Complete top-level Tekton project integration and release readiness

Goal

Complete the remaining work for MCP Server to meet the standard top-level Tekton project baseline and have a documented, reproducible release path.

The repository is already well along: it has local issue and PR templates, Tekton community documents, OWNERS, standard labels, Dependabot, CI/coverage, ChatOps, org teams, Tide configuration, and protected main. This issue tracks the gaps rather than replacing working setup.

Project and community integration

• Standard bug, feature, and free-form issue templates are present.
• A Tekton-style PR template with contributor checks and release notes is present.
• OWNERS, maintainer/collaborator org teams, standard labels, Tide, and required-check plumbing are present.
• Review the existing templates against tektoncd/.github and current component repos; keep the shared structure while adding MCP-specific diagnostics such as server version, client/transport, deployment mode, and Kubernetes/Tekton versions. Completed by #137.
• Add the required DEVELOPMENT.md with build, test, local-run, cluster deployment, generated/vendor update, and debugging instructions. Completed by #140.
• Fix CONTRIBUTING.md so every repository-local link exists and it points to the new DEVELOPMENT.md; remove copied Pipeline-specific links that do not apply here. Completed by #140.
• Confirm and link the governing-committee approval/TEP or adoption record for this top-level project; the README links the accepted proposal in tektoncd/community#1194. Completed by #140.
• Set repository topics for Tekton, Kubernetes, Go, and MCP.
• Set the repository homepage to https://tekton.dev (requires repository administrator access).
• Publish concise installation, compatibility, configuration, transport, and security guidance. Completed by #140.

CI, dependencies, and security

• Enable the existing e2e path and add a required smoke test that deploys the server, connects with a supported MCP client/transport, and invokes representative read and write tools against a test cluster. Tracked by #144.
• Add CodeQL and workflow-security linting used by current Tekton Go repositories, or document equivalent shared coverage. Tracked by #141 and #142.
• Keep vendored dependencies reproducible: make dependency updates regenerate vendor/, verify a clean diff, and cover supported release branches when they exist. The MCP Go SDK security update and vendor refresh are tracked by #145.
• Enable private vulnerability reporting, secret scanning and push protection, and Dependabot alerts/security updates.
• Land the least-privilege workflow and RBAC changes in #142 and #143, then verify required CI summary enforcement after the existing plumbing configuration is applied.
• Verify release environments, secrets, registry permissions, and tag protection are managed through Tekton-controlled infrastructure.

Release readiness

• Decide the supported release artifacts:
  • container image and deployable manifests
  • standalone binaries only if users need them
  • checksums, SBOM/provenance, and signatures/attestations
• Add releases.md with cadence, support/EOL policy, and release history as required by the Tekton release policy.
• Document the release operator procedure, versioning/branching policy, compatibility matrix, rollback, and patch-release process.
• Add the smallest current Tekton release implementation appropriate for a Go service: reproducible image/binary build, Tekton-controlled registry publication, immutable manifests, generated release notes, and signed GitHub release assets.
• Configure the release service account/robot, registry package access, signing identity, artifact promotion/storage, and GitHub tag/release permissions.
• Create the first semantic-versioned release and verify installation, image/signature provenance, checksums, release notes, and patching from a supported release branch.

Completion criteria

• The repository satisfies the Tekton project requirements without broken or copied documentation.
• Required CI/e2e/security checks protect main through the existing plumbing integration.
• A release can be produced from a clean checkout by documented Tekton-controlled automation, and a user can install and verify every published artifact.

References

• Tekton project requirements
• Tekton release policy
• Tekton organization templates and security policy
• MCP Server templates
• Tekton plumbing required checks
• Tekton CLI release process
• Tekton Results releases

Start with the completion checklist and inspect the existing repository templates, DEVELOPMENT.md, CONTRIBUTING.md, CI configuration, and release-related automation. Review the linked work in #141–#145 before selecting a remaining area. Done means the documented Tekton baseline, required checks, reproducible release path, and artifact verification criteria are satisfied.