Pin conformance harness by commit SHA (ed314a73) instead of PR number (#3000)

This commit is contained in:
Max 2026-06-26 17:01:42 +02:00 • committed by GitHub
commit 3caa445c6c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -19,15 +19,17 @@ env:
# Bump deliberately and reconcile both
# .github/actions/conformance/expected-failures*.yml files in the same change.
#
# Temporarily pinned to the pkg.pr.new preview build of conformance#371, which
# fixes the http-custom-headers fixture's spec-forbidden `number`-typed
# x-mcp-header annotations. Because this is a mutable URL (not a registry
# spec), CONFORMANCE_PKG_SHA256 pins the tarball and the fetch-and-verify step
# below downloads, checks the digest, and repoints CONFORMANCE_PKG at the
# verified local copy. Repin to the published release that includes #371 once
# it ships, then drop CONFORMANCE_PKG_SHA256 and the fetch-and-verify steps.
CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@371"
CONFORMANCE_PKG_SHA256: "9d8b25874d55e304b006cbaa066571773582f5828143c53a2b8a6830f203ca1d"
# Temporarily pinned to the pkg.pr.new build of conformance main@b18aa918
# (the merge of #371, which fixes the http-custom-headers fixture's
# spec-forbidden `number`-typed x-mcp-header annotations) — no published
# release includes it yet. Pinned by commit SHA so the tarball cannot move
# under us; CONFORMANCE_PKG_SHA256 pins the bytes and the fetch-and-verify
# step below downloads, checks the digest, and repoints CONFORMANCE_PKG at the
# verified local copy. Repin to the next published @modelcontextprotocol/
# conformance release (>0.2.0-alpha.7) once it ships, then drop
# CONFORMANCE_PKG_SHA256 and the fetch-and-verify steps.
CONFORMANCE_PKG: "https://pkg.pr.new/@modelcontextprotocol/conformance@b18aa918"
CONFORMANCE_PKG_SHA256: "e9f6bc25085b4692e988cbdbd024a4203d54a52a6aaa065376cf8ecaa09bb680"
jobs:
server-conformance: