pmcp 2.22.5

name: Release

on:
  push:
    tags:
      - 'v*'
  # Allow manual re-runs (e.g., after a workflow fix when a publish step
  # failed and we want to re-fire against an existing tag). All publish
  # steps already skip gracefully when the version is already on crates.io.
  workflow_dispatch:

env:
  CARGO_TERM_COLOR: never

jobs:
  create-release:
    name: Create Release
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.get_version.outputs.VERSION }}
    steps:
    - uses: actions/checkout@v7

    - name: Get version from tag
      id: get_version
      run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT

    - name: Read changelog
      id: changelog
      run: |
        # Extract the latest version's changelog
        VERSION="${{ steps.get_version.outputs.VERSION }}"
        VERSION_NO_V="${VERSION#v}"
        # Match the heading with index(), NOT a regex built from a -v value.
        # awk applies string-literal escape processing to -v assignments, and
        # `\[` is an UNDEFINED escape: BSD awk (measured) drops the backslash, so
        # `ver` became `## [2.19.1]` and `$0 ~ ver` read `[2.19.1]` as a CHARACTER
        # CLASS. `## [` never matched it, the extraction returned EMPTY, and the
        # release was created with blank notes at exit 0 -- silently. Measured
        # 2026-08-27 against v2.19.1, v2.19.0 and v2.18.0: 0 bytes for all three.
        # Passing the bare version (no backslashes, so nothing to escape) and
        # comparing with index() removes the hazard entirely.
        CHANGELOG=$(awk -v ver="$VERSION_NO_V" '
          index($0, "## [" ver "]") == 1 {p=1; next}
          /^## \[/ && p {exit}
          p {print}
        ' CHANGELOG.md)
        if [ -z "$CHANGELOG" ]; then
          echo "::error::CHANGELOG.md has no '## [$VERSION_NO_V]' section - refusing to create a release with empty notes" >&2
          exit 1
        fi
        echo "CHANGELOG<<EOF" >> $GITHUB_OUTPUT
        echo "$CHANGELOG" >> $GITHUB_OUTPUT
        echo "EOF" >> $GITHUB_OUTPUT

    - name: Create Release
      id: create_release
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        VERSION: ${{ steps.get_version.outputs.VERSION }}
        RELEASE_NOTES: ${{ steps.changelog.outputs.CHANGELOG }}
      run: |
        # Check if release already exists
        if gh release view "$VERSION" &>/dev/null; then
          echo "Release $VERSION already exists, skipping creation"
          echo "RELEASE_EXISTS=true" >> $GITHUB_OUTPUT
        else
          gh release create "$VERSION" \
            --title "$VERSION" \
            --notes "$RELEASE_NOTES" \
            --verify-tag
          echo "RELEASE_EXISTS=false" >> $GITHUB_OUTPUT
        fi

  publish-crates:
    name: Publish to crates.io
    runs-on: ubuntu-latest
    needs: create-release
    steps:
    - uses: actions/checkout@v7

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache cargo
      uses: actions/cache@v6
      with:
        path: |
          ~/.cargo/bin/
          ~/.cargo/registry/index/
          ~/.cargo/registry/cache/
          ~/.cargo/git/db/
          target/
        key: ${{ runner.os }}-cargo-publish-${{ hashFiles('**/Cargo.lock') }}

    # Publish order: leaf dependencies first, then dependents. This list is the
    # prose mirror of the publish STEPS below it, and the STEPS are the authority
    # — every recorded time the two disagreed, the steps were right. It is kept
    # complete (one entry per step) on purpose: a partial list cannot be checked
    # against the steps, and that is how its tail rotted unnoticed once already.
    # scripts/check-release-coverage.sh machine-checks that every publishable
    # workspace member has a step here, and that pmcp-package precedes its four
    # in-repo consumers (D-10).
    # pmcp-widget-utils (no internal deps)
    # -> pmcp-macros-support (no internal deps; consumed by pmcp-macros)
    # -> pmcp-macros (depends on pmcp-macros-support)
    # -> pmcp-code-mode (depends on pmcp)
    # -> pmcp-code-mode-derive (depends on pmcp-code-mode)
    # -> pmcp (depends on widget-utils + macros)
    # -> pmcp-workbook-runtime (depends on pmcp)
    # -> pmcp-workbook-dialect (workbook leaf)
    # -> pmcp-server-toolkit (depends on pmcp + pmcp-code-mode)
    # -> pmcp-toolkit-postgres / -mysql / -athena (depend on the toolkit)
    # -> pmcp-sql-server (depends on toolkit + the three connectors)
    # -> pmcp-openapi-server (depends on the toolkit; its pmcp-package dev-dep is
    #    PATH-ONLY, with no version key, precisely because it publishes AHEAD of
    #    pmcp-package — see CLAUDE.md item 9b before "fixing" it)
    # -> pmcp-workbook-compiler (depends on the workbook tree)
    # -> pmcp-workbook-server (depends on the toolkit's workbook + http features)
    # -> mcp-tester (depends on pmcp)
    # -> mcp-preview (depends on widget-utils)
    # -> pmcp-package (standalone workspace-EXCLUDED leaf, published via
    #    --manifest-path, NOT -p. It publishes HERE, ahead of its four in-repo
    #    consumers, each of which pins it — see the cluster comment above its
    #    step, and the authoritative ordering constraint under item 13 of
    #    CLAUDE.md's Workspace Crates ledger.)
    # -> pmcp-cfn-renderer (pins pmcp-package)
    # -> pmcp-agent (pins pmcp + pmcp-package)
    # -> pmcp-team-servers (pins pmcp + pmcp-agent + pmcp-package)
    # -> cargo-pmcp (pins pmcp, mcp-tester, mcp-preview, pmcp-package,
    #    pmcp-cfn-renderer, pmcp-agent, pmcp-team-servers)
    # -> pmcp-server (depends on pmcp, mcp-tester)
    # -> pmcp-tasks (depends on pmcp; nothing in this workspace depends on it,
    #    so it publishes last — it is consumed out-of-repo)

    - name: Publish pmcp-widget-utils
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-widget-utils..."
        OUTPUT=$(cargo publish -p pmcp-widget-utils 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-widget-utils already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-widget-utils"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-widget-utils
      run: sleep 30

    - name: Publish pmcp-macros-support
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-macros-support..."
        OUTPUT=$(cargo publish -p pmcp-macros-support 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-macros-support already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-macros-support"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-macros-support
      run: sleep 30

    - name: Publish pmcp-macros
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-macros..."
        OUTPUT=$(cargo publish -p pmcp-macros 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-macros already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-macros"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-macros
      run: sleep 30

    # --- Phase 128 FORK 1: `pmcp` publishes BEFORE the code-mode crates. ---
    #
    # This ORDER IS LOAD-BEARING and was REVERSED by Phase 128. Do not "restore"
    # it, and note that CLAUDE.md item 2's pre-Phase-128 rationale for the old
    # order was measured FALSE (it attributed the order to a `pmcp` feature that
    # does not exist in root `[features]`; the real cause was a retained dev-dep).
    #
    # Why `pmcp` must go first now: `crates/pmcp-code-mode/Cargo.toml` requires a
    # `pmcp` carrying the `schema-validation` feature (D-09 / Q2 — the ONE copy of
    # the placeholder floor lives in core and pmcp-code-mode re-exports it). A
    # code-mode publish running first would resolve the highest ALREADY-published
    # `pmcp`, which has no such feature, and die at this step — and every step
    # below tolerates only an "already exists" failure, so the job would exit
    # having published NOTHING from the release.
    #
    # What made this order possible: root `Cargo.toml`'s `pmcp-code-mode` and
    # `pmcp-code-mode-derive` dev-deps are now PATH-ONLY. A dev-dep carrying both
    # `path` and `version` is RETAINED in the published manifest and must resolve
    # on crates.io, which is what previously forced the code-mode crates to go
    # first. Reordering WITHOUT that change moves the failure here instead of
    # removing it.
    #
    # Guarded twice: `tests/root_dev_dep_path_only.rs` fails if a `version` key
    # comes back, and `scripts/check-release-coverage.sh`'s PHASE-128 order region
    # fails if this order is reverted. Both run inside `make quality-gate`.
    - name: Publish pmcp (core SDK)
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp..."
        OUTPUT=$(cargo publish -p pmcp 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp already published, continuing..."
          else
            echo "::error::Failed to publish pmcp"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp
      run: sleep 30

    - name: Publish pmcp-code-mode
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-code-mode..."
        OUTPUT=$(cargo publish -p pmcp-code-mode 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-code-mode already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-code-mode"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-code-mode
      run: sleep 30

    - name: Publish pmcp-code-mode-derive
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-code-mode-derive..."
        OUTPUT=$(cargo publish -p pmcp-code-mode-derive 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-code-mode-derive already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-code-mode-derive"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-code-mode-derive
      run: sleep 30

    # --- v2.2 config-driven server toolkit (first published in v2.9.0) ---
    # pmcp-server-toolkit depends on pmcp + pmcp-code-mode (both published above);
    # the three per-backend connectors depend on the toolkit; pmcp-sql-server
    # depends on the toolkit + all three connectors; pmcp-openapi-server depends
    # on the toolkit. (mcp-tester is only a dev-dependency of the servers and is
    # already on crates.io, so it does not gate this tier.)
    # --- v2.3 workbook leaves — MUST precede pmcp-server-toolkit, which has an
    # OPTIONAL dependency on pmcp-workbook-runtime; crates.io rejects a publish whose
    # dependencies (even optional) are not yet on the index.
    # Internal order matters: pmcp-workbook-runtime is the only true leaf;
    # pmcp-workbook-dialect depends on it, so runtime must publish AND index first.
    - name: Publish pmcp-workbook-runtime
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-workbook-runtime..."
        OUTPUT=$(cargo publish -p pmcp-workbook-runtime 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-workbook-runtime already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-workbook-runtime"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-workbook-runtime
      run: sleep 30

    - name: Publish pmcp-workbook-dialect
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-workbook-dialect..."
        OUTPUT=$(cargo publish -p pmcp-workbook-dialect 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-workbook-dialect already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-workbook-dialect"
            exit 1
          fi
        }

    - name: Wait for crates.io to index the workbook leaves
      run: sleep 30

    - name: Publish pmcp-server-toolkit
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-server-toolkit..."
        OUTPUT=$(cargo publish -p pmcp-server-toolkit 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-server-toolkit already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-server-toolkit"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-server-toolkit
      run: sleep 30

    - name: Publish pmcp-toolkit-postgres
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-toolkit-postgres..."
        OUTPUT=$(cargo publish -p pmcp-toolkit-postgres 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-toolkit-postgres already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-toolkit-postgres"
            exit 1
          fi
        }

    - name: Publish pmcp-toolkit-mysql
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-toolkit-mysql..."
        OUTPUT=$(cargo publish -p pmcp-toolkit-mysql 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-toolkit-mysql already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-toolkit-mysql"
            exit 1
          fi
        }

    - name: Publish pmcp-toolkit-athena
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-toolkit-athena..."
        OUTPUT=$(cargo publish -p pmcp-toolkit-athena 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-toolkit-athena already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-toolkit-athena"
            exit 1
          fi
        }

    - name: Wait for crates.io to index the toolkit connectors
      run: sleep 30

    - name: Publish pmcp-sql-server
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-sql-server..."
        OUTPUT=$(cargo publish -p pmcp-sql-server 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-sql-server already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-sql-server"
            exit 1
          fi
        }

    - name: Publish pmcp-openapi-server
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-openapi-server..."
        OUTPUT=$(cargo publish -p pmcp-openapi-server 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-openapi-server already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-openapi-server"
            exit 1
          fi
        }

    - name: Wait for crates.io to index the toolkit servers
      run: sleep 30

    # --- v2.3 workbook compiler + server (after the toolkit they depend on) ---
    # pmcp-workbook-dialect + pmcp-workbook-runtime were published earlier (BEFORE
    # pmcp-server-toolkit, which optionally depends on the runtime). The compiler
    # depends on dialect + runtime + pmcp-server-toolkit[workbook] (a dev-dependency);
    # pmcp-workbook-server depends on the toolkit[workbook,http]. cargo-pmcp (below)
    # depends on the compiler, so both must publish before it.
    - name: Publish pmcp-workbook-compiler
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-workbook-compiler..."
        OUTPUT=$(cargo publish -p pmcp-workbook-compiler 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-workbook-compiler already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-workbook-compiler"
            exit 1
          fi
        }

    - name: Publish pmcp-workbook-server
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-workbook-server..."
        OUTPUT=$(cargo publish -p pmcp-workbook-server 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-workbook-server already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-workbook-server"
            exit 1
          fi
        }

    - name: Wait for crates.io to index the workbook crates
      run: sleep 30

    - name: Publish mcp-tester
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing mcp-tester..."
        OUTPUT=$(cargo publish -p mcp-tester 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "mcp-tester already published, continuing..."
          else
            echo "::error::Failed to publish mcp-tester"
            exit 1
          fi
        }

    - name: Publish mcp-preview
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing mcp-preview..."
        OUTPUT=$(cargo publish -p mcp-preview 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "mcp-preview already published, continuing..."
          else
            echo "::error::Failed to publish mcp-preview"
            exit 1
          fi
        }

    # THE CLUSTER ORDERING CONSTRAINT (D-09). Stated, not merely implied by the
    # sequence of steps below:
    #
    #   pmcp-package publishes BEFORE pmcp-cfn-renderer, pmcp-agent, pmcp-team-servers and cargo-pmcp.
    #
    # All four of those crates declare a `pmcp-package` dependency carrying a
    # version requirement, so pmcp-package must already exist on crates.io at a
    # matching version or their publish fails with "no matching package named
    # `...`". cargo-pmcp additionally pins pmcp-cfn-renderer, pmcp-agent and
    # pmcp-team-servers, which is why it is last of the five.
    #
    # The requirement VALUES are deliberately not quoted here. Literals in
    # comments have no guard, and the ones that used to sit on these lines had
    # rotted by two minor versions before anyone noticed. The manifests are the
    # source of truth for the values (crates/pmcp-cfn-renderer/Cargo.toml,
    # crates/pmcp-agent/Cargo.toml, crates/pmcp-team-servers/Cargo.toml,
    # cargo-pmcp/Cargo.toml); CLAUDE.md's Workspace Crates ledger carries the
    # authoritative statement of this constraint under item 13.
    #
    # Dependency order among the four:
    # pmcp-package (leaf) -> pmcp-cfn-renderer (pins pmcp-package) ->
    # pmcp-agent (pins pmcp-package) -> pmcp-team-servers (pins pmcp-agent +
    # pmcp-package). All are experimental 0.x, so each keeps the same
    # "already exists"-tolerant guard — a failure here must not gate the
    # already-published core `pmcp` SDK.
    #
    # This ORDER is machine-checked: scripts/check-release-coverage.sh asserts
    # pmcp-package's publish step precedes all four consumers' steps (D-10), so a
    # prose-versus-workflow order bug of the kind PR #303 fixed is now a build
    # failure rather than a discovery.
    #
    # pmcp-package is workspace-EXCLUDED (own [workspace] table), so it publishes
    # via --manifest-path, NOT `-p pmcp-package`.
    - name: Publish pmcp-package
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-package..."
        OUTPUT=$(cargo publish --manifest-path crates/pmcp-package/Cargo.toml 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-package already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-package"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-package
      run: sleep 30

    # pmcp-cfn-renderer (CFN-renderer extraction) publishes right after
    # pmcp-package, its only internal dependency. It pins pmcp-package by
    # version — read crates/pmcp-cfn-renderer/Cargo.toml for the current
    # requirement rather than trusting a number quoted here, and see that
    # crate's tests/goldens/README.md "Cross-crate publish coupling" section for
    # why the coupling exists. It publishes BEFORE cargo-pmcp, which pins
    # pmcp-cfn-renderer by version (it replaces `npx cdk synth`/`cdk deploy` for
    # unmodified scaffolds on the pmcp-run and aws-lambda deploy targets).
    # Experimental 0.x — a failure here must not gate the core SDK release.
    - name: Publish pmcp-cfn-renderer
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-cfn-renderer..."
        OUTPUT=$(cargo publish -p pmcp-cfn-renderer 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-cfn-renderer already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-cfn-renderer"
            exit 1
          fi
        }

    - name: Wait for crates.io to index pmcp-cfn-renderer
      run: sleep 30

    - name: Publish pmcp-agent
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-agent..."
        OUTPUT=$(cargo publish -p pmcp-agent 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-agent already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-agent"
            exit 1
          fi
        }

    - name: Publish pmcp-team-servers
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-team-servers..."
        OUTPUT=$(cargo publish -p pmcp-team-servers 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-team-servers already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-team-servers"
            exit 1
          fi
        }

    - name: Wait for crates.io to index the agent/team crates
      run: sleep 30

    # cargo-pmcp (the user-facing CLI) publishes AFTER its pmcp-agent/
    # pmcp-team-servers/pmcp-package deps (above) and BEFORE pmcp-server, so a
    # future pmcp-server packaging issue cannot block the main CLI from shipping.
    - name: Publish cargo-pmcp
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing cargo-pmcp..."
        OUTPUT=$(cargo publish -p cargo-pmcp 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "cargo-pmcp already published, continuing..."
          else
            echo "::error::Failed to publish cargo-pmcp"
            exit 1
          fi
        }

    - name: Wait for crates.io to index cargo-pmcp
      run: sleep 30

    - name: Publish pmcp-server
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-server..."
        OUTPUT=$(cargo publish -p pmcp-server 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-server already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-server"
            exit 1
          fi
        }

    # pmcp-tasks: experimental 0.x leaf. Depends on `pmcp` only, and NOTHING in
    # this workspace depends on it — so it publishes late, for the same reason
    # pmcp-package does: a failure here must not abort the job before the core
    # SDK and its dependents publish. It is consumed out-of-repo (pmcp-run's
    # built-in servers pin it with `features = ["dynamodb"]`), which is why it
    # must publish at all rather than staying a path-dep.
    - name: Publish pmcp-tasks
      env:
        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
      run: |
        echo "Publishing pmcp-tasks..."
        OUTPUT=$(cargo publish -p pmcp-tasks 2>&1) && echo "$OUTPUT" || {
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "already exists"; then
            echo "pmcp-tasks already published, continuing..."
          else
            echo "::error::Failed to publish pmcp-tasks"
            exit 1
          fi
        }

    # NOTE: pmcp-package is NOT published here. Its publish step moved UP the
    # job (before pmcp-cfn-renderer/pmcp-agent/pmcp-team-servers/cargo-pmcp)
    # when those crates started pinning it — a stale duplicate step used to sit
    # here with a "has NO in-repo consumers yet" comment that had been false
    # since Phase 108, re-running the publish a second time per release.

  publish-mcp:
    name: Publish to MCP Registry
    runs-on: ubuntu-latest
    needs: publish-crates
    permissions:
      id-token: write  # Required for OIDC authentication
      contents: read
    steps:
    - uses: actions/checkout@v7

    - name: Wait for crates.io availability
      run: |
        echo "Waiting 60 seconds for crates.io to index all packages..."
        sleep 60

    - name: Install MCP Publisher
      run: |
        PLATFORM=$(uname -s | tr '[:upper:]' '[:lower:]')
        ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
        curl -sL "https://github.com/modelcontextprotocol/registry/releases/download/v1.7.9/mcp-publisher_${PLATFORM}_${ARCH}.tar.gz" | tar xz
        chmod +x mcp-publisher

    - name: Login to MCP Registry
      run: ./mcp-publisher login github-oidc

    - name: Publish to MCP Registry
      run: ./mcp-publisher publish

  build-tester:
    name: Build Tester Binaries
    needs: create-release
    uses: ./.github/workflows/release-binary.yml
    with:
      tag_name: ${{ needs.create-release.outputs.version }}
      package_name: mcp-tester
    secrets: inherit

  build-pmcp-server:
    name: Build PMCP Server Binaries
    needs: create-release
    uses: ./.github/workflows/release-binary.yml
    with:
      tag_name: ${{ needs.create-release.outputs.version }}
      package_name: pmcp-server
    secrets: inherit

  # Shape A pure-config connector binaries (CFN-renderer extraction, Task 10):
  # `cargo pmcp deploy --target aws-lambda` on a `[metadata].server_type`
  # project (ServerShape::BuiltIn — see
  # cargo-pmcp/src/deployment/targets/aws_lambda/artifact.rs) fetches one of
  # these three as a bare `<name>-<target-triple>` GitHub Release asset (same
  # `.sha256` sidecar convention as mcp-tester/pmcp-server above). Before this
  # job existed, none of the three were ever built by this workflow, so a
  # real built-in deploy 404'd (T8/T10 gap, closed here).
  build-pmcp-sql-server:
    name: Build PMCP SQL Server Binaries
    needs: create-release
    uses: ./.github/workflows/release-binary.yml
    with:
      tag_name: ${{ needs.create-release.outputs.version }}
      package_name: pmcp-sql-server
    secrets: inherit

  build-pmcp-workbook-server:
    name: Build PMCP Workbook Server Binaries
    needs: create-release
    uses: ./.github/workflows/release-binary.yml
    with:
      tag_name: ${{ needs.create-release.outputs.version }}
      package_name: pmcp-workbook-server
    secrets: inherit

  build-pmcp-openapi-server:
    name: Build PMCP OpenAPI Server Binaries
    needs: create-release
    uses: ./.github/workflows/release-binary.yml
    with:
      tag_name: ${{ needs.create-release.outputs.version }}
      package_name: pmcp-openapi-server
    secrets: inherit