From 388124d08564924452e91dff1be795d1a277ac3b Mon Sep 17 00:00:00 2001
From: Vignesh Narayanaswamy <Vigneshn@squareup.com>
Date: Fri, 3 Jul 2026 22:14:17 -0700
Subject: [PATCH] ci: publish to the MCP Registry via GitHub OIDC on each
 release

The registry authorizes io.github.block/* through the repository's own
OIDC identity, so publishing runs in CI rather than from a maintainer
laptop (which would require public org membership). The workflow syncs
server.json to the pyproject version, waits for the release to be
visible on PyPI (the registry validates the package and its mcp-name
ownership marker there), then publishes. workflow_dispatch is included
for the initial publish and manual re-runs.

Also trims the server.json description to the registry's 100-char
limit, which the first manual publish attempt surfaced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vignesh Narayanaswamy <Vigneshn@squareup.com>
---
 .github/workflows/publish-mcp.yml | 49 +++++++++++++++++++++++++++++++
 server.json                       |  2 +-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/publish-mcp.yml

diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml
new file mode 100644
index 0000000..bdea318
--- /dev/null
+++ b/.github/workflows/publish-mcp.yml
@@ -0,0 +1,49 @@
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+name: Publish to MCP Registry
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  publish-mcp:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # OIDC proof that this run comes from block/model-ledger
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Sync server.json version from pyproject.toml
+        run: |
+          VERSION=$(grep -m 1 'version =' pyproject.toml | awk -F'"' '{print $2}')
+          jq --arg v "$VERSION" \
+            '.version = $v
+             | .packages[0].version = $v
+             | .packages[0].runtimeArguments[0].value = "model-ledger[mcp,cli]==" + $v' \
+            server.json > server.tmp && mv server.tmp server.json
+          echo "Publishing version $VERSION"
+
+      - name: Wait for the version to be visible on PyPI
+        run: |
+          VERSION=$(jq -r '.version' server.json)
+          for i in $(seq 1 30); do
+            curl -sf "https://pypi.org/pypi/model-ledger/${VERSION}/json" > /dev/null && exit 0
+            echo "PyPI does not serve ${VERSION} yet (attempt ${i}/30)"
+            sleep 10
+          done
+          echo "model-ledger ${VERSION} never appeared on PyPI" >&2
+          exit 1
+
+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+
+      - name: Authenticate to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish to MCP Registry
+        run: ./mcp-publisher publish
diff --git a/server.json b/server.json
index f902f47..a7bc9a5 100644
--- a/server.json
+++ b/server.json
@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.block/model-ledger",
   "title": "Model Ledger",
-  "description": "Model inventory and governance: discover, query, and trace deployed models and their dependency graph as an append-only event log",
+  "description": "Model inventory and governance: trace deployed models and their dependencies as an append-only log",
   "version": "0.7.9",
   "repository": {
     "url": "https://github.com/block/model-ledger",