security: hash-pin publish.yml TestPyPI installs (#299)

* security: hash-pin publish.yml TestPyPI installs, add smithery.yaml

Closes Scorecard Pinned-Dependencies alerts #49 (real-PyPI runtime deps,
now pinned via uv export's own hash resolution) and #50 (the mcpg
install from TestPyPI, now pinned to the sha256 of the wheel this same
workflow run built - TestPyPI serves that identical file back, so this
also catches upload-path tampering, not just dependency confusion).

Verified locally: a fresh venv installs the full hashed dependency set
cleanly via pip's hash-checking mode.

Also adds smithery.yaml (verification hash for the Smithery registry
listing), previously untracked.

Entire-Checkpoint: 30082aaf6e70

* security: harden hash-pin script per review, add explicit CodeQL workflow

Sourcery review on #299 flagged two real gaps in the TestPyPI hash-pin
step: the wheel glob could silently match >1 file, and the extracted
hash wasn't validated before being written into the pin file. Both now
fail loudly instead of proceeding on bad input.

Also closes Scorecard SAST alert #54: CodeQL was running via GitHub's
"default setup", which Scorecard's static SAST check can't see (it only
recognizes an explicit codeql-action workflow). Switched to an explicit
.github/workflows/codeql.yml (python + actions, matching this repo's
actual content) and disabled default setup via the API to avoid the two
configurations conflicting.

Entire-Checkpoint: 8dc67c1349b0

Author: devopam

.github/workflows/codeql.yml

@@ -0,0 +1,55 @@
+name: CodeQL
+
+# Explicit workflow (replaces GitHub's "default setup") for two reasons:
+# 1. Scorecard's SAST check only recognizes a workflow file running
+#    github/codeql-action — "default setup" scans just as thoroughly but
+#    is invisible to that static check (scorecard alert #54).
+# 2. Running on `pull_request` (not just a schedule) gates every PR, not
+#    just periodic scans of main.
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  schedule:
+    - cron: "23 8 * * 3"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to upload SARIF results.
+      security-events: write
+      # Required to fetch the source.
+      contents: read
+      # Required for the "actions" language (workflow analysis).
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Matches this repo's actual content — pure Python plus the
+        # workflow files themselves. (Default setup had also flagged
+        # c-cpp from autodetection; there's no C/C++ source in the repo,
+        # only vendored build artifacts under the gitignored .venv/.)
+        language: ["python", "actions"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@e60ea984bd3baa95954f2856bcf24f9eaba46637 # v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/publish.yml

@@ -79,14 +79,21 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: "3.14"
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: dist
+          path: dist/
       - name: Install runtime deps from real PyPI (anti-confusion)
         # TestPyPI is a public sandbox; combining its index with
         # ``--extra-index-url=pypi`` lets an attacker shadow our
         # deps with a higher-numbered fake (dependency confusion).
         # Step 1 pins real PyPI only, dep list canonically derived
-        # from pyproject.toml.
+        # from pyproject.toml. Hashes come from uv's own lockfile
+        # resolution, so pip refuses to install anything whose
+        # artifact doesn't match what we resolved (belt-and-braces
+        # on top of the index pinning above).
         run: |
-          uv export --no-dev --no-emit-project --no-hashes \
+          uv export --no-dev --no-emit-project \
             --format requirements-txt > /tmp/mcpg-deps.txt
           python -m pip install -r /tmp/mcpg-deps.txt
       - name: Wait for TestPyPI to index the upload
@@ -110,16 +117,32 @@ jobs:
           done
           echo "::error::TestPyPI simple index never listed mcpg==${VER}"
           exit 1
-      - name: Install mcpg from TestPyPI (no deps)
+      - name: Install mcpg from TestPyPI (no deps, hash-pinned)
         # A short retry on the install itself too: even after the simple
         # index origin has the version, a CDN edge cache in front of it can
-        # lag a few more seconds.
+        # lag a few more seconds. The hash comes from the wheel this same
+        # workflow run built and uploaded a few steps ago (downloaded
+        # above) — TestPyPI serves that identical file back byte-for-byte,
+        # so pinning to it also catches any upload-path tampering, not
+        # just dependency confusion.
         run: |
           VER="${GITHUB_REF_NAME#v}"
+          mapfile -t WHEELS < <(ls dist/mcpg-"${VER}"-*.whl)
+          if [ "${#WHEELS[@]}" -ne 1 ]; then
+            echo "::error::Expected exactly one wheel for mcpg==${VER} in dist/, found ${#WHEELS[@]}: ${WHEELS[*]}"
+            exit 1
+          fi
+          WHEEL="${WHEELS[0]}"
+          HASH="$(python -m pip hash "$WHEEL" | sed -n 's/^--hash=sha256://p')"
+          if ! [[ "$HASH" =~ ^[0-9a-f]{64}$ ]]; then
+            echo "::error::pip hash output for $WHEEL did not look like a sha256 hex digest: '${HASH}'"
+            exit 1
+          fi
+          echo "mcpg==${VER} --hash=sha256:${HASH}" > /tmp/mcpg-pin.txt
           for i in 1 2 3; do
             if python -m pip install --no-deps \
                 --index-url https://test.pypi.org/simple/ \
-                "mcpg==${VER}"; then
+                -r /tmp/mcpg-pin.txt; then
               exit 0
             fi
             echo "pip install attempt $i/3 failed; retrying in 10s..."

smithery.yaml

@@ -0,0 +1,2 @@
+version: 1
+verification: "21ea4bfd62e446e674040d0da57bdd3c1cd1dba72dcbe832bb90a55b47d6e11c"