name: 发布包到PyPI
on:
push:
branches:
- main
paths:
- 'src/**'
- 'publish.yaml'
workflow_dispatch: # 允许手动触发
permissions:
contents: write
id-token: write
jobs:
# Job 1: 构建 PyPI 分发包（多平台多版本）
release-build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
exclude:
# macOS上Python 3.14暂不支持，待稳定后可取消此排除
- os: macos-latest
python-version: '3.14'
steps:
- name: Harden Runner
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
with:
egress-policy: audit
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # 获取完整的 git 历史
- name: 设置Python环境
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: ${{ matrix.python-version }}
- name: 构建发布分发包
run: |
python -m pip install build
python -m build
- name: 上传分发包作为工件
uses: actions/upload-artifact@v6.0.0
with:
name: release-dists-${{ matrix.os }}-py${{ matrix.python-version }}
path: dist/
retention-days: 7
# Job 2: 发布到 PyPI
pypi-publish:
runs-on: ubuntu-latest
needs: release-build
environment:
name: pypi
url: https://pypi.org/project/MZ-MCP
steps:
- name: Harden Runner
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # 获取完整的 git 历史
- name: 检索所有发布分发包
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
pattern: release-dists-*
path: all-dists/
merge-multiple: false
- name: 合并所有发布分发包
run: |
mkdir -p dist
find all-dists -name "*.whl" -exec cp {} dist/ \;
find all-dists -name "*.tar.gz" -exec cp {} dist/ \;
- name: 提取版本号
id: extract_version
run: |
# 从 pyproject.toml 文件中读取版本号
VERSION=$(grep "^version = " pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=$VERSION" >> $GITHUB_ENV
echo "tag_name=v$VERSION" >> $GITHUB_ENV
- name: 将发布分发包发布到PyPI
uses: pypa/gh-action-pypi-publish@v1.13.0
with:
packages-dir: dist/
- name: 上传PyPI包供后续使用
uses: actions/upload-artifact@v6.0.0 # v4.4.0
with:
name: pypi-packages
path: dist/
retention-days: 7
# Job 3: 构建源码发布包和创建 GitHub Release
build-release:
runs-on: ubuntu-latest
needs: pypi-publish
steps:
- name: Harden Runner
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0 # 获取完整的 git 历史
- name: Set up Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.11'
- name: Get version
id: get_version
run: |
# 从 pyproject.toml 文件中读取版本号
VERSION=$(grep "^version = " pyproject.toml | sed 's/version = "\(.*\)"/\1/')
echo "version=$VERSION" >> $GITHUB_OUTPUT
echo "tag_name=v$VERSION" >> $GITHUB_OUTPUT
- name: Install dependencies
run: |
pip install -r src/mzmcp/requirements.txt
- name: Run Fuzzing Tests
run: |
cd src/mzmcp
pytest tests/test_fuzzing.py -v --cov=. --cov-report=xml --cov-report=term
continue-on-error: true # 模糊测试失败不应阻止构建
- name: Create release directory
run: |
mkdir -p mzmcp-release
- name: Copy project files
run: |
# 复制源代码
cp -r src/mzmcp mzmcp-release/
# 复制配置文件
cp src/build.yaml src/s.yaml src/variable.yaml mzmcp-release/
# 复制文档和许可证
cp LICENSE readme.md mzmcp-release/
- name: Create zip package
id: create_zip
run: |
cd mzmcp-release
zip -r ../mzmcp-${{ steps.get_version.outputs.version }}.zip .
cd ..
# 计算文件的 SHA256 哈希值
ARTIFACT_HASH=$(sha256sum mzmcp-${{ steps.get_version.outputs.version }}.zip | awk '{print $1}')
echo "artifact-hash=$ARTIFACT_HASH" >> $GITHUB_OUTPUT
- name: Generate Release Notes
id: release_notes
run: |
# 从上一个标签生成 Release Notes
PREVIOUS_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
VERSION=${{ steps.get_version.outputs.version }}
if [ -z "$PREVIOUS_TAG" ]; then
# 首次发布
NOTES="## 🎉 首次发布\n\n这是 MZMCP - MCP 服务集成平台的首次正式发布。\n\n### 功能特性\n- 支持华为云 OCR 服务\n- 支持 URL 和 Base64 两种图片输入方式\n- 基于 Serverless 架构，自动扩缩容\n- 模块化设计，易于扩展其他 AI 服务"
else
# 后续发布：只显示更新日志，过滤掉 commit 前缀
CHANGELOG=$(git log ${PREVIOUS_TAG}..HEAD --pretty=format:"- %s" --no-merges | \
sed -E 's/^- (feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert|bump|chore\(|update|add|remove|delete|modify|change|improve|optimize):? ?//g' | \
sed -E 's/^- (feat|fix|docs|style|refactor|test|chore|perf|ci|build|revert|bump)\([^)]+\): ?//g')
if [ -z "$CHANGELOG" ]; then
NOTES="## 📝 更新日志\n\n暂无更新内容"
else
NOTES="## 📝 更新日志\n\n### 本次更新\n\n${CHANGELOG}"
fi
fi
# 保存到文件
echo "$NOTES" > release_notes.md
# 输出到环境变量
{
echo 'notes<<EOF'
cat release_notes.md
echo EOF
} >> $GITHUB_OUTPUT
- name: Generate Evidence Bundle
if: always() # Run even if build fails
uses: OrygnsCode/ci-evidence-pack@8222d7b3b015ce2f72222215bdf9966773036ab1 # main
with:
python-version: '3.11'
upload-name: 'mzmcp-evidence-${{ steps.get_version.outputs.version }}'
include: |
src/mzmcp/
src/build.yaml
src/s.yaml
src/variable.yaml
LICENSE
readme.md
sbom: 'auto'
sign: 'true'
retention-days: '90'
- name: Download PyPI packages
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: pypi-packages
path: pypi-dist/
- name: Create Release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
with:
tag_name: ${{ steps.get_version.outputs.tag_name }}
name: MZMCP ${{ steps.get_version.outputs.version }}
body: |
${{ steps.release_notes.outputs.notes }}
---
## 📦 安装说明
### 使用 pip 安装（推荐）
```bash
pip install MZ-MCP
```
或使用 uvx 运行（MCP 标准方式）：
```bash
uvx MZ-MCP
```
uvx 是 MCP 工具链的标准运行方式，会自动下载并运行最新版本。
支持的平台：
- Linux (Python 3.10, 3.11, 3.12, 3.13, 3.14)
- Windows (Python 3.10, 3.11, 3.12, 3.13, 3.14)
- macOS (Python 3.10, 3.11, 3.12, 3.13)
### 从源码部署
前置要求
- 已安装 Node.js
- 已安装 Serverless Devs 工具
快速开始
1. 克隆仓库
```bash
git clone https://github.com/xiaomizhoubaobei/MCP.git
cd MCP
```
2. 配置阿里云密钥
```bash
s config add
```
3. 部署服务
```bash
s deploy
```
### 详细文档
请查看 [README.md](https://github.com/xiaomizhoubaobei/MCP/blob/main/readme.md) 获取完整的使用文档。
---
## 📦 文件说明
本 Release 包含以下文件：
- **MZ-MCP-*.whl**: PyPI 安装包（适用于 pip install，支持多平台多Python版本）
- **MZ-MCP-*.tar.gz**: PyPI 源码包
- **mzmcp-*.zip**: MCP 服务源码发布包（用于 Serverless 部署）
- **evidence-bundle.tar.gz**: CI 证据包（包含源代码、Git 元数据、依赖项、SBOM 等）
- **evidence-bundle.tar.gz.sig**: 证据包的 Sigstore 签名
- **evidence-bundle.tar.gz.crt**: 证据包的签名证书
### SLSA 出处文件
SLSA (Supply-chain Levels for Software Artifacts) 出处文件提供了关于构建过程的可验证证明，包括：
- 构建来源和触发方式
- 构建环境信息
- 构建步骤和输入
- 输出制品的哈希值
可以使用以下工具验证 SLSA 出处文件：
```bash
slsa-verifier verify-artifact mzmcp-${{ steps.get_version.outputs.version }}.zip \
--provenance mzmcp-${{ steps.get_version.outputs.version }}.intoto.jsonl \
--source-uri github.com/xiaomizhoubaobei/MCP
```
### 证据包验证
证据包用于合规性审计和构建验证，可以使用以下命令验证：
```bash
ci-evidence-pack verify evidence-bundle.tar.gz
```
draft: false
prerelease: false
files: |
mzmcp-${{ steps.get_version.outputs.version }}.zip
pypi-dist/*.whl
pypi-dist/*.tar.gz
_evidence_dist/*.tar.gz
_evidence_dist/*.sig
_evidence_dist/*.crt
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
