Document tag-driven releases and Control Tower roadmap - #15
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 035b166843
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| publish-mcp-registry: | ||
| create-github-release: | ||
| runs-on: ubuntu-latest | ||
| needs: publish-pypi |
There was a problem hiding this comment.
When a pushed tag lacks the exact ## <version> - changelog heading, publish-pypi has already completed before this job runs, so the extractor exits after an immutable PyPI version has been published but before the GitHub Release and MCP Registry entry are created. Correcting the changelog in a later commit will not change the tagged checkout, while rerunning the whole workflow can fail on the duplicate PyPI upload; perform the deterministic changelog extraction/validation before the publish job and pass the generated notes forward.
AGENTS.md reference: AGENTS.md:L170-L179
Useful? React with 👍 / 👎.
| permissions: | ||
| contents: read | ||
| contents: write |
There was a problem hiding this comment.
This workflow-level grant is inherited by the build job, so checkout, dependency setup, build commands, and third-party actions all run with a token capable of modifying repository contents even though only create-github-release needs that privilege. A compromised dependency or action during a tag build could therefore alter tags or repository content; keep workflow/build access at contents: read and grant contents: write only on the release-creation job.
Useful? React with 👍 / 👎.
2 participants
What changed
This PR packages two related documentation updates:
AGENTS.mdand updatesrelease-pypi.ymlso tag pushes drive PyPI publish, GitHub Release creation, and MCP Registry publish from a single flowROADMAP.mdwith the first planned Control Tower integration scope, including read-only inventory/health/posture queries and explicit guardrails around write-capable actionsWhy
The release guidance was too terse for a repo that now has multiple release artifacts, and the roadmap needed a clearer statement of how this package should relate to
agenticops-control-towerinstead of reimplementing control-plane behavior locally.Impact
Maintainers get a clearer release checklist and more aligned automation, while roadmap readers get a more concrete picture of the intended Control Tower integration boundary.
Validation
These are documentation and workflow-file changes only; no code or test commands were required.