feat: create initial release workflow for automated pypi publishing by Krishna-kg732 · Pull Request #28 · kubeflow/mcp-server

Krishna-kg732 · 2026-05-28T12:19:53Z

Add automated PyPI release pipeline

Adds a documented release workflow for kubeflow-mcp with pre-production and production publish paths.

What's included

release.yaml — GitHub Actions workflow with two triggers:
- workflow_dispatch → builds and publishes RC/dev builds to Test PyPI
- release: published → publishes stable tags to PyPI
scripts/check_version.py — fails the build if pyproject.toml and kubeflow_mcp/__init__.py versions don't match
RELEASE.md — maintainer checklist for both pre-prod and prod flows

Key behaviour

OIDC trusted publishing (no stored API tokens)
Pre-release versions (rc/dev) are blocked from production PyPI by default; maintainers can override via force_prod input
dry_run mode builds and verifies without uploading

Out of scope

Release branches, auto cherry-picks, and per-minor CHANGELOG automation (tracked separately).

Closes

#16

cc: @abhijeet-dhumal

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

chore:Updated release workflow

google-oss-prow · 2026-05-28T12:20:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kramaranya for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a documented and automated release process to publish kubeflow-mcp to Test PyPI (manual) and PyPI (on GitHub Release), using PyPI trusted publishing (OIDC) instead of API tokens.

Changes:

Introduces a GitHub Actions Release workflow to build, test, and publish to Test PyPI / PyPI via OIDC.
Adds release documentation describing versioning rules, release paths, and trusted publisher setup.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
docs/release/RELEASE.md	Documents the release process, prerequisites, and trusted publishing configuration.
.github/workflows/release.yaml	Automates build/test/package validation and publishing to Test PyPI/PyPI and attaching release assets.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+      - name: Check version and release target
+        id: vars
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          python - <<'PY'
+          import ast
+          import os
+          from pathlib import Path
+          import re
+          import tomllib


+          python - <<'PY'
+          import ast
+          import os
+          from pathlib import Path
+          import re
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              project = tomllib.load(f)["project"]


+          module = ast.parse(open("kubeflow_mcp/__init__.py", encoding="utf-8").read())
+          code_version = None
+          for node in module.body:
+              if (
+                  isinstance(node, ast.Assign)
+                  and len(node.targets) == 1
+                  and isinstance(node.targets[0], ast.Name)
+                  and node.targets[0].id == "__version__"
+                  and isinstance(node.value, ast.Constant)
+                  and isinstance(node.value.value, str)
+              ):
+                  code_version = node.value.value
+                  break


abhijeet-dhumal · 2026-06-24T05:58:50Z

Thanks @Krishna-kg732 for working on this! A few small items before /lgtm - happy to merge after these.
depends on #3

abhijeet-dhumal · 2026-06-24T06:00:15Z

+
+      - name: Setup build environment
+        run: |
+          make verify


I think we can add uv sync --extra dev (or make install) before make verify .. bare checkout won't have deps, wdyt?

okayy ,sounds good

abhijeet-dhumal · 2026-06-24T06:01:33Z

+        with:
+          verbose: true
+
+  github-release:


IIUC github-release job runs on release: published then calls softprops/action-gh-release to create a release .. release already exists. what if we use upload_url from github.event.release to attach dist/* assets instead

@Krishna-kg732 did you get time to fix this ?

abhijeet-dhumal · 2026-06-24T06:02:45Z

+          else:
+              target_ref = os.environ["GITHUB_REF"]
+
+          is_prerelease = bool(re.search(r"(?:dev|rc)", project_version, re.IGNORECASE))


is_prerelease regex (?:dev|rc) misses a, b, alpha, beta .. what does SDK release workflow use? maybe can also use PEP 440 parsing ?

yeah okayy , I will change that

abhijeet-dhumal · 2026-06-24T06:04:04Z

+          name: ${{ needs.prepare.outputs.artifact-name }}
+          path: dist/
+
+  publish-test-pypi:


IIUC workflow_dispatch can publish any branch to Test PyPI with no tag match.. maybe consider requiring version in branch name or manual input

Thanks @Krishna-kg732 , version input validation helps but I afraid you can't publish without matching both files. But we should also add a branches filter to lock workflow_dispatch to main and release-*.
that weill prevent someone accidentally publishing a feature branch to Test PyPI. One-line fix:

workflow_dispatch: branches: [main, 'release-*']

cool , makes sense
will update it

abhijeet-dhumal · 2026-06-24T06:05:49Z

PR description mentions about scripts/check_version.py exists ?

…workflow Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

abhijeet-dhumal · 2026-07-12T08:19:21Z

+.PHONY: format
+format: ## Auto-fix lint and formatting issues
+	@uv run ruff check --fix .
+	@uv run ruff format .


Duplicate format target.. it seems this block adds a format: target without --group dev, then the existing one follows with --group dev. Make uses the last definition, so this block is dead code. Please remove it.

abhijeet-dhumal · 2026-07-12T08:20:32Z

+    print(f"pyproject.toml:   {project_version}")
+    print(f"__init__.py:      {code_version}")
+
+    if project_version != code_version:


--release-tag comparison doesn't strip a v prefix. If someone tags v0.1.0 (very common convention), this check fails against 0.1.0 in pyproject.toml.

Either strip the prefix: tag = args.release_tag.removeprefix("v") or document in RELEASE.md that tags must be bare versions (no v).

abhijeet-dhumal · 2026-07-12T08:24:15Z

workflow_dispatch should have a branches.. filter restricting to main and release-*.

Without this, any branch can trigger a Test PyPI publish. Since v0.1.0 is imminent, this is worth adding now even if the full release-branch workflow (cherry-picks, branch protection) is follow-up scope.
wdyt?

This is not yet resolved.. workflow_dispatch.branches is ignored by GitHub Actions, so feature branches can still publish to Test PyPI. Please add a job-level 'if' (or fail step) locking dispatch to 'main' + 'release-*' only.

abhijeet-dhumal · 2026-07-12T08:26:39Z

also can you fix PR title to pass Check PR Title .. ⬆️

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

abhijeet-dhumal · 2026-07-18T08:59:09Z

/ok-to-test

abhijeet-dhumal · 2026-07-18T09:13:31Z

Almost there, fork Test PyPI run looks good. 🙌

One blocker before /lgtm: workflow_dispatch.branches is ignored by GitHub Actions, so feature branches can still publish to Test PyPI. Please add a job-level 'if' (or fail step) locking dispatch to 'main' + 'release-*' only.

After that I'm happy to /lgtm.

@Krishna-kg732 QQ: after the PR merges, someone with admin on kubeflow/mcp-server must create two GitHub Environments and wire them to Test PyPI / PyPI or the publish jobs will fail even though the workflow YAML is correct.. right?
cc: @andreyvelich @thesuperzapper @kramaranya

abhijeet-dhumal · 2026-07-18T10:52:11Z

@andreyvelich @thesuperzapper @kramaranya
Please review!
This is a candidate for the first mcp-server release (0.1.0rc1) tracking in #56 / #16.

Once above reviews resolved, happy to /lgtm.
Post-merge we'll still need 'test-pypi' + 'release' envs + trusted publishers.

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Krishna-kg732 · 2026-07-20T11:44:13Z

@Krishna-kg732 QQ: after the PR merges, someone with admin on kubeflow/mcp-server must create two GitHub Environments and wire them to Test PyPI / PyPI or the publish jobs will fail even though the workflow YAML is correct.. right?

yes , the release will fail if the github environment is not configured.

workflow dryrun with test-PyPi :
github actions : https://github.com/Krishna-kg732/KF-mcp-server/actions/runs/29512432425

test PyPi : https://test.pypi.org/project/kubeflow-mcp-krishna-kg732

it will default to the test pypi workflow.

Krishna-kg732 added 4 commits May 18, 2026 00:35

chore:initial release workflow

79320ec

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

chore:Added push trigger for version-file changes on main / release-*.

28888a5

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

chore:Updated release workflow

a21d7d1

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Merge pull request #2 from Krishna-kg732/chore/test-release-workflow

6c7161a

chore:Updated release workflow

google-oss-prow Bot added the do-not-merge/work-in-progress Work in progress label May 28, 2026

google-oss-prow Bot requested review from Electronic-Waste, abhijeet-dhumal and szaher May 28, 2026 12:20

google-oss-prow Bot added the size/L label May 28, 2026

Krishna-kg732 marked this pull request as ready for review June 5, 2026 14:00

Copilot AI review requested due to automatic review settings June 5, 2026 14:00

google-oss-prow Bot removed the do-not-merge/work-in-progress Work in progress label Jun 5, 2026

google-oss-prow Bot requested a review from kramaranya June 5, 2026 14:00

Copilot AI reviewed Jun 5, 2026

View reviewed changes

abhijeet-dhumal reviewed Jun 24, 2026

View reviewed changes

Krishna-kg732 added 2 commits June 29, 2026 16:06

chore(ci):address review feedback, and align the workflow with SDK's …

fa170b0

…workflow Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Merge branch 'main' into chore/release-workflow

9ff81b5

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Krishna-kg732 changed the title ~~feat(ci) : Create initial Release workflow for automated Pypi publishing~~ feat: Create initial Release workflow for automated Pypi publishing Jun 29, 2026

google-oss-prow Bot assigned Krishna-kg732 Jul 10, 2026

abhijeet-dhumal reviewed Jul 12, 2026

View reviewed changes

Comment thread scripts/check_version.py

abhijeet-dhumal reviewed Jul 12, 2026

View reviewed changes

This was referenced Jul 12, 2026

chore: add jaiakash and Krishna-kg732 as reviewers #55

Open

Kubeflow MCP Server 0.1.0 Release #56

Open

Add Krishna-kg732 as Kubeflow org member kubeflow/internal-acls#935

Merged

chore: version change is pinned to main and release branches only

2548d65

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Krishna-kg732 changed the title ~~feat: Create initial Release workflow for automated Pypi publishing~~ feat: create initial release workflow for automated pypi publishing Jul 13, 2026

google-oss-prow Bot added size/XL and removed size/L labels Jul 13, 2026

google-oss-prow Bot added the ok-to-test Approve CI for external contributors label Jul 18, 2026

chore: restrict release to specific branches

fc3d1ef

Signed-off-by: Krishna Gupta <Krishnagupta.kg2k6@gmail.com>

Uh oh!

Conversation

Krishna-kg732 commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add automated PyPI release pipeline

What's included

Key behaviour

Out of scope

Closes

Uh oh!

google-oss-prow Bot commented May 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

abhijeet-dhumal commented Jun 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abhijeet-dhumal commented Jun 24, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abhijeet-dhumal commented Jul 12, 2026

Uh oh!

abhijeet-dhumal commented Jul 18, 2026

Uh oh!

abhijeet-dhumal commented Jul 18, 2026

Uh oh!

abhijeet-dhumal commented Jul 18, 2026

Uh oh!

Krishna-kg732 commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Krishna-kg732 commented May 28, 2026 •

edited

Loading