Harden capture, transactional history and release workflows for 2.1.0

.github/workflows/ci.yml

@@ -23,16 +23,18 @@ jobs:
           docker exec ci-mongo mongosh --quiet --eval 'db.runCommand({ping: 1})' && break
           sleep 1
         done
+        docker exec ci-mongo mongosh --quiet --eval 'db.runCommand({ping: 1})'
         docker exec ci-mongo mongosh --quiet --eval 'rs.initiate({_id: "rs0", members: [{_id: 0, host: "localhost:27017"}]})'
         for i in $(seq 1 30); do
           [ "$(docker exec ci-mongo mongosh --quiet --eval 'db.hello().isWritablePrimary')" = "true" ] && break
           sleep 1
         done
+        test "$(docker exec ci-mongo mongosh --quiet --eval 'db.hello().isWritablePrimary')" = true
 
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.21'
+        go-version-file: go.mod
 
     - name: Cache Go modules
       uses: actions/cache@v4
@@ -45,6 +47,16 @@ jobs:
     - name: Download dependencies
       run: go mod download
 
+    - uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+
+    - name: Validate release metadata and installer
+      run: |
+        node scripts/release-version.js --check
+        node --test scripts/release-version.test.js npm/scripts/install.test.js
+        npm pack --dry-run ./npm
+
     - name: Start MinIO (S3 chunk store backend)
       run: |
         docker run -d --name ci-minio -p 9010:9000 \
@@ -54,6 +66,7 @@ jobs:
           curl -sf http://localhost:9010/minio/health/live && break
           sleep 1
         done
+        curl -fsS http://localhost:9010/minio/health/live
 
     - name: Run tests
       env:
@@ -64,9 +77,13 @@ jobs:
         AWS_REGION: us-east-1
       run: go test -v ./...
 
-    - name: Build CLI
+    - name: Test and build CLI
       working-directory: ./cli
-      run: go build -v .
+      env:
+        ARGON_TEST_MONGODB_URI: mongodb://localhost:27017/?replicaSet=rs0
+      run: |
+        go test ./...
+        go build -v .
 
     - name: Test API
       working-directory: ./api
@@ -82,7 +99,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: '1.24'
+        go-version-file: go.mod
 
     - name: Set up Python
       uses: actions/setup-python@v5
@@ -101,11 +118,13 @@ jobs:
           docker exec compat-mongo mongosh --quiet --eval 'db.runCommand({ping: 1})' && break
           sleep 1
         done
+        docker exec compat-mongo mongosh --quiet --eval 'db.runCommand({ping: 1})'
         docker exec compat-mongo mongosh --quiet --eval 'rs.initiate({_id: "rs0", members: [{_id: 0, host: "localhost:27017"}]})'
         for i in $(seq 1 30); do
           [ "$(docker exec compat-mongo mongosh --quiet --eval 'db.hello().isWritablePrimary')" = "true" ] && break
           sleep 1
         done
+        test "$(docker exec compat-mongo mongosh --quiet --eval 'db.hello().isWritablePrimary')" = true
 
     - name: Install Python driver
       run: pip install pymongo pytest
@@ -114,19 +133,41 @@ jobs:
       run: bash compat/run.sh
 
   lint:
-    name: Lint
+    name: Vet (${{ matrix.module }})
     runs-on: ubuntu-latest
-
+    strategy:
+      matrix:
+        module: ['.', cli, api]
     steps:
-    - uses: actions/checkout@v4
-
-    - name: Set up Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: '1.21'
-
-    - name: golangci-lint
-      uses: golangci/golangci-lint-action@v6
-      with:
-        version: latest
-        args: --timeout=5m
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: |
+            go.sum
+            cli/go.sum
+            api/go.sum
+      - name: Go vet
+        working-directory: ${{ matrix.module }}
+        run: go vet ./...
+
+  vulnerabilities:
+    name: Reachable Go vulnerabilities (${{ matrix.module }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        module: ['.', cli, api]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: |
+            go.sum
+            cli/go.sum
+            api/go.sum
+      - name: Install official vulnerability scanner
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+      - name: Scan reachable dependencies against the current database
+        working-directory: ${{ matrix.module }}
+        run: govulncheck ./...

.github/workflows/publish-mcp.yml

@@ -1,53 +1,57 @@
 name: Publish to MCP Registry
 
-# Registers io.github.argon-lab/argon in the official MCP Registry.
-# Auth is GitHub OIDC (no tokens): the registry trusts that this workflow runs
-# in the argon-lab org, which grants the io.github.argon-lab/* namespace.
-#
-# Prerequisite each publish: argonctl must already be on npm at the target
-# version WITH the "mcpName" field (npm publish is manual — see runbook), because
-# the registry verifies the published package's mcpName matches server.json.
-
+# Called explicitly after npm succeeds: release events created with GITHUB_TOKEN
+# do not start another workflow. Manual dispatch is available for recovery.
 on:
-  release:
-    types: [published]
+  workflow_call:
+    inputs:
+      version:
+        description: Published npm version
+        required: true
+        type: string
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to publish, e.g. 2.0.1 (defaults to the release tag)"
-        required: false
+        description: Published npm version, for example 2.0.1
+        required: true
+        type: string
 
 permissions:
   contents: read
-  id-token: write # required for github-oidc login to the registry
+  id-token: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Resolve version
-        id: ver
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Validate and stamp the requested version
+        id: version
+        env:
+          RELEASE_VERSION: ${{ inputs.version }}
         run: |
-          v="${{ github.event.inputs.version }}"
-          [ -z "$v" ] && v="${GITHUB_REF_NAME#v}"
-          echo "version=$v" >> "$GITHUB_OUTPUT"
-
-      - name: Stamp version into server.json
+          version=$(node scripts/release-version.js "$RELEASE_VERSION")
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+      - name: Verify npm publication is visible
+        env:
+          RELEASE_VERSION: ${{ steps.version.outputs.version }}
         run: |
-          v="${{ steps.ver.outputs.version }}"
-          tmp=$(mktemp)
-          jq --arg v "$v" '.version=$v | .packages[0].version=$v' server.json > "$tmp" && mv "$tmp" server.json
-          cat server.json
-
+          for attempt in $(seq 1 12); do
+            if [ "$(npm view "argonctl@$RELEASE_VERSION" mcpName 2>/dev/null)" = io.github.argon-lab/argon ]; then
+              exit 0
+            fi
+            sleep 5
+          done
+          echo 'The matching argonctl package with mcpName is not visible on npm.' >&2
+          exit 1
       - name: Install mcp-publisher
         run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
-          sudo mv mcp-publisher /usr/local/bin/
-
-      - name: Authenticate (GitHub OIDC)
-        run: mcp-publisher login github-oidc
-
+          curl --fail --location --retry 3 --output mcp-publisher.tar.gz https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz
+          tar -xzf mcp-publisher.tar.gz mcp-publisher
+      - name: Authenticate with GitHub OIDC
+        run: ./mcp-publisher login github-oidc
       - name: Publish
-        run: mcp-publisher publish
+        run: ./mcp-publisher publish