | |
| env: | |
| MCP_PRIVATE_KEY: ${{ secrets.MCP_PRIVATE_KEY }} | |
| run: ./mcp-publisher login dns --domain=gaijin.team --private-key="$MCP_PRIVATE_KEY" | |
| - name: Publish to the MCP registry | |
| if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.verify_only) }} | |
| run: ./mcp-publisher publish |