Merge branch 'main' into fix/2110-http-error-propagation

fede-kamel · web-flow · commit b2ed978aaa02 · 2026-05-25T02:27:00.000-04:00
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
@@ -30,12 +30,13 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude
         uses: anthropics/claude-code-action@2f8ba26a219c06cfb0f468eef8d97055fa814f97 # v1.0.53
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
           use_commit_signing: true
           additional_permissions: |
             actions: read
diff --git a/.github/workflows/comment-on-release.yml b/.github/workflows/comment-on-release.yml
@@ -16,13 +16,16 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get previous release
         id: previous_release
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          CURRENT_TAG: ${{ github.event.release.tag_name }}
         with:
           script: |
-            const currentTag = '${{ github.event.release.tag_name }}';
+            const currentTag = process.env.CURRENT_TAG;
 
             // Get all releases
             const { data: releases } = await github.rest.repos.listReleases({
@@ -54,10 +57,13 @@ jobs:
       - name: Get merged PRs between releases
         id: get_prs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          CURRENT_TAG: ${{ github.event.release.tag_name }}
+          PREVIOUS_TAG_JSON: ${{ steps.previous_release.outputs.result }}
         with:
           script: |
-            const currentTag = '${{ github.event.release.tag_name }}';
-            const previousTag = ${{ steps.previous_release.outputs.result }};
+            const currentTag = process.env.CURRENT_TAG;
+            const previousTag = JSON.parse(process.env.PREVIOUS_TAG_JSON);
 
             if (!previousTag) {
               console.log('No previous release found, skipping');
@@ -104,11 +110,15 @@ jobs:
 
       - name: Comment on PRs
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          PR_NUMBERS_JSON: ${{ steps.get_prs.outputs.result }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_URL: ${{ github.event.release.html_url }}
         with:
           script: |
-            const prNumbers = ${{ steps.get_prs.outputs.result }};
-            const releaseTag = '${{ github.event.release.tag_name }}';
-            const releaseUrl = '${{ github.event.release.html_url }}';
+            const prNumbers = JSON.parse(process.env.PR_NUMBERS_JSON);
+            const releaseTag = process.env.RELEASE_TAG;
+            const releaseUrl = process.env.RELEASE_URL;
 
             const comment = `This pull request is included in [${releaseTag}](${releaseUrl})`;
 
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
@@ -19,6 +19,8 @@ jobs:
     continue-on-error: true
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
@@ -34,6 +36,8 @@ jobs:
     continue-on-error: true
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
@@ -0,0 +1,59 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches:
+      - main
+      - v1.x
+    paths:
+      - docs/**
+      - mkdocs.yml
+      - src/mcp/**
+      - scripts/build-docs.sh
+      - pyproject.toml
+      - uv.lock
+      - .github/workflows/deploy-docs.yml
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-docs
+  cancel-in-progress: false
+
+jobs:
+  deploy-docs:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
+        with:
+          enable-cache: true
+          version: 0.9.5
+
+      - name: Build combined docs (v1.x at /, main at /v2/)
+        run: bash scripts/build-docs.sh site
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload Pages artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/publish-docs-manually.yml b/.github/workflows/publish-docs-manually.yml
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
@@ -4,18 +4,23 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   release-build:
     name: Build distribution
     runs-on: ubuntu-latest
     needs: [checks]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
-          enable-cache: true
+          enable-cache: false
           version: 0.9.5
 
       - name: Set up Python 3.12
@@ -51,32 +56,3 @@ jobs:
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
-
-  docs-publish:
-    runs-on: ubuntu-latest
-    needs: ["pypi-publish"]
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
-        with:
-          enable-cache: true
-          version: 0.9.5
-
-      - run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-      - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
-      - run: uv sync --frozen --group docs
-      - run: uv run --frozen --no-sync mkdocs gh-deploy --force
diff --git a/.github/workflows/shared.yml b/.github/workflows/shared.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
@@ -57,6 +59,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Install uv
         uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
@@ -83,6 +87,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
diff --git a/.github/workflows/weekly-lockfile-update.yml b/.github/workflows/weekly-lockfile-update.yml
@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
@@ -0,0 +1,25 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
diff --git a/.gitignore b/.gitignore
@@ -143,6 +143,7 @@ venv.bak/
 
 # mkdocs documentation
 /site
+/.worktrees/
 
 # mypy
 .mypy_cache/
diff --git a/docs/index.md b/docs/index.md
@@ -1,5 +1,8 @@
 # MCP Python SDK
 
+!!! info "You are viewing the in-development v2 documentation"
+    For the current stable release, see the [v1.x documentation](https://py.sdk.modelcontextprotocol.io/).
+
 The **Model Context Protocol (MCP)** allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction.
 
 This Python SDK implements the full MCP specification, making it easy to:
diff --git a/mkdocs.yml b/mkdocs.yml
@@ -5,7 +5,7 @@ strict: true
 repo_name: modelcontextprotocol/python-sdk
 repo_url: https://github.com/modelcontextprotocol/python-sdk
 edit_uri: edit/main/docs/
-site_url: https://modelcontextprotocol.github.io/python-sdk
+site_url: https://py.sdk.modelcontextprotocol.io/v2/
 
 # TODO(Marcelo): Add Anthropic copyright?
 # copyright: © Model Context Protocol 2025 to present
diff --git a/pyproject.toml b/pyproject.toml
@@ -115,6 +115,7 @@ bump = true
 
 [project.urls]
 Homepage = "https://modelcontextprotocol.io"
+Documentation = "https://py.sdk.modelcontextprotocol.io/v2/"
 Repository = "https://github.com/modelcontextprotocol/python-sdk"
 Issues = "https://github.com/modelcontextprotocol/python-sdk/issues"
 
diff --git a/scripts/build-docs.sh b/scripts/build-docs.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+#
+# Build combined v1 + v2 MkDocs documentation for GitHub Pages.
+#
+# v1 docs (from the v1.x branch) are placed at the site root.
+# v2 docs (from main) are placed under /v2/.
+#
+# Both branches are fetched fresh from origin, so the output is identical
+# regardless of which branch triggered the workflow. This script is intended
+# to run in CI; for local single-branch preview use `uv run mkdocs serve`.
+#
+# Usage:
+#   scripts/build-docs.sh [output-dir]
+#
+# Default output directory: site
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+OUTPUT_DIR="$(cd "$REPO_ROOT" && mkdir -p "${1:-site}" && cd "${1:-site}" && pwd)"
+V1_WORKTREE="$REPO_ROOT/.worktrees/v1-docs"
+V2_WORKTREE="$REPO_ROOT/.worktrees/v2-docs"
+
+cleanup() {
+    cd "$REPO_ROOT"
+    git worktree remove --force "$V1_WORKTREE" 2>/dev/null || true
+    git worktree remove --force "$V2_WORKTREE" 2>/dev/null || true
+    rmdir "$REPO_ROOT/.worktrees" 2>/dev/null || true
+}
+trap cleanup EXIT
+
+rm -rf "${OUTPUT_DIR:?}"/*
+
+build_branch() {
+    local branch="$1" worktree="$2" dest="$3"
+
+    echo "=== Building docs for ${branch} ==="
+    git fetch origin "$branch"
+    git worktree remove --force "$worktree" 2>/dev/null || true
+    rm -rf "$worktree"
+    git worktree add --detach "$worktree" "origin/${branch}"
+
+    (
+        cd "$worktree"
+        uv sync --frozen --group docs
+        uv run --frozen --no-sync mkdocs build --site-dir "$dest"
+    )
+}
+
+build_branch v1.x "$V1_WORKTREE" "$OUTPUT_DIR"
+build_branch main "$V2_WORKTREE" "$OUTPUT_DIR/v2"
+
+echo "=== Combined docs built at $OUTPUT_DIR ==="
