Prepare package and server releases

.github/workflows/publish-first-cohort.yml

@@ -1,33 +1,28 @@
-name: Publish first cohort
+name: Publish package release
 
 on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Signed annotated release tag for the authorized first cohort
+        description: Signed annotated tag for the authorized package release
         required: true
         type: choice
         options:
-          - v0.3.0
+          - v0.3.1
       confirm:
-        description: I have configured the required registry publishers and reviewed the release notes
+        description: I have reviewed the release evidence, package scope, and release notes
         required: true
         type: boolean
-      npm_direct_token_published:
-        description: The authorized local direct-token publication of vyral-client is complete and ready for exact archive verification
-        required: true
-        default: false
-        type: boolean
 
 permissions: {}
 
 concurrency:
-  group: publish-first-cohort-v0.3.0
+  group: publish-package-release-v0.3.1
   cancel-in-progress: false
 
 jobs:
   validate:
-    name: Validate release authority
+    name: Validate package release authority
     runs-on: ubuntu-22.04
     permissions:
       actions: read
@@ -45,14 +40,12 @@ jobs:
         env:
           CONFIRM: ${{ inputs.confirm }}
           GITHUB_TOKEN: ${{ github.token }}
-          NPM_DIRECT_TOKEN_PUBLISHED: ${{ inputs.npm_direct_token_published }}
           RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           set -euo pipefail
           test "$GITHUB_REF" = "refs/heads/main"
           test "$CONFIRM" = "true"
-          test "$NPM_DIRECT_TOKEN_PUBLISHED" = "true"
-          test "$RELEASE_TAG" = "v0.3.0"
+          test "$RELEASE_TAG" = "v0.3.1"
           git fetch --force --tags origin
           test "$(git cat-file -t "refs/tags/${RELEASE_TAG}")" = "tag"
           source_sha="$(git rev-parse "${RELEASE_TAG}^{commit}")"
@@ -71,11 +64,13 @@ jobs:
           printf 'source_sha=%s\n' "$source_sha" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Build authorized artifacts
+    name: Build authorized package artifacts
     needs: validate
     runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      SOURCE_DATE_EPOCH: "315532800"
     steps:
       - name: Check out the authorized release commit
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -87,11 +82,6 @@ jobs:
         with:
           dotnet-version: 10.0.x
 
-      - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: 22.x
-
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
@@ -103,52 +93,38 @@ jobs:
           python -m pip install --disable-pip-version-check build==1.3.0
           python3 scripts/verify-publication-cohort.py
           dotnet restore Vyral.sln --locked-mode
-          mkdir -p artifacts/publish/nuget artifacts/publish/npm artifacts/publish/pypi
+          mkdir -p artifacts/publish/nuget artifacts/publish/pypi
           for project in \
             src/Vyral.Abstractions/Vyral.Abstractions.csproj \
-            src/Vyral.Local/Vyral.Local.csproj \
-            src/Vyral.Primitives/Vyral.Primitives.csproj \
-            src/Vyral.Execution/Vyral.Execution.csproj \
-            src/Vyral.Execution.Local/Vyral.Execution.Local.csproj; do
+            src/Vyral.Local/Vyral.Local.csproj; do
             dotnet pack "$project" --configuration Release --no-restore \
               --output artifacts/publish/nuget
           done
           python -m build --outdir artifacts/publish/pypi runtimes/python
-          (
-            cd clients/javascript
-            npm ci --ignore-scripts
-            npm run check
-            npm run typecheck
-            npm test
-            npm pack --pack-destination ../../artifacts/publish/npm
-          )
           for package in \
-            Vyral.Abstractions.0.3.0 \
-            Vyral.Local.0.3.0 \
-            Vyral.Primitives.0.2.0 \
-            Vyral.Execution.0.2.0 \
-            Vyral.Execution.Local.0.2.0; do
+            Vyral.Abstractions.0.3.1 \
+            Vyral.Local.0.3.1; do
             test -s "artifacts/publish/nuget/${package}.nupkg"
             test -s "artifacts/publish/nuget/${package}.snupkg"
           done
-          test -s artifacts/publish/pypi/vyral-0.1.1-py3-none-any.whl
-          test -s artifacts/publish/pypi/vyral-0.1.1.tar.gz
-          test -s artifacts/publish/npm/vyral-client-0.3.0.tgz
+          test -s artifacts/publish/pypi/vyral-0.1.2-py3-none-any.whl
+          test -s artifacts/publish/pypi/vyral-0.1.2.tar.gz
 
       - name: Retain immutable publication distributions
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: first-cohort-v0.3.0
+          name: package-release-v0.3.1
           path: artifacts/publish
           if-no-files-found: error
-          retention-days: 7
+          retention-days: 30
 
   publish-nuget:
-    name: Publish NuGet first cohort
+    name: Publish authorized NuGet packages
     needs: build
     runs-on: ubuntu-22.04
     environment:
       name: publish-nuget
+      url: https://www.nuget.org/profiles/Univeracity
     permissions:
       id-token: write
     steps:
@@ -160,7 +136,7 @@ jobs:
       - name: Download the authorized distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: first-cohort-v0.3.0
+          name: package-release-v0.3.1
           path: dist
 
       - name: Exchange the GitHub OIDC token for a short-lived NuGet key
@@ -175,11 +151,8 @@ jobs:
         run: |
           set -euo pipefail
           for package in \
-            Vyral.Abstractions.0.3.0 \
-            Vyral.Local.0.3.0 \
-            Vyral.Primitives.0.2.0 \
-            Vyral.Execution.0.2.0 \
-            Vyral.Execution.Local.0.2.0; do
+            Vyral.Abstractions.0.3.1 \
+            Vyral.Local.0.3.1; do
             dotnet nuget push "dist/nuget/${package}.nupkg" \
               --api-key "$NUGET_API_KEY" \
               --skip-duplicate \
@@ -191,7 +164,7 @@ jobs:
           done
 
   publish-pypi:
-    name: Publish PyPI first cohort
+    name: Publish authorized Python runtime
     needs: build
     runs-on: ubuntu-22.04
     environment:
@@ -203,7 +176,7 @@ jobs:
       - name: Download the authorized distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: first-cohort-v0.3.0
+          name: package-release-v0.3.1
           path: dist
 
       - name: Publish the Python runtime with its PyPI attestation
@@ -212,87 +185,26 @@ jobs:
           packages-dir: dist/pypi
           skip-existing: true
 
-  publish-npm:
-    name: Verify direct-token npm first cohort
-    needs: build
+  verify:
+    name: Verify public package availability
+    needs:
+      - publish-nuget
+      - publish-pypi
     runs-on: ubuntu-22.04
-    environment:
-      name: publish-npm
-      url: https://www.npmjs.com/package/vyral-client
-    permissions:
-      contents: read
+    permissions: {}
     steps:
-      - name: Set up a trusted-publishing-compatible Node and npm CLI
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "22.14.0"
-          registry-url: https://registry.npmjs.org
-          package-manager-cache: false
-
-      - name: Install the minimum trusted-publishing npm CLI
-        run: |
-          npm install --global --ignore-scripts npm@11.5.1
-          test "$(npm --version)" = "11.5.1"
-
-      - name: Download the authorized distribution
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: first-cohort-v0.3.0
-          path: dist
-
-      - name: Verify the authorized direct-token archive
-        working-directory: dist/npm
+      - name: Wait for exact registry versions
         run: |
           set -euo pipefail
-          expected_integrity="sha512-$(openssl dgst -sha512 -binary vyral-client-0.3.0.tgz | base64 -w 0)"
-          test "$(npm view vyral-client@0.3.0 version)" = "0.3.0"
-          test "$(npm view vyral-client@0.3.0 repository.url)" = "git+https://github.com/univeracity/vyral.git"
-          test "$(npm view vyral-client@0.3.0 dist.integrity)" = "$expected_integrity"
-
-  publish-container:
-    name: Publish server container
-    needs:
-      - validate
-      - build
-    runs-on: ubuntu-22.04
-    environment:
-      name: publish-container
-      url: https://github.com/Univeracity/vyral/pkgs/container/vyral-server
-    permissions:
-      attestations: write
-      contents: read
-      id-token: write
-      packages: write
-    steps:
-      - name: Check out the authorized release commit
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ needs.validate.outputs.source_sha }}
-
-      - name: Set up an attestation-capable BuildKit builder
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
-        with:
-          driver: docker-container
-
-      - name: Log in to the GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build, attest, and publish the authorized server image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
-        with:
-          context: .
-          push: true
-          sbom: true
-          provenance: mode=max
-          build-args: |
-            VYRAL_IMAGE_VERSION=0.3.0
-            VYRAL_IMAGE_REVISION=${{ needs.validate.outputs.source_sha }}
-          tags: ghcr.io/univeracity/vyral-server:0.3.0
-          labels: |
-            org.opencontainers.image.source=https://github.com/Univeracity/vyral
-            org.opencontainers.image.version=0.3.0
-            org.opencontainers.image.revision=${{ needs.validate.outputs.source_sha }}
+          for attempt in {1..40}; do
+            nuget_abstractions="$(curl --fail --silent --show-error https://api.nuget.org/v3-flatcontainer/vyral.abstractions/index.json | jq -r '.versions[-1]')" || true
+            nuget_local="$(curl --fail --silent --show-error https://api.nuget.org/v3-flatcontainer/vyral.local/index.json | jq -r '.versions[-1]')" || true
+            pypi="$(curl --fail --silent --show-error https://pypi.org/pypi/vyral/json | jq -r '.info.version')" || true
+            if [[ "$nuget_abstractions" == "0.3.1" && "$nuget_local" == "0.3.1" && "$pypi" == "0.1.2" ]]; then
+              printf 'NuGet and PyPI expose every authorized package version.\n' >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "The authorized package versions were not all visible before the verification deadline." >&2
+          exit 1

.github/workflows/publish-worker-container.yml

@@ -1,14 +1,14 @@
-name: Publish worker-capable server container
+name: Publish server container
 
 on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Signed server container tag for the reviewed worker-capable release
+        description: Signed server container tag for the reviewed release
         required: true
         type: choice
         options:
-          - server-v0.3.2
+          - server-v0.3.3
       confirm:
         description: I have reviewed the release evidence and worker capability notes
         required: true
@@ -17,7 +17,7 @@ on:
 permissions: {}
 
 concurrency:
-  group: publish-server-container-v0.3.2
+  group: publish-server-container-v0.3.3
   cancel-in-progress: false
 
 jobs:
@@ -45,7 +45,7 @@ jobs:
           set -euo pipefail
           test "$GITHUB_REF" = "refs/heads/main"
           test "$CONFIRM" = "true"
-          test "$RELEASE_TAG" = "server-v0.3.2"
+          test "$RELEASE_TAG" = "server-v0.3.3"
           git fetch --force --tags origin
           test "$(git cat-file -t "refs/tags/${RELEASE_TAG}")" = "tag"
           source_sha="$(git rev-parse "${RELEASE_TAG}^{commit}")"
@@ -102,12 +102,12 @@ jobs:
           sbom: true
           provenance: mode=max
           build-args: |
-            VYRAL_IMAGE_VERSION=0.3.2
+            VYRAL_IMAGE_VERSION=0.3.3
             VYRAL_IMAGE_REVISION=${{ needs.validate.outputs.source_sha }}
-          tags: ghcr.io/univeracity/vyral-server:0.3.2
+          tags: ghcr.io/univeracity/vyral-server:0.3.3
           labels: |
             org.opencontainers.image.source=https://github.com/Univeracity/vyral
-            org.opencontainers.image.version=0.3.2
+            org.opencontainers.image.version=0.3.3
             org.opencontainers.image.revision=${{ needs.validate.outputs.source_sha }}
 
       - name: Qualify the exact published worker image
@@ -122,6 +122,9 @@ jobs:
           scripts/verify-hosted-worker-container.sh \
             "$image" \
             artifacts/publish/hosted-worker-container.json
+          scripts/verify-mcp-container.sh \
+            "$image" \
+            artifacts/publish/mcp-container.json
           printf '%s\n' "$IMAGE_DIGEST" > artifacts/publish/image-digest.txt
           printf 'Published immutable digest: `%s`\n' "$IMAGE_DIGEST" >> "$GITHUB_STEP_SUMMARY"
 
@@ -143,7 +146,7 @@ jobs:
       - name: Retain published-image evidence
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: worker-container-server-v0.3.2
+          name: server-container-server-v0.3.3
           path: artifacts/publish
           if-no-files-found: error
           retention-days: 30

.github/workflows/release-integrity.yml

@@ -148,7 +148,7 @@ jobs:
           docker buildx build \
             --file Dockerfile \
             --tag "vyral-server-mcp-qualification:${{ github.sha }}" \
-            --build-arg VYRAL_IMAGE_VERSION=0.3.2 \
+            --build-arg VYRAL_IMAGE_VERSION=0.3.3 \
             --build-arg VYRAL_IMAGE_REVISION="${{ github.sha }}" \
             --sbom=true \
             --provenance=mode=max \

Dockerfile

@@ -18,7 +18,7 @@ RUN dotnet restore src/Vyral.Server/Vyral.Server.csproj --locked-mode --disable-
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-extra@sha256:f5b3b2e2e548828d50e349726f51a5de001286f02c4bbde77db0dd34eb9f55ff
 
-ARG VYRAL_IMAGE_VERSION=0.3.2
+ARG VYRAL_IMAGE_VERSION=0.3.3
 ARG VYRAL_IMAGE_REVISION=local
 LABEL org.opencontainers.image.title="Vyral Server" \
       org.opencontainers.image.description="Provider-portable records, retrieval, durable execution, and MCP server" \