fix(publisher): tolerate transient device-flow failures during login polling (#1588)

Follow-up to my analysis on #1543.

Heads up on the shape first: this builds on #1290's poll-loop seams and
github wont let me target a fork branch, so the diff shows its two
commits too. Review only the last commit, the first two are #1290
unchanged, credit to @developer-ishan. Happy to rebase whichever way
#1290 goes, or split differently if that's easier to review.

What it does. pollForToken treats every non-pending answer as terminal,
so one flaky response kills a login the user may already have approved
in the browser. This spends a small grace budget (2 polls) on
incorrect_device_code before giving up, retries 5xx with a growing
backoff, and returns status plus body on other non-200s instead of dying
inside json.Unmarshal on an html error page. Terminal errors now carry
error_description and error_uri, and a timeout that happens after
polling recovered reports a plain timeout, not a stale error from
minutes earlier.

Also honours the interval and expires_in GitHub returns with the device
code (RFC 8628 3.2) instead of hardcoding 5/900, clamped (60s / 3600s)
so a misbehaving response can't stall the CLI or overflow the duration
math.

One thing I changed my mind on from the issue comment: I wrote there
that the client should wait one interval before the first poll. Dropped
that. My own repro test showed 40s of clean polling before authorize, so
the propagation theory doesn't hold, and the grace retry covers the same
window without taxing every fast login. First poll stays immediate,
pinned by a test.

Root cause note: I can't prove the GitHub-side race (cli/cli#9302 is the
same error class but was closed on an unconfirmed "platform race"). So
this isn't claimed as a root-cause fix, it makes the login recoverable
if the condition is transient and diagnosable if it isn't. Btw
incorrect_device_code is a GitHub extension, not an RFC 8628 3.5 code,
so there's no spec retry semantic being violated by the grace polls.

## Test

12 new tests in github_at_device_flow_internal_test.go, all green with
-race (33 in the package). #1290's four tests pass unmodified.
golangci-lint clean in the touched files under both v2.11.4 (this
branch's CI pin) and v2.13.1 (what main pins now).

## AI Disclosure

AI assistance (Claude) was used for issue research and during
development. All changes were reviewed and tested by the author.

Fixes #1543

---------

Co-authored-by: developer-ishan <igupta@groupon.com>
Co-authored-by: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com>
Co-authored-by: developer-ishan <guptaishan849@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.dockerignore

@@ -1 +0,0 @@
-.db

.env.example

@@ -5,12 +5,16 @@ MCP_REGISTRY_SERVER_ADDRESS=:8080
 MCP_REGISTRY_VERSION=dev
 
 # Database configuration
-# Supported types: postgresql, memory
-MCP_REGISTRY_DATABASE_TYPE=postgresql
 MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-registry
 
 # Path or URL to import seed data (supports local files and HTTP URLs)
-MCP_REGISTRY_SEED_FROM=data/seed.json
+# For offline development, use: data/seed.json
+MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers
+
+# Validate seed data against the registry rules on import (default: true)
+# Set to false for offline development when seeding from a local file, since
+# data/seed.json is not guaranteed to pass validation
+MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true
 
 # GitHub OAuth configuration
 # These creds are for local development with the 'MCP Registry Login (Local)' GitHub App
@@ -28,6 +32,14 @@ MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb
 # This should be disabled in prod
 MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false
 
+# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`)
+# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the
+# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`).
+# The publisher CLI derives the audience from `--registry` automatically; the server
+# rejects all OIDC exchanges if this is unset, so set it on every deployment that
+# accepts GitHub Actions publishes.
+MCP_REGISTRY_GITHUB_OIDC_AUDIENCE=
+
 # Google Cloud Identity OIDC configuration for admin access
 # Enable OIDC authentication for @modelcontextprotocol.io admin accounts
 MCP_REGISTRY_OIDC_ENABLED=false

.github/copilot-instructions.md

@@ -0,0 +1,13 @@
+# Copilot Instructions for MCP Registry
+
+## Important: Publishing MCP servers
+
+The `data/seed.json` file is seed data for local development only. Do NOT create pull requests that add or modify server entries in `data/seed.json` to publish a server.
+
+To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions.
+
+## Development
+
+- Use `make` targets where possible (run `make help` to see available targets)
+- Run `make check` to run lint, schema validation, and all tests (this also stops any running dev-compose environment)
+- Run `make dev-compose` to start the local development environment

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /deploy
+    groups:
+      deploy-go-dependencies:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/cancel-pulumi-lock.yml

@@ -0,0 +1,76 @@
+name: Cancel Pulumi Lock
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to cancel lock for'
+        required: true
+        type: choice
+        options:
+          - staging
+          - production
+
+permissions:
+  contents: read
+
+env:
+  PULUMI_VERSION: "3.188.0"
+
+jobs:
+  cancel-lock:
+    name: Cancel Pulumi Lock
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Authenticate to Google Cloud (Staging)
+        if: inputs.environment == 'staging'
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
+
+      - name: Authenticate to Google Cloud (Production)
+        if: inputs.environment == 'production'
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      - name: Setup Google Cloud SDK (Staging)
+        if: inputs.environment == 'staging'
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-staging
+
+      - name: Setup Google Cloud SDK (Production)
+        if: inputs.environment == 'production'
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-prod
+
+      - name: Cancel Pulumi Lock (Staging)
+        if: inputs.environment == 'staging'
+        working-directory: ./deploy
+        env:
+          PULUMI_STAGING_PASSPHRASE: ${{ secrets.PULUMI_STAGING_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_STAGING_PASSPHRASE" > passphrase.staging.txt
+          pulumi login gs://mcp-registry-staging-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.staging.txt pulumi cancel --stack gcpStaging --yes
+
+      - name: Cancel Pulumi Lock (Production)
+        if: inputs.environment == 'production'
+        working-directory: ./deploy
+        env:
+          PULUMI_PROD_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_PROD_PASSPHRASE" > passphrase.prod.txt
+          pulumi login gs://mcp-registry-prod-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi cancel --stack gcpProd --yes

.github/workflows/ci.yml

@@ -6,8 +6,8 @@ on:
   pull_request:
     branches: [ main ]
 
-env:
-  GO_VERSION: '1.24.x'
+permissions:
+  contents: read
 
 jobs:
   # Build, Lint, and Validate
@@ -16,32 +16,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
       with:
-        go-version: ${{ env.GO_VERSION }}
-
-    - name: Cache Go modules
-      uses: actions/cache@v4
-      with:
-        path: |
-          ~/.cache/go-build
-          ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ github.sha }}-${{ hashFiles('**/go.sum', '.golangci.yml') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-
-    - name: Download dependencies
-      run: go mod download
-
-    - name: Install golangci-lint
-      run: |
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.4.0
+        go-version: 'stable'
+        cache: true
 
     - name: Run lint
-      run: make lint
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
+      with:
+        version: v2.13.1
 
     - name: Validate schemas and examples
       run: make validate
@@ -49,10 +35,12 @@ jobs:
     - name: Build application
       run: make build
 
-    - name: Check for vulnerabilities
-      run: |
-        go install golang.org/x/vuln/cmd/govulncheck@latest
-        govulncheck ./...
+    - name: Run govulncheck
+      uses: golang/govulncheck-action@v1
+      with:
+        go-version-input: 'stable'
+        go-package: ./...
+        repo-checkout: false
 
   # All Tests
   tests:
@@ -60,31 +48,22 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version: 'stable'
+        cache: true
 
-    - name: Cache Go modules
-      uses: actions/cache@v4
-      with:
-        path: |
-          ~/.cache/go-build
-          ~/go/pkg/mod
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-
-    - name: Download dependencies
-      run: go mod download
+    - name: Set up ko
+      uses: ko-build/setup-ko@v0.10
 
     - name: Run all tests
       run: make test-all
 
     - name: Upload coverage artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
       with:
         name: coverage-report
         path: |

.github/workflows/claude.yml

@@ -26,13 +26,13 @@ jobs:
       actions: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@beta
+        uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
@@ -42,10 +42,7 @@ jobs:
 
           # Trigger when assigned to an issue
           assignee_trigger: "claude"
-          
-          # Allow Claude to run bash
-          # This should be safe given the repo is already public
-          allowed_tools: "Bash"
-          
-          custom_instructions: |
-            If posting a comment to GitHub, give a concise summary of the comment at the top and put all the details in a <details> block.
+
+          claude_args: |
+            --allowedTools Bash
+            --system-prompt "If posting a comment to GitHub, give a concise summary of the comment at the top and put all the details in a <details> block."

.github/workflows/close-invalid-publish-prs.yml

@@ -0,0 +1,151 @@
+name: Close invalid publish PRs
+
+# Stage 2 of 2 (see detect-invalid-publish-prs.yml for stage 1).
+#
+# Runs in the trusted base-repo context (triggered by workflow_run, not by the
+# PR itself), so it has a write token. It picks up the PR number flagged by
+# stage 1 and, after independently re-validating the PR from the API, posts a
+# comment pointing at the publishing docs, labels it `invalid`, and closes it.
+#
+# Trust boundary: the ONLY thing crossing from the untrusted stage is the PR
+# number (sanitized to digits below). We re-derive every decision (state,
+# author, changed files) here, so a wrong/stale artifact can never cause us to
+# close a PR that doesn't actually match.
+
+on:
+  workflow_run:
+    workflows: ["Detect invalid publish PRs"]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write # labels on PRs go through the issues API
+  actions: read # needed to list/download the stage-1 artifact
+
+jobs:
+  close:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      RUN_ID: ${{ github.event.workflow_run.id }}
+      COMMENT_BODY: |
+        Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry!
+
+        It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically.
+
+        **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API.
+
+        To publish your server, follow the **[Publishing Quickstart](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx)**. In short:
+
+        ```bash
+        # Build the publisher CLI
+        make publisher
+
+        # Authenticate (e.g. via GitHub) and publish your server.json
+        ./bin/mcp-publisher login github
+        ./bin/mcp-publisher publish
+        ```
+
+        Note: `data/seed.json` is seed data for **local development only** — adding entries there does not publish anything to the registry.
+
+        If you believe this was closed in error, please leave a comment and a maintainer will take a look. 🙇
+
+        _This is an automated message._
+
+    steps:
+      - name: Check for flagged-pr artifact
+        id: check
+        run: |
+          set -euo pipefail
+          names="$(gh api "repos/$GH_REPO/actions/runs/$RUN_ID/artifacts" --jq '.artifacts[].name' || true)"
+          if printf '%s\n' "$names" | grep -qx "flagged-pr"; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "No flagged-pr artifact on run $RUN_ID; nothing to do."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download flagged PR number
+        if: steps.check.outputs.found == 'true'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: flagged-pr
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Re-validate and close
+        if: steps.check.outputs.found == 'true'
+        run: |
+          set -euo pipefail
+
+          # Sanitize: the only cross-boundary input. Keep digits only.
+          PR_NUMBER="$(tr -dc '0-9' < pr-number.txt)"
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No valid PR number in artifact; skipping."
+            exit 0
+          fi
+          echo "Re-validating PR #$PR_NUMBER"
+
+          state="$(gh pr view "$PR_NUMBER" --json state --jq '.state')"
+          if [ "$state" != "OPEN" ]; then
+            echo "PR #$PR_NUMBER is $state, not OPEN; skipping."
+            exit 0
+          fi
+
+          # Use the REST endpoint: `gh pr view --json` does not expose an
+          # authorAssociation field, so calling it there exits non-zero and,
+          # under `set -euo pipefail`, aborts the job before we ever close.
+          assoc="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.author_association')"
+          case "$assoc" in
+            MEMBER|OWNER|COLLABORATOR)
+              echo "Author association '$assoc' is trusted; skipping."
+              exit 0
+              ;;
+          esac
+
+          # Idempotency: if a maintainer reopens after we labeled it, leave it be.
+          # Capture into a var first so a transient gh failure can't fail open
+          # (an errored fetch piped to grep would otherwise look "not labeled").
+          labels="$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name' || true)"
+          if printf '%s\n' "$labels" | grep -qx "invalid"; then
+            echo "PR #$PR_NUMBER already labeled 'invalid'; skipping."
+            exit 0
+          fi
+
+          # Paginated REST endpoint (gh pr view --json files caps at 100, no pagination).
+          mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
+          if [ "${#FILES[@]}" -eq 0 ]; then
+            echo "No files for PR #$PR_NUMBER; skipping."
+            exit 0
+          fi
+          # Keep this list in sync with the copy in stage 1.
+          publish_attempt=0
+          other=0
+          for f in "${FILES[@]}"; do
+            if [[ "$f" == servers/* \
+               || "$f" == data/servers/* \
+               || "$f" == data/data/servers/* \
+               || "$f" =~ ^data/[^/]*server\.json$ \
+               || "$f" == "data/seed.json" \
+               || "$f" == "server.json" \
+               || "$f" == "servers.json" ]]; then
+              publish_attempt=1
+            else
+              other=1
+            fi
+          done
+          if [ "$publish_attempt" -ne 1 ] || [ "$other" -ne 0 ]; then
+            echo "PR #$PR_NUMBER no longer matches the publish-attempt pattern; skipping."
+            exit 0
+          fi
+
+          author="$(gh pr view "$PR_NUMBER" --json author --jq '.author.login')"
+          body="${COMMENT_BODY//__AUTHOR__/$author}"
+
+          echo "Commenting on, labeling, and closing PR #$PR_NUMBER"
+          gh pr comment "$PR_NUMBER" --body "$body"
+          gh pr edit "$PR_NUMBER" --add-label "invalid" || echo "Could not add label; continuing."
+          gh pr close "$PR_NUMBER"

.github/workflows/deploy-production.yml

@@ -0,0 +1,56 @@
+name: Deploy to Production
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'deploy/Pulumi.gcpProd.yaml'
+
+permissions:
+  contents: read
+
+env:
+  PULUMI_VERSION: "3.188.0"
+
+jobs:
+  deploy-production:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    environment: production
+    concurrency:
+      group: deploy-production
+      cancel-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: 'stable'
+          cache: true
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-prod
+          install_components: gke-gcloud-auth-plugin
+
+      - name: Deploy to Production
+        working-directory: ./deploy
+        env:
+          PULUMI_PROD_PASSPHRASE: ${{ secrets.PULUMI_PROD_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_PROD_PASSPHRASE" > passphrase.prod.txt
+          make prod-up

.github/workflows/deploy-staging.yml

@@ -0,0 +1,103 @@
+name: Deploy to Staging
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - 'deploy/Pulumi.gcpProd.yaml'
+
+permissions:
+  contents: read
+
+env:
+  PULUMI_VERSION: "3.188.0"
+
+jobs:
+  ko-push:
+    name: Build and Push Image with ko
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: 'stable'
+          cache: true
+
+      - name: Set up ko
+        uses: ko-build/setup-ko@v0.10
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Get build timestamp and tags
+        id: build-info
+        run: |
+          echo "timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT
+          echo "date=$(date -u +%Y%m%d)" >> $GITHUB_OUTPUT
+          echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+      - name: Build and push with ko
+        env:
+          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
+          VERSION: main-${{ steps.build-info.outputs.date }}-${{ steps.build-info.outputs.short_sha }}
+          GIT_COMMIT: ${{ github.sha }}
+          BUILD_TIME: ${{ steps.build-info.outputs.timestamp }}
+        run: |
+          # Build and push multi-platform image
+          ko build ./cmd/registry \
+            --bare \
+            --platform=linux/amd64,linux/arm64 \
+            --tags=main-${{ steps.build-info.outputs.date }}-${{ steps.build-info.outputs.short_sha }},main
+
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    environment: staging
+    needs: ko-push
+    concurrency:
+      group: deploy-staging
+      cancel-in-progress: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: 'stable'
+          cache: true
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-staging
+          install_components: gke-gcloud-auth-plugin
+
+      - name: Deploy to Staging
+        working-directory: ./deploy
+        env:
+          PULUMI_STAGING_PASSPHRASE: ${{ secrets.PULUMI_STAGING_PASSPHRASE }}
+        run: |
+          echo "$PULUMI_STAGING_PASSPHRASE" > passphrase.staging.txt
+          make staging-up

.github/workflows/deploy.yml

@@ -1,124 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-
-env:
-  PULUMI_VERSION: "3.188.0"
-  GO_VERSION: "1.24.6"
-
-jobs:
-  docker-push:
-    name: Build Docker Image
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=sha,prefix=main-{{date 'YYYYMMDD'}}-,enable={{is_default_branch}}
-            type=raw,value=main,enable={{is_default_branch}}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  deploy-staging:
-    name: Deploy to Staging
-    runs-on: ubuntu-latest
-    environment: staging
-    needs: docker-push
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Setup Pulumi
-        uses: pulumi/actions@v6
-        with:
-          pulumi-version: ${{ env.PULUMI_VERSION }}
-
-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v2
-        with:
-          credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
-
-      - name: Setup Google Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2
-        with:
-          project_id: mcp-registry-staging
-          install_components: gke-gcloud-auth-plugin
-
-      - name: Deploy to Staging
-        working-directory: ./deploy
-        run: |
-          echo "${{ secrets.PULUMI_STAGING_PASSPHRASE }}" > passphrase.staging.txt
-          make staging-up
-
-  deploy-production:
-    name: Deploy to Production
-    runs-on: ubuntu-latest
-    environment: production
-    needs: deploy-staging
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Setup Pulumi
-        uses: pulumi/actions@v6
-        with:
-          pulumi-version: ${{ env.PULUMI_VERSION }}
-
-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v2
-        with:
-          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
-
-      - name: Setup Google Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2
-        with:
-          project_id: mcp-registry-prod
-          install_components: gke-gcloud-auth-plugin
-
-      - name: Deploy to Production
-        working-directory: ./deploy
-        run: |
-          echo "${{ secrets.PULUMI_PROD_PASSPHRASE }}" > passphrase.prod.txt
-          make prod-up

.github/workflows/detect-invalid-publish-prs.yml

@@ -0,0 +1,96 @@
+name: Detect invalid publish PRs
+
+# Stage 1 of 2 (see close-invalid-publish-prs.yml for stage 2).
+#
+# Some contributors try to "publish" a server by opening a PR that adds files
+# under servers/ or edits data/seed.json. That is not how publishing works -
+# servers are published with the mcp-publisher CLI against the live registry
+# API. This job only DETECTS such PRs. It runs from the (untrusted) PR context
+# with a read-only token, so it cannot comment on or close anything. When it
+# finds a match it records just the PR number as an artifact; the privileged
+# stage-2 workflow picks that up via workflow_run and acts on it.
+#
+# We never check out or run the PR's code - we only read changed file paths.
+
+on:
+  pull_request:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+    steps:
+      - name: Classify PR
+        id: classify
+        run: |
+          set -euo pipefail
+          match=false
+
+          # Maintainers may legitimately touch these files (e.g. dev seed data),
+          # so never flag their PRs.
+          case "$AUTHOR_ASSOCIATION" in
+            MEMBER|OWNER|COLLABORATOR)
+              echo "Author association '$AUTHOR_ASSOCIATION' is trusted; not flagging."
+              ;;
+            *)
+              # Use the paginated REST endpoint: `gh pr view --json files` caps
+              # at 100 files with no pagination, which could truncate a large PR
+              # and cause a false match.
+              mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename')
+              if [ "${#FILES[@]}" -gt 0 ]; then
+                # Flag only if the PR touches *exclusively* publish-attempt files
+                # and nothing else, so that legit PRs touching seed data
+                # alongside real code are left alone.
+                #
+                # Keep this list in sync with the copy in stage 2. It stays an
+                # explicit list rather than a broad `**/server.json` glob:
+                # because we require *every* file to match, an over-broad
+                # pattern would auto-close a legitimate single-file PR.
+                # data/servers/** is here because #1524 put its server.json
+                # there - a natural guess next to data/seed.json - and slipped
+                # through the original servers/**-only list.
+                publish_attempt=0
+                other=0
+                for f in "${FILES[@]}"; do
+                  if [[ "$f" == servers/* \
+                     || "$f" == data/servers/* \
+                     || "$f" == data/data/servers/* \
+                     || "$f" =~ ^data/[^/]*server\.json$ \
+                     || "$f" == "data/seed.json" \
+                     || "$f" == "server.json" \
+                     || "$f" == "servers.json" ]]; then
+                    publish_attempt=1
+                  else
+                    echo "Non-publish file changed: $f"
+                    other=1
+                  fi
+                done
+                if [ "$publish_attempt" -eq 1 ] && [ "$other" -eq 0 ]; then
+                  match=true
+                fi
+              fi
+              ;;
+          esac
+
+          echo "PR #$PR_NUMBER match=$match"
+          echo "match=$match" >> "$GITHUB_OUTPUT"
+          if [ "$match" = "true" ]; then
+            echo "$PR_NUMBER" > pr-number.txt
+          fi
+
+      - name: Record flagged PR number
+        if: steps.classify.outputs.match == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4
+        with:
+          name: flagged-pr
+          path: pr-number.txt
+          retention-days: 1

.github/workflows/release.yml

@@ -14,23 +14,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
         with:
-          go-version: '1.24.x'
+          go-version: 'stable'
+          cache: true
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install Syft
-        uses: anchore/sbom-action/download-syft@v0.20.5
+        uses: anchore/sbom-action/download-syft@v0.24.2
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
         with:
           distribution: goreleaser
           version: v2.12.0
@@ -38,40 +39,48 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  docker:
+  ko-push:
+    name: Build and Push Image with ko
     runs-on: ubuntu-latest
     needs: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: 'stable'
+          cache: true
+
+      - name: Set up ko
+        uses: ko-build/setup-ko@v0.10
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=raw,value=latest
+      - name: Get build timestamp and version
+        id: build-info
+        run: |
+          echo "timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_OUTPUT
+          # Extract version from tag and strip 'v' prefix (e.g., refs/tags/v1.2.3 -> 1.2.3)
+          VERSION="${GITHUB_REF#refs/tags/}"
+          VERSION="${VERSION#v}"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Build and push with ko
+        env:
+          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
+          VERSION: ${{ steps.build-info.outputs.version }}
+          GIT_COMMIT: ${{ github.sha }}
+          BUILD_TIME: ${{ steps.build-info.outputs.timestamp }}
+        run: |
+          # Build and push multi-platform image with version tag and latest
+          ko build ./cmd/registry \
+            --bare \
+            --platform=linux/amd64,linux/arm64 \
+            --tags=${{ steps.build-info.outputs.version }},latest

.github/workflows/sync-db.yml

@@ -0,0 +1,435 @@
+name: Sync Production DB to Staging (from backups)
+
+on:
+  # schedule:
+  #   # Run daily at 2 AM UTC (during low-traffic hours)
+  #   - cron: '0 2 * * *'
+  workflow_dispatch:  # Allow manual triggering
+
+permissions:
+  contents: read
+
+jobs:
+  sync-database:
+    name: Sync Prod DB to Staging from k8up Backups
+    runs-on: ubuntu-latest
+    environment: staging
+    concurrency:
+      group: sync-staging-database
+      cancel-in-progress: false
+    steps:
+      - name: Authenticate to Google Cloud (Production)
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      - name: Setup Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-prod
+          install_components: gke-gcloud-auth-plugin
+
+      - name: Get backup credentials from prod cluster
+        id: backup-creds
+        run: |
+          gcloud container clusters get-credentials mcp-registry-prod \
+            --zone=us-central1-b \
+            --project=mcp-registry-prod
+
+          # Store in outputs (GitHub Actions encrypts these automatically)
+          kubectl get secret k8up-backup-credentials -n default -o json | jq -r '
+            "access_key=" + (.data.AWS_ACCESS_KEY_ID | @base64d),
+            "secret_key=" + (.data.AWS_SECRET_ACCESS_KEY | @base64d)
+          ' >> $GITHUB_OUTPUT
+
+      - name: Remove all production access (SAFETY MEASURE)
+        run: |
+          # Remove production cluster from kubeconfig
+          kubectl config delete-context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod 2>/dev/null || true
+
+          # Revoke gcloud credentials
+          gcloud auth revoke --all 2>/dev/null || true
+
+          # Clear gcloud configuration
+          gcloud config unset project 2>/dev/null || true
+          gcloud config unset account 2>/dev/null || true
+
+          # Verify no contexts remain
+          CONTEXT_COUNT=$(kubectl config get-contexts -o name 2>/dev/null | wc -l)
+          if [ "$CONTEXT_COUNT" -gt 0 ]; then
+            echo "❌ ERROR: $CONTEXT_COUNT context(s) still exist after cleanup!"
+            kubectl config get-contexts
+            exit 1
+          fi
+
+      - name: Switch to staging cluster
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
+
+      - name: Configure staging cluster access
+        run: |
+          gcloud config set project mcp-registry-staging
+          gcloud container clusters get-credentials mcp-registry-staging \
+            --zone=us-central1-b \
+            --project=mcp-registry-staging
+
+      - name: Create secret for prod backup bucket access
+        run: |
+          # Create/update secret in staging with access to prod backups
+          kubectl create secret generic prod-to-staging-sync-credentials \
+            --from-literal=AWS_ACCESS_KEY_ID="${{ steps.backup-creds.outputs.access_key }}" \
+            --from-literal=AWS_SECRET_ACCESS_KEY="${{ steps.backup-creds.outputs.secret_key }}" \
+            --dry-run=client -o yaml | kubectl apply -f -
+
+      - name: Create restore PVC
+        run: |
+          kubectl apply -f - <<EOF
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            name: restore-data-pvc
+            namespace: default
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 50Gi
+          EOF
+
+      - name: Trigger k8up restore from prod backups
+        id: restore
+        run: |
+          RESTORE_NAME="restore-from-prod-$(date +%Y%m%d-%H%M%S)"
+          echo "restore_name=$RESTORE_NAME" >> $GITHUB_OUTPUT
+
+          # Create a k8up Restore resource to restore from prod backups
+          kubectl apply -f - <<EOF
+          apiVersion: k8up.io/v1
+          kind: Restore
+          metadata:
+            name: $RESTORE_NAME
+            namespace: default
+          spec:
+            snapshot: latest
+            restoreMethod:
+              folder:
+                claimName: restore-data-pvc
+            backend:
+              repoPasswordSecretRef:
+                name: k8up-repo-password
+                key: password
+              s3:
+                bucket: mcp-registry-prod-backups
+                endpoint: https://storage.googleapis.com
+                accessKeyIDSecretRef:
+                  name: prod-to-staging-sync-credentials
+                  key: AWS_ACCESS_KEY_ID
+                secretAccessKeySecretRef:
+                  name: prod-to-staging-sync-credentials
+                  key: AWS_SECRET_ACCESS_KEY
+          EOF
+
+      - name: Wait for k8up restore to complete
+        run: |
+          RESTORE_NAME="${{ steps.restore.outputs.restore_name }}"
+
+          echo "Waiting for restore job to start..."
+          sleep 15
+
+          # Find the job created by k8up for this restore
+          # k8up creates jobs with name pattern "restore-<restore-name>"
+          # Since our restore is named "restore-from-prod-*", the job will be "restore-restore-from-prod-*"
+          for i in {1..60}; do
+            JOB_NAME=$(kubectl get jobs -n default --no-headers 2>/dev/null | grep "^restore-$RESTORE_NAME" | awk '{print $1}' | head -1)
+            if [ -n "$JOB_NAME" ]; then
+              echo "Found restore job: $JOB_NAME"
+              break
+            fi
+            echo "Waiting for job to be created... ($i/60)"
+            sleep 2
+          done
+
+          if [ -z "$JOB_NAME" ]; then
+            echo "ERROR: Restore job not found after 120 seconds"
+            echo "Checking restore resource status:"
+            kubectl get restore $RESTORE_NAME -n default
+            kubectl describe restore $RESTORE_NAME -n default
+
+            echo "Checking for any restore jobs:"
+            kubectl get jobs -n default | grep restore || echo "No restore jobs found"
+
+            echo "Checking k8up operator logs:"
+            kubectl logs deployment/k8up -n default --tail=50 | grep -i restore || echo "No restore logs found"
+            exit 1
+          fi
+
+          # Wait for the restore job to complete (max 15 minutes)
+          echo "Waiting for restore job to complete..."
+          kubectl wait --for=condition=complete \
+            job/$JOB_NAME \
+            --timeout=900s -n default || {
+              echo "Restore job failed or timed out"
+              echo "Job status:"
+              kubectl get job/$JOB_NAME -n default
+              echo "Job details:"
+              kubectl describe job/$JOB_NAME -n default
+              echo "Job logs (if available):"
+              kubectl logs job/$JOB_NAME -n default --tail=100 || echo "No logs available"
+
+              # Check if it's a credential issue
+              echo "Checking if credentials exist:"
+              kubectl get secret prod-to-staging-sync-credentials -n default || echo "Credentials secret missing!"
+              exit 1
+            }
+
+      - name: Find staging PostgreSQL PVC
+        id: pgdata-pvc
+        run: |
+          # Find the PVC used by the PostgreSQL cluster
+          PVC_NAME=$(kubectl get pvc -n default -l cnpg.io/cluster=registry-pg -o jsonpath='{.items[0].metadata.name}')
+
+          if [ -z "$PVC_NAME" ]; then
+            echo "ERROR: Could not find PostgreSQL PVC"
+            kubectl get pvc -n default -l cnpg.io/cluster=registry-pg
+            exit 1
+          fi
+
+          echo "pvc_name=$PVC_NAME" >> $GITHUB_OUTPUT
+
+      - name: Scale down staging PostgreSQL
+        run: |
+          echo "Scaling down PostgreSQL cluster..."
+          kubectl patch cluster registry-pg -n default \
+            --type merge \
+            --patch '{"spec":{"instances":0}}'
+
+          # Wait for pods to terminate
+          echo "Waiting for pods to terminate..."
+          kubectl wait --for=delete pod -l cnpg.io/cluster=registry-pg -n default --timeout=300s || true
+
+      - name: Verify we are in staging cluster (SAFETY CHECK)
+        run: |
+          # Get current cluster context
+          CURRENT_CONTEXT=$(kubectl config current-context)
+          CURRENT_PROJECT=$(gcloud config get-value project)
+
+          echo "Current kubectl context: $CURRENT_CONTEXT"
+          echo "Current GCP project: $CURRENT_PROJECT"
+
+          # Verify we're in staging
+          if ! echo "$CURRENT_CONTEXT" | grep -qi "staging"; then
+            echo "❌ SAFETY CHECK FAILED: Not in staging cluster"
+            echo "Context: $CURRENT_CONTEXT"
+            echo "Expected: staging cluster"
+            exit 1
+          fi
+
+          if [ "$CURRENT_PROJECT" != "mcp-registry-staging" ]; then
+            echo "❌ SAFETY CHECK FAILED: Not in staging project"
+            echo "Project: $CURRENT_PROJECT"
+            echo "Expected: mcp-registry-staging"
+            exit 1
+          fi
+
+      - name: Replace staging database with restored backup
+        id: copy-job
+        run: |
+          JOB_NAME="copy-pgdata-$(date +%Y%m%d-%H%M%S)"
+          echo "job_name=$JOB_NAME" >> $GITHUB_OUTPUT
+
+          # Create a job to copy the restored backup data to the staging PVC
+          kubectl apply -f - <<EOF
+          apiVersion: batch/v1
+          kind: Job
+          metadata:
+            name: $JOB_NAME
+            namespace: default
+          spec:
+            ttlSecondsAfterFinished: 600
+            template:
+              spec:
+                restartPolicy: Never
+                containers:
+                - name: copy-data
+                  image: busybox:latest
+                  command:
+                    - /bin/sh
+                    - -c
+                    - |
+                      set -e
+                      echo "Finding PostgreSQL data in backup..."
+                      echo "Restore structure:"
+                      find /restore -maxdepth 3 -type d 2>/dev/null | head -20
+
+                      # Try different possible paths for pgdata
+                      PGDATA_SOURCE=""
+                      for path in \$(find /restore -type d -name "pgdata" 2>/dev/null); do
+                        if [ -f "\$path/PG_VERSION" ]; then
+                          PGDATA_SOURCE="\$path"
+                          break
+                        fi
+                      done
+
+                      if [ -z "\$PGDATA_SOURCE" ]; then
+                        echo "ERROR: Could not find valid pgdata directory with PG_VERSION"
+                        echo "Searched paths:"
+                        find /restore -type d -name "pgdata" 2>/dev/null
+                        exit 1
+                      fi
+
+                      echo "Found pgdata at: \$PGDATA_SOURCE"
+                      echo "Contents:"
+                      ls -lah \$PGDATA_SOURCE/ | head -10
+
+                      echo "Backing up existing staging data..."
+                      mkdir -p /pgdata-backup
+                      if [ "\$(ls -A /pgdata)" ]; then
+                        cp -a /pgdata/. /pgdata-backup/ || echo "Warning: Could not backup existing data"
+                      fi
+
+                      echo "Clearing existing data..."
+                      rm -rf /pgdata/*
+
+                      echo "Copying backup data to staging PVC..."
+                      cp -a \$PGDATA_SOURCE/. /pgdata/
+
+                      echo "Setting correct permissions..."
+                      chmod 700 /pgdata
+
+                      ls -lah /pgdata/ | head -20
+                      echo "PostgreSQL version: \$(cat /pgdata/PG_VERSION)"
+                  volumeMounts:
+                  - name: restore-data
+                    mountPath: /restore
+                  - name: staging-pgdata
+                    mountPath: /pgdata
+                volumes:
+                - name: restore-data
+                  persistentVolumeClaim:
+                    claimName: restore-data-pvc
+                - name: staging-pgdata
+                  persistentVolumeClaim:
+                    claimName: ${{ steps.pgdata-pvc.outputs.pvc_name }}
+          EOF
+
+      - name: Wait for data copy to complete
+        run: |
+          JOB_NAME="${{ steps.copy-job.outputs.job_name }}"
+
+          # Wait for copy to complete
+          kubectl wait --for=condition=complete job/$JOB_NAME --timeout=600s -n default || {
+            echo "Data copy job failed"
+            kubectl describe job/$JOB_NAME -n default
+            kubectl logs job/$JOB_NAME -n default --tail=100
+            exit 1
+          }
+
+      - name: Scale up staging PostgreSQL
+        run: |
+          echo "Scaling up PostgreSQL cluster..."
+          kubectl patch cluster registry-pg -n default \
+            --type merge \
+            --patch '{"spec":{"instances":1}}'
+
+          # Wait for PostgreSQL pod to be created
+          echo "Waiting for PostgreSQL pod to be created..."
+          for i in {1..60}; do
+            POD_COUNT=$(kubectl get pods -l cnpg.io/cluster=registry-pg -n default --no-headers 2>/dev/null | wc -l)
+            if [ "$POD_COUNT" -gt 0 ]; then
+              echo "Pod created"
+              break
+            fi
+            echo "Waiting... ($i/60)"
+            sleep 2
+          done
+
+          # Wait for PostgreSQL to be ready
+          echo "Waiting for PostgreSQL to be ready..."
+          kubectl wait --for=condition=ready pod -l cnpg.io/cluster=registry-pg -n default --timeout=300s
+
+      - name: Verify staging DB is functional
+        run: |
+          # Create a verification pod
+          kubectl run pg-verify-$(date +%s) \
+            --image=postgres:15 \
+            --rm -i --restart=Never \
+            --env="PGPASSWORD=$(kubectl get secret registry-pg-superuser -n default -o jsonpath='{.data.password}' | base64 -d)" \
+            -- bash -c '
+              echo "Waiting for database to accept connections..."
+              for i in {1..30}; do
+                if pg_isready -h registry-pg-rw -U postgres 2>/dev/null; then
+                  break
+                fi
+                echo "Waiting... ($i/30)"
+                sleep 2
+              done
+
+              echo "Querying database..."
+              TABLE_COUNT=$(psql -h registry-pg-rw -U postgres -d app -tAc "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = '\''public'\'';" 2>&1)
+
+              if [ $? -ne 0 ]; then
+                echo "ERROR: Could not query database"
+                echo "$TABLE_COUNT"
+                exit 1
+              fi
+
+              if [ "$TABLE_COUNT" -lt 1 ]; then
+                echo "ERROR: Staging DB has no tables!"
+                exit 1
+              fi
+
+              echo "Staging DB has $TABLE_COUNT tables"
+              echo "Top 10 tables by row count:"
+              psql -h registry-pg-rw -U postgres -d app \
+                -c "SELECT schemaname, tablename, n_live_tup FROM pg_stat_user_tables ORDER BY n_live_tup DESC LIMIT 10;" || true
+            '
+
+      - name: Cleanup
+        if: always()
+        run: |
+          # Wait for any restore jobs to finish before cleanup (max 5 minutes for large database restores)
+          echo "Checking for running restore jobs..."
+          RESTORE_NAME="${{ steps.restore.outputs.restore_name }}"
+
+          for i in {1..60}; do
+            # Check specifically for our restore job in Running or Pending state
+            RUNNING_JOBS=$(kubectl get jobs -n default --no-headers 2>/dev/null | grep "^restore-${RESTORE_NAME}" | grep -E "Running|Pending" | wc -l)
+            if [ "$RUNNING_JOBS" -eq 0 ]; then
+              echo "No running restore jobs found"
+              break
+            fi
+            echo "Waiting for $RUNNING_JOBS restore job(s) to finish... ($i/60)"
+            sleep 5
+          done
+
+          # Clean up jobs first
+          if [ -n "${{ steps.copy-job.outputs.job_name }}" ]; then
+            kubectl delete job ${{ steps.copy-job.outputs.job_name }} -n default || true
+          fi
+
+          # Clean up the restore job if it exists (with proper error handling)
+          if [ -n "$RESTORE_NAME" ]; then
+            if kubectl get job "restore-$RESTORE_NAME" -n default >/dev/null 2>&1; then
+              echo "Deleting restore job: restore-$RESTORE_NAME"
+              kubectl delete job "restore-$RESTORE_NAME" -n default || echo "Failed to delete job, may have already been cleaned up"
+            else
+              echo "Restore job restore-$RESTORE_NAME not found, skipping deletion"
+            fi
+          fi
+
+          # Remove restore PVC (will wait for jobs to finish)
+          kubectl delete pvc restore-data-pvc -n default || true
+
+          # Remove prod backup credentials (for security)
+          kubectl delete secret prod-to-staging-sync-credentials -n default || true
+
+          # Clean up old restore resources (keep last 3)
+          kubectl get restore -n default --sort-by=.metadata.creationTimestamp -o name | head -n -3 | xargs -r kubectl delete || true
+
+          # Clean up old restore jobs (keep last 3)
+          kubectl get jobs -n default --sort-by=.metadata.creationTimestamp -o name | grep '^job.batch/restore-' | head -n -3 | xargs -r kubectl delete -n default || true
+
+          # Clean up old copy jobs (keep last 3)
+          kubectl get jobs -n default --sort-by=.metadata.creationTimestamp -o name | grep 'copy-pgdata-' | head -n -3 | xargs -r kubectl delete -n default || true

.github/workflows/sync-schema.yml

@@ -0,0 +1,69 @@
+name: Sync Schema
+
+on:
+  workflow_dispatch: # Manual trigger
+  # TODO: Add daily schedule later
+  # schedule:
+  #   - cron: '0 2 * * *'  # Run daily at 2 AM UTC
+
+permissions:
+  contents: write
+
+jobs:
+  sync-schema:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Checkout static repo
+        uses: actions/checkout@v7
+        with:
+          repository: modelcontextprotocol/static
+          path: static-repo
+
+      - name: Sync schemas from static repo
+        run: |
+          echo "🔍 Syncing schemas from modelcontextprotocol/static..."
+          mkdir -p internal/validators/schemas
+          
+          # Copy all versioned schema files
+          for dir in static-repo/schemas/*/; do
+            if [ -f "$dir/server.schema.json" ]; then
+              version=$(basename "$dir")
+              # Skip draft directory if it exists
+              if [ "$version" != "draft" ]; then
+                output_file="internal/validators/schemas/${version}.json"
+                if [ ! -f "$output_file" ] || ! cmp -s "$dir/server.schema.json" "$output_file"; then
+                  echo "⬇ Adding/updating ${version}/server.schema.json -> ${version}.json"
+                  cp "$dir/server.schema.json" "$output_file"
+                else
+                  echo "✓ ${version} is already up to date"
+                fi
+              fi
+            fi
+          done
+          
+          echo "✅ Schema sync complete"
+
+      - name: Check for changes
+        id: changes
+        run: |
+          # Check for both modified and untracked files
+          if [ -n "$(git status --porcelain internal/validators/schemas/)" ]; then
+            echo "changed=true" >> $GITHUB_OUTPUT
+            git status --porcelain internal/validators/schemas/
+          else
+            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "No changes to schemas"
+          fi
+
+      - name: Commit and push changes
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          git add internal/validators/schemas/
+          git commit -m "Sync schemas from modelcontextprotocol/static [skip ci]"
+          git push

.gitignore

@@ -1,5 +1,6 @@
 build/
 bin/
+tmp/
 
 .db
 .env

.golangci.yml

@@ -22,7 +22,7 @@ linters:
     - gocyclo
     - godox
     - gomoddirectives
-    - gomodguard
+    - gomodguard_v2
     - goprintffuncname
     - gosec
     - grouper
@@ -55,6 +55,10 @@ linters:
       max-complexity: 20
     dupl:
       threshold: 300
+    goconst:
+      # Repeated literals in tests are fixture data ("1.0.0", "Test server", ...);
+      # hoisting them into constants hurts readability more than it helps.
+      ignore-tests: true
     gocognit:
       min-complexity: 51
     nestif:
@@ -66,11 +70,18 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      # httptest.NewRequest is idiomatic in tests; noctx is not useful there.
+      - path: _test\.go
+        linters:
+          - noctx
     paths:
       - third_party$
       - builtin$
       - examples$
 formatters:
+  enable:
+    - gofmt
   exclusions:
     generated: lax
     paths:

.goreleaser.yaml

@@ -95,37 +95,35 @@ signs:
     cmd: cosign
     args:
       - "sign-blob"
-      - "--output-signature=${signature}"
-      - "--output-certificate=${certificate}"
+      - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together
       - "${artifact}"
       - "--yes" # needed on cosign 2.0.0+
     artifacts: archive
     output: true
-    certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem'
-    
+    signature: "${artifact}.sigstore.json"
+
   # Also sign checksums file for additional verification
   - id: checksums
     cmd: cosign
     args:
       - "sign-blob"
-      - "--output-signature=${signature}"
-      - "--output-certificate=${certificate}"
+      - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together
       - "${artifact}"
       - "--yes"
     artifacts: checksum
     output: true
-    certificate: '{{ trimsuffix .Env.artifact ".txt" }}.pem'
+    signature: "${artifact}.sigstore.json"
 
 # This section defines the release format.
 archives:
   # Registry server archive
   - id: registry
-    name_template: "registry_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    name_template: "registry_{{ .Os }}_{{ .Arch }}"
     ids:
       - registry
-  
+
   # Publisher CLI archive
   - id: publisher
-    name_template: "mcp-publisher_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    name_template: "mcp-publisher_{{ .Os }}_{{ .Arch }}"
     ids:
       - publisher

.ko.dockerignore

@@ -0,0 +1,52 @@
+# Build artifacts
+bin/
+*.exe
+*.dll
+*.so
+*.dylib
+
+# Test and coverage files
+coverage.out
+coverage.html
+*.test
+
+# Database files
+*.db
+.db/
+
+# Deployment files
+deploy/
+
+# Documentation
+docs/
+
+# Tests
+tests/
+
+# Git
+.git/
+.gitignore
+
+# GitHub Actions
+.github/
+
+# Docker files (no longer used)
+Dockerfile
+.dockerignore
+docker-compose.yml
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Temporary files
+tmp/
+temp/
+*.tmp
+
+# OS files
+.DS_Store
+Thumbs.db

.ko.yaml

@@ -0,0 +1,32 @@
+# ko configuration for MCP Registry
+# Documentation: https://ko.build/configuration/
+
+# Default base image for all builds
+# Using Chainguard's static image for minimal, secure containers (~2MB)
+defaultBaseImage: cgr.dev/chainguard/static:latest
+
+# Default platforms for multi-architecture builds
+defaultPlatforms:
+  - linux/amd64
+  - linux/arm64
+
+# Build configuration
+builds:
+  - id: registry
+    # Main package to build
+    main: ./cmd/registry
+    # Inject version information at build time via ldflags
+    ldflags:
+      - -s -w
+      - -X main.Version={{ .Env.VERSION }}
+      - -X main.GitCommit={{ .Env.GIT_COMMIT }}
+      - -X main.BuildTime={{ .Env.BUILD_TIME }}
+    env:
+      - CGO_ENABLED=0
+
+# SBOM (Software Bill of Materials) configuration
+sbom: spdx
+
+# Base import path handling
+# Set to false to preserve full import paths in image names
+baseImportPaths: false