fix(ci): repair release workflows that silently skipped or never ran

[adityamparikh]

Findings from a CodeRabbit review of the release workflows. Every item below was verified against the file on current main before being changed.

Jobs that never run

release-publish.yml:518 — publish-mcp-registry gates on needs.validate-release.outputs.proceed, but validate-release is not listed in needs::

needs: [publish-docker, publish-native-manifests]
if: ${{ needs.validate-release.outputs.proceed == 'true' }}

A needs.<job> reference to a job absent from needs: resolves to empty rather than erroring, so the condition is always falsy. MCP Registry publishing has never run.

atr-release.yml:338 / atr-release-test.yml — finish-release has no needs: at all, only if: always() && inputs.skip_vote, so it announces the release in parallel with the jobs that produce it.

Steps that fail outright

atr-release.yml:249,332 — actions/upload-artifact@v3 was retired by GitHub.

release-publish.yml:555 — the MCP Publisher download 404s today. The published asset is mcp-publisher_linux_amd64.tar.gz, not mcp-publisher-linux-amd64.tar.gz:

$ curl -sSL -o /dev/null -w '%{http_code}' .../mcp-publisher-linux-amd64.tar.gz
404

Because curl -L has no --fail and is piped straight into tar, GitHub's HTML error page is streamed to tar rather than failing the step cleanly. Now pinned to v1.8.0 and verified against the release's published checksum before extraction.

Other correctness and hardening

• apache/tooling-actions/{upload-to-atr,release-on-atr} were referenced at @main. Pinned to a commit SHA — ASF's Actions allow-list matches by exact SHA, and a mutable ref is not reproducible.
• workflow_dispatch inputs now pass through step env instead of being interpolated into shell text.
• The Docker Hub publish step warned and exited 0 when credentials were absent, so a release could report success while publishing nothing. It now fails. Credentials move to JIB_TO_AUTH_* env so the token is not in the process argument list.
• The build.gradle.kts version sed was unanchored; restricted to the top-level version = declaration.
• Dropped an unresolved ${VOTE_THREAD_NOTE} from the announcement heredoc — the vote thread URL is already appended by the block below it.
• server.json: the release step rewrote only .packages[0].version, leaving the second package on -SNAPSHOT, so the registry entry advertised an image tag that is never published. Now rewrites every package and fails if a SNAPSHOT survives.

Notes

Rebased onto current main, so it accounts for #153 (GHCR/Docker publishing dropped from build-and-publish.yml) and #155 (nightly-build.yml removed) — fixes for that now-deleted code are deliberately excluded. The inline docker login from #154 is preserved unchanged.

All modified YAML and server.json parse cleanly.

🤖 Generated with Claude Code