Fix MCP Registry publication gate

.github/workflows/publish-mcp.yml

@@ -0,0 +1,71 @@
+name: publish-mcp
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Exact already-published PyPI version
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-mcp-${{ inputs.version }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Validate package and publish MCP descriptor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Validate descriptor and public package identity
+        run: |
+          python - <<'PY'
+          import json
+          import os
+          import pathlib
+          import re
+          import urllib.request
+
+          version = os.environ["VERSION"]
+          assert re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version)
+          server = json.loads(pathlib.Path("server.json").read_text())
+          package = server["packages"][0]
+          assert server["name"] == "io.github.chaoz23/charactercheck"
+          assert server["version"] == version
+          assert len(server["description"]) <= 100
+          assert package["identifier"] == "charactercheck"
+          assert package["version"] == version
+          assert package["runtimeArguments"][0]["value"] == f"charactercheck=={version}"
+          with urllib.request.urlopen(
+              f"https://pypi.org/pypi/charactercheck/{version}/json",
+              timeout=30,
+          ) as response:
+              metadata = json.load(response)
+          assert metadata["info"]["version"] == version
+          assert {item["packagetype"] for item in metadata["urls"]} == {
+              "bdist_wheel", "sdist",
+          }
+          PY
+      - name: Install checksum-pinned MCP publisher v1.8.0
+        run: |
+          curl --fail --location --silent --show-error \
+            --output mcp-publisher.tar.gz \
+            https://github.com/modelcontextprotocol/registry/releases/download/v1.8.0/mcp-publisher_linux_amd64.tar.gz
+          echo "1370446bbe74d562608e8005a6ccce02d146a661fbd78674e11cc70b9618d6cf  mcp-publisher.tar.gz" | sha256sum --check
+          tar -xzf mcp-publisher.tar.gz mcp-publisher
+      - name: Publish descriptor with GitHub OIDC
+        run: |
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish

.github/workflows/release.yml

@@ -183,7 +183,13 @@ jobs:
             test "$attempt" -lt 6
             sleep 10
           done
-          python -m pip download --no-deps --no-binary=:all: --dest public "charactercheck==${VERSION}"
+          for attempt in 1 2 3 4 5 6; do
+            if python -m pip download --no-deps --no-binary=:all: --dest public "charactercheck==${VERSION}"; then
+              break
+            fi
+            test "$attempt" -lt 6
+            sleep 10
+          done
           test "$(find public -maxdepth 1 -name '*.whl' | wc -l)" -eq 1
           test "$(find public -maxdepth 1 -name '*.tar.gz' | wc -l)" -eq 1
           python -m venv "${RUNNER_TEMP}/public-cold"

server.json

@@ -1,7 +1,7 @@
 {
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.chaoz23/charactercheck",
- "description": "Read-only CharacterCheck 0.7.0 MCP server for deterministic character context with provenance and trust states.",
+ "description": "Read-only CharacterCheck MCP server for deterministic character context with provenance and trust.",
  "version": "0.7.0",
  "repository": {
   "url": "https://github.com/chaoz23/charactercheck",

tests/test_cold_start.py

@@ -268,6 +268,8 @@ def test_every_file_reports_the_same_version(self):
 
         if os.path.exists(os.path.join(self.root, "server.json")):
             found = []
+            server = json.loads(self._read("server.json"))
+            self.assertLessEqual(len(server["description"]), 100)
 
             def walk(o):
                 if isinstance(o, dict):
@@ -279,7 +281,7 @@ def walk(o):
                 elif isinstance(o, list):
                     for x in o:
                         walk(x)
-            walk(json.loads(self._read("server.json")))
+            walk(server)
             for i, v in enumerate(found):
                 seen[f"server.json[{i}]"] = v