OSS release prep

[SamMorrowDrums]

What

Release prep PR — currently contains the cherry-picked work from #2486 plus a small refactor to make the new ReadOnlyHint guardrail reusable from github/github-mcp-server-remote (and any other downstream consumer of this repo as a library). More small prep items can stack here before the next release.

Contents

1. test(github): enforce explicit ReadOnlyHint on every mcp.Tool literal

Cherry-picked from #2486 (author: @jluocsa, authorship preserved). AST scan that fails the build if any mcp.Tool{...} literal in pkg/github omits an explicit Annotations.ReadOnlyHint. Closes the runtime gap noted in TestAllToolsHaveRequiredMetadata (Go can't distinguish unset bool from false).

Refs #2483 (item 3).

2. test(github): address reviewer feedback on ReadOnlyHint check

Cherry-picked from #2486 (author: @jluocsa, authorship preserved).

3. refactor(toolvalidation): extract ReadOnlyHint scanner into reusable package

New change. Moves the AST scan out of pkg/github's test file and into a new exported package, pkg/toolvalidation, so the remote server (which imports this repo) can apply the same guardrail with a one-line test:

func TestAllToolRegistrationsExplicitlySetReadOnlyHint(t *testing.T) {
    dir, _ := os.Getwd()
    violations, err := toolvalidation.ScanReadOnlyHint(dir)
    require.NoError(t, err)
    if len(violations) > 0 {
        t.Fatal(toolvalidation.FormatReadOnlyHintViolations(violations))
    }
}

This follows the repo's stated convention that functions usable as a library from github-mcp-server-remote should be exported.

Refactor details

• New pkg/toolvalidation/readonlyhint.go with ScanReadOnlyHint, FormatReadOnlyHintViolations, and the ReadOnlyHintViolation type — stdlib only.
• New pkg/toolvalidation/readonlyhint_test.go with dedicated unit tests using in-memory fixtures: compliant literal, missing hint, missing annotations, non-literal annotations, aliased import (import sdk "..."), positional fields, and a file with no MCP import. This gives the validator real coverage it didn't have when it lived inline.
• pkg/github/tools_static_validation_test.go shrunk from 271 → 36 lines, behavior preserved.

Verification

• script/lint → 0 issues
• script/test → all packages pass, including the new pkg/toolvalidation and the thin pkg/github wrapper
• No production-code, schema, or toolsnap changes; no docs regeneration needed.

Follow-up

I'll open a parallel PR against github/github-mcp-server-remote once this lands (or against a prerelease tag) that bumps the go.mod to this commit and adds the thin one-line test there.

Co-authored-by: John CSA 103165870+jluocsa@users.noreply.github.com

[Copilot]

Pull request overview

Release-prep PR that cherry-picks the AST-based ReadOnlyHint guardrail from #2486 and refactors it into a new exported package, pkg/toolvalidation, so the remote server can reuse the same check.

Changes:

• New pkg/toolvalidation package with ScanReadOnlyHint, FormatReadOnlyHintViolations, and ReadOnlyHintViolation, using only stdlib parsing.
• Unit tests covering compliant/missing/positional/aliased/no-import fixtures plus formatter and missing-directory error.
• pkg/github/tools_static_validation_test.go shrunk to a thin wrapper that scans the package and fails with formatted violations.

Show a summary per file

File	Description
pkg/toolvalidation/readonlyhint.go	New exported AST scanner that flags mcp.Tool literals missing explicit Annotations.ReadOnlyHint.
pkg/toolvalidation/readonlyhint_test.go	Fixture-driven unit tests for scanner + formatter behavior.
pkg/github/tools_static_validation_test.go	Thin wrapper applying the shared scanner to pkg/github.

Copilot's findings

• Files reviewed: 3/3 changed files
• Comments generated: 0