Publish FunASR MCP server to the official Registry

[LauraGPT]

Summary

• add canonical MCP Registry metadata for `io.github.modelscope/funasr-mcp` and a versioned GHCR package
• add a tag-gated workflow that validates metadata, builds and smoke-tests the image, then publishes through GitHub OIDC
• pin the container to FunASR 1.3.14, persist model cache, and mount host audio read-only
• document the protected release process and add strict metadata/smoke contract tests

Verification

• `python -m unittest discover -s examples/mcp_server -p "test_*.py" -v` (19 passed)
• `mcp-publisher v1.8.0 validate examples/mcp_server/server.json`
• Actionlint 1.7.12
• Ruff 0.8.4 and Black 24.10.0
• Hadolint 2.14.0 (DL3008 ignored for the rolling Debian apt repository)
• `git diff --check`
• GitHub Actions run 29369367241: image build and real container `initialize` / `tools/list` handshake passed

The remaining checkout cleanup annotation comes from the pre-existing unregistered gitlink at `runtime/onnxruntime/realtime-mic` (introduced by #2841); it is unrelated to this patch and does not fail the job.

Release

After merge, protect the mcp-registry-publish environment and have an authorized maintainer push mcp-v0.1.0. GitHub OIDC grants io.github.modelscope/* from the workflow token repository_owner claim, so the triggering user does not need to be an organization Owner. The protected environment and its independent reviewer are the security boundary that prevents an arbitrary repository writer from publishing the organization namespace.

[gemini-code-assist]

Code Review

This pull request adds registry metadata, a smoke test script, and unit tests for the FunASR MCP server, as well as updating the Dockerfile and documentation to support official MCP Registry publishing. The review feedback suggests improving the robustness of the smoke test by safely handling non-JSON output and potential TypeErrors during response validation, and defensively handling module loading in the test suite to prevent AttributeErrors.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[LauraGPT]

Post-merge release handoff: the implementation is now on main, and the post-merge validation run passed the image build plus a real MCP initialize/tools/list handshake.

@wangxingjun778, could you create and push tag mcp-v0.1.0 at merge commit ddd9a3fadad4a1b27e713120538a85a9a2568623? The official MCP Registry grants the io.github.modelscope/* namespace through a GitHub organization Owner identity; repository-admin access alone cannot perform the first claim.

The tag will start the protected mcp-registry-publish environment. No Registry secret is needed (the workflow uses GitHub OIDC); I will review the deployment gate, then the workflow will publish the public GHCR image and verify the Registry listing.

[LauraGPT]

Release update: I verified the official MCP Registry GitHub OIDC rule against its current documentation. Namespace authorization is bound to a GitHub Action running in modelscope/FunASR; it does not require the tag pusher to be an organization Owner.

I kept the two-person environment gate and prevent_self_review=true, added @wangxingjun778 as the second reviewer, and created mcp-v0.1.0 at the reviewed merge commit. The tag run has now passed unit/metadata/schema validation, version matching, image build, and the real container MCP handshake:
https://github.com/modelscope/FunASR/actions/runs/29376100237

The publish job is waiting only for the mcp-registry-publish environment approval. @wangxingjun778, could you approve that deployment when convenient? No tag push or secret setup is needed now; approval will let the existing workflow publish GHCR and the official Registry listing.

[LauraGPT]

The mcp-v0.1.0 release run has reached the protected deployment gate:

• validation, all 19 MCP/metadata tests, official publisher validation, image build, and the container initialize / tools/list smoke test passed;
• the publish job is waiting for approval on environment mcp-registry-publish;
• the triggering account cannot self-approve because the environment correctly has prevent_self_review enabled.

@wangxingjun778, could you review and approve the pending deployment when convenient?

Run: https://github.com/modelscope/FunASR/actions/runs/29376100237