Skip to content

Commit d1ec011

Browse files
castnettechcastnettech
committed
Add mnemosyne-ollama v0.1.0, bump engine to v1.0.5, fix PyPI docs
 New package: mnemosyne-ollama (ollama/) - Lightweight MCP host bridging Ollama to mnemosyne-mcp - Zero new dependencies (stdlib urllib, mcp SDK via mnemosyne-mcp) - Auto-detects tool-capable models (Gemma 3/4, Llama 3.x/4, Qwen, Phi-4) - Single-shot and interactive CLI modes - 32K context window for full search result delivery - OIDC publish workflow (publish-ollama.yml) Engine v1.0.5 fixes: - README: relative links converted to absolute GitHub URLs for PyPI rendering - REFERENCE: 10 Mermaid blocks replaced with pre-rendered PNGs - publish.yml: reject ollama-v tags to prevent cross-publish - Trademark notices added to README and ollama README Includes all pending engine, test, and config changes.
1 parent 289e703 commit d1ec011

70 files changed

Lines changed: 1973 additions & 613 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/publish-mcp.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,16 @@
77
# - Publish job requires "release" environment (approval + branch restriction)
88
# - Minimal permissions per job (least-privilege)
99
# - Artifact attestation creates a signed provenance record (SLSA Level 2)
10-
# - No secrets, tokens, or passwords — pure OIDC
10+
# - No secrets, tokens, or passwords -- pure OIDC
1111
#
1212
# Required setup:
1313
# 1. PyPI: Add trusted publisher for mnemosyne-mcp
1414
# (owner=castnettech, repo=mnemosyne, workflow=publish-mcp.yml, environment=release)
15-
# 2. GitHub: "release" environment already exists — ensure it covers this workflow
15+
# 2. GitHub: "release" environment already exists -- ensure it covers this workflow
1616
#
1717
# Tag convention:
18-
# Core engine uses "v1.0.4" tags → triggers publish.yml
19-
# MCP server uses "mcp-v0.1.0" tags → triggers this workflow
18+
# Core engine uses "v1.0.4" tags -> triggers publish.yml
19+
# MCP server uses "mcp-v0.1.0" tags -> triggers this workflow
2020
# This prevents one release from accidentally publishing both packages.
2121

2222
name: Publish MCP to PyPI
@@ -29,7 +29,7 @@ on:
2929
permissions: {}
3030

3131
jobs:
32-
# ── Gate: verify release is an MCP release targeting main ──────────
32+
# -- Gate: verify release is an MCP release targeting main ----------
3333
verify:
3434
runs-on: ubuntu-latest
3535
permissions: {}
@@ -52,7 +52,7 @@ jobs:
5252
echo "::error::Pre-releases are not published to PyPI."
5353
exit 1
5454
55-
# ── Build: produce distribution artifacts from mcp/ ────────────────
55+
# -- Build: produce distribution artifacts from mcp/ ----------------
5656
build:
5757
needs: [verify]
5858
runs-on: ubuntu-latest
@@ -110,7 +110,7 @@ jobs:
110110
if-no-files-found: error
111111
retention-days: 5
112112

113-
# ── Publish: push to PyPI via OIDC ─────────────────────────────────
113+
# -- Publish: push to PyPI via OIDC ---------------------------------
114114
publish:
115115
needs: [build]
116116
runs-on: ubuntu-latest
@@ -133,4 +133,4 @@ jobs:
133133

134134
- name: Publish to PyPI
135135
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
136-
# No token needed — OIDC trusted publisher handles authentication
136+
# No token needed -- OIDC trusted publisher handles authentication

‎.github/workflows/publish-ollama.yml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Publish mnemosyne-ollama to PyPI via OIDC Trusted Publisher
2+
#
3+
# Security model:
4+
# - ONLY fires on GitHub Releases with tag prefix "ollama-v" (e.g. ollama-v0.1.0)
5+
# - Build and publish are SEPARATE jobs (artifacts never modified after build)
6+
# - All actions pinned to full SHA (immune to tag-hijack attacks)
7+
# - Publish job requires "release" environment (approval + branch restriction)
8+
# - Minimal permissions per job (least-privilege)
9+
# - Artifact attestation creates a signed provenance record (SLSA Level 2)
10+
# - No secrets, tokens, or passwords -- pure OIDC
11+
#
12+
# Required setup:
13+
# 1. PyPI: Add trusted publisher for mnemosyne-ollama
14+
# (owner=castnettech, repo=mnemosyne, workflow=publish-ollama.yml, environment=release)
15+
# 2. GitHub: "release" environment already exists -- ensure it covers this workflow
16+
#
17+
# Tag convention:
18+
# Core engine uses "v1.0.5" tags -> triggers publish.yml
19+
# MCP server uses "mcp-v0.1.0" tags -> triggers publish-mcp.yml
20+
# Ollama bridge uses "ollama-v0.1.0" tags -> triggers this workflow
21+
22+
name: Publish Ollama to PyPI
23+
24+
on:
25+
release:
26+
types: [published]
27+
28+
permissions: {}
29+
30+
jobs:
31+
verify:
32+
runs-on: ubuntu-latest
33+
permissions: {}
34+
steps:
35+
- name: Reject non-Ollama release tags
36+
if: "!startsWith(github.event.release.tag_name, 'ollama-v')"
37+
run: |
38+
echo "::error::This workflow only handles ollama-v* tags. Got '${{ github.event.release.tag_name }}'."
39+
exit 1
40+
41+
- name: Reject releases not targeting main
42+
if: github.event.release.target_commitish != 'main'
43+
run: |
44+
echo "::error::Release must target 'main' branch. Got '${{ github.event.release.target_commitish }}'."
45+
exit 1
46+
47+
- name: Reject pre-releases
48+
if: github.event.release.prerelease == true
49+
run: |
50+
echo "::error::Pre-releases are not published to PyPI."
51+
exit 1
52+
53+
build:
54+
needs: [verify]
55+
runs-on: ubuntu-latest
56+
permissions:
57+
contents: read
58+
steps:
59+
- name: Checkout pinned to release tag
60+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
61+
with:
62+
ref: ${{ github.event.release.tag_name }}
63+
persist-credentials: false
64+
65+
- name: Verify tag matches ollama/pyproject.toml version
66+
run: |
67+
TAG="${GITHUB_REF_NAME#ollama-v}"
68+
PKG_VERSION=$(python3 -c "
69+
import re, pathlib
70+
text = pathlib.Path('ollama/pyproject.toml').read_text()
71+
m = re.search(r'^version\s*=\s*\"([^\"]+)\"', text, re.M)
72+
print(m.group(1) if m else 'UNKNOWN')
73+
")
74+
echo "Tag version: $TAG"
75+
echo "Package version: $PKG_VERSION"
76+
if [ "$TAG" != "$PKG_VERSION" ]; then
77+
echo "::error::Tag 'ollama-v$TAG' does not match ollama/pyproject.toml version '$PKG_VERSION'"
78+
exit 1
79+
fi
80+
81+
- name: Set up Python
82+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
83+
with:
84+
python-version: "3.12"
85+
86+
- name: Install build frontend
87+
run: pip install --upgrade build
88+
89+
- name: Build sdist and wheel
90+
run: python -m build ollama/
91+
92+
- name: Verify dist contents
93+
run: |
94+
ls -la ollama/dist/
95+
SDIST_COUNT=$(ls ollama/dist/*.tar.gz 2>/dev/null | wc -l)
96+
WHEEL_COUNT=$(ls ollama/dist/*.whl 2>/dev/null | wc -l)
97+
if [ "$SDIST_COUNT" -ne 1 ] || [ "$WHEEL_COUNT" -ne 1 ]; then
98+
echo "::error::Expected 1 sdist + 1 wheel, got $SDIST_COUNT sdist + $WHEEL_COUNT wheel"
99+
exit 1
100+
fi
101+
102+
- name: Upload dist artifacts
103+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
104+
with:
105+
name: ollama-dist
106+
path: ollama/dist/
107+
if-no-files-found: error
108+
retention-days: 5
109+
110+
publish:
111+
needs: [build]
112+
runs-on: ubuntu-latest
113+
environment: release
114+
permissions:
115+
id-token: write
116+
attestations: write
117+
contents: read
118+
steps:
119+
- name: Download dist artifacts
120+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
121+
with:
122+
name: ollama-dist
123+
path: dist/
124+
125+
- name: Generate artifact attestation
126+
uses: actions/attest-build-provenance@db473fddc028af60658334401dc6fa3ffd8669fd # v2.3.0
127+
with:
128+
subject-path: "dist/*"
129+
130+
- name: Publish to PyPI
131+
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4

‎.github/workflows/publish.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
# - Publish job requires "release" environment (configure approval rules in GitHub Settings)
88
# - Minimal permissions per job (least-privilege)
99
# - Artifact attestation creates a signed provenance record (SLSA Level 2)
10-
# - No secrets, tokens, or passwords anywhere — pure OIDC
10+
# - No secrets, tokens, or passwords anywhere -- pure OIDC
1111
#
1212
# Required setup:
1313
# 1. PyPI: Add trusted publisher (owner=castnettech, repo=mnemosyne, workflow=publish.yml, environment=release)
@@ -25,7 +25,7 @@ on:
2525
permissions: {}
2626

2727
jobs:
28-
# ── Gate: verify release targets main ──────────────────────────────
28+
# -- Gate: verify release targets main ------------------------------
2929
verify:
3030
runs-on: ubuntu-latest
3131
permissions: {}
@@ -36,6 +36,12 @@ jobs:
3636
echo "::error::MCP releases use publish-mcp.yml, not this workflow. Got '${{ github.event.release.tag_name }}'."
3737
exit 1
3838
39+
- name: Reject Ollama release tags
40+
if: startsWith(github.event.release.tag_name, 'ollama-v')
41+
run: |
42+
echo "::error::Ollama releases use publish-ollama.yml, not this workflow. Got '${{ github.event.release.tag_name }}'."
43+
exit 1
44+
3945
- name: Reject releases not targeting main
4046
if: github.event.release.target_commitish != 'main'
4147
run: |
@@ -48,7 +54,7 @@ jobs:
4854
echo "::error::Pre-releases are not published to PyPI."
4955
exit 1
5056
51-
# ── Build: produce distribution artifacts ──────────────────────────
57+
# -- Build: produce distribution artifacts --------------------------
5258
build:
5359
needs: [verify]
5460
runs-on: ubuntu-latest
@@ -107,7 +113,7 @@ jobs:
107113
if-no-files-found: error
108114
retention-days: 5
109115

110-
# ── Publish: push to PyPI via OIDC ─────────────────────────────────
116+
# -- Publish: push to PyPI via OIDC ---------------------------------
111117
publish:
112118
needs: [build]
113119
runs-on: ubuntu-latest
@@ -130,4 +136,4 @@ jobs:
130136

131137
- name: Publish to PyPI
132138
uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
133-
# No token needed — OIDC trusted publisher handles authentication
139+
# No token needed -- OIDC trusted publisher handles authentication

‎.gitignore‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# ── Mnemosyne data (user-specific, never committed) ──
1+
# -- Mnemosyne data (user-specific, never committed) --
22
.mnemosyne/
33
bloom.bin
44
*.db
55
*.db-wal
66
*.db-shm
77
mnemosyne.lock
88

9-
# ── Python ──
9+
# -- Python --
1010
__pycache__/
1111
*.pyc
1212
*.pyo
@@ -15,23 +15,23 @@ dist/
1515
build/
1616
.eggs/
1717

18-
# ── Virtual environments ──
18+
# -- Virtual environments --
1919
.venv/
2020
venv/
2121
env/
2222

23-
# ── Testing ──
23+
# -- Testing --
2424
.pytest_cache/
2525
.coverage
2626
htmlcov/
2727

28-
# ── IDE ──
28+
# -- IDE --
2929
.vscode/
3030
.idea/
3131
*.swp
3232
*.swo
3333

34-
# ── Secrets / credentials ──
34+
# -- Secrets / credentials --
3535
.env
3636
*.pem
3737
*.key
@@ -41,11 +41,11 @@ credentials*
4141
id_rsa*
4242
id_ed25519*
4343

44-
# ── OS artifacts ──
44+
# -- OS artifacts --
4545
.DS_Store
4646
Thumbs.db
4747

48-
# ── Claude Code workspace ──
48+
# -- Claude Code workspace --
4949
.claude/
5050
CLAUDE.md
5151

@@ -55,5 +55,5 @@ docs/
5555
!docs/assets/
5656
!docs/assets/mnemosyne.png
5757

58-
# -- Holdback test data (never committed — validation-only) --
58+
# -- Holdback test data (never committed -- validation-only) --
5959
mnemosyne/tests/benchmark_questions/httpx_holdback.json

0 commit comments

Comments
 (0)