[sys-ops-node]

Motivation and Context

Fixes #1505.

The GitHub Actions publishing guide downloaded mcp-publisher through the mutable releases/latest URL and extracted it without checking the published Sigstore bundle. The three credential-bearing examples now pin the release to v1.8.1, download the archive and its bundle separately, verify the release workflow identity and GitHub Actions OIDC issuer with cosign verify-blob, and extract only after verification.

How Has This Been Tested?

• Parsed all three fenced workflow examples with PyYAML and checked the pinned version, cosign installer, and verification flags.
• Verified the published v1.8.1 Linux amd64 archive against its published Sigstore bundle with cosign v3.0.6 (the version installed by the pinned cosign-installer action); verification returned Verified OK.
• Ran git diff --check.

Breaking Changes

None. This only hardens the documented installer workflow; existing registry APIs and authentication commands are unchanged.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing users to update)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally (documentation/workflow validation listed above)
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

The release version is intentionally explicit so upgrades are reviewable. The Sigstore certificate identity is constrained to this repository's release workflow and the selected tag.

[rdimitrov]

Reviewed all three workflow variants and implemented a follow-up replacing regex identity matching with exact --certificate-identity matching. This binds verification to the selected release tag without treating dots as regex wildcards.

Validated the real v1.8.1 Linux amd64 archive and bundle with Cosign v3.0.6, whose bootstrap checksum matches the SHA-pinned installer action. All three YAML examples parse and have identical Bash installers. Executed the updated installer against the real Darwin arm64 assets: signature verification, extraction, and cleanup succeed. Negative checks reject a tampered archive, wrong tag identity, and wrong OIDC issuer. make validate and git diff --check pass.

No runtime API or authentication changes. This addresses the pinned, verified installer in #1505; job separation and broader action pinning are separate hardening choices. Merge conditional on required CI passing on this exact head.