Skip to content

Give mcpb/manifest.json's version an owner in the release pipeline (Refs #311) - #325

Merged
kiki830621 merged 2 commits into
mainfrom
idd/311-manifest-version-guard
Aug 1, 2026
Merged

Give mcpb/manifest.json's version an owner in the release pipeline (Refs #311)#325
kiki830621 merged 2 commits into
mainfrom
idd/311-manifest-version-guard

Conversation

@kiki830621

Copy link
Copy Markdown
Member

Refs #311

Summary

mcpb/manifest.json's version froze at 2.7.2 for ~18 releases — nothing owned it, and Server.swift's coincidentally-identical hardcoded handshake masked it. This PR bumps it to 2.25.0, adds a fail-closed release.sh check (manifest must equal the tag), and pins the invariant in CI via ManifestVersionTests (manifest == newest released CHANGELOG header). RED-first: the test failed at 2.7.2 != 2.25.0 before the bump.

Coordination note

Shares scripts/release.sh with unmerged PR #307 (different region — #307's guard block sits adjacent). Whichever merges second resolves a trivial textual conflict; semantics are independent.

Verification

  • Guard exercised: matching tag passes, drifted tag dies.
  • Full suite: 1069 tests, 0 failures.
  • Codex lens unavailable until Aug 5 — Claude-only verify round, per batch discipline.

🤖 Generated by /idd-all. Do NOT add a GitHub close trailer — run /idd-close after merge.

The field froze at 2.7.2 for ~18 releases — no release tooling referenced
it, and the drift was masked because Server.swift's then-hardcoded
handshake version had rotted to the same value (the two wrong sources
agreed by coincidence; PR #307's dynamic handshake exposes it).

- mcpb/manifest.json bumped to the current release (2.25.0)
- release.sh dies when the manifest disagrees with the tag (fail-closed;
  JSON-parsed via python3, not grepped — it is JSON, read it as JSON;
  deliberately not auto-edited: the script requires a clean tree, so
  editing mid-release would contradict its own precondition)
- ManifestVersionTests pins manifest == newest released CHANGELOG header
  (RED at 2.7.2 vs 2.25.0 before the bump, GREEN after)

1069 tests, 0 failures.

Refs #311
@kiki830621

Copy link
Copy Markdown
Member Author

Verify: PR #325 (Refs #311)

Engine

Claude lens (sonnet, read-only from PR diff + branch files) — Codex cross-model lens unavailable (usage limit until Aug 5); single-family verify, noted per batch discipline.

Result: PASS — no blocking findings

Severity Where Finding
PASS release.sh:109-116 Guard fail-closed on all paths (file missing / bad JSON / missing key / python3 absent — 2>/dev/null || true + -z catches each); placed before every destructive op
PASS ManifestVersionTests CHANGELOG parser correctly skips [Unreleased] and would skip a hypothetical 2.26.0-rc1; XCTFails (not silently passes) if no released header exists
INFO (pre-existing) mcpb/che-apple-mail-mcp.mcpb The tracked prebuilt zip contains its own manifest at 2.7.1 (last touched 7650d5b) — post-merge the repo shows source manifest 2.25.0 vs zip 2.7.1. Pre-existing (.gitignore lists mcpb/*.mcpb but the file predates the rule); same family as #323 → recorded there
INFO (pre-existing) mcpb/manifest.json descriptions Claim "53 tools" but the tools array lists 47 entries — untouched by this PR, recorded on #323
LOW (known) release.sh × PR #307 Both branches insert guards at the same anchor (after the CHANGELOG check) — textual conflict on second merge, semantically independent, trivial resolution
INFO history Issue #40 fixed this same drift class in 2026-05 without leaving a guard — it re-accumulated to 18 versions, which validates this PR's guard+CI-test design over another one-shot value fix

Process notes: repo has no swift-test CI (CodeQL only) so the 1069/0 figure is author-machine-only; the verifier did not run the suite (working tree off-limits during batch). Diff hygiene: manifest array pretty-printing is a JSON-library side effect (values verified unchanged); the second ### Fixed heading under [Unreleased] matches existing repo convention.

Verify-gated: PASS — ready for review/merge. After merge: /idd-close #311.

@kiki830621
kiki830621 merged commit b6b2dd7 into main Aug 1, 2026
1 check passed
@kiki830621
kiki830621 deleted the idd/311-manifest-version-guard branch August 1, 2026 13:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant