chore(release): 0.4.3

Author: rldyourmnd

.github/actions/setup-codex-runtime/action.yml

@@ -60,6 +60,54 @@ runs:
           exit 1
         fi
 
+    - name: Install pinned GitHub MCP server
+      if: inputs.install-codex == 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        # shellcheck source=config/mcp-runtime-versions.env
+        . config/mcp-runtime-versions.env
+        : "${GITHUB_MCP_SERVER_VERSION:?GITHUB_MCP_SERVER_VERSION is required}"
+        case "$RUNNER_OS" in
+          Linux) os_name="Linux" ;;
+          macOS) os_name="Darwin" ;;
+          *)
+            echo "Unsupported runner OS for github-mcp-server: $RUNNER_OS" >&2
+            exit 1
+            ;;
+        esac
+        case "$(uname -m)" in
+          x86_64|amd64) arch_name="x86_64" ;;
+          arm64|aarch64) arch_name="arm64" ;;
+          i386|i686) arch_name="i386" ;;
+          *)
+            echo "Unsupported runner architecture for github-mcp-server: $(uname -m)" >&2
+            exit 1
+            ;;
+        esac
+        archive="github-mcp-server_${os_name}_${arch_name}.tar.gz"
+        base_url="https://github.com/github/github-mcp-server/releases/download/v${GITHUB_MCP_SERVER_VERSION}"
+        tmp_dir="$(mktemp -d)"
+        install_dir="${RUNNER_TEMP:-$tmp_dir}/rldyour-bin"
+        mkdir -p "$install_dir"
+        curl -fsSL "${base_url}/${archive}" -o "${tmp_dir}/${archive}"
+        curl -fsSL "${base_url}/github-mcp-server_${GITHUB_MCP_SERVER_VERSION}_checksums.txt" -o "${tmp_dir}/checksums.txt"
+        grep "  ${archive}$" "${tmp_dir}/checksums.txt" > "${tmp_dir}/checksums.selected"
+        if [ "$RUNNER_OS" = "Linux" ]; then
+          (cd "$tmp_dir" && sha256sum -c checksums.selected)
+        else
+          expected_sha="$(awk '{print $1}' "${tmp_dir}/checksums.selected")"
+          actual_sha="$(shasum -a 256 "${tmp_dir}/${archive}" | awk '{print $1}')"
+          if [ "$expected_sha" != "$actual_sha" ]; then
+            echo "github-mcp-server checksum mismatch" >&2
+            exit 1
+          fi
+        fi
+        tar -xzf "${tmp_dir}/${archive}" -C "$tmp_dir"
+        install -m 0755 "${tmp_dir}/github-mcp-server" "${install_dir}/github-mcp-server"
+        echo "$install_dir" >> "$GITHUB_PATH"
+        "${install_dir}/github-mcp-server" --version || "${install_dir}/github-mcp-server" --help >/dev/null
+
     - name: Install pinned Codex CLI
       if: inputs.install-codex == 'true'
       shell: bash

CHANGELOG.md

@@ -6,6 +6,26 @@ The format follows Keep a Changelog, and marketplace/plugin versions follow Sema
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-05-21
+
+### Changed
+
+- GitHub Actions runtime setup now installs the pinned official GitHub MCP
+  server `1.0.5` from the upstream release artifact with SHA-256 checksum
+  verification before strict Codex runtime validation runs.
+- Context7 MCP is updated from `2.2.5` to the current stable `2.3.0` in both
+  `.mcp.json` and `config/mcp-runtime-versions.env`.
+- MCP runtime freshness now tracks `GITHUB_MCP_SERVER_VERSION` through the
+  GitHub releases API alongside npm and PyPI-backed runtime pins.
+
+### Fixed
+
+- `scripts/validate_contract.py` now narrows JSON-derived values before sorting
+  or passing them to typed helpers, keeping Pyright strict checks green under
+  the public `security-static` workflow.
+- Public Codex CI no longer fails strict runtime prerequisite checks because the
+  `github` MCP server launcher is absent on hosted Ubuntu/macOS runners.
+
 ## [0.4.2] - 2026-05-21
 
 ### Added

README.md

@@ -122,9 +122,9 @@ The Codex adapter contract lives in `config/rldyour-contract.json` and is docume
 
 `plugins/rldyour-mcps/.mcp.json` is the portable source of truth for MCP server definitions. The installer resolves portable commands such as `uvx`, `bunx`, and `dart` to local executable paths in `~/.codex/config.toml`; `scripts/validate_marketplace.sh` checks that the installed MCP config still matches `.mcp.json` apart from that expected command-path resolution.
 
-Local MCP launcher packages are pinned in `.mcp.json` and mirrored in `config/mcp-runtime-versions.env`; marketplace validation fails if these sources drift. Do not use `@latest` or unpinned `uvx --from` package specs for local MCP runtime definitions; update versions intentionally and rerun capability smoke.
+Local MCP launcher packages are pinned in `.mcp.json` and mirrored in `config/mcp-runtime-versions.env`; marketplace validation fails if these sources drift. Do not use `@latest` or unpinned `uvx --from` package specs for local MCP runtime definitions; update versions intentionally and rerun capability smoke. The official GitHub MCP server binary is pinned separately as `GITHUB_MCP_SERVER_VERSION` and installed by CI from the matching upstream release artifact with checksum verification.
 
-`dart-flutter` is intentionally declared as an external local Dart SDK runtime in `config/mcp-runtime-versions.env`; all other local package launchers remain package-pinned. Host runtime pins for Node major, Bun, and Dart SDK also live in this file so local setup, GitHub Actions, and the devcontainer share one source of truth. GitHub Actions workflows pin external actions to full commit SHAs, with the source tag kept as an inline comment for review.
+`dart-flutter` is intentionally declared as an external local Dart SDK runtime in `config/mcp-runtime-versions.env`; all other local package launchers remain package-pinned or binary-release-pinned. Host runtime pins for Node major, Bun, Dart SDK, and GitHub MCP also live in this file so local setup, GitHub Actions, and the devcontainer share one source of truth. GitHub Actions workflows pin external actions to full commit SHAs, with the source tag kept as an inline comment for review.
 
 Strict runtime mode is available when the environment must be fully reproducible instead of warning-only:
 

VERSION

@@ -1 +1 @@
-0.4.2
+0.4.3

config/mcp-runtime-versions.env

@@ -6,11 +6,12 @@ NODE_MAJOR_VERSION=24
 BUN_VERSION=1.3.14
 DART_SDK_VERSION=3.11.0
 CODEX_CLI_VERSION=0.132.0
+GITHUB_MCP_SERVER_VERSION=1.0.5
 MCP_PYTHON_SDK_VERSION=1.27.1
 SERENA_AGENT_VERSION=1.5.1
 SEMGREP_VERSION=1.163.0
 SEQUENTIAL_THINKING_MCP_VERSION=2025.12.18
 PLAYWRIGHT_MCP_VERSION=0.0.75
 CHROME_DEVTOOLS_MCP_VERSION=1.0.1
-CONTEXT7_MCP_VERSION=2.2.5
+CONTEXT7_MCP_VERSION=2.3.0
 SHADCN_VERSION=4.7.0

plugins/rldyour-mcps/.mcp.json

@@ -57,7 +57,7 @@
     "context7": {
       "command": "bunx",
       "args": [
-        "@upstash/context7-mcp@2.2.5"
+        "@upstash/context7-mcp@2.3.0"
       ],
       "env_vars": [
         "CONTEXT7_API_KEY"

plugins/rldyour-mcps/README.md

@@ -86,6 +86,11 @@ The server is restricted to `context,repos,issues,pull_requests,users` so
 repository, issue, and PR workflows have parity without exposing every GitHub
 toolset by default.
 
+The CI/runtime pin for this binary is `GITHUB_MCP_SERVER_VERSION` in
+`config/mcp-runtime-versions.env`. GitHub Actions installs the matching release
+archive from `github/github-mcp-server` and verifies its published SHA-256
+checksum before strict runtime validation.
+
 ## Codex Verification
 
 After installing or updating the plugin, check:

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "rldyour-codex"
-version = "0.4.2"
+version = "0.4.3"
 description = "Personal Codex marketplace with rldyour plugins, MCP servers, skills, hooks, and SDLC tooling."
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

scripts/check_mcp_runtime_versions.py

@@ -23,6 +23,7 @@ class Pin:
 
 PINS: tuple[Pin, ...] = (
     Pin("CODEX_CLI_VERSION", "npm", "@openai/codex"),
+    Pin("GITHUB_MCP_SERVER_VERSION", "github-release", "github/github-mcp-server"),
     Pin("BUN_VERSION", "npm", "bun"),
     Pin("MCP_PYTHON_SDK_VERSION", "pypi", "mcp"),
     Pin("SERENA_AGENT_VERSION", "pypi", "serena-agent"),
@@ -72,11 +73,24 @@ def pypi_latest(package: str) -> str:
     return version
 
 
+def github_release_latest(repository: str) -> str:
+    url = f"https://api.github.com/repos/{repository}/releases/latest"
+    # PINS is a repository allowlist, so repository cannot be user-controlled.
+    with urllib.request.urlopen(url, timeout=45) as response:  # nosemgrep: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected
+        data = json.load(response)
+    tag = data.get("tag_name")
+    if not isinstance(tag, str) or not tag:
+        raise RuntimeError(f"unexpected GitHub releases response for {repository}")
+    return tag.removeprefix("v")
+
+
 def latest_for(pin: Pin) -> str:
     if pin.ecosystem == "npm":
         return npm_latest(pin.package)
     if pin.ecosystem == "pypi":
         return pypi_latest(pin.package)
+    if pin.ecosystem == "github-release":
+        return github_release_latest(pin.package)
     raise RuntimeError(f"unsupported ecosystem: {pin.ecosystem}")
 
 

scripts/validate_contract.py

@@ -80,13 +80,18 @@ def main() -> int:
         errors.append("config/rldyour-contract.json: schema_version must be 1")
 
     marketplace = load_json(ROOT / ".agents/plugins/marketplace.json")
-    marketplace_plugins = marketplace.get("plugins") if isinstance(marketplace, dict) else None
-    actual_plugins = sorted(
-        entry.get("name")
-        for entry in marketplace_plugins or []
-        if isinstance(entry, dict) and isinstance(entry.get("name"), str)
-    )
-    expected_plugins = sorted(contract.get("plugins") or [])
+    marketplace_plugins_raw = marketplace.get("plugins") if isinstance(marketplace, dict) else []
+    marketplace_plugins = marketplace_plugins_raw if isinstance(marketplace_plugins_raw, list) else []
+    actual_plugins: list[str] = []
+    for entry in marketplace_plugins:
+        if not isinstance(entry, dict):
+            continue
+        name = entry.get("name")
+        if isinstance(name, str):
+            actual_plugins.append(name)
+    actual_plugins.sort()
+    expected_plugins_raw = contract.get("plugins")
+    expected_plugins = sorted(item for item in expected_plugins_raw if isinstance(item, str)) if isinstance(expected_plugins_raw, list) else []
     if actual_plugins != expected_plugins:
         errors.append(f"plugins: expected {expected_plugins}, got {actual_plugins}")
 
@@ -183,17 +188,21 @@ def main() -> int:
                     if not isinstance(dispatcher, dict):
                         errors.append(f"hooks.lifecycles.{lifecycle_id}: unknown dispatcher {dispatched_by!r}")
                     continue
-                plugin = mapping.get("plugin")
-                event = mapping.get("event")
-                needle = mapping.get("command_contains")
-                if not all(isinstance(item, str) for item in (plugin, event, needle)):
+                plugin_raw = mapping.get("plugin")
+                event_raw = mapping.get("event")
+                needle_raw = mapping.get("command_contains")
+                if not isinstance(plugin_raw, str) or not isinstance(event_raw, str) or not isinstance(needle_raw, str):
                     errors.append(f"hooks.lifecycles.{lifecycle_id}: plugin/event/command_contains must be strings")
                     continue
+                plugin = plugin_raw
+                event = event_raw
+                needle = needle_raw
                 if not command_for_event(plugin, event, needle):
                     errors.append(f"hooks.lifecycles.{lifecycle_id}: {plugin} {event} missing command {needle}")
 
     mcp_contract = contract.get("mcp")
-    expected_servers = sorted(mcp_contract.get("servers") if isinstance(mcp_contract, dict) else [])
+    expected_servers_raw = mcp_contract.get("servers") if isinstance(mcp_contract, dict) else []
+    expected_servers = sorted(item for item in expected_servers_raw if isinstance(item, str)) if isinstance(expected_servers_raw, list) else []
     mcp_data = load_json(ROOT / "plugins/rldyour-mcps/.mcp.json")
     actual_servers = sorted((mcp_data.get("mcpServers") or {}).keys()) if isinstance(mcp_data, dict) else []
     if actual_servers != expected_servers: