chore(release): regenerate server-card and auto-add v3 deprecation notice

[zereight]

Motivation

Two things in recent releases needed fixing by hand after npm run release:

1. server-card.json keeps falling behind. .well-known/mcp/server-card.json has serverInfo.version taken from package.json, but release.sh never regenerates it. It still says 2.2.4 while the package is 2.2.5; docs: sync server-card version with package.json (2.2.5) #845 is a one-off fix for that. This PR stops it from happening again.
2. The Deprecation notice: legacy env vars and CLI flags will be removed in v3.0.0 #815 deprecation notice was pasted in by hand at the end of the v2.2.4 and v2.2.5 GitHub release notes. It has to keep appearing on every 2.x release until v3.0.0.

What changed (scripts/release.sh only)

• sync_server_card_version "$NEW_VERSION": a new helper called in both patch-bump paths ("tag already exists" and "no existing tag"), right after sync_registry_metadata_version, so it runs after npm version patch. It:
  • runs npx tsx scripts/generate-server-card.ts. No build is needed: tsx resolves ../tools/registry.js to tools/registry.ts, so it doesn't matter that this runs before build_docs;
  • checks that the regenerated serverInfo.version equals $NEW_VERSION;
  • exits 1 with a ❌ message if generation fails or the versions don't match. It never silently skips.
• git add "$SERVER_CARD_FILE" sits next to the existing server.json add in both bump paths, so the card goes into the chore(release): vX.Y.Z commit.
• deprecation_notice "$version": prints the Deprecation notice: legacy env vars and CLI flags will be removed in v3.0.0 #815 notice (same wording as v2.2.4/v2.2.5) when the release's major version is below DEPRECATION_NOTICE_UNTIL_MAJOR=3. If the version doesn't parse, it prints nothing. generate_changelog_notes adds it as the last section, after Contributors, which is where it was in v2.2.4 and v2.2.5.
  • Gating: releases with major < 3 get the notice, and v3.0.0+ drops it without any further edit. To stop it earlier, or to reuse it for another major, change that one constant.
  • The release-specific gitlab_api_request security note from v2.2.5 is not included.
  • The bot-PR filter (is_bot_pr) is unchanged.

Everything else in release.sh (branch/alignment checks, tag logic, docs pinning, registry preflight, build_docs, push, gh release create) works as before. The only other diff line removes trailing whitespace from one blank line.

This does not touch server-card.json; the current version bump is #845.

How it was tested (safe only — no release was run)

• bash -n scripts/release.sh passes.
• shellcheck gives the same 2 warnings (SC2034) before and after; nothing new.
• A harness pulled individual functions out of release.sh and ran them on their own, never the release path:
  • deprecation_notice: 2.2.6 and 2.99.0 print the notice; 3.0.0, 3.0.1, 10.0.0, garbage and empty print nothing.
  • generate_changelog_notes with a stubbed gh (no network) over v2.2.4..HEAD: 2.2.6 notes end with the notice after Contributors and 3.0.0 notes have no notice. In both, the github-actions[bot] PR (chore(homebrew): sync formula for release #843) is still filtered out.
  • sync_server_card_version in a throwaway git worktree (npm ci --ignore-scripts, so no build/), after a fake npm version patch (2.2.5 → 2.2.6): the card regenerated (275 tools) with serverInfo.version == 2.2.6. The only diff from the committed card was the version line, so the formatting is byte-identical. A version mismatch exits non-zero, a missing generator exits non-zero, and under plain set -e the caller stops.
  • The worktree and its fake bump were thrown away afterwards; nothing from them was committed.

No release was run: no npm run release, no tags pushed, no gh release create, no publish.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8382cf3e-eb97-40af-ac17-73ead9327d56

📥 Commits

Reviewing files that changed from the base of the PR and between 6bbea84 and 197ea47.

📒 Files selected for processing: 1

• scripts/release.sh

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 8

• GitHub Check: docs-build
• GitHub Check: integration-test
• GitHub Check: code-quality
• GitHub Check: test
• GitHub Check: Analyze (python)
• GitHub Check: Analyze (ruby)
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (actions)

🔇 Additional comments: 1

scripts/release.sh: 1

87-107: LGTM!

Also applies to: 339-359, 496-502, 554-554, 563-563, 584-584, 593-593

📝 Summary

Summary by CodeRabbit

• Release Notes
  • Releases with numeric major versions below 3 now include a deprecation notice. Versions with major number 3 or higher do not include this notice, and invalid or empty major-version values also do not trigger it. This update affects the release notes only; no changes to product features are described.

The release script regenerates and validates .well-known/mcp/server-card.json in both release paths, then stages the card. Changelog notes now include a legacy-configuration deprecation notice for numeric major versions below 3.

Changes: Release updates

Layer / File(s)	Summary
Generate and stage the server card scripts/release.sh	The script regenerates the server card after registry metadata updates and exits if generation fails or the card version does not match. Both release paths stage the generated card.
Add version-based changelog notice scripts/release.sh	The script appends a legacy-configuration notice for numeric major versions below 3. Empty, nonnumeric, and major versions of 3 or higher produce no notice.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 197ea

The release paths validate and stage the generated card, and the deprecation notice is limited to numeric major versions below 3. No concrete merge-blocking issue was established; the PR appears ready for normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description clearly explains the server-card regeneration and deprecation-notice changes in scripts/release.sh. It also documents testing and confirms that no release was run.
Title check		The title accurately and concisely identifies both primary changes: regenerating the server card and adding the v3 deprecation notice.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}