ci: Install publisher via binary release#42
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of 66e26ed...87c787c
Tip
⚡ Quick Actions
This review was generated by Mesa.
Actions:
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
1 files reviewed | 3 comments | Review on Mesa | Edit Reviewer Settings
| if [ "$ARCH" = "x86_64" ]; then ARCH="amd64"; elif [ "$ARCH" = "aarch64" ]; then ARCH="arm64"; fi | ||
| OS="$(uname -s | tr '[:upper:]' '[:lower:]')" | ||
| URL="https://github.com/modelcontextprotocol/registry/releases/download/v1.0.0/mcp-publisher_1.0.0_${OS}_${ARCH}.tar.gz" | ||
| curl -L "$URL" | tar xz mcp-publisher |
There was a problem hiding this comment.
The curl command lacks checksum verification, making it vulnerable to supply chain attacks. Consider adding SHA256 checksum verification after downloading the binary to ensure integrity.
Agent: 🤖 General
| run: | | ||
| set -euo pipefail | ||
| ARCH="$(uname -m)" | ||
| if [ "$ARCH" = "x86_64" ]; then ARCH="amd64"; elif [ "$ARCH" = "aarch64" ]; then ARCH="arm64"; fi |
There was a problem hiding this comment.
The architecture detection only handles x86_64 and aarch64, but doesn't have a fallback for unsupported architectures. This could cause silent failures if the workflow runs on an unexpected architecture. Consider adding an explicit check and error message for unsupported architectures.
Agent: 🤖 General
1 participant
TL;DR
Updated the
publish-mcpworkflow to install themcp-publishervia its binary release instead of building it from source.Why we made these changes
Building the publisher from source during the CI run is slow and adds unnecessary complexity. Downloading a pre-compiled binary is faster, simplifies the workflow by removing the Go build dependency, and improves reliability.
What changed?
publish-mcp.ymlworkflow now downloads themcp-publisherbinary directly from its GitHub release assets.setup-goaction and thego installcommand, as the Go toolchain is no longer required.Description generated by Mesa. Update settings