v0.3.0-alpha.9: one-command install via modelrisk-mcp install
#5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Triggered by pushing a version tag. Builds wheel + sdist + standalone | |
| # Windows .exe and publishes to PyPI (via trusted publishing) plus the | |
| # GitHub Release for the tag. See spec §13 Phase 6. | |
| # | |
| # Setup once before the first real release: | |
| # 1. Create a PyPI project (https://pypi.org/manage/account/publishing/) | |
| # and add a trusted publisher pointing at this repo + this workflow | |
| # under the environment name "pypi". No tokens to manage. | |
| # 2. (Optional) Create a separate "test-pypi" trusted publisher if you | |
| # want to dry-run with `*.dev*` tags. | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| - "v*.*.*-*" | |
| permissions: {} | |
| jobs: | |
| build-wheel: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| wheel: ${{ steps.find.outputs.wheel }} | |
| sdist: ${{ steps.find.outputs.sdist }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v3 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python 3.13 | |
| run: uv python install 3.13 | |
| - name: Build wheel and sdist | |
| run: uv build | |
| - name: Find artifact filenames | |
| id: find | |
| shell: bash | |
| run: | | |
| wheel=$(ls dist/*.whl | head -n 1) | |
| sdist=$(ls dist/*.tar.gz | head -n 1) | |
| echo "wheel=$wheel" >> "$GITHUB_OUTPUT" | |
| echo "sdist=$sdist" >> "$GITHUB_OUTPUT" | |
| - name: Upload Python artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: python-distributions | |
| path: dist/* | |
| build-windows-exe: | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v3 | |
| with: | |
| enable-cache: true | |
| - name: Set up Python 3.13 | |
| run: uv python install 3.13 | |
| - name: Install dependencies (incl. dev for pyinstaller) | |
| run: uv sync --extra dev | |
| - name: Build single-file .exe | |
| run: uv run pyinstaller modelrisk_mcp.spec --clean --noconfirm | |
| - name: Verify .exe boots and answers MCP initialize | |
| shell: bash | |
| run: | | |
| INIT='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"ci","version":"0.1"}}}' | |
| OUT=$(echo "$INIT" | timeout 15 ./dist/modelrisk-mcp.exe || true) | |
| echo "$OUT" | |
| echo "$OUT" | grep -q '"serverInfo"' || (echo "exe did not return a serverInfo block" && exit 1) | |
| echo "$OUT" | grep -q '"modelrisk-mcp"' || (echo "exe did not identify as modelrisk-mcp" && exit 1) | |
| - name: Scan exe for plain activation key | |
| shell: bash | |
| run: | | |
| uv run python scripts/scan_exe_for_key.py dist/modelrisk-mcp.exe | |
| - name: Upload Windows artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows-exe | |
| path: dist/modelrisk-mcp.exe | |
| publish-pypi: | |
| needs: build-wheel | |
| runs-on: ubuntu-latest | |
| environment: pypi | |
| permissions: | |
| id-token: write # for PyPI trusted publishing | |
| steps: | |
| - name: Download Python artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: python-distributions | |
| path: dist | |
| - name: Publish to PyPI | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| publish-mcp-registry: | |
| # PyPI must publish first — the registry verifies ownership by | |
| # fetching the package's README from PyPI and looking for the | |
| # `mcp-name: <server-name>` marker. If PyPI doesn't have the new | |
| # version yet the verification fails. | |
| needs: publish-pypi | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # for GitHub OIDC against the registry | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install mcp-publisher | |
| run: | | |
| curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" \ | |
| | tar xz mcp-publisher | |
| chmod +x mcp-publisher | |
| - name: Wait for PyPI to surface the new version | |
| # PyPI's CDN can take 30-60s to make a freshly-published | |
| # version visible to the registry's verifier. Give it room. | |
| run: sleep 60 | |
| - name: Authenticate to the MCP Registry (GitHub OIDC) | |
| run: ./mcp-publisher login github-oidc | |
| - name: Publish server.json to the MCP Registry | |
| run: ./mcp-publisher publish | |
| github-release: | |
| needs: [build-wheel, build-windows-exe] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # to upload release assets | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Download Python artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: python-distributions | |
| path: artifacts/python | |
| - name: Download Windows artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: windows-exe | |
| path: artifacts/windows | |
| - name: Create GitHub release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| name: ${{ github.ref_name }} | |
| body_path: CHANGELOG.md | |
| files: | | |
| artifacts/python/* | |
| artifacts/windows/modelrisk-mcp.exe | |
| generate_release_notes: false | |
| prerelease: ${{ contains(github.ref_name, '-') }} |