ci: add release and crate-publish workflows #2

Merged

David merged 1 commit from feat/MCPWEB-2-publish-pipeline into main

2026-07-18 02:37:05 +02:00

David commented

2026-07-18 02:31:32 +02:00

Owner

What

Add the release and crate-publish pipeline so mcp-web can be deployed as a versioned crate on the Pandora's Box Forgejo Cargo registry (dev.a8n.run). Implements MCPWEB-2, which is the sole remaining gate on MCPWEB-1 (the youtrack-mcp adoption cannot commit until the crate is publishable, since its docker/CI cannot resolve a sibling path dependency).

Changes

.forgejo/workflows/create-release.yml: on a merged release/v* PR, create the vX.Y.Z tag and Forgejo release from the branch name plus a git-log changelog, then dispatch publish-crates.yml for the tag. The tag is created via the Forgejo API, which raises no tag-push event, so the publish is dispatched explicitly rather than relying on the tag trigger. Ported from pandoras-box/youtrack-cli with the dispatch step added.
.forgejo/workflows/publish-crates.yml: on a v* tag push or manual workflow_dispatch(ref), verify the tag matches Cargo.toml package.version, then cargo publish --registry pandoras-box-cargo --locked. Auth via step-scoped CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN (Bearer + the write:package PAT; the prefix is mandatory or the registry returns 401). Ported from psa-systems/vervain-agent, reduced to the single generic crate.
.cargo/config.toml: define the pandoras-box-cargo registry alias (sparse index sparse+https://dev.a8n.run/api/packages/pandoras-box/cargo/). Cargo.toml sets publish = ["pandoras-box-cargo"] so the crate can never be published to crates.io.
Docs: README and CLAUDE.md gain a Releasing section, and the repository-layout list names all three workflows and .cargo/config.toml.

The release-authoring half (just create-release <major|minor|hotfix>) already ships via the common submodule and needs no change; it opens the release/vX.Y.Z PR these workflows react to.

Config prerequisites (owner)

These must exist on the repo/org for the workflows to run green:

Secret PANDORAS_BOX_PRIVATE_PACKAGE_PAT with write:package scope (used by publish-crates.yml).
Secret FORGEJO_PAT with repo scope (used by create-release.yml to create the release and dispatch the publish).
Variable RUNS_ON_OPENSUSE_BASE_LATEST (already used by check.yml).

Verification

just pre-commit green: fmt + clippy -D warnings + build + 112 tests.
cargo verify-project passes; cargo metadata reports publish: ["pandoras-box-cargo"].
First publish of the existing 0.1.0: after merge, run fj actions dispatch publish-crates.yml main -I ref=v0.1.0 (there is no v0.1.0 tag yet; the automatic path applies from the next just create-release).

#MCPWEB-2

## What Add the release and crate-publish pipeline so `mcp-web` can be deployed as a versioned crate on the Pandora's Box Forgejo Cargo registry (`dev.a8n.run`). Implements MCPWEB-2, which is the sole remaining gate on MCPWEB-1 (the youtrack-mcp adoption cannot commit until the crate is publishable, since its docker/CI cannot resolve a sibling path dependency). ## Changes - `.forgejo/workflows/create-release.yml`: on a merged `release/v*` PR, create the `vX.Y.Z` tag and Forgejo release from the branch name plus a git-log changelog, then dispatch `publish-crates.yml` for the tag. The tag is created via the Forgejo API, which raises no tag-push event, so the publish is dispatched explicitly rather than relying on the tag trigger. Ported from `pandoras-box/youtrack-cli` with the dispatch step added. - `.forgejo/workflows/publish-crates.yml`: on a `v*` tag push or manual `workflow_dispatch(ref)`, verify the tag matches `Cargo.toml` `package.version`, then `cargo publish --registry pandoras-box-cargo --locked`. Auth via step-scoped `CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN` (`Bearer ` + the `write:package` PAT; the prefix is mandatory or the registry returns 401). Ported from `psa-systems/vervain-agent`, reduced to the single generic crate. - `.cargo/config.toml`: define the `pandoras-box-cargo` registry alias (sparse index `sparse+https://dev.a8n.run/api/packages/pandoras-box/cargo/`). `Cargo.toml` sets `publish = ["pandoras-box-cargo"]` so the crate can never be published to crates.io. - Docs: README and CLAUDE.md gain a Releasing section, and the repository-layout list names all three workflows and `.cargo/config.toml`. The release-authoring half (`just create-release <major|minor|hotfix>`) already ships via the `common` submodule and needs no change; it opens the `release/vX.Y.Z` PR these workflows react to. ## Config prerequisites (owner) These must exist on the repo/org for the workflows to run green: - Secret `PANDORAS_BOX_PRIVATE_PACKAGE_PAT` with `write:package` scope (used by `publish-crates.yml`). - Secret `FORGEJO_PAT` with repo scope (used by `create-release.yml` to create the release and dispatch the publish). - Variable `RUNS_ON_OPENSUSE_BASE_LATEST` (already used by `check.yml`). ## Verification - `just pre-commit` green: fmt + clippy `-D warnings` + build + 112 tests. - `cargo verify-project` passes; `cargo metadata` reports `publish: ["pandoras-box-cargo"]`. - First publish of the existing `0.1.0`: after merge, run `fj actions dispatch publish-crates.yml main -I ref=v0.1.0` (there is no `v0.1.0` tag yet; the automatic path applies from the next `just create-release`). #MCPWEB-2

David added 1 commit

2026-07-18 02:31:32 +02:00

ci: add release and crate-publish workflows

Check / fmt + clippy + build + tests (pull_request) Successful in 33s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

5490595c39

Make mcp-web deployable as a versioned crate on the Pandora's Box Forgejo Cargo registry (dev.a8n.run). The release-authoring half (`just create-release`) already ships via the common submodule; this adds the two workflows and the registry wiring it dispatches into.

- `create-release.yml`: on a merged `release/v*` PR, create the `vX.Y.Z` tag and Forgejo release from the branch name plus a git-log changelog, then dispatch `publish-crates.yml` for the tag. The tag is created via the Forgejo API, which raises no tag-push event, so the publish is dispatched explicitly instead of relying on the tag trigger.
- `publish-crates.yml`: on a `v*` tag push or manual `workflow_dispatch(ref)`, verify the tag matches `Cargo.toml` `package.version`, then `cargo publish --registry pandoras-box-cargo --locked`. Auth via step-scoped `CARGO_REGISTRIES_PANDORAS_BOX_CARGO_TOKEN` (`Bearer ` + the `write:package` PAT; the prefix is mandatory or the registry 401s).
- `.cargo/config.toml`: define the `pandoras-box-cargo` registry alias (sparse index), and `Cargo.toml` sets `publish = ["pandoras-box-cargo"]` so the crate can never be published to crates.io.
- docs: README and CLAUDE.md gain a Releasing section and the updated workflow list.

#MCPWEB-2