python-mcp-bootstrap v0.1.5

python-mcp-bootstrap v0.1.5

First installable release after PyPI 0.1.2. The code is identical to 0.1.3;
only the version string and documentation differ.

Why the version jumps from 0.1.2 to 0.1.5

An earlier iteration of this repository published 0.1.3 and 0.1.4 through
trusted publishing. Those releases were deleted when the repository history
was replaced. PyPI permanently reserves the filenames of a deleted release, so
neither version can ever be uploaded again. 0.1.5 is the first free version
number.

• v0.1.3 remains a GitHub-only release with verified assets, but it is not
  installable from PyPI.
• 0.1.4 is skipped.
• 0.1.5 is the PyPI release that supersedes 0.1.2.

What changed in 0.1.3 (included here)

• The v0.1.2 sdist could not run its bundled test suite. The sdist now ships
  requirements-ci.txt and requirements-build.txt, repository-only workflow
  tests skip when .github/ is absent, and CI runs the extracted-sdist suite.
• Provisioning uses uv pip install --python <venv python> <install_args>, so
  a trailing consumer-supplied flag cannot swallow the interpreter argument.
• publish.yml verifies build provenance for the sdist as well as the wheel.
• CI builds with the pinned backend (--no-isolation); release-gate.yml no
  longer waits for assets that already exist.
• README and CONTRIBUTING corrections for the v0.1.2 provenance wording and
  the macOS CI schedule.

Release integrity

• v0.1.5 is an annotated tag. Assets are built once by prepare-release,
  attached to a draft, verified, and only then published; the release is
  immutable with seven assets: wheel, sdist, SHA256SUMS, three
  .sigstore.json bundles, and provenance.intoto.jsonl.
• publish.yml verifies checksums, the full release gate, and both artifact
  attestations before publishing to PyPI last with OIDC trusted publishing.

Artifacts

• python_mcp_bootstrap-0.1.5-py3-none-any.whl
• python_mcp_bootstrap-0.1.5.tar.gz
• SHA256SUMS, three .sigstore.json bundles, and provenance.intoto.jsonl