name: Build and Release
on:
push:
tags:
- 'v*'
workflow_dispatch:
inputs:
version:
description: 'Version tag (e.g., v1.32.0)'
required: true
type: string
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
jobs:
build-macos:
runs-on: macos-latest
permissions:
contents: read
id-token: write attestations: write steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Install Rust
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: stable
- name: Cache Cargo
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: macos-cargo-${{ hashFiles('Cargo.lock') }}
restore-keys: macos-cargo-
- name: Build release binary
run: cargo build --release
- name: Package binary
run: |
mkdir -p dist/mcp-mt5-quant-macos
cp target/release/mt5-quant dist/mcp-mt5-quant-macos/
cp -r config dist/mcp-mt5-quant-macos/
cp README.md dist/mcp-mt5-quant-macos/
cp -r docs dist/mcp-mt5-quant-macos/
cd dist
tar -czf mcp-mt5-quant-macos-arm64.tar.gz mcp-mt5-quant-macos
- name: Upload artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with:
name: macos-binary
path: dist/mcp-mt5-quant-macos-arm64.tar.gz
- name: Generate build provenance attestation
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 with:
subject-path: dist/mcp-mt5-quant-macos-arm64.tar.gz
build-linux:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write attestations: write steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Install Rust
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: stable
- name: Cache Cargo
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: linux-cargo-${{ hashFiles('Cargo.lock') }}
restore-keys: linux-cargo-
- name: Build release binary
run: cargo build --release
- name: Package binary
run: |
mkdir -p dist/mcp-mt5-quant-linux
cp target/release/mt5-quant dist/mcp-mt5-quant-linux/
cp -r config dist/mcp-mt5-quant-linux/
cp README.md dist/mcp-mt5-quant-linux/
cp -r docs dist/mcp-mt5-quant-linux/
cd dist
tar -czf mcp-mt5-quant-linux-x64.tar.gz mcp-mt5-quant-linux
- name: Upload artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with:
name: linux-binary
path: dist/mcp-mt5-quant-linux-x64.tar.gz
- name: Generate build provenance attestation
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 with:
subject-path: dist/mcp-mt5-quant-linux-x64.tar.gz
cargo-publish:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Install Rust
uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 with:
toolchain: stable
- name: Cache Cargo
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: cargo-publish-${{ hashFiles('Cargo.lock') }}
restore-keys: cargo-publish-
- name: Get crates.io authentication token
uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 id: auth
- name: Publish to crates.io
run: cargo publish --no-verify --allow-dirty
env:
CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
release:
needs: [build-macos, build-linux, cargo-publish]
runs-on: ubuntu-latest
permissions:
contents: write
env:
RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Download macOS artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: macos-binary
path: dist
- name: Download Linux artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: linux-binary
path: dist
- name: Create GitHub Release
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 with:
tag_name: ${{ env.RELEASE_TAG }}
name: ${{ env.RELEASE_TAG }}
files: |
dist/mcp-mt5-quant-macos-arm64.tar.gz
dist/mcp-mt5-quant-linux-x64.tar.gz
draft: false
prerelease: false
generate_release_notes: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
build-mcp-package:
needs: release
runs-on: macos-latest
permissions:
contents: write
outputs:
sha256: ${{ steps.compute-sha256.outputs.sha256 }}
env:
RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }}
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- name: Download macOS binary
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: macos-binary
path: dist
- name: Build MCP package
run: |
mkdir -p mcp-package/mcp-server/bin
cd dist && tar -xzf mcp-mt5-quant-macos-arm64.tar.gz && cd ..
cp dist/mcp-mt5-quant-macos/mt5-quant mcp-package/mcp-server/bin/
cp -r config mcp-package/
cp -r docs mcp-package/
cp README.md mcp-package/
cp server.json mcp-package/
cd mcp-package && tar -czf ../mcp-mt5-quant-macos-arm64.tar.gz . && cd ..
- name: Compute SHA256
id: compute-sha256
run: |
SHA256=$(shasum -a 256 mcp-mt5-quant-macos-arm64.tar.gz | awk '{print $1}')
echo "sha256=$SHA256" >> "$GITHUB_OUTPUT"
echo "MCP Package SHA256: $SHA256"
- name: Upload MCP package to release
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 with:
tag_name: ${{ env.RELEASE_TAG }}
files: mcp-mt5-quant-macos-arm64.tar.gz
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload MCP package artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with:
name: mcp-package
path: mcp-mt5-quant-macos-arm64.tar.gz
update-server-json:
needs: build-mcp-package
runs-on: ubuntu-latest
permissions:
contents: write pull-requests: write steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
ref: master
fetch-depth: 1
token: ${{ secrets.GITHUB_TOKEN }}
- name: Patch server.json
env:
PKG_SHA256: ${{ needs.build-mcp-package.outputs.sha256 }}
RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }}
run: |
VERSION="${RELEASE_TAG#v}"
echo "VERSION=$VERSION" >> "$GITHUB_ENV"
VERSION="$VERSION" PKG_SHA256="$PKG_SHA256" python3 - <<'PYEOF'
import json, os, re
sha256 = os.environ['PKG_SHA256']
version = os.environ['VERSION']
with open('server.json') as f:
data = json.load(f)
data['version'] = version
for pkg in data.get('packages', []):
pkg['version'] = version
pkg['fileSha256'] = sha256
if 'identifier' in pkg:
pkg['identifier'] = re.sub(
r'/v[0-9]+\.[0-9]+\.[0-9]+/',
f'/v{version}/',
pkg['identifier']
)
with open('server.json', 'w') as f:
json.dump(data, f, indent=2)
f.write('\n')
print(f"Patched: version={version}, sha256={sha256[:16]}...")
PYEOF
- name: Commit server.json to release branch
id: commit
run: |
BRANCH="ci/server-json-sha-${VERSION}"
# Drop any stale branch/PR left over from a previous attempt at
# this release so every run starts from a clean slate
git push origin --delete "$BRANCH" 2>/dev/null || true
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git checkout -b "$BRANCH"
git add server.json
if git diff --cached --quiet; then
echo "server.json unchanged — no commit needed"
echo "changed=false" >> "$GITHUB_OUTPUT"
else
# Never add a CI-skip marker to this commit message: under the
# protect-master ruleset the server.json PR carries required
# status checks, and a CI-skip marker suppresses
# pull_request-triggered workflows, so those checks never report
# and auto-merge hangs until timeout. Omitting it is safe —
# release.yml triggers only on tags (no loop risk) and
# GITHUB_TOKEN-attributed merges never retrigger workflows.
git commit -m "ci: update server.json SHA256 for v${VERSION}"
git push origin "$BRANCH"
echo "changed=true" >> "$GITHUB_OUTPUT"
echo "Committed server.json update to ${BRANCH}"
fi
- name: Create PR and enable auto-merge
if: steps.commit.outputs.changed == 'true'
run: |
BRANCH="ci/server-json-sha-${VERSION}"
# Same rule as above: no CI-skip marker in the title — GitHub
# honors markers on PR titles too, which would suppress the
# required checks.
GH_TOKEN="${{ github.token }}" gh pr create \
--title "ci: update server.json SHA256 for v${VERSION}" \
--body "Automated MCP package hash update." \
--base master \
--head "$BRANCH"
GH_TOKEN="${{ github.token }}" gh pr merge "$BRANCH" --auto --squash
# Block until required checks (build, lint, cargo-deny x4) finish
# and auto-merge completes — mcp-publish depends on this job and
# checks out master expecting the patched server.json
DEADLINE=$((SECONDS + 1800))
while (( SECONDS < DEADLINE )); do
STATE=$(GH_TOKEN="${{ github.token }}" gh pr view "$BRANCH" --json state --jq .state)
case "$STATE" in
MERGED)
echo "server.json PR merged to master"
exit 0
;;
CLOSED)
echo "::error::server.json PR was closed without merging" >&2
exit 1
;;
esac
sleep 20
done
echo "::error::Timed out after 30m waiting for server.json PR auto-merge (required checks: build, lint, cargo-deny x4)" >&2
exit 1
mcp-publish:
needs: [build-mcp-package, update-server-json]
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 with:
ref: master
- name: Download MCP package
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c with:
name: mcp-package
path: .
- name: Install mcp-publisher
id: install-publisher
run: |
# Fetch the download URL for linux_amd64 directly from the release assets API
# (asset name format changed in v1.6.0 — look it up rather than constructing it)
URL=$(curl -sf \
-H "Accept: application/vnd.github+json" \
"https://api.github.com/repos/modelcontextprotocol/registry/releases/latest" \
| python3 -c "
import sys, json
r = json.load(sys.stdin)
tag = r['tag_name']
assets = r.get('assets', [])
match = next((a['browser_download_url'] for a in assets
if 'linux' in a['name'] and 'amd64' in a['name']
and a['name'].endswith('.tar.gz')
and 'sbom' not in a['name']
and 'sigstore' not in a['name']), None)
if match:
print(match)
else:
print(f'https://github.com/modelcontextprotocol/registry/releases/download/{tag}/mcp-publisher_linux_amd64.tar.gz', file=sys.stderr)
sys.exit(1)
" 2>/dev/null)
if [[ -z "$URL" ]]; then
echo "installed=false" >> "$GITHUB_OUTPUT"
echo "Could not resolve mcp-publisher download URL"
else
echo "Downloading: $URL"
if curl -fsSL -o mcp-publisher.tar.gz "$URL"; then
tar -xzf mcp-publisher.tar.gz 2>/dev/null || true
BINARY=$(find . -maxdepth 3 -name "mcp-publisher" ! -path "./.git/*" | head -1)
if [[ -n "$BINARY" && -f "$BINARY" ]]; then
chmod +x "$BINARY"
sudo mv "$BINARY" /usr/local/bin/mcp-publisher
echo "installed=true" >> "$GITHUB_OUTPUT"
echo "Installed: $(mcp-publisher --version 2>/dev/null || echo 'ok')"
else
echo "installed=false" >> "$GITHUB_OUTPUT"
echo "Binary not found in archive"
fi
rm -f mcp-publisher.tar.gz
else
echo "installed=false" >> "$GITHUB_OUTPUT"
echo "Download failed: $URL"
fi
fi
- name: Validate server.json before publish
id: validate
run: |
python3 - <<'PYEOF'
import json, sys
with open('server.json') as f:
data = json.load(f)
print(f" name: {data.get('name')}")
print(f" version: {data.get('version')}")
ok = True
for pkg in data.get('packages', []):
sha = pkg.get('fileSha256', '')
ident = pkg.get('identifier', '')
print(f" sha256: {sha}")
print(f" url: {ident}")
if sha in ('', 'TBD_CI_WILL_UPDATE', 'TBD_UPDATED_BY_CI'):
print('ERROR: fileSha256 is a placeholder — publish aborted')
ok = False
sys.exit(0 if ok else 1)
PYEOF
- name: Publish to MCP Registry
if: steps.install-publisher.outputs.installed == 'true' && steps.validate.outcome == 'success'
run: |
echo "=== Authenticating with GitHub OIDC ==="
mcp-publisher login github-oidc || {
echo "OIDC login failed"
exit 1
}
echo "=== Publishing ==="
mcp-publisher publish && echo "✓ Published to MCP Registry" || {
echo ""
echo "══════════════════════════════════════════════════════════"
echo " AUTOMATED MCP PUBLISH FAILED — manual steps:"
echo "══════════════════════════════════════════════════════════"
echo " 1. Download: https://github.com/modelcontextprotocol/registry/releases"
echo " 2. ./mcp-publisher login github"
echo " 3. ./mcp-publisher publish"
echo " Web UI: https://registry.modelcontextprotocol.io"
echo "══════════════════════════════════════════════════════════"
exit 0 # Don't fail the workflow — release succeeded
}
- name: Skip notice
if: steps.install-publisher.outputs.installed != 'true'
run: |
echo "mcp-publisher not installed — skipping automated publish"
echo "Manual: https://registry.modelcontextprotocol.io"
release-info:
needs: [mcp-publish]
runs-on: ubuntu-latest
env:
RELEASE_TAG: ${{ github.event.inputs.version || github.ref_name }}
steps:
- name: Summary
run: |
echo ""
echo "╔══════════════════════════════════════════════════════════════╗"
echo "║ Release ${RELEASE_TAG} complete! "
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""
echo "GitHub Release:"
echo " https://github.com/masdevid/mt5-quant/releases/tag/${RELEASE_TAG}"
echo ""
echo "MCP Registry: io.github.masdevid/mt5-quant"
echo ""
echo "── MCP Client Registration ──────────────────────────────────"
echo ""
echo "Claude Code:"
echo " claude mcp add io.github.masdevid/mt5-quant -- ~/.local/bin/mt5-quant"
echo ""
echo "Windsurf (~/.codeium/windsurf/mcp_config.json):"
echo ' {"mcpServers": {"io.github.masdevid/mt5-quant": {"command": "~/.local/bin/mt5-quant"}}}'
echo ""
echo "Cursor / VS Code (~/.cursor/mcp.json):"
echo ' {"mcpServers": {"mt5-quant": {"command": "~/.local/bin/mt5-quant"}}}'
echo ""
echo "─────────────────────────────────────────────────────────────"