python-docs-mcp-server 0.3.0__tar.gz → 0.3.2__tar.gz

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/CODEOWNERS

@@ -3,9 +3,11 @@
 # Source of truth: AGENT-EXECUTION-PIPELINE.md §2 (Forbidden Territory),
 # required by §10 (Pre-flight Checklist).
 #
-# For these rules to be ENFORCED, branch protection on `main` must enable
-# "Require review from Code Owners". CODEOWNERS alone only requests review;
-# branch protection only blocks merge when review rules are enabled.
+# These entries retain GitHub account visibility, not a human approval gate.
+# Vision owns project decisions under the 2026-10-01 pipeline amendment.
+# Required PR/CI rules enforce delivery; independent agent verification is
+# recorded against the current head. Do not require a self-approval from this
+# shared GitHub identity or treat CODEOWNERS as an independent verification.
 #
 # Autonomous agents may NOT modify these paths without explicit Vision approval
 # (pipeline §2). Any agent PR touching them must add the `supervisor-review`

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/ISSUE_TEMPLATE/autonomous-agent.yml

@@ -16,9 +16,9 @@ body:
     id: context
     attributes:
       label: Context (self-containment)
-      description: Link to the per-issue context file, this pipeline doc, the roadmap, any relevant ADR or `.planning/phases/0X-*` directory, and prior related issues.
+      description: Include working context here or link an existing context file, the pipeline, roadmap, relevant ADRs, and related issues (2026-10-01 ownership amendment).
       value: |
-        - Per-issue context file: `.planning/agent-context/<issue-slug>.md` (read this first)
+        - Working context or existing context-file link:
         - Pipeline: `AGENT-EXECUTION-PIPELINE.md`
         - Roadmap: `STRATEGIC-ROADMAP-2026-05-29.md` §<section>
         - Related issues:
@@ -41,6 +41,13 @@ body:
         - [ ] `<exact command>` <expected result>
     validations:
       required: true
+  - type: textarea
+    id: product-evidence
+    attributes:
+      label: Product evidence
+      description: For features include dated sources, a relevant alternative, baseline and target, non-goals, review date, and a revisit/removal condition. For repairs provide the reproduction or maintenance rationale.
+    validations:
+      required: true
   - type: textarea
     id: scope
     attributes:
@@ -68,10 +75,10 @@ body:
       description: The exact canonical gate, in order, plus any change-type-specific gates. Must pass before any PR is opened.
       value: |
         ```bash
-        uv run ruff check src/ tests/
-        uv run pyright src/
-        uv run pytest --tb=short -q
-        uv run python-docs-mcp-server doctor
+        uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
+        uv run --locked pyright src/ benchmarks/
+        uv run --locked pytest --tb=short -q
+        uv run --locked python-docs-mcp-server doctor
         ```
     validations:
       required: true
@@ -100,7 +107,7 @@ body:
     attributes:
       label: Agent acknowledgements
       options:
-        - label: I will work on a branch, never on `main`, and will not self-merge.
+        - label: I will work on a branch; Vision may merge only after separate current-head verification and required checks.
           required: true
         - label: I will stop and comment rather than silently expand scope or touch forbidden territory.
           required: true

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/PULL_REQUEST_TEMPLATE/agent.md

@@ -1,6 +1,8 @@
 <!--
 Autonomous-agent PR template. Enforces AGENT-EXECUTION-PIPELINE.md §6.
-PR title MUST match the issue title verbatim. Never self-merge.
+PR title MUST match the issue title verbatim. Implementers do not self-verify.
+Vision may merge after separate current-head verification and required checks
+under the 2026-10-01 ownership amendment; no human approval is required.
 -->
 
 Closes #<issue-number>
@@ -14,10 +16,10 @@ Closes #<issue-number>
 ## Validation gate output
 <!-- Paste the tail of each gate command. All must be green before opening this PR. -->
 ```text
-$ uv run ruff check src/ tests/
-$ uv run pyright src/
-$ uv run pytest --tb=short -q
-$ uv run python-docs-mcp-server doctor
+$ uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
+$ uv run --locked pyright src/ benchmarks/
+$ uv run --locked pytest --tb=short -q
+$ uv run --locked python-docs-mcp-server doctor
 ```
 <!-- Plus any change-type-specific gates from pipeline §5 (stdio smoke,
      validate-corpus, uv lock --check) that applied to this change. -->
@@ -37,6 +39,20 @@ Pending.
 
 ## Why this triggered supervisor review
 <!-- List any pipeline §7 triggers and explain each. If none, write "None."
-     If any fired: this PR is opened for supervisor review only; do not merge it yourself,
-     and ensure the `supervisor-review` label is applied. -->
+     If any fired: apply `supervisor-review` for Vision to decide. Vision can
+     resolve it and merge after separate verification; delegates cannot self-merge. -->
 None.
+
+
+## Product decision and independent evidence
+
+- Kind: feature / bugfix / maintenance / policy
+- User problem or reproducible failure:
+- Dated research and alternative/market comparison (features):
+- Baseline → target; acceptance evidence:
+- Non-goals; compatibility/security impact:
+- Outcome review date and revisit/removal condition (features):
+- Exact head/base SHA; independent verifier check; unresolved limitations:
+
+<!-- Keep the corresponding pdctl decision JSON with this evidence. A label or
+     another agent's summary does not replace the independent check. -->

python_docs_mcp_server-0.3.2/.github/RELEASE.md

@@ -0,0 +1,35 @@
+# Release process
+
+Vision releases through the project broker after the scoped GitHub Apps are
+activated (`ops/vision/README.md`). While setup is pending, release eligibility
+fails closed. Do not substitute personal tokens or bypass checks.
+
+1. Merge the version/changelog PR after independent current-head verification
+   and all required CI. `pyproject.toml`, `uv.lock`, `server.json` and its package
+   entry must agree. CI covers Python 3.12–3.14 on Ubuntu and macOS, the real
+   benchmark corpus, offline full-index regression, and installed-wheel stdio.
+2. Wait for the required checks on the resulting **main commit** to pass.
+3. Run `pdctl release EXACT_MAIN_COMMIT vX.Y.Z`. The broker confirms main
+   ancestry, the merged PR's verifier App check, main CI and manifest versions
+   before creating the tag. Release tags cannot be moved or deleted.
+4. The release workflow runs eligibility → build/test/manifest validation →
+   installed-wheel integration on Python 3.13 and 3.14 → PyPI → MCP Registry →
+   GitHub release. Integration builds documentation 3.10–3.14 before publishing.
+   PyPI receives the same wheel that passed integration, with provenance.
+5. Confirm every job succeeded, the exact version is visible on PyPI and in the
+   MCP Registry, the GitHub release has both artifacts, and a clean
+   `uvx --refresh python-docs-mcp-server@X.Y.Z --version` reports that version.
+   Confirm a representative real MCP client query before claiming client
+   compatibility; automated stdio tests are a distinct proof.
+
+The Linux publisher helper `.github/scripts/install_publisher.sh` pins the
+release URL and verifies its SHA-256 before extracting the executable. The
+manifest is validated **before** PyPI publication. Do not use an unverified
+`curl | tar` download or a moving `latest` URL.
+
+PyPI Trusted Publishing remains bound to this repository, `release.yml` and the
+`pypi` environment. Activation restricts that environment to `v*` tags and tag
+creation to the owner App; the separate immutable-tag rule has no bypass actors.
+No routine human reviewer is required. If publication partially fails, record
+which registries succeeded and diagnose the failure; never overwrite a published
+version, move a tag, or claim a release complete from a partial result.

python_docs_mcp_server-0.3.2/.github/scripts/install_publisher.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Linux amd64 release runners only. Deliberate version/digest update required.
+curl --fail --location --proto '=https' --tlsv1.2 \
+  https://github.com/modelcontextprotocol/registry/releases/download/v1.8.1/mcp-publisher_linux_amd64.tar.gz \
+  --output "${RUNNER_TEMP}/mcp-publisher.tar.gz"
+echo "a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc  ${RUNNER_TEMP}/mcp-publisher.tar.gz" | sha256sum --check
+tar -xzf "${RUNNER_TEMP}/mcp-publisher.tar.gz" -C "${RUNNER_TEMP}" mcp-publisher

python_docs_mcp_server-0.3.2/.github/scripts/release_gate.py

@@ -0,0 +1,85 @@
+"""Fail closed unless this tag names an independently verified main commit."""
+
+import json
+import os
+import re
+import urllib.request
+
+REQUIRED = {
+    "Test (Python 3.12, ubuntu-latest)",
+    "Test (Python 3.13, ubuntu-latest)",
+    "Test (Python 3.14, ubuntu-latest)",
+    "Test (Python 3.12, macos-latest)",
+    "Test (Python 3.13, macos-latest)",
+    "Test (Python 3.14, macos-latest)",
+    "Dependency audit",
+    "Analyze",
+    "Installed package smoke",
+    "Product regression",
+}
+
+
+def require_eligible(api, sha: str, verifier_app_id: int) -> None:
+    if not re.fullmatch(r"[0-9a-f]{40}", sha) or verifier_app_id <= 0:
+        raise ValueError("Exact commit and configured verifier App ID are required")
+    if api(f"compare/{sha}...main")["status"] not in {"ahead", "identical"}:
+        raise ValueError("Release commit is not on main")
+    prs = [
+        p
+        for p in api(f"commits/{sha}/pulls?per_page=100")
+        if p["merged_at"] and p["merge_commit_sha"] == sha and p["base"]["ref"] == "main"
+    ]
+    if len(prs) != 1:
+        raise ValueError("Release must be a uniquely identified merged PR")
+    head = prs[0]["head"]["sha"]
+    head_checks = api(f"commits/{head}/check-runs?per_page=100")["check_runs"]
+    codeql = [c for c in head_checks if c["name"] == "CodeQL" and c["app"]["id"] == 57789]
+    if not codeql or max(codeql, key=lambda c: c["id"])["conclusion"] != "success":
+        raise ValueError("Missing or failing CodeQL findings check on merged PR head")
+    reviews = [
+        c
+        for c in head_checks
+        if c["name"] == "Independent verification" and c["app"]["id"] == verifier_app_id
+    ]
+    parents = api(f"git/commits/{sha}")["parents"]
+    latest = max(reviews, key=lambda c: c["id"], default={})
+    if (
+        len(parents) != 1
+        or latest.get("conclusion") != "success"
+        or latest.get("external_id") != f"{parents[0]['sha']}:{head}"
+    ):
+        raise ValueError("Missing successful independent verification for merged PR head")
+    checks = api(f"commits/{sha}/check-runs?per_page=100")["check_runs"]
+    latest = {}
+    for check in sorted(checks, key=lambda c: c["id"]):
+        if check["app"]["id"] == 15368:
+            latest[check["name"]] = check
+    failed = sorted(
+        name for name in REQUIRED if latest.get(name, {}).get("conclusion") != "success"
+    )
+    if failed:
+        raise ValueError(f"Missing or failing main checks: {', '.join(failed)}")
+
+
+def main() -> None:
+    repo = os.environ["GITHUB_REPOSITORY"]
+    token = os.environ["GH_TOKEN"]
+
+    def api(path):
+        request = urllib.request.Request(
+            f"https://api.github.com/repos/{repo}/{path}",
+            headers={
+                "Authorization": f"Bearer {token}",
+                "Accept": "application/vnd.github+json",
+                "User-Agent": "release-eligibility",
+            },
+        )
+        with urllib.request.urlopen(request, timeout=30) as response:
+            return json.load(response)
+
+    require_eligible(api, os.environ["GITHUB_SHA"], int(os.environ.get("VERIFIER_APP_ID") or "0"))
+    print("Verified main commit, independent review and required main checks.")
+
+
+if __name__ == "__main__":
+    main()

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/workflows/ci.yml

@@ -6,22 +6,30 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
-        python-version: ["3.12", "3.13"]
+        python-version: ["3.12", "3.13", "3.14"]
 
+    timeout-minutes: 20
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
     runs-on: ${{ matrix.os }}
     name: Test (Python ${{ matrix.python-version }}, ${{ matrix.os }})
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-suffix: py${{ matrix.python-version }}
 
@@ -29,21 +37,24 @@ jobs:
         run: uv python install ${{ matrix.python-version }}
 
       - name: Install dependencies
-        run: uv sync --dev
+        run: uv sync --locked --dev
 
       - name: Run linter
-        run: uv run ruff check src/ tests/
+        run: uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
 
       - name: Run type checker
-        run: uv run pyright src/
+        run: uv run --locked pyright src/ benchmarks/
+
+      - name: Validate frozen benchmark corpus
+        run: uv run --locked python -m benchmarks validate-corpus --corpus docs/benchmarks/corpus.yml --schema docs/benchmarks/corpus.schema.json
 
       - name: Run tests
-        run: uv run pytest --tb=short -q
+        run: uv run --locked pytest --tb=short -q
 
       - name: Verify wheel contents
         run: |
           uv build
-          uv run python -c "
+          uv run --locked python -c "
           import zipfile, glob, sys
           wheels = glob.glob('dist/*.whl')
           if not wheels:

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/workflows/codeql.yml

@@ -22,13 +22,15 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           languages: python
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/workflows/e2e.yml

@@ -2,9 +2,18 @@ name: Slow E2E
 
 on:
   workflow_dispatch:
+  workflow_call:
+    inputs:
+      artifact-name:
+        type: string
+        required: false
+        default: ''
   schedule:
     - cron: "17 4 * * 1"
 
+permissions:
+  contents: read
+
 jobs:
   installed-build-index:
     name: Installed build-index (Python ${{ matrix.python-version }})
@@ -17,29 +26,44 @@ jobs:
         python-version: ["3.13", "3.14"]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
         with:
           cache-suffix: py${{ matrix.python-version }}
 
       - name: Set up Python ${{ matrix.python-version }}
         run: uv python install ${{ matrix.python-version }}
 
+      - name: Download release artifact
+        if: inputs.artifact-name != ''
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: dist
+
       - name: Build package
+        if: inputs.artifact-name == ''
         run: uv build
 
       - name: Install wheel in clean virtual environment
         run: |
-          uv run --python ${{ matrix.python-version }} python -m venv .e2e-venv
+          uv run --locked --python ${{ matrix.python-version }} python -m venv .e2e-venv
           .e2e-venv/bin/python -m pip install --upgrade pip
           .e2e-venv/bin/python -m pip install dist/*.whl
           .e2e-venv/bin/python-docs-mcp-server --version
 
+      - name: Smoke test the installed wheel
+        run: |
+          .e2e-venv/bin/python -m pip install pytest
+          cp tests/test_stdio_smoke.py "${RUNNER_TEMP}/test_stdio_smoke.py"
+          "${GITHUB_WORKSPACE}/.e2e-venv/bin/python" -m pytest --import-mode=importlib "${RUNNER_TEMP}/test_stdio_smoke.py" -q
+
       - name: Build and validate full docs index
         env:
-          HOME: ${{ runner.temp }}/mcp-python-docs-home
           XDG_CACHE_HOME: ${{ runner.temp }}/mcp-python-docs-cache
         run: |
           set -o pipefail
@@ -50,7 +74,7 @@ jobs:
 
       - name: Upload E2E logs and cache artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: e2e-python-${{ matrix.python-version }}
           path: |

python_docs_mcp_server-0.3.2/.github/workflows/product-quality.yml

@@ -0,0 +1,63 @@
+name: Product quality
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  installed-smoke:
+    name: Installed package smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: '3.14'
+      - name: Build and install wheel without editable source
+        run: |
+          uv sync --locked --dev
+          uv build
+          uv venv "${RUNNER_TEMP}/installed"
+          uv pip install --python "${RUNNER_TEMP}/installed/bin/python" dist/*.whl pytest
+          cp tests/test_stdio_smoke.py "${RUNNER_TEMP}/test_stdio_smoke.py"
+          cd "${RUNNER_TEMP}"
+          installed/bin/python -m pytest --import-mode=importlib test_stdio_smoke.py -q
+
+  regression:
+    name: Product regression
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      UV_PYTHON: '3.13'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - run: echo "XDG_CACHE_HOME=${RUNNER_TEMP}/docs-cache" >> "$GITHUB_ENV"
+      - run: uv sync --locked --dev
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
+        id: index
+        with:
+          path: ${{ runner.temp }}/docs-cache/mcp-python-docs/index.db
+          key: docs-regression-v1-${{ runner.os }}-${{ hashFiles('src/mcp_server_python_docs/ingestion/**', 'src/mcp_server_python_docs/storage/**', 'src/mcp_server_python_docs/__main__.py', 'uv.lock') }}
+      - name: Build full reference index
+        if: steps.index.outputs.cache-hit != 'true'
+        run: uv run --locked python-docs-mcp-server build-index --versions 3.11,3.12,3.13
+      - name: Enforce offline retrieval baseline
+        run: uv run --locked python -m benchmarks.regression --output regression-results.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: product-regression-results
+          path: regression-results.json
+          if-no-files-found: error

{python_docs_mcp_server-0.3.0 → python_docs_mcp_server-0.3.2}/.github/workflows/release.yml

@@ -9,34 +9,58 @@ concurrency:
   group: release-${{ github.ref_name }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
+  eligibility:
+    name: Release eligibility
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      checks: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Require verified main commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERIFIER_APP_ID: ${{ vars.VISION_VERIFIER_APP_ID }}
+        run: python .github/scripts/release_gate.py
+
   build:
+    needs: eligibility
     runs-on: ubuntu-latest
     name: Build & Test
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.1.0
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
       - name: Set up Python 3.13
         run: uv python install 3.13
 
       - name: Install dependencies
-        run: uv sync --dev
+        run: uv sync --locked --dev
 
       - name: Verify tag matches package version
         run: |
           TAG_VERSION="${GITHUB_REF_NAME#v}"
-          PKG_VERSION=$(uv run python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          PKG_VERSION=$(uv run --locked python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
           if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
             echo "::error::Tag ${GITHUB_REF_NAME} does not match pyproject.toml version ${PKG_VERSION}"
             exit 1
           fi
-          SERVER_VERSION=$(uv run python -c "import json; print(json.load(open('server.json'))['version'])")
-          PACKAGE_VERSION=$(uv run python -c "import json; print(json.load(open('server.json'))['packages'][0]['version'])")
+          SERVER_VERSION=$(uv run --locked python -c "import json; print(json.load(open('server.json'))['version'])")
+          PACKAGE_VERSION=$(uv run --locked python -c "import json; print(json.load(open('server.json'))['packages'][0]['version'])")
           if [ "$TAG_VERSION" != "$SERVER_VERSION" ]; then
             echo "::error::Tag ${GITHUB_REF_NAME} does not match server.json version ${SERVER_VERSION}"
             exit 1
@@ -48,20 +72,28 @@ jobs:
           echo "Version check passed: ${PKG_VERSION}"
 
       - name: Run linter
-        run: uv run ruff check src/ tests/
+        run: uv run --locked ruff check src/ tests/ benchmarks/ ops/ .github/scripts/
 
       - name: Run type checker
-        run: uv run pyright src/
+        run: uv run --locked pyright src/ benchmarks/
 
       - name: Run tests
-        run: uv run pytest --tb=short -q
+        run: uv run --locked pytest --tb=short -q
+
+      - name: Validate frozen benchmark corpus
+        run: uv run --locked python -m benchmarks validate-corpus --corpus docs/benchmarks/corpus.yml --schema docs/benchmarks/corpus.schema.json
+
+      - name: Validate MCP manifest before publication
+        run: |
+          bash .github/scripts/install_publisher.sh
+          "${RUNNER_TEMP}/mcp-publisher" validate server.json
 
       - name: Build package
         run: uv build
 
       - name: Verify wheel contents
         run: |
-          uv run python -c "
+          uv run --locked python -c "
           import zipfile, glob, sys
           wheels = glob.glob('dist/*.whl')
           if not wheels:
@@ -76,13 +108,19 @@ jobs:
           "
 
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dist
           path: dist/
 
-  publish:
+  integration:
     needs: build
+    uses: ./.github/workflows/e2e.yml
+    with:
+      artifact-name: dist
+
+  publish:
+    needs: [build, integration]
     runs-on: ubuntu-latest
     name: Publish to PyPI
     timeout-minutes: 10
@@ -94,18 +132,18 @@ jobs:
 
     steps:
       - name: Download dist artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: dist
           path: dist/
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: 'dist/*'
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
 
   publish-mcp-registry:
     needs: publish
@@ -117,21 +155,18 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Install mcp-publisher
-        run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" \
-            | tar xz mcp-publisher
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
-      - name: Validate server.json
-        run: ./mcp-publisher validate server.json
+      - name: Install verified MCP publisher
+        run: bash .github/scripts/install_publisher.sh
 
       - name: Authenticate to MCP Registry
-        run: ./mcp-publisher login github-oidc
+        run: '"${RUNNER_TEMP}/mcp-publisher" login github-oidc'
 
       - name: Publish to MCP Registry
-        run: ./mcp-publisher publish
+        run: '"${RUNNER_TEMP}/mcp-publisher" publish'
 
   github-release:
     needs:
@@ -145,13 +180,13 @@ jobs:
 
     steps:
       - name: Download dist artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: dist
           path: dist/
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           files: dist/*
           generate_release_notes: true