fix(ci): arm64 binary, rust-cache SHA, and codeql runner (#1270) - #1280
Conversation
Signed-off-by: Hugues Clouatre <hugues@linux.com>
![aptu-dev[bot]](https://avatars.githubusercontent.com/in/4134521?s=60&v=4){kind=small}
There was a problem hiding this comment.
Aptu Review
✅ Approve — This PR updates CI workflows to align with the project's ARM64 infrastructure, including updating the mcp-publisher binary to the ARM64 version with verified checksums and pinning the rust-cache action to a specific SHA. It also migrates the CodeQL analysis runner to the ARM64 environment to maintain consistency across the CI pipeline.
Posted by aptu
29eef336 is a dangling commit (unreachable from any branch or tag) that zizmor correctly rejects as an impostor-commit. 4be7066a is the current tip of the stable branch. Affects: build-and-attest.yml, ci.yml (3x), release.yml, update-deps.yml Signed-off-by: Hugues Clouatre <hugues@linux.com>
There was a problem hiding this comment.
Aptu Review
✅ Approve — This PR updates CI workflows to use ARM64 runners, pins the Rust toolchain to a specific SHA, and updates the mcp-publisher artifact to the ARM64 version. These changes align the CI environment with the project's ARM64 infrastructure and improve build reproducibility.
- The file .github/workflows/release.yml appears truncated at the end, which prevents a full review of the final publish-registry step logic.
Posted by aptu
| --repo modelcontextprotocol/registry \ | ||
| --pattern "mcp-publisher_linux_amd64.tar.gz" \ | ||
| --pattern "mcp-publisher_linux_arm64.tar.gz" \ | ||
| --output /tmp/mcp-publisher.tar.gz |
There was a problem hiding this comment.
The SHA256 checksum has been updated for the ARM64 binary. Ensure this matches the upstream release artifact hash.
CodeQL CLI v2.25.6 bundles an AMD64 JVM; it cannot execute on linux/arm64. The ubuntu-24.04-arm change (F04) was incorrect -- keeping ubuntu-24.04. Signed-off-by: Hugues Clouatre <hugues@linux.com>
There was a problem hiding this comment.
Aptu Review
✅ Approve — This PR addresses CI stability issues on ARM64 runners by correcting architecture-specific binary downloads, synchronizing rust-cache action versions, and updating dangling rust-toolchain commit references to the current stable tip.
Posted by aptu
| --repo modelcontextprotocol/registry \ | ||
| --pattern "mcp-publisher_linux_amd64.tar.gz" \ | ||
| --pattern "mcp-publisher_linux_arm64.tar.gz" \ | ||
| --output /tmp/mcp-publisher.tar.gz |
There was a problem hiding this comment.
The SHA256 verification is excellent practice for external binary downloads. Ensure this is updated whenever the mcp-publisher version is bumped.
…links (#1285) - docs/audit/2026-07-05-v0.22.3.md: add Fixed column to summary table with PR links (#1280-#1283); replace Fix/Regression gate/PR group blocks with concise Resolution lines for all confirmed findings; correct F04 (CodeQL stays on AMD64; ARM64 JVM incompatible); update subsystem review statuses; replace Regression Strategy with Resolution Summary table - docs/OBSERVABILITY.md: delete stale duplicate of docs/METRICS.md (renamed in #1265) - docs/ARCHITECTURE.md, docs/DESIGN-GUIDE.md, docs/METRICS.md, docs/ROADMAP.md: replace relative ../OBSERVABILITY.md links with absolute URLs; DESIGN-GUIDE.md metrics schema links updated to METRICS.md Signed-off-by: Hugues Clouatre <hugues@linux.com>
1 participant
Summary
Three CI workflow fixes from the v0.22.3 audit (issue #1270) plus a zizmor
impostor-commitfix.publish-registry-manual.ymlwas downloadingmcp-publisher_linux_amd64.tar.gzon anubuntu-24.04-armrunner, causing "Exec format error" at execution. Swapped tomcp-publisher_linux_arm64.tar.gzwith the correct ARM64 SHA256.build-and-attest.ymlpinnedSwatinem/rust-cachetoe18b4977(v2 floating) while all three references inci.ymlusedc19371144(v2.9.1). Pinned toc19371144to match.codeql.ymlwas left onubuntu-24.04. CodeQL CLI v2.25.6 bundles an AMD64 JVM and cannot execute onlinux/arm64; migrating the CodeQL runner requires a separate action version bump.dtolnay/rust-toolchain@29eef336is a dangling commit — the prior tip of thestablebranch, no longer reachable from any branch or tag. Updated to4be7066a(currentstabletip) across all 6 occurrences inbuild-and-attest.yml,ci.yml(x3),release.yml, andupdate-deps.yml.Changes
.github/workflows/publish-registry-manual.yml— arm64 artifact + SHA256.github/workflows/build-and-attest.yml— rust-cache SHA + rust-toolchain SHA.github/workflows/ci.yml— rust-toolchain SHA (3x).github/workflows/release.yml— rust-toolchain SHA.github/workflows/update-deps.yml— rust-toolchain SHACloses #1270