python-mcp-bootstrap 0.1.3__tar.gz → 0.1.4__tar.gz

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.4 — 2026-11-04
+
+- Correct the PyPI project page. PyPI renders the README captured when the
+  artifacts were built, and the 0.1.3 build predated the package being
+  published, so its page still said the project was "not published on PyPI"
+  and that CI was advisory. This release ships the current README. `core.py`
+  is unchanged.
+- Pin every GitHub Action used by `ci`, `release-gate`, and `publish` to a
+  commit SHA instead of a mutable tag or branch. The publish action runs with
+  `id-token: write`, so a moved ref could mint a PyPI token.
+- Add `Changelog` and `Documentation` project URLs.
+- Note for the record: 0.1.3 reached PyPI after its tag was cut, so the 0.1.3
+  release notes describe the state before that publication.
+
 ## 0.1.3 — 2026-11-04
 
 - Restore the single handoff that 0.1.2 removed. 0.1.2 stopped exec'ing on the

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/CONTRIBUTING.md

@@ -36,9 +36,14 @@ python scripts/vendor.py --target examples --dest _vendor/python_mcp_bootstrap.p
 
 ## CI status
 
-CI is advisory for now: there is no branch protection and there are no
-required status checks. Check the matrix before merging; a pending cell is not
-green. A green tag run is the strongest evidence for a release.
+`main` is protected. The wheel/release gate, the Python 3.12 import job, and
+the vendored example run are required status checks before a pull request
+merges, and force-pushes and branch deletions are blocked.
+
+The 3.14/3.15 matrix runs alongside those required jobs, but it is not a
+required check, so read the run rather than the badge: a queued macOS or
+Windows cell is not green. A green tag run is the strongest evidence for a
+release.
 
 ## Rules
 

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/PKG-INFO

@@ -1,8 +1,10 @@
 Metadata-Version: 2.5
 Name: python-mcp-bootstrap
-Version: 0.1.3
+Version: 0.1.4
 Summary: Pre-install Python runtime bootstrap for MCP applications.
 Project-URL: Repository, https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap
+Project-URL: Changelog, https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/blob/main/docs/contract.md
 Author-email: Ron <4zhmv6zvj2-afk@users.noreply.github.com>
 License-Expression: MIT
 License-File: LICENSE
@@ -25,6 +27,8 @@ Description-Content-Type: text/markdown
 
 # python-mcp-bootstrap
 
+[![ci](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/actions/workflows/ci.yml/badge.svg)](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/actions/workflows/ci.yml)
+
 A small setup helper for Python apps that use MCP.
 
 MCP (Model Context Protocol) is a way for AI assistants to use tools and data.
@@ -40,7 +44,6 @@ no runtime dependency on the MCP SDK and never imports one.
 it. If you are a developer adding it to an app, jump to
 [For developers](#for-developers).
 
-
 ## Do I need this?
 
 - If an app's setup tells you to run `python first_run.py`, that script uses
@@ -85,10 +88,15 @@ python -m python_mcp_bootstrap --check
 python -m python_mcp_bootstrap --version
 ```
 
-Distribution is GitHub Releases only: install the wheel or sdist from the
+Install from PyPI:
+
+```bash
+python -m pip install python-mcp-bootstrap
+```
+
+Each release also attaches the wheel, the sdist, and `SHA256SUMS` to the
 [releases page](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/releases).
-This project is **not published on PyPI**, so `pip install python-mcp-bootstrap`
-does not resolve.
+Both are built from the same tagged tree, so their digests match.
 
 Use `BootstrapSpec` and `bootstrap()` from an app's first-run wrapper:
 
@@ -183,8 +191,10 @@ python -m build
 
 CI targets Python 3.14.10 and 3.15.2 on Ubuntu, macOS, and Windows, plus a 3.12
 compatibility job, a wheel/release gate, and the vendored example first run.
-CI is advisory for now (no required status checks); check the current matrix
-before merging, and treat a pending cell as not green.
+`main` is protected: the release gate, the 3.12 job, and the vendored example
+run are required before a merge, and force-pushes and deletions are blocked.
+The OS matrix runs alongside them, so read the run rather than the badge — a
+queued cell is not green.
 
 ## Who maintains this
 

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/README.md

@@ -1,5 +1,7 @@
 # python-mcp-bootstrap
 
+[![ci](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/actions/workflows/ci.yml/badge.svg)](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/actions/workflows/ci.yml)
+
 A small setup helper for Python apps that use MCP.
 
 MCP (Model Context Protocol) is a way for AI assistants to use tools and data.
@@ -15,7 +17,6 @@ no runtime dependency on the MCP SDK and never imports one.
 it. If you are a developer adding it to an app, jump to
 [For developers](#for-developers).
 
-
 ## Do I need this?
 
 - If an app's setup tells you to run `python first_run.py`, that script uses
@@ -60,10 +61,15 @@ python -m python_mcp_bootstrap --check
 python -m python_mcp_bootstrap --version
 ```
 
-Distribution is GitHub Releases only: install the wheel or sdist from the
+Install from PyPI:
+
+```bash
+python -m pip install python-mcp-bootstrap
+```
+
+Each release also attaches the wheel, the sdist, and `SHA256SUMS` to the
 [releases page](https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/releases).
-This project is **not published on PyPI**, so `pip install python-mcp-bootstrap`
-does not resolve.
+Both are built from the same tagged tree, so their digests match.
 
 Use `BootstrapSpec` and `bootstrap()` from an app's first-run wrapper:
 
@@ -158,8 +164,10 @@ python -m build
 
 CI targets Python 3.14.10 and 3.15.2 on Ubuntu, macOS, and Windows, plus a 3.12
 compatibility job, a wheel/release gate, and the vendored example first run.
-CI is advisory for now (no required status checks); check the current matrix
-before merging, and treat a pending cell as not green.
+`main` is protected: the release gate, the 3.12 job, and the vendored example
+run are required before a merge, and force-pushes and deletions are blocked.
+The OS matrix runs alongside them, so read the run rather than the badge — a
+queued cell is not green.
 
 ## Who maintains this
 

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/docs/integration.md

@@ -24,8 +24,8 @@ consumer/
 ```json
 {
   "name": "python-mcp-bootstrap",
-  "version": "0.1.3",
-  "tag": "v0.1.3",
+  "version": "0.1.4",
+  "tag": "v0.1.4",
   "commit": "<full commit>",
   "file": "python_mcp_bootstrap.py",
   "sha256": "<sha256 of the vendored file>"

python_mcp_bootstrap-0.1.4/docs/releases/0.1.4.md

@@ -0,0 +1,60 @@
+# python-mcp-bootstrap v0.1.4
+
+A packaging correction. `src/python_mcp_bootstrap/core.py` is unchanged from
+v0.1.3; there is no behaviour change and nothing to migrate.
+
+## Fixed
+
+- **The PyPI project page now describes the project accurately.** PyPI renders
+  the README captured when the uploaded artifacts were built. The v0.1.3 build
+  happened before the package was published, so its page still said the project
+  was "not published on PyPI" and that CI was advisory. PyPI metadata is
+  immutable per upload, so the only way to correct the page is a new version;
+  this release ships the current README.
+- **GitHub Actions are pinned to commit SHAs** in `ci`, `release-gate`, and
+  `publish`, instead of mutable tags and branches. The publish action runs with
+  `id-token: write` and can mint a PyPI token, so a moved ref was the sharpest
+  supply-chain edge in the repository.
+- `Changelog` and `Documentation` project URLs were added to the package
+  metadata.
+
+## Honest limits
+
+- The v0.1.3 page on PyPI stays wrong permanently. Only 0.1.4 and later render
+  the corrected README. v0.1.3 remains installable and its code is identical to
+  0.1.4 apart from packaging metadata.
+- Pinning actions to SHAs means updates are manual. Without Dependabot version
+  updates, the pins will drift from the actions' releases; that is the price of
+  not trusting a mutable ref.
+
+## Install and verify
+
+```bash
+python -m pip install python-mcp-bootstrap==0.1.4
+python -m python_mcp_bootstrap --check
+```
+
+## Vendor into a consumer
+
+```bash
+python scripts/vendor.py \
+  --target /path/to/consumer \
+  --dest src/example/_vendor/python_mcp_bootstrap.py
+```
+
+`core.py` did not change, so an existing v0.1.3 vendored copy stays
+byte-identical. Re-vendoring to 0.1.4 only updates the manifest.
+
+## Release integrity
+
+- v0.1.4 is an annotated tag. v0.1.3, v0.1.2, v0.1.1, and v0.1.0 stay in place
+  as history.
+- The wheel and sdist are attached to this GitHub release and published to PyPI
+  by the OIDC workflow; `dist/` stays gitignored.
+- Tags are unsigned for now. An unsigned tag is not a signature; verify the
+  artifacts by digest.
+
+## Artifacts
+
+- `python_mcp_bootstrap-0.1.4-py3-none-any.whl`
+- `python_mcp_bootstrap-0.1.4.tar.gz`

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "python-mcp-bootstrap"
-version = "0.1.3"
+version = "0.1.4"
 description = "Pre-install Python runtime bootstrap for MCP applications."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -39,6 +39,8 @@ python-mcp-bootstrap = "python_mcp_bootstrap.cli:main"
 
 [project.urls]
 Repository = "https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap"
+Changelog = "https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/4zhmv6zvj2-afk/python-mcp-bootstrap/blob/main/docs/contract.md"
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/python_mcp_bootstrap"]

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/src/python_mcp_bootstrap/__init__.py

@@ -28,7 +28,7 @@ from .core import (
     version_tuple,
 )
 
-__version__ = "0.1.3"
+__version__ = "0.1.4"
 
 __all__ = [
     "CARD",

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/tests/test_release_check.py

@@ -36,7 +36,7 @@ def _local_tag_is_annotated(tag: str) -> bool:
 
 
 def test_package_version_matches_the_release() -> None:
-    assert package_version(ROOT) == "0.1.3"
+    assert package_version(ROOT) == "0.1.4"
 
 
 def test_current_tree_is_release_ready() -> None:
@@ -44,12 +44,12 @@ def test_current_tree_is_release_ready() -> None:
 
 
 @pytest.mark.skipif(
-    not _local_tag_is_annotated("v0.1.3"),
-    reason="local v0.1.3 is absent or not annotated; CI restores it after checkout",
+    not _local_tag_is_annotated("v0.1.4"),
+    reason="local v0.1.4 is absent or not annotated; CI restores it after checkout",
 )
 def test_matching_release_tag_passes(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(release_check, "_release_asset_errors", lambda *_args: [])
-    assert check(ROOT, allow_dirty=True, tag="v0.1.3") == []
+    assert check(ROOT, allow_dirty=True, tag="v0.1.4") == []
 
 
 def test_mismatched_release_tag_fails() -> None:
@@ -83,7 +83,7 @@ def test_release_asset_check_skips_without_gh(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:
     monkeypatch.setattr(release_check.shutil, "which", lambda _name: None)
-    assert _release_asset_errors(ROOT, "v0.1.3", "0.1.3") == []
+    assert _release_asset_errors(ROOT, "v0.1.4", "0.1.4") == []
     assert "skipping" in capsys.readouterr().err
 
 
@@ -91,12 +91,12 @@ def test_release_asset_check_reports_missing_assets(monkeypatch: pytest.MonkeyPa
     monkeypatch.setattr(release_check.shutil, "which", lambda _name: "/fake/gh")
     result = SimpleNamespace(
         returncode=0,
-        stdout="python_mcp_bootstrap-0.1.3-py3-none-any.whl\nSHA256SUMS\n",
+        stdout="python_mcp_bootstrap-0.1.4-py3-none-any.whl\nSHA256SUMS\n",
         stderr="",
     )
     monkeypatch.setattr(release_check.subprocess, "run", lambda *_args, **_kwargs: result)
 
-    errors = _release_asset_errors(ROOT, "v0.1.3", "0.1.3")
+    errors = _release_asset_errors(ROOT, "v0.1.4", "0.1.4")
     assert any("tar.gz" in error for error in errors)
 
 
@@ -105,15 +105,15 @@ def test_release_asset_check_accepts_full_assets(monkeypatch: pytest.MonkeyPatch
     result = SimpleNamespace(
         returncode=0,
         stdout=(
-            "python_mcp_bootstrap-0.1.3-py3-none-any.whl\n"
-            "python_mcp_bootstrap-0.1.3.tar.gz\n"
+            "python_mcp_bootstrap-0.1.4-py3-none-any.whl\n"
+            "python_mcp_bootstrap-0.1.4.tar.gz\n"
             "SHA256SUMS\n"
         ),
         stderr="",
     )
     monkeypatch.setattr(release_check.subprocess, "run", lambda *_args, **_kwargs: result)
 
-    assert _release_asset_errors(ROOT, "v0.1.3", "0.1.3") == []
+    assert _release_asset_errors(ROOT, "v0.1.4", "0.1.4") == []
 
 
 def test_check_requires_a_notes_file(tmp_path: Path) -> None:

{python_mcp_bootstrap-0.1.3 → python_mcp_bootstrap-0.1.4}/tests/test_vendor.py

@@ -23,10 +23,10 @@ def test_vendor_writes_core_and_manifest(tmp_path: Path) -> None:
     assert manifest_path.is_file()
     manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
     assert manifest["name"] == "python-mcp-bootstrap"
-    assert manifest["version"] == "0.1.3"
+    assert manifest["version"] == "0.1.4"
     assert manifest["file"] == dest.name
     assert manifest["sha256"] == sha256(dest)
-    assert manifest["tag"] == "v0.1.3"
+    assert manifest["tag"] == "v0.1.4"
     assert manifest["source"].startswith("https://github.com/")
     assert len(manifest["commit"]) == 40