From 6839cf866b1c22f57d126b1ec131fd8f4465458d Mon Sep 17 00:00:00 2001
From: Tym Rabchuk <tymrabchuk@gmail.com>
Date: Fri, 22 May 2026 14:41:32 -0400
Subject: [PATCH] ci(release): bump mcpb/manifest.json in lockstep + rebuild
 bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The auto-bump job (Step 5 of release.yml) only updates
.claude-plugin/plugin.json. mcpb/manifest.json never gets bumped by CI —
it only moves when someone runs `make sync-version` locally. So after
every PR merge it drifts one version behind, and the next contributor
who builds locally trips the mcpb-bundle-integrity CI check because the
manifest bump invalidates devkit.mcpb.sources.json. PR #104 hit this;
without a fix, every contributor will hit it.

There's also a versioning lie: devkit.mcpb advertises the old version
(currently 2.1.33) but ships a launcher that reads plugin.json and
fetches a newer engine (2.1.34+).

This change extends the auto-bump job to:
- Set up Go (needed for the launcher cross-compile)
- Bump mcpb/manifest.json alongside plugin.json
- Run bin/mcpb-build to regenerate devkit.mcpb, the sidecar, and the
  Windows launcher binary
- Stage all changed files in the same bump commit

The launcher cross-compile is deterministic (-trimpath, -s -w, no
embedded version) so mcpb/server/devkit.exe is usually byte-identical
and git add skips it; only the bundle + sidecar actually change.

Also converts the bump job's shell steps to env-var style for inputs,
matching the pattern recommended by the workflow-edit security
reminder (defense in depth — these inputs are repo-controlled, not
event-controlled, but env: is cleaner).

Manual-bump path (where the merge commit already carries a bumped
plugin.json) is unchanged — Step 5 is skipped for those. A follow-up
could add a CI check that manual bumps also touch manifest.json + the
bundle, but that's out of scope here.
---
 .github/workflows/release.yml | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 94eb4c7..b72e39d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -220,6 +220,13 @@ jobs:
   # Runs last so plugin.json on main only advertises the new version after
   # the release is fully published. Skipped for manual bumps where the
   # merge commit already carries the bumped plugin.json.
+  #
+  # Bumps mcpb/manifest.json in lockstep with .claude-plugin/plugin.json and
+  # rebuilds devkit.mcpb + devkit.mcpb.sources.json so the MCPB bundle's
+  # advertised version matches what the launcher actually fetches, and the
+  # sidecar's sha256s stay consistent with the bundled files. Without this,
+  # manifest.json drifts behind every auto-bump and the next contributor who
+  # runs `make sync-version` locally trips the mcpb-bundle-integrity CI check.
   bump:
     needs: [version, create-release, binaries, publish]
     if: >-
@@ -233,17 +240,37 @@ jobs:
           fetch-depth: 0
           ref: main
 
-      - name: Sync plugin.json
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: src/go.mod
+          cache-dependency-path: src/go.sum
+
+      - name: Sync plugin.json + mcpb/manifest.json
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
         run: |
-          VERSION="${{ needs.version.outputs.version }}"
           jq --arg v "$VERSION" '.version = $v' .claude-plugin/plugin.json > tmp.json && mv tmp.json .claude-plugin/plugin.json
+          jq --arg v "$VERSION" '.version = $v' mcpb/manifest.json > tmp.json && mv tmp.json mcpb/manifest.json
+
+      - name: Rebuild MCPB bundle
+        # manifest.json is hashed in devkit.mcpb.sources.json and zipped into
+        # devkit.mcpb, so a manifest bump invalidates both. The launcher
+        # cross-compile is deterministic (-trimpath, -s -w, no embedded
+        # version) so mcpb/server/devkit.exe is usually byte-identical and
+        # `git add` skips it; only the bundle + sidecar actually change.
+        run: bin/mcpb-build
 
       - name: Commit and push version bump
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
         run: |
-          VERSION="${{ needs.version.outputs.version }}"
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add .claude-plugin/plugin.json
+          git add .claude-plugin/plugin.json \
+                  mcpb/manifest.json \
+                  mcpb/server/devkit.exe \
+                  devkit.mcpb \
+                  devkit.mcpb.sources.json
           if git diff --cached --quiet; then
             echo "Version files already at $VERSION — no commit needed"
           else