Release v0.12.0: correctness, security, and MCP evaluations (#75)

* Prepare v0.12.0 correctness and evaluation release

* Align documented release verification with supported workflow

* Use US spelling in VFS documentation

* Fix README configuration guide link

* Resolve independent release review findings

* Standardize US spelling in changed files

* Harden filter operands and R logging

* Keep frame locals out of tracebacks

* Resolve final release review findings

* Preserve safe actionable R errors

* Use native uv build for v0.12.0

* Resolve independent release review

* Make secure reads portable and metadata-correct

* Resolve final release review edge cases

* Fail closed on release image validation

* Block parenthesized formula code execution

* Harden staged MCP file reads

Author: soodoku

.github/workflows/build-base-image.yml

@@ -18,7 +18,7 @@ on:
   push:
     branches: [main]
     paths:
-      - 'Dockerfile.base'
+      - 'Dockerfile'
       - '.github/workflows/build-base-image.yml'
 
 env:
@@ -51,11 +51,11 @@ jobs:
       id: check-rebuild
       run: |
         # Check if base image exists and get its creation date
-        if docker manifest inspect ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest >/dev/null 2>&1; then
+        if docker manifest inspect "${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" >/dev/null 2>&1; then
           echo "Base image exists"
 
           # Get image creation date (simplified check)
-          CREATION_DATE=$(docker manifest inspect ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest | jq -r '.history[0].created // empty')
+          CREATION_DATE=$(docker manifest inspect "${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" | jq -r '.history[0].created // empty')
 
           if [ -n "$CREATION_DATE" ]; then
             # Check if image is older than 7 days
@@ -67,18 +67,18 @@ jobs:
 
             if [ "$AGE_DAYS" -lt 7 ] && [ "${{ github.event.inputs.force_rebuild }}" != "true" ]; then
               echo "Image is recent (< 7 days old) and no force rebuild requested"
-              echo "rebuild_needed=false" >> $GITHUB_OUTPUT
+              echo "rebuild_needed=false" >> "$GITHUB_OUTPUT"
             else
               echo "Image is old (>= 7 days) or force rebuild requested"
-              echo "rebuild_needed=true" >> $GITHUB_OUTPUT
+              echo "rebuild_needed=true" >> "$GITHUB_OUTPUT"
             fi
           else
             echo "Could not determine image age, rebuilding"
-            echo "rebuild_needed=true" >> $GITHUB_OUTPUT
+            echo "rebuild_needed=true" >> "$GITHUB_OUTPUT"
           fi
         else
           echo "Base image does not exist, building"
-          echo "rebuild_needed=true" >> $GITHUB_OUTPUT
+          echo "rebuild_needed=true" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Extract metadata
@@ -98,7 +98,8 @@ jobs:
       uses: docker/build-push-action@v7
       with:
         context: .
-        file: ./Dockerfile.base
+        file: ./Dockerfile
+        target: base
         platforms: linux/amd64,linux/arm64
         push: true
         tags: ${{ steps.meta.outputs.tags }}
@@ -116,7 +117,7 @@ jobs:
         echo "🧪 Testing base image functionality..."
 
         # Test R availability and packages
-        docker run --rm ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest R -e "
+        docker run --rm "${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" R -e "
         cat('✅ R version:', R.version.string, '\n')
 
         # Test key packages
@@ -136,19 +137,16 @@ jobs:
         }
         "
 
-        # Test mkcert availability
-        docker run --rm ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest mkcert -version
-
         # Test Python availability
-        docker run --rm ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest python3 --version
+        docker run --rm "${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" python3 --version
 
         echo "✅ Base image tests passed"
 
     - name: Update image metadata
       if: steps.check-rebuild.outputs.rebuild_needed == 'true'
       run: |
         # Extract and display build information
-        docker run --rm ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest cat /opt/rmcp-base-info.json | jq .
+        docker run --rm "${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" cat /opt/rmcp-base-info.json | jq .
 
         echo "📊 Base image build completed:"
         echo "  Registry: ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}"
@@ -161,27 +159,30 @@ jobs:
     - name: Create release note
       if: steps.check-rebuild.outputs.rebuild_needed == 'true' && github.event_name == 'schedule'
       run: |
-        echo "📦 **Base Image Updated**" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "The RMCP base R environment has been rebuilt with:" >> $GITHUB_STEP_SUMMARY
-        echo "- 🔄 Latest system packages" >> $GITHUB_STEP_SUMMARY
-        echo "- 📊 All R statistical packages" >> $GITHUB_STEP_SUMMARY
-        echo "- 🔒 mkcert for HTTPS development" >> $GITHUB_STEP_SUMMARY
-        echo "- 🐍 Python development environment" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Impact:** CI builds will now be significantly faster! ⚡" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Next Steps:** " >> $GITHUB_STEP_SUMMARY
-        echo "1. Main CI will automatically use the new base image" >> $GITHUB_STEP_SUMMARY
-        echo "2. Development Docker builds will benefit from faster startup" >> $GITHUB_STEP_SUMMARY
-        echo "3. No action required from developers" >> $GITHUB_STEP_SUMMARY
+        {
+          echo "📦 **Base Image Updated**"
+          echo ""
+          echo "The RMCP base R environment has been rebuilt with:"
+          echo "- 🔄 Latest system packages"
+          echo "- 📊 All R statistical packages"
+          echo "- 🐍 Python runtime environment"
+          echo ""
+          echo "**Impact:** Production images inherit only runtime dependencies."
+          echo ""
+          echo "**Next Steps:** "
+          echo "1. Main CI will automatically use the new base image"
+          echo "2. Development Docker builds will benefit from faster startup"
+          echo "3. No action required from developers"
+        } >> "$GITHUB_STEP_SUMMARY"
 
     - name: Skip notification
       if: steps.check-rebuild.outputs.rebuild_needed == 'false'
       run: |
-        echo "ℹ️ Base image rebuild skipped - image is recent and no changes detected" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Current base image:** ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest" >> $GITHUB_STEP_SUMMARY
-        echo "**Reason:** Image is less than 7 days old and no force rebuild requested" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "To force a rebuild, use the manual trigger with 'force_rebuild' option." >> $GITHUB_STEP_SUMMARY
+        {
+          echo "ℹ️ Base image rebuild skipped - image is recent and no changes detected"
+          echo ""
+          echo "**Current base image:** ${{ env.REGISTRY }}/${{ env.BASE_IMAGE_NAME }}:latest"
+          echo "**Reason:** Image is less than 7 days old and no force rebuild requested"
+          echo ""
+          echo "To force a rebuild, use the manual trigger with 'force_rebuild' option."
+        } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
         python-version: "3.11"
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9.0.0
+      uses: astral-sh/setup-uv@v10.0.1
       with:
         enable-cache: true
 
@@ -47,6 +47,28 @@ jobs:
         # Run all unit tests (Python-only, schema validation, etc.)
         uv run pytest tests/unit/ -v --tb=short
 
+  windows-vfs:
+    name: Windows VFS Tests
+    runs-on: windows-latest
+    steps:
+    - uses: actions/checkout@v7
+
+    - name: Set up Python
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.11"
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v10.0.1
+      with:
+        enable-cache: true
+
+    - name: Install dependencies
+      run: uv sync --group dev
+
+    - name: Run VFS tests
+      run: uv run pytest tests/unit/core/test_contract_validation.py -v --tb=short
+
   # Build Docker images for R testing (both development and production)
   docker-build:
     name: Build R Testing Environment
@@ -78,21 +100,21 @@ jobs:
 
         # Always build if it's a manual trigger
         if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-          echo "should_build=true" >> $GITHUB_OUTPUT
+          echo "should_build=true" >> "$GITHUB_OUTPUT"
           echo "🔄 Building: Manual trigger (forced)"
           exit 0
         fi
 
         # Always build on main branch pushes (production deployments)
         if [ "${{ github.event_name }}" = "push" ] && [ "${{ github.ref }}" = "refs/heads/main" ]; then
-          echo "should_build=true" >> $GITHUB_OUTPUT
+          echo "should_build=true" >> "$GITHUB_OUTPUT"
           echo "🔄 Building: Main branch push"
           exit 0
         fi
 
         # For local testing with act, always build (git diff doesn't work reliably)
         if [ -n "${ACT:-}" ]; then
-          echo "should_build=true" >> $GITHUB_OUTPUT
+          echo "should_build=true" >> "$GITHUB_OUTPUT"
           echo "🔄 Building: Local testing with act"
           exit 0
         fi
@@ -107,7 +129,6 @@ jobs:
           # dependency bump changes what the image contains.
           docker_relevant_files=(
             "Dockerfile"
-            "Dockerfile.base"
             "pyproject.toml"
             "uv.lock"
             "rmcp/"
@@ -124,14 +145,14 @@ jobs:
           done
 
           if [ "$needs_build" = true ]; then
-            echo "should_build=true" >> $GITHUB_OUTPUT
+            echo "should_build=true" >> "$GITHUB_OUTPUT"
           else
-            echo "should_build=false" >> $GITHUB_OUTPUT
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
             echo "⏭️  Skipping: No Docker-relevant files changed"
           fi
         else
           # No previous commit available (initial commit or shallow clone)
-          echo "should_build=true" >> $GITHUB_OUTPUT
+          echo "should_build=true" >> "$GITHUB_OUTPUT"
           echo "🔄 Building: No previous commit available for comparison"
         fi
 
@@ -221,7 +242,7 @@ jobs:
       if: steps.check-changes.outputs.should_build == 'false'
       run: |
         echo "Using existing development image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
-        echo "image=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> $GITHUB_OUTPUT
+        echo "image=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> "$GITHUB_OUTPUT"
 
     - name: Generate artifact attestation for development image
       if: steps.check-changes.outputs.should_build == 'true'
@@ -383,7 +404,11 @@ jobs:
     - name: Run smoke tests (basic functionality)
       run: |
         # Ensure R is in PATH for skip condition checks
-        which R && export R_AVAILABLE=1 || export R_AVAILABLE=0
+        if which R; then
+          export R_AVAILABLE=1
+        else
+          export R_AVAILABLE=0
+        fi
         echo "R available: $R_AVAILABLE"
         pytest tests/smoke/ -v --tb=short --cov=rmcp --cov-report=xml
 
@@ -419,14 +444,14 @@ jobs:
         SERVER_PID=$!
 
         HEALTHY=0
-        for i in $(seq 1 30); do
+        for _ in $(seq 1 30); do
           if curl -s --cacert "$(mkcert -CAROOT)/rootCA.pem" https://localhost:8443/health | grep -q healthy; then
             HEALTHY=1
             break
           fi
           sleep 1
         done
-        kill $SERVER_PID || true
+        kill "$SERVER_PID" || true
         if [ "$HEALTHY" != "1" ]; then
           echo "❌ HTTPS health check failed"
           exit 1
@@ -532,7 +557,7 @@ jobs:
         python-version: "3.11"
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9.0.0
+      uses: astral-sh/setup-uv@v10.0.1
       with:
         enable-cache: true
 
@@ -578,7 +603,7 @@ jobs:
         docker images | grep rmcp || echo "No RMCP images found"
 
         # Export for subsequent steps
-        echo "RMCP_PRODUCTION_IMAGE=$RMCP_PRODUCTION_IMAGE" >> $GITHUB_ENV
+        echo "RMCP_PRODUCTION_IMAGE=$RMCP_PRODUCTION_IMAGE" >> "$GITHUB_ENV"
 
     - name: Run Docker deployment scenario tests
       run: |
@@ -614,6 +639,12 @@ jobs:
 
         echo "✅ All Docker scenario tests completed"
 
+    - name: Run production MCP evaluations
+      run: |
+        test -n "$RMCP_PRODUCTION_IMAGE"
+        RMCP_EVAL_DOCKER_IMAGE="$RMCP_PRODUCTION_IMAGE" \
+          uv run pytest tests/evals/test_mcp_server_evals.py -v --tb=short
+
   # Container-based tests for production image validation
   production-container-tests:
     name: Production Container Tests
@@ -695,7 +726,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9.0.0
+      uses: astral-sh/setup-uv@v10.0.1
       with:
         enable-cache: true
 

.github/workflows/deploy.yml

@@ -40,24 +40,24 @@ jobs:
 
     - name: Configure Docker for Artifact Registry
       run: |
-        gcloud auth configure-docker $AR_REGION-docker.pkg.dev
+        gcloud auth configure-docker "$AR_REGION-docker.pkg.dev"
 
     - name: Pull image from GitHub Container Registry
       run: |
-        docker pull $GHCR_IMAGE
+        docker pull "$GHCR_IMAGE"
 
     - name: Tag and push to Artifact Registry
       run: |
-        docker tag $GHCR_IMAGE $AR_IMAGE
-        docker push $AR_IMAGE
+        docker tag "$GHCR_IMAGE" "$AR_IMAGE"
+        docker push "$AR_IMAGE"
 
     - name: Deploy to Cloud Run
       env:
         RMCP_API_KEY: ${{ secrets.RMCP_API_KEY }}
       run: |
-        gcloud run deploy $SERVICE_NAME \
-          --image $AR_IMAGE \
-          --region $REGION \
+        gcloud run deploy "$SERVICE_NAME" \
+          --image "$AR_IMAGE" \
+          --region "$REGION" \
           --platform managed \
           --allow-unauthenticated \
           --command rmcp \

.github/workflows/docs.yml

@@ -33,7 +33,7 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Install uv
-      uses: astral-sh/setup-uv@v9.0.0
+      uses: astral-sh/setup-uv@v10.0.1
       with:
         enable-cache: true
         cache-dependency-glob: "uv.lock"

.github/workflows/python-publish.yml

@@ -24,19 +24,16 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0 # uv-dynamic-versioning derives the version from tags
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Build distributions
-        run: uv build
+        run: uv build --no-sources
 
       - name: Check metadata
         run: uvx twine check dist/*
 
-      # Cheap guard against a shallow clone or missing tags yielding 0.0.0,
-      # which would otherwise publish a bogus version under a good tag.
+      # Prevent a mistagged release from publishing the wrong project version.
       - name: Confirm the built version matches the tag
         run: |
           set -euo pipefail