Skip to content

v0.12.5

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Sep 01:22
· 5 commits to main since this release
v0.12.5
This tag was signed with the committer’s verified signature.
clouatre Hugues Clouâtre
GPG key ID: 5F980CD4EA9C8846
Verified
Learn about vigilant mode.
705c393
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Aptu Security Bot, A2A Protocol Fix, and Release Pipeline Hardening

Integrates the aptu GitHub App for automated security scanning and PR review filtering, corrects the A2A agent-card protocolVersion field, migrates from poutine to zizmor for supply-chain scanning, splits the aptu dispatcher into scoped workflows with scheduled security audits, and hardens the release pipeline itself (an amd64-only PyPI publish action pinned to an arm64 runner, and a workflow_dispatch skip-cascade) alongside a large batch of CI dependency updates.

Installation

# Local (stdio transport)
uvx math-mcp-learning-server

# Remote (streamable HTTP, no install needed)
# https://math-mcp.fastmcp.app/mcp

What's Changed

Fixes

  • agent-card: Correct A2A protocolVersion and dedupe test suite (#484)
  • ci: Forward installation-token instead of app credentials to aptu dispatchers (#485)
  • ci: Forward aptu-dev App credentials to reusable workflows (#476)
  • ci: Gate scorecard to public repos only (#470)
  • ci: Make zizmor advanced-security conditional on repo visibility (#469)
  • ci: Add continue-on-error to SARIF uploads for private repo compatibility (#468)
  • ci: Drop conflicting annotations input from scheduled zizmor step (#466)
  • Bump scan-security dispatcher pin to pick up diff-scoped scanning (#479)
  • release: Use ubuntu-24.04 for the PyPI publish job — pypa/gh-action-pypi-publish is amd64-only (#487)
  • release: Prevent a skipped verify-tag-signature from cascading a skip through create-release on workflow_dispatch (#488)

CI

  • Pin dispatcher reusable workflows to v0.1.0 tag (#482)
  • Remove poutine scanner in favor of zizmor (#478)
  • Split aptu dispatcher into 3 workflows (#477)
  • Add aptu dispatch handler workflow (#473)
  • Make zizmor/poutine findings persistent, wire Renovate to CVE alerts (#463)
  • Add scheduled security audit, fix typecheck gating (#462)
  • Restore scorecard.dev publishing via monthly amd64 exception job (#461)
  • Fix Scorecard ARM64 incompatibility, tighten zizmor gate (#460)
  • Configure aptu GitHub App (security scan + review filtering) (#452)
  • Align workflows with template best practices (#447)

Chores

  • aptu: Remove dead api-key-secret field from aptu.yml (#474)
  • aptu: Standardize aptu.yml to canonical openrouter config (#441)
  • aptu: Switch AI provider from Gemini to OpenRouter gemma-4-26b-a4b-it:free (#440)
  • deps: Lock file maintenance (#472, #439)
  • deps: Update github/codeql-action action to v4.37.9, v4.37.8, v4, v3.37.7 (#481, #475, #467, #464)
  • deps: Update clouatre-labs/aptu-github-app digest to 94f0d4c (#480)
  • deps: Update taiki-e/create-gh-release-action action to v1.11.0, digest to 491e676 (#459, #453)
  • deps: Update astral-sh/ruff-action action to v4.1.0 (#458)
  • deps: Update actions/attest-build-provenance action to v4.2.2, digest to e4d4f7c, 4d10147 (#457, #448, #444)
  • deps: Update dorny/paths-filter action to v4.0.3, digest to 9d7afb8, ceb8a2b (#456, #451, #443)
  • deps: Update actions/upload-artifact action to v7.0.1, digest to bbbca2d (#455, #450)
  • deps: Update actions/download-artifact action to v8.0.1, digest to 70fc10c (#454, #449)
  • deps: Update astral-sh/setup-uv action to v10.0.1, v10 (#446, #445)
  • deps: Update zizmorcore/zizmor-action action to v0.6.2 (#442)

Full Changelog: v0.12.3...v0.12.5

Assets 2
Loading