Skip to content
Latchkey

Publish PyPI + MCP Registry workflow (taylorwilsdon/google_workspace_mcp)

The Publish PyPI + MCP Registry workflow from taylorwilsdon/google_workspace_mcp, explained and optimized by Latchkey.

F

CI health: F - at risk

Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →
Source: taylorwilsdon/google_workspace_mcp.github/workflows/publish-mcp-registry.ymlLicense MITView source

What it does

This is the Publish PyPI + MCP Registry workflow from the taylorwilsdon/google_workspace_mcp repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
name: Publish PyPI + MCP Registry

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions: {}

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Resolve version from tag
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

      - name: Verify tag matches pyproject version
        run: |
          PYPROJECT_VERSION="$(python - <<'PY'
          import tomllib
          with open("pyproject.toml", "rb") as f:
              data = tomllib.load(f)
          print(data["project"]["version"])
          PY
          )"
          if [ "$PYPROJECT_VERSION" != "$VERSION" ]; then
            echo "Tag version ($VERSION) does not match pyproject version ($PYPROJECT_VERSION)."
            exit 1
          fi

      - name: Sync server.json version with release
        run: |
          tmp="$(mktemp)"
          jq --arg version "$VERSION" '
            .version = $version
            | .packages = (
                (.packages // [])
                | map(
                    if ((.registryType // .registry_type // "") == "pypi")
                    then .version = $version
                    else .
                    end
                  )
              )
          ' server.json > "$tmp"
          mv "$tmp" server.json

      - name: Validate server.json against schema
        run: |
          python -m pip install --upgrade pip
          python -m pip install jsonschema requests
          python - <<'PY'
          import json
          import requests
          from jsonschema import Draft202012Validator

          with open("server.json", "r", encoding="utf-8") as f:
              instance = json.load(f)

          schema_url = instance["$schema"]
          schema = requests.get(schema_url, timeout=30).json()

          Draft202012Validator.check_schema(schema)
          Draft202012Validator(schema).validate(instance)
          print("server.json schema validation passed")
          PY

      - name: Build distribution
        run: |
          python -m pip install build
          python -m build

      - name: Check package metadata
        run: |
          python -m pip install twine
          twine check dist/*

      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true

      - name: Install mcp-publisher
        run: |
          OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
          ARCH="$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')"
          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_${OS}_${ARCH}.tar.gz" | tar xz mcp-publisher
          chmod +x mcp-publisher

      - name: Login to MCP Registry with GitHub OIDC
        run: ./mcp-publisher login github-oidc

      - name: Publish server to MCP Registry
        run: ./mcp-publisher publish

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

name: Publish PyPI + MCP Registry
 
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:
 
permissions: {}
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  publish:
    timeout-minutes: 30
    runs-on: latchkey-small
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6
 
      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          cache: 'pip'
          python-version: "3.11"
 
      - name: Resolve version from tag
        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
 
      - name: Verify tag matches pyproject version
        run: |
          PYPROJECT_VERSION="$(python - <<'PY'
          import tomllib
          with open("pyproject.toml", "rb") as f:
              data = tomllib.load(f)
          print(data["project"]["version"])
          PY
          )"
          if [ "$PYPROJECT_VERSION" != "$VERSION" ]; then
            echo "Tag version ($VERSION) does not match pyproject version ($PYPROJECT_VERSION)."
            exit 1
          fi
 
      - name: Sync server.json version with release
        run: |
          tmp="$(mktemp)"
          jq --arg version "$VERSION" '
            .version = $version
            | .packages = (
                (.packages // [])
                | map(
                    if ((.registryType // .registry_type // "") == "pypi")
                    then .version = $version
                    else .
                    end
                  )
              )
          ' server.json > "$tmp"
          mv "$tmp" server.json
 
      - name: Validate server.json against schema
        run: |
          python -m pip install --upgrade pip
          python -m pip install jsonschema requests
          python - <<'PY'
          import json
          import requests
          from jsonschema import Draft202012Validator
 
          with open("server.json", "r", encoding="utf-8") as f:
              instance = json.load(f)
 
          schema_url = instance["$schema"]
          schema = requests.get(schema_url, timeout=30).json()
 
          Draft202012Validator.check_schema(schema)
          Draft202012Validator(schema).validate(instance)
          print("server.json schema validation passed")
          PY
 
      - name: Build distribution
        run: |
          python -m pip install build
          python -m build
 
      - name: Check package metadata
        run: |
          python -m pip install twine
          twine check dist/*
 
      - name: Publish package to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          skip-existing: true
 
      - name: Install mcp-publisher
        run: |
          OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
          ARCH="$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')"
          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_${OS}_${ARCH}.tar.gz" | tar xz mcp-publisher
          chmod +x mcp-publisher
 
      - name: Login to MCP Registry with GitHub OIDC
        run: ./mcp-publisher login github-oidc
 
      - name: Publish server to MCP Registry
        run: ./mcp-publisher publish
 

What changed

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow