1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: release-plz
on:
push:
branches:
permissions:
contents: write
pull-requests: write
concurrency:
group: release-plz-${{ github.ref }}
cancel-in-progress: false
# release-plz owns versioning + git only. `publish = false` in release-plz.toml
# means it never runs `cargo publish` here; it opens the version-bump PR and, on
# merge, creates the git tags + GitHub Release. The crates.io upload is done by
# publish.yml.
#
# publish.yml is CALLED here rather than left to its `macp-runtime-v*` tag
# trigger. That trigger cannot work from this workflow: GitHub does not start
# workflow runs from events created with the default GITHUB_TOKEN, so the tags
# release-plz pushes are invisible to it. That is why 0.6.1 was tagged and
# GitHub-released on 2026-07-12 but never published — the tag fired nothing.
# `workflow_call` runs inside this same run, so the recursion guard never
# applies and no PAT is needed.
jobs:
release-plz:
name: release-plz
runs-on: ubuntu-latest
if: ${{ github.repository_owner == 'multiagentcoordinationprotocol' }}
outputs:
releases_created: ${{ steps.release-plz.outputs.releases_created }}
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
token: ${{ secrets.GITHUB_TOKEN }}
# Pin the same toolchain as rust-toolchain.toml so release-plz's build /
# semver-check / publish-verify steps run the workspace compiler rather
# than rustup's minimal auto-install of the file pin.
- uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
with:
toolchain: "1.96.1"
# macp-runtime's build.rs generates gRPC stubs via tonic-prost-build, so
# every crate build (which release-plz runs for semver-check and publish
# verification) needs protoc on PATH.
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
with:
version: "31.x"
repo-token: ${{ github.token }}
- uses: MarcoIeni/release-plz-action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
id: release-plz
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# Only when the step above actually cut a release (tags + GitHub Release).
# A run that merely opens or refreshes the release PR sets this false and
# publishes nothing.
publish:
name: publish
needs: release-plz
if: ${{ needs.release-plz.outputs.releases_created == 'true' }}
uses: ./.github/workflows/publish.yml
secrets: inherit