* fix(python): respect configured inspector path
* fix(python): treat inspector path as a base prefix
* fix(python): format inspector fixes for ruff
* fix(ci): run conformance with node 22
* fix(ci): fail conformance runs with empty results
* chore(ci): drop inline conformance result validation
* docs(python): clarify inspector path behavior
- Comment workflow only runs for pull_request events (not push)
- For push events, there's no PR to comment on
- Conformance workflow already runs on all branch pushes for iteration
- Badges remain branch-specific (only updated for main/canary pushes)
- Remove pull_request-only restriction from workflow trigger
- Make PR metadata download and comment posting conditional
- Workflow now runs for both push and pull_request events
- For push events, workflow completes without posting comment
- Badges remain branch-specific per existing logic in conformance.yml
Use environment variables instead of direct string interpolation to pass
PR metadata to the github-script action, preventing potential code injection
from untrusted input.
Addresses CodeQL security findings.
- Split conformance workflow into test execution and comment posting
- Created conformance-comment.yml with workflow_run trigger for full permissions
- Upload PR metadata and parsed results as artifacts
- Updated badge labels to 'MCP Conformance (TS)' and 'MCP Conformance (PY)'
- Fixed badge colors: green at 100%, yellow ≥60%, red <60%
- Resolves permission errors when posting comments on forked PRs
Enrico Toniato