adityamparikh opened a new pull request, #174:
URL: https://github.com/apache/solr-mcp/pull/174
Findings from a CodeRabbit review of the release workflows. Every item below
was verified against the file on current `main` before being changed.
## Jobs that never run
**`release-publish.yml:518`** — `publish-mcp-registry` gates on
`needs.validate-release.outputs.proceed`, but `validate-release` is not listed
in `needs:`:
```yaml
needs: [publish-docker, publish-native-manifests]
if: ${{ needs.validate-release.outputs.proceed == 'true' }}
```
A `needs.<job>` reference to a job absent from `needs:` resolves to empty
rather than erroring, so the condition is always falsy. **MCP Registry
publishing has never run.**
**`atr-release.yml:338` / `atr-release-test.yml`** — `finish-release` has no
`needs:` at all, only `if: always() && inputs.skip_vote`, so it announces the
release in parallel with the jobs that produce it.
## Steps that fail outright
**`atr-release.yml:249,332`** — `actions/upload-artifact@v3` was retired by
GitHub.
**`release-publish.yml:555`** — the MCP Publisher download 404s today. The
published asset is `mcp-publisher_linux_amd64.tar.gz`, not
`mcp-publisher-linux-amd64.tar.gz`:
```
$ curl -sSL -o /dev/null -w '%{http_code}'
.../mcp-publisher-linux-amd64.tar.gz
404
```
Because `curl -L` has no `--fail` and is piped straight into `tar`, GitHub's
HTML error page is streamed to `tar` rather than failing the step cleanly. Now
pinned to `v1.8.0` and verified against the release's published checksum before
extraction.
## Other correctness and hardening
- `apache/tooling-actions/{upload-to-atr,release-on-atr}` were referenced at
`@main`. Pinned to a commit SHA — ASF's Actions allow-list matches by exact
SHA, and a mutable ref is not reproducible.
- `workflow_dispatch` inputs now pass through step `env` instead of being
interpolated into shell text.
- The Docker Hub publish step warned and exited 0 when credentials were
absent, so a release could report success while publishing nothing. It now
fails. Credentials move to `JIB_TO_AUTH_*` env so the token is not in the
process argument list.
- The `build.gradle.kts` version `sed` was unanchored; restricted to the
top-level `version = ` declaration.
- Dropped an unresolved `${VOTE_THREAD_NOTE}` from the announcement heredoc
— the vote thread URL is already appended by the block below it.
- `server.json`: the release step rewrote only `.packages[0].version`,
leaving the second package on `-SNAPSHOT`, so the registry entry advertised an
image tag that is never published. Now rewrites every package and fails if a
`SNAPSHOT` survives.
## Notes
Rebased onto current `main`, so it accounts for #153 (GHCR/Docker publishing
dropped from `build-and-publish.yml`) and #155 (`nightly-build.yml` removed) —
fixes for that now-deleted code are deliberately excluded. The inline `docker
login` from #154 is preserved unchanged.
All modified YAML and `server.json` parse cleanly.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
