adityamparikh opened a new pull request, #263: URL: https://github.com/apache/solr-mcp/pull/263
Closes #261. The PMC and Infra prerequisites (Docker Hub repo, secrets, GHCR visibility) stay in #251. ## What this does Makes the `publish-mcp-registry` job in `release-publish.yml` able to publish a voted release to the [official MCP Registry](https://modelcontextprotocol.io/registry/about) as `io.github.apache/solr-mcp`, and documents where that step sits in the ATR release. On `main` the job can't succeed. `server.json` uses things the registry's publish step rejects, and the workflow checks out tags the release process doesn't create. `mcp-publisher validate` doesn't catch any of it, because it only checks the schema; the package checks (allowed host, ownership label, the OCI `version` rule) run only on `publish`. A published version can't be edited afterwards, only deprecated, so these need to be right before 1.0.0. ### `server.json` - `registryType` `docker` → `oci`, and no `version` on the packages: the registry rejects a `version` on OCI packages and takes the tag from `identifier`. - Identifiers are the images the workflow pushes, `docker.io/apache/solr-mcp:<v>` and `ghcr.io/apache/solr-mcp:<v>`, instead of `ghcr.io/apache/solr-mcp-server`, which is never pushed. - Schema `2025-12-11` (current), plus a `title`. - Both packages are stdio. The `streamable-http` package is dropped: HTTP mode is secured by default and needs `OAUTH2_ISSUER_URI` and a published port, so it suits a remote deployment rather than a client-launched container. ### `release-publish.yml` - Every job checks out `releases/solr-mcp/<version>-<rc>`, the tag `dev-docs/release-process.md` creates. The old `v<version>-<rc>` made `validate-release` fail, so nothing published. - `validate-release` rejects a malformed `release_version` / `release_candidate` before they reach a tag name, an image tag or `server.json`. - Docker Hub credentials come from `DOCKERHUB_USER` / `DOCKERHUB_TOKEN`, the names Infra provisions (#251). - The registry job writes the release version into each `identifier` tag instead of adding a `version` field. It checks every image can be pulled anonymously, the same check the registry does, and says what to do when one can't (on the first release the new GHCR package is private). It also pins `mcp-publisher` v1.8.1 and runs `validate` before `publish`. Finally it reads `/v0.1/servers/io.github.apache%2Fsolr-mcp/versions/<v>` back and fails if the version doesn't appear; the old check queried a search URL and never failed. ### Docs `dev-docs/MCP_REGISTRY.md` covers what the registry checks, what the job does, and the ATR steps around it. In short: - ATR doesn't push images or registry entries. Its finish phase leaves third-party distribution to the release manager and records it. So the release manager runs `release-publish.yml` after the vote and before announcing, then records the Docker Hub distribution on ATR's finish page. - The workflow can't record that itself yet. ATR accepts `record-atr-distribution`'s OIDC call only from a committee with CI builds enabled (Security-team approval of reproducible builds), and only when the release policy lists this workflow as a finish-phase workflow. - ATR has no GHCR/OCI or MCP Registry platform, so those two can't be recorded on ATR today. Its Docker Hub check confirms the tag exists without comparing digests. `release-process.md` step 5 links to the new page. The stale `server.json` example and manual-publish steps in `DEPLOYMENT.md` are replaced with a pointer to it. `WORKFLOWS.md` and `DOCKER_PUBLISHING.md` use the new tag and secret names. ## Testing - `./gradlew build`: passes. - `actionlint` 1.7.7 on `release-publish.yml`: no findings. - The workflow's `jq` rewrite on the new `server.json` with `1.0.0` gives `docker.io/apache/solr-mcp:1.0.0` and `ghcr.io/apache/solr-mcp:1.0.0`, with no `version` field left. The result passes `mcp-publisher validate` (v1.8.1). - The anonymous `docker manifest inspect` check passes for public images on Docker Hub and GHCR, and fails for `apache/solr-mcp`, which doesn't exist yet. `publish` itself can only run in the real release, once the images exist and GHCR is public. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
