This is an automated email from the ASF dual-hosted git repository.
cgivre pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/drill-mcp.git
The following commit(s) were added to refs/heads/main by this push:
new 9fb2981 Add release scripts and mcp-name marker
9fb2981 is described below
commit 9fb298149cee570b80fff8348256572c81685434
Author: cgivre <[email protected]>
AuthorDate: Tue Oct 6 09:53:21 2026 -0400
Add release scripts and mcp-name marker
prepare-release.sh builds, signs and checksums a release candidate
(source release plus PyPI sdist and wheel) reproducibly from a tagged
commit. verify-release.sh checks signatures, checksums, LICENSE/NOTICE
and runs the tests from the source release, as a voter would.
The README carries the mcp-name marker the MCP Registry uses to verify
PyPI package ownership.
---
README.md | 2 +
dev-support/release/prepare-release.sh | 87 ++++++++++++++++++++++++++++++++++
dev-support/release/verify-release.sh | 54 +++++++++++++++++++++
3 files changed, 143 insertions(+)
diff --git a/README.md b/README.md
index baf20cf..70d0053 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
# Drill-MCP Server
+<!-- mcp-name: io.github.apache/drill-mcp -->
+
The official [MCP](https://modelcontextprotocol.io/) server for [Apache
Drill](https://drill.apache.org/).
It lets an MCP client run read-only (and narrowly, explicitly allow-listed
write) SQL against a Drill cluster, and inspect schemas, storage plugins,
diff --git a/dev-support/release/prepare-release.sh
b/dev-support/release/prepare-release.sh
new file mode 100755
index 0000000..7ddc490
--- /dev/null
+++ b/dev-support/release/prepare-release.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+# either express or implied. See the License for the specific
+# language governing permissions and limitations under the
+# License.
+#
+# Builds, signs and checksums a release candidate from the current commit.
+#
+# dev-support/release/prepare-release.sh <rc-number>
+#
+# The version comes from pyproject.toml; server.json must agree. Produces in
+# dist/release/drill-mcp-<version>-rc<N>/:
+# apache-drill-mcp-<version>-src.tar.gz the source release voted on
+# drill_mcp-<version>.tar.gz, *.whl PyPI convenience artifacts
+# each with a .asc signature and .sha512 checksum. Requires git, gpg, uv.
+#
+# Set GPG_KEY to choose a signing key other than gpg's default.
+
+set -euo pipefail
+
+rc="${1:?usage: $0 <rc-number>}"
+cd "$(git rev-parse --show-toplevel)"
+
+version=$(python3 -c 'import tomllib;
print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')
+python3 - "$version" <<'EOF'
+import json, sys
+v = sys.argv[1]
+s = json.load(open("server.json"))
+found = {s["version"], *(p["version"] for p in s["packages"])}
+if found != {v}:
+ sys.exit(f"server.json versions {sorted(found)} do not match
pyproject.toml {v}")
+EOF
+
+if [[ -n "$(git status --porcelain)" ]]; then
+ echo "working tree is not clean; commit or stash first" >&2
+ exit 1
+fi
+
+tag="v${version}-rc${rc}"
+if [[ "$(git rev-parse HEAD)" != "$(git rev-parse -q --verify
"${tag}^{commit}" || true)" ]]; then
+ echo "HEAD is not tagged ${tag}; run: git tag -s ${tag} -m 'drill-mcp
${version} RC${rc}'" >&2
+ exit 1
+fi
+
+out="dist/release/drill-mcp-${version}-rc${rc}"
+rm -rf "$out"
+mkdir -p "$out"
+
+# Commit time as the build timestamp, so anyone can rebuild the same bytes.
+export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
+
+src="apache-drill-mcp-${version}-src"
+git archive --format=tar.gz --prefix="${src}/" -o "${out}/${src}.tar.gz" HEAD
+uv build --sdist --wheel -o "$out" .
+uvx twine check "$out"/drill_mcp-*
+
+cd "$out"
+for f in *.tar.gz *.whl; do
+ gpg --batch --yes --armor --detach-sign ${GPG_KEY:+--local-user
"$GPG_KEY"} "$f"
+ shasum -a 512 "$f" > "${f}.sha512"
+done
+
+cat <<EOF
+
+Release candidate ready in ${out}:
+$(ls -1)
+
+Next steps:
+ 1. git push origin ${tag}
+ 2. svn co https://dist.apache.org/repos/dist/dev/drill/ drill-dist-dev
+ copy ${out} into it as drill-mcp-${version}-rc${rc}/, then svn add and
commit
+ 3. Run dev-support/release/verify-release.sh on the staged copy
+ 4. Call the vote on [email protected] (72 hours, 3 binding +1s)
+EOF
diff --git a/dev-support/release/verify-release.sh
b/dev-support/release/verify-release.sh
new file mode 100755
index 0000000..dd1dc8f
--- /dev/null
+++ b/dev-support/release/verify-release.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+# either express or implied. See the License for the specific
+# language governing permissions and limitations under the
+# License.
+#
+# Checks a release candidate the way a voter would.
+#
+# dev-support/release/verify-release.sh <release-candidate-dir>
+#
+# Verifies every signature and checksum, that the source release carries
+# LICENSE and NOTICE, and that its test suite passes. Import the signer's key
+# first: curl https://downloads.apache.org/drill/KEYS | gpg --import
+# Requires gpg, uv.
+
+set -euo pipefail
+
+dir="$(cd "${1:?usage: $0 <release-candidate-dir>}" && pwd)"
+cd "$dir"
+
+for f in *.tar.gz *.whl; do
+ gpg --batch --verify "${f}.asc" "$f"
+ shasum -a 512 -c "${f}.sha512"
+done
+
+src=$(ls apache-drill-mcp-*-src.tar.gz)
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+tar xzf "$src" -C "$work"
+root="${work}/${src%.tar.gz}"
+
+for f in LICENSE NOTICE; do
+ [[ -f "${root}/${f}" ]] || { echo "${src} is missing ${f}" >&2; exit 1; }
+done
+
+uv venv -q "${work}/venv"
+VIRTUAL_ENV="${work}/venv" uv pip install -q -e "${root}[dev]"
+(cd "$root" && "${work}/venv/bin/pytest" -q -p no:cacheprovider)
+
+echo
+echo "All checks passed for ${dir}"
