v0.1.3 - Automated releases, and the version moves to pyproject.toml

Release automation, and the package version moves into pyproject.toml. No change to the tool surface.

Releases are now cut by CI

This release is the first one produced by the new tag_and_release.yaml workflow rather than by hand.

A push to main touching pyproject.toml, uv.lock, src/**, or the workflows themselves starts a version job that reads [project] version and checks whether v<version> is already tagged. If it is, the run is a near-instant no-op — so a source change without a version bump costs nothing. If it isn't, the existing test and pre-commit workflows are invoked as gates through workflow_call, meaning a release is blocked by exactly the same jobs that guard a pull request, with no third-party wait-for-checks action and no polling. Only then does the release job build, checksum, tag, and publish.

Nothing in the workflow bumps the version. The flow is to change [project] version in a PR, merge it, and let the workflow do the rest.

The tag itself is created by gh release create --target, so no git push is involved and the checkout stays credential-less. Every action is pinned to a full commit SHA, permissions are read-only except in the release job, and the workflows are audited by zizmor in CI.

Build artifacts

First release to carry them: the wheel, the sdist, and a SHA256SUMS.txt you can check with sha256sum -c SHA256SUMS.txt. The checksums are also reproduced in this release body, below.

The version now lives in pyproject.toml

[project] version is a literal string again; dynamic = ["version"] and the [tool.hatch.version] block are gone. src/bigfix_root_mcp/__init__.py reads __version__ back out of the installed package metadata, falling back to 0.0.0 for a checkout where the package is not installed, so there is still exactly one place to bump.

This is what makes the release workflow's version step possible: it reads pyproject.toml with tomllib directly, which a dynamic version sourced from __init__.py could not support without executing the package.

One consequence worth knowing: __version__ now reflects the installed distribution's metadata rather than the source tree, so a bump that has not been re-synced into the environment will report the older value until it is.

PyPI

Publishing is wired into the workflow but deliberately inert. It requires a PyPI trusted publisher for this repository, the PYPI_PUBLISH repository variable set to true, and the pypi environment. bigfix-root-mcp is not on PyPI yet, so installation is still from source or from the artifacts attached here.

Full Changelog: v0.1.2...v0.1.3

SHA-256

Verify with sha256sum -c SHA256SUMS.txt:

1c3eebb1513cbdb6690cce5a6cf91c311f058860acc9b85fff908d6bddc32f13  ./bigfix_root_mcp-0.1.3-py3-none-any.whl
aea3b9cf45269880b5d1cb72950059177e9c483ef1383255c227bf1125e2a7d6  ./bigfix_root_mcp-0.1.3.tar.gz