python-mcp-bootstrap v0.1.2

python-mcp-bootstrap v0.1.2

First published release of the hardened 0.1.x line, and the first release
produced by the draft-first pipeline.

Why 0.1.2 and not 0.1.1

v0.1.1 was tagged on the same content, but its release could not be
republished: GitHub's immutable-release rule burns the tag name once the
original immutable release is deleted (tag_name was used by an immutable release). The tag is kept as history; this release ships the same content
under a fresh tag.

Highlights

• Draft-first artifacts: prepare-release.yml builds, checksums, attests and
  signs the wheel, sdist and SHA256SUMS, attaches them to a draft, and
  verifies the draft. publish.yml then verifies the published assets and
  publishes to PyPI last, with no permission to modify release assets.
• verify_import runs on every interpreter branch; explicit --python
  failures report verify_import_failed (exit 5), and an unstattable
  interpreter reports exec_failed (exit 8).
• BootstrapSpec is truly immutable and validates required at construction.
• Credential redaction covers Basic/Bearer/Token/Digest headers, URL passwords
  containing /, and keys such as AWS_SECRET_ACCESS_KEY.
• install_args reject system-modifying flags, file: URLs, drive-relative
  Windows paths, and value-swallowing long flags.
• Older uv versions produce an actionable upgrade tip on provisioning failure.

Release integrity

• v0.1.2 is an annotated tag; the release is published from a verified draft
  and is immutable with seven assets: wheel, sdist, SHA256SUMS, three
  .sigstore.json bundles, and provenance.intoto.jsonl.
• publish.yml verifies checksums, the full release gate, and the build
  provenance attestation before publishing to PyPI with OIDC trusted
  publishing. No stored PyPI token exists.
• Tags are unsigned; the artifact signatures and provenance live in the release
  assets.

Honest limits

• v0.1.1 has a tag but no release and was never published to PyPI.
• Path checks stay lexical (symlinks are not resolved); concurrent first runs
  against one project are not supported.
• Still alpha: the contract and exit codes follow semantic versioning.

Artifacts

• python_mcp_bootstrap-0.1.2-py3-none-any.whl
• python_mcp_bootstrap-0.1.2.tar.gz
• SHA256SUMS, three .sigstore.json bundles, and provenance.intoto.jsonl