From 3774e8dccbfc630d5fec3774537ec5ae85678106 Mon Sep 17 00:00:00 2001 From: Paul Carleton Date: Mon, 27 Jul 2026 12:08:01 +0100 Subject: [PATCH 1/2] ci: repin conformance harness to published 0.2.0-alpha.10 The conformance workflow was temporarily pinned to the pkg.pr.new build of conformance main@da56f663 because the sep-2575 checks asserting the final spec #3002 discover shape (conformance #403) and per-check expected-failures granularity (#406) had not shipped in a published release. 0.2.0-alpha.10 is now on npm and contains both (plus #409, a client request-metadata scenario fix), so point CONFORMANCE_PKG back at the registry and drop the CONFORMANCE_PKG_SHA256 digest and the fetch-and-verify steps that existed only to pin the tarball bytes. All six CI legs (server active/draft/2026/all, client all/2026) pass locally against the published alpha.10 with no baseline changes; the expected-failures comments now name the alpha.10 pin instead of the commit SHA. No-Verification-Needed: CI-config version repin; no runtime surface --- .../actions/conformance/expected-failures.yml | 4 +- .github/workflows/conformance.yml | 43 +------------------ 2 files changed, 3 insertions(+), 44 deletions(-) diff --git a/.github/actions/conformance/expected-failures.yml b/.github/actions/conformance/expected-failures.yml index 2c1717833..46c12e16b 100644 --- a/.github/actions/conformance/expected-failures.yml +++ b/.github/actions/conformance/expected-failures.yml @@ -12,7 +12,7 @@ client: # SEP-1932 (DPoP): the SDK's OAuth client does not implement DPoP proofs. - # These scenarios are new in the da56f663 referee pin. The entries are + # These scenarios are new in the 0.2.0-alpha.10 referee pin. The entries are # per-check (conformance #406) because both scenarios pass their # non-DPoP checks (discovery, token acquisition, request flow) live. - auth/dpop:sep-1932-client-token-request-proof @@ -25,7 +25,7 @@ client: - auth/dpop-nonce:sep-1932-client-rs-nonce # Workload identity federation: the OAuth client does not implement the # urn:ietf:params:oauth:grant-type:jwt-bearer grant (it answers with - # authorization_code). Also new in the da56f663 referee pin; per-check for + # authorization_code). Also new in the 0.2.0-alpha.10 referee pin; per-check for # the same reason. - auth/wif-jwt-bearer:wif-grant-type diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 9dd50debe..56bf6045b 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -18,20 +18,7 @@ env: # Use a published version, e.g. @modelcontextprotocol/conformance@0.2.0-alpha.7. # Bump deliberately and reconcile both # .github/actions/conformance/expected-failures*.yml files in the same change. - # - # Temporarily pinned to the pkg.pr.new build of conformance main@da56f663, - # which includes #403 (sep-2575 checks flipped to the post-spec-#3002 shape: - # clientInfo optional on requests, serverInfo in result _meta instead of the - # discover body) and #406 (per-check expected-failures granularity) — the - # last published npm release (0.2.0-alpha.9) still enforces the pre-#3002 - # shape. Pinned by commit SHA so the tarball cannot move under us; - # CONFORMANCE_PKG_SHA256 pins the bytes and the fetch-and-verify step below - # downloads, checks the digest, and repoints CONFORMANCE_PKG at the - # verified local copy. Repin to the next published @modelcontextprotocol/ - # conformance release (>=0.2.0-alpha.10) once it ships, then drop - # CONFORMANCE_PKG_SHA256 and the fetch-and-verify steps. - CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@da56f663" - CONFORMANCE_PKG_SHA256: "bbc94678033071df4bc9851ce2054f9dff918f4501661d1d60e2d09d8c515e6d" + CONFORMANCE_PKG: "@modelcontextprotocol/conformance@0.2.0-alpha.10" jobs: server-conformance: @@ -47,19 +34,6 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 - - name: Fetch and verify conformance harness - # Only when CONFORMANCE_PKG is a URL: download, check the recorded - # sha256, and re-point CONFORMANCE_PKG at the verified local tarball. - # When CONFORMANCE_PKG is a registry spec, this step is a no-op (npm's - # own integrity check applies). - run: | - case "$CONFORMANCE_PKG" in - https://*) - curl -fsSL "$CONFORMANCE_PKG" -o /tmp/conformance.tgz - echo "$CONFORMANCE_PKG_SHA256 /tmp/conformance.tgz" | sha256sum -c - - echo "CONFORMANCE_PKG=file:/tmp/conformance.tgz" >> "$GITHUB_ENV" - ;; - esac - run: uv sync --frozen --all-extras --package mcp-everything-server - name: Run server conformance (active suite) run: >- @@ -119,21 +93,6 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 - - name: Fetch and verify conformance harness - # Only when CONFORMANCE_PKG is a URL: download, check the recorded - # sha256, and re-point CONFORMANCE_PKG at the verified local tarball. - # When CONFORMANCE_PKG is a registry spec, this step is a no-op (npm's - # own integrity check applies). - run: | - case "$CONFORMANCE_PKG" in - https://*) - curl -fsSL "$CONFORMANCE_PKG" -o /tmp/conformance.tgz - echo "$CONFORMANCE_PKG_SHA256 /tmp/conformance.tgz" | sha256sum -c - - echo "CONFORMANCE_PKG=file:/tmp/conformance.tgz" >> "$GITHUB_ENV" - ;; - esac - # --compile-bytecode: without it, ~40 concurrently spawned interpreters - # race to byte-compile site-packages during the timing-sensitive window. - run: uv sync --frozen --all-extras --package mcp --compile-bytecode - name: Pre-compile bytecode (editable sources) run: uv run --frozen python -m compileall -q src .github/actions/conformance From 40328e72b2cb53c612503eec2cf8863756f60cde Mon Sep 17 00:00:00 2001 From: Paul Carleton Date: Mon, 27 Jul 2026 14:39:21 +0100 Subject: [PATCH 2/2] ci: pin conformance harness by tarball URL + sha256, not version spec Registry version specs and dist-tags are movable, so keep the fetch-and-verify machinery from the previous pin and point it at the published 0.2.0-alpha.10 registry tarball with its digest, rather than switching to a bare @modelcontextprotocol/conformance@0.2.0-alpha.10 spec. Digest computed from the registry tarball and verified locally; the server active leg passes against the verified local copy via the same file: repoint the workflow step performs. Also restores the --compile-bytecode rationale comment that the previous commit deleted alongside the adjacent fetch-and-verify step. No-Verification-Needed: CI-config pin change; no runtime surface --- .github/workflows/conformance.yml | 41 ++++++++++++++++++++++++++++--- 1 file changed, 37 insertions(+), 4 deletions(-) diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 56bf6045b..d940a5a0d 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -15,10 +15,15 @@ permissions: env: # Pinned conformance harness package spec (passed verbatim to `npx --yes`). - # Use a published version, e.g. @modelcontextprotocol/conformance@0.2.0-alpha.7. - # Bump deliberately and reconcile both - # .github/actions/conformance/expected-failures*.yml files in the same change. - CONFORMANCE_PKG: "@modelcontextprotocol/conformance@0.2.0-alpha.10" + # Pinned to the published release tarball by registry URL, with + # CONFORMANCE_PKG_SHA256 pinning the bytes (registry version specs and + # dist-tags are movable; the digest is not) — the fetch-and-verify step + # below downloads, checks the digest, and repoints CONFORMANCE_PKG at the + # verified local copy. Bump deliberately: update both values and reconcile + # both .github/actions/conformance/expected-failures*.yml files in the same + # change. + CONFORMANCE_PKG: "https://registry.npmjs.org/@modelcontextprotocol/conformance/-/conformance-0.2.0-alpha.10.tgz" + CONFORMANCE_PKG_SHA256: "fd3795fd3f55ee7c3395710282c3f9739ec8bffe98898bd36eca0c142e2a4234" jobs: server-conformance: @@ -34,6 +39,19 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 + - name: Fetch and verify conformance harness + # Only when CONFORMANCE_PKG is a URL: download, check the recorded + # sha256, and re-point CONFORMANCE_PKG at the verified local tarball. + # When CONFORMANCE_PKG is a registry spec, this step is a no-op (npm's + # own integrity check applies). + run: | + case "$CONFORMANCE_PKG" in + https://*) + curl -fsSL "$CONFORMANCE_PKG" -o /tmp/conformance.tgz + echo "$CONFORMANCE_PKG_SHA256 /tmp/conformance.tgz" | sha256sum -c - + echo "CONFORMANCE_PKG=file:/tmp/conformance.tgz" >> "$GITHUB_ENV" + ;; + esac - run: uv sync --frozen --all-extras --package mcp-everything-server - name: Run server conformance (active suite) run: >- @@ -93,6 +111,21 @@ jobs: - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24 + - name: Fetch and verify conformance harness + # Only when CONFORMANCE_PKG is a URL: download, check the recorded + # sha256, and re-point CONFORMANCE_PKG at the verified local tarball. + # When CONFORMANCE_PKG is a registry spec, this step is a no-op (npm's + # own integrity check applies). + run: | + case "$CONFORMANCE_PKG" in + https://*) + curl -fsSL "$CONFORMANCE_PKG" -o /tmp/conformance.tgz + echo "$CONFORMANCE_PKG_SHA256 /tmp/conformance.tgz" | sha256sum -c - + echo "CONFORMANCE_PKG=file:/tmp/conformance.tgz" >> "$GITHUB_ENV" + ;; + esac + # --compile-bytecode: without it, ~40 concurrently spawned interpreters + # race to byte-compile site-packages during the timing-sensitive window. - run: uv sync --frozen --all-extras --package mcp --compile-bytecode - name: Pre-compile bytecode (editable sources) run: uv run --frozen python -m compileall -q src .github/actions/conformance