feat(mcp): store/distribution readiness -- release machinery, MCPB bundle, Codex CLI docs #8

Activity

1. cristim

   added

   triagedItem has been triagedItem has been triaged

   priority/p2Backlog-worthyBacklog-worthy

   severity/lowMinor harmMinor harm

   urgency/this-sprintWithin the current sprintWithin the current sprint

   impact/internalTeam-internal onlyTeam-internal only

   effort/lWeeksWeeks

   type/featNew capabilityNew capability

   on Aug 25, 2026
2. cristim commented on Aug 25, 2026

   

   cristim

   on Aug 25, 2026

   MemberAuthor

   More actions

   Split into three sequenced PRs per the workstream plan's ~700-line-diff guidance, each based on main independently:

   • fix(mcp): inject build version into cudly-mcp and document Codex CLI setup cloud-commitments-cli#1891 -- B1 version-injection fix + Codex CLI docs
   • feat(mcp): add server.json for the MCP Registry + PR/tag validation CI cloud-commitments-cli#1892 -- server.json for the MCP Registry + PR/tag validation CI
   • feat(mcp): add GoReleaser + release workflow + MCPB bundle for cudly-mcp cloud-commitments-cli#1893 -- GoReleaser + release.yml + MCPB bundle (Phase C)

   None of the three carries an auto-close keyword since merge order isn't fixed and any single one merging shouldn't prematurely close this tracking issue. This issue will be closed manually once all three have merged.
3. cristim

   transferred this issue fromLeanerCloud/cloud-commitments-clion Sep 27, 2026
4. cristim commented on Oct 7, 2026

   

   cristim

   on Oct 7, 2026

   MemberAuthor

   More actions

   claimed by cc-mcp-w2
5. cristim commented on Oct 7, 2026

   

   cristim

   on Oct 7, 2026

   MemberAuthor

   More actions

   Closing as already-done: every slice this issue asks for is implemented in cloud-commitments-mcp, and verified locally on main at 86a698e.

   Evidence per slice:

   B1 + D - version injection and Codex CLI docs. cmd/cudly-mcp/main.go:30 declares var Version = "dev" with a build-time override comment; server.go:45 takes it as NewServer(version string) and passes it to gosdk.Implementation.Version (server.go:54). README.md:96 documents the ~/.codex/config.toml [mcp_servers.<name>] shape, including the project-scoped-trust caveat. Landed in 1159ab1 (CLI #1891). The end-to-end check is a real subprocess, not a unit assertion: cmd/cudly-mcp/version_test.go builds the binary with -ldflags "-X main.Version=..." and asserts over a live stdio initialize handshake. go test ./cmd/cudly-mcp/ -run Version -count=1 passes.

   B2 + B3 - server.json and its CI gate. Root server.json declares $schema https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json and name io.github.LeanerCloud/cudly-mcp, the canonical namespace. .github/workflows/mcp-server-json.yml fails loud on a schema-URL or identity mismatch, validates against the fetched official schema via .github/scripts/server-json-validator/validate.cjs, and its assert-version-matches-tag job fails when server.json.version disagrees with the pushed v* tag. Landed in 14fd3f5 and 420273a (CLI #1892).

   B4 + C - release machinery and the MCPB bundle. .goreleaser.yml builds cmd/cudly-mcp for darwin/linux on amd64/arm64, with CGO_ENABLED=0, the -X main.Version ldflag, per-platform cudly-mcp_{{.Os}}_{{.Arch}} names, and a sha256 checksum file. .github/workflows/release.yml chains consistency-gate (asserts both server.json and mcpb/manifest.json versions match the tag) -> test -> goreleaser -> mcpb -> publish-registry. The mcpb job downloads the release binaries, verifies them with sha256sum -c cudly-mcp_checksums.txt, stages them into the MCPB layout, packs with a pinned @anthropic-ai/mcpb, attests provenance for both binaries and bundle, and uploads the bundle. The publish-registry job patches the placeholder fileSha256/identifier in the ephemeral runner checkout only (never writes back to the repo), verifies the mcp-publisher binary by sha256 and a Sigstore cosign verify-blob against the registry's OIDC identity, then authenticates with mcp-publisher login github-oidc and publishes. No long-lived secret anywhere. Landed in d38a895 with follow-ups 2c6f787, 77c9f21, 2cdc02b (CLI #1893).

   Local verification on main at 86a698e: make build succeeds; go test ./... is green across all three packages (mcp 0.673s, cmd/cudly-mcp 19.815s, tools 5.163s).

   Out-of-scope items stay out of scope, as the issue itself specifies: no release tag has been cut yet (git tag is empty, gh release list is empty), and no third-party directory submission is claimed. Both are gated on a real release existing, and the machinery to make the first one is now in place.

   No code change was needed for this issue, so there is nothing to review or merge here.
6. cristim

   closed this as completedon Oct 7, 2026