# How the codebase-memory-mcp Project Is Versioned and Managed for Releases

> Learn how DeusData/codebase-memory-mcp uses semantic Git tags and CI pipelines for automated GitHub Releases and cryptographically signed binaries across Linux, macOS, and Windows.

- Repository: [Martin Vogel/codebase-memory-mcp](https://github.com/DeusData/codebase-memory-mcp)
- Tags: management-overview
- Published: 2026-07-14

---

**The codebase-memory-mcp repository uses semantic Git tags (vMAJOR.MINOR.PATCH) to trigger automated GitHub Releases, with CI pipelines building cryptographically signed binaries for Linux, macOS, and Windows while propagating version metadata to package managers including Homebrew, Scoop, and Winget.**

The DeusData/codebase-memory-mcp project implements a fully automated release workflow that anchors every distributed artifact to a specific Git commit through semantic versioning tags. According to the source code analysis, this system ensures reproducible builds across multiple platforms and distribution channels, embedding version identifiers directly into compiled binaries for runtime verification and automatic update notifications.

## Semantic Versioning and Git Tag Strategy

The project adheres to strict semantic versioning conventions, marking each public release with Git tags following the `vMAJOR.MINOR.PATCH` pattern (e.g., `v0.8.1`). These tags serve as the immutable source of truth for the entire release pipeline.

In [`src/cli/cli.c`](https://github.com/DeusData/codebase-memory-mcp/blob/main/src/cli/cli.c) at line 4444, the helper function `cbm_tag_version()` returns the embedded version string, allowing the binary to self-identify its release version:

```c
// From src/cli/cli.c (line 4444)
const char* cbm_tag_version(void) {
    return "v0.8.1";  // Embedded at build time
}

```

## Automated CI Build and Release Pipeline

The continuous integration workflow defined in [`.github/workflows/_build.yml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/.github/workflows/_build.yml) orchestrates the entire release process. When a maintainer pushes a semantic version tag, the pipeline automatically triggers builds for all supported architectures (Linux amd64/arm64, macOS amd64/arm64, and Windows amd64).

The build script at [`scripts/build.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/build.sh) accepts a `--version` flag (line 7) to stamp the binary with the exact Git tag:

```bash

# From scripts/build.sh (line 7)

./scripts/build.sh --version $(git describe --tags --exact-match)

```

The CI pipeline enhances supply chain security by signing artifacts with Sigstore Cosign, running VirusTotal scans, and generating SHA-256 checksums, achieving SLSA Level 3 attestation standards.

## Package Manager Integration

Version propagation extends beyond GitHub Releases into multiple package ecosystems. The repository maintains dedicated packaging configurations in the `pkg/` directory that reference specific GitHub release artifacts by their semantic version tags.

For example, the Homebrew formula at [`pkg/homebrew/Formula/codebase-memory-mcp.rb`](https://github.com/DeusData/codebase-memory-mcp/blob/main/pkg/homebrew/Formula/codebase-memory-mcp.rb) specifies the exact release URL:

```ruby

# pkg/homebrew/Formula/codebase-memory-mcp.rb

url "https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/codebase-memory-mcp-darwin-arm64.tar.gz"

```

Similarly, Winget manifests in `pkg/winget/manifests/` and the AUR `PKGBUILD` at `pkg/aur/PKGBUILD` embed the tag version and corresponding download URLs, ensuring package managers distribute identical binaries to those available on GitHub.

## Runtime Version Verification and Update Checks

The distributed binary includes built-in version introspection and update notification capabilities. Users can query the embedded version string via command line:

```bash
codebase-memory-mcp --version

# Output: v0.8.1

```

Additionally, the implementation includes an automatic update check described in the README's "Keeping Up to Date" section and documented in [`docs/CONFIGURATION.md`](https://github.com/DeusData/codebase-memory-mcp/blob/main/docs/CONFIGURATION.md). On startup, the binary queries the GitHub Releases API to detect newer tags and notifies users when updates are available through the `codebase-memory-mcp update` subcommand.

## Verifying Release Integrity

Each GitHub Release includes a [`checksums.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/checksums.txt) file containing SHA-256 hashes for all platform-specific archives. Users can verify downloaded artifacts against these cryptographic signatures:

```bash

# Download the release archive and checksums

curl -L -o cbm.tar.gz \
  https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/codebase-memory-mcp-linux-amd64.tar.gz
curl -L -o checksums.txt \
  https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/checksums.txt

# Verify the checksum

sha256sum -c <(grep codebase-memory-mcp-linux-amd64.tar.gz checksums.txt)

# Output: OK

```

To inspect available versions programmatically, query the GitHub API:

```bash
curl -s https://api.github.com/repos/DeusData/codebase-memory-mcp/tags \
| jq -r '.[].name' | head -n 5

# v0.8.1

# v0.8.0

# v0.7.0

```

## Summary

- **Semantic Git tags** (`vMAJOR.MINOR.PATCH`) trigger the entire release pipeline and are embedded into binaries via `cbm_tag_version()` in [`src/cli/cli.c`](https://github.com/DeusData/codebase-memory-mcp/blob/main/src/cli/cli.c).
- **Automated CI/CD** in [`.github/workflows/_build.yml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/.github/workflows/_build.yml) builds cross-platform binaries, signs them with Sigstore, runs VirusTotal scans, and generates SHA-256 checksums for SLSA Level 3 compliance.
- **Package manager manifests** in `pkg/homebrew/`, `pkg/winget/`, and `pkg/aur/` pin exact release versions to ensure consistent distribution across ecosystems.
- **Runtime verification** allows users to check installed versions via `--version` and receive automatic update notifications through the GitHub Releases API.
- **Cryptographic verification** via [`checksums.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/checksums.txt) ensures downloaded artifacts match the officially released binaries.

## Frequently Asked Questions

### How does codebase-memory-mcp handle version tagging?

The project uses semantic versioning tags in the format `vMAJOR.MINOR.PATCH` (e.g., `v0.8.1`). These Git tags trigger the CI pipeline in [`.github/workflows/_build.yml`](https://github.com/DeusData/codebase-memory-mcp/blob/main/.github/workflows/_build.yml) and are embedded into the binary at compile time through the [`scripts/build.sh`](https://github.com/DeusData/codebase-memory-mcp/blob/main/scripts/build.sh) `--version` flag (line 7).

### Where is the version number stored in the source code?

The version string is defined in [`src/cli/cli.c`](https://github.com/DeusData/codebase-memory-mcp/blob/main/src/cli/cli.c) at line 4444 within the `cbm_tag_version()` function. This value is compiled into the binary during the build process, allowing the `--version` flag to return the exact tag associated with that release.

### How can I verify that my downloaded binary is authentic?

Each release includes a [`checksums.txt`](https://github.com/DeusData/codebase-memory-mcp/blob/main/checksums.txt) file containing SHA-256 hashes. Download the archive and checksums from the GitHub Releases page, then run `sha256sum -c` to verify the hash matches. Additionally, binaries are signed with Sigstore Cosign, providing SLSA Level 3 attestation for supply chain security.

### Does the tool automatically notify me of new releases?

Yes. The binary implements an update-on-start check that queries the GitHub Releases API for newer tags. If a more recent version exists, the tool notifies the user on the first tool call, as documented in the README under the "Keeping Up to Date" section and in [`docs/CONFIGURATION.md`](https://github.com/DeusData/codebase-memory-mcp/blob/main/docs/CONFIGURATION.md), and available via the `codebase-memory-mcp update` command.