How the codebase-memory-mcp Project Is Versioned and Managed for Releases

The codebase-memory-mcp repository uses semantic Git tags (vMAJOR.MINOR.PATCH) to trigger automated GitHub Releases, with CI pipelines building cryptographically signed binaries for Linux, macOS, and Windows while propagating version metadata to package managers including Homebrew, Scoop, and Winget.

The DeusData/codebase-memory-mcp project implements a fully automated release workflow that anchors every distributed artifact to a specific Git commit through semantic versioning tags. According to the source code analysis, this system ensures reproducible builds across multiple platforms and distribution channels, embedding version identifiers directly into compiled binaries for runtime verification and automatic update notifications.

Semantic Versioning and Git Tag Strategy

The project adheres to strict semantic versioning conventions, marking each public release with Git tags following the vMAJOR.MINOR.PATCH pattern (e.g., v0.8.1). These tags serve as the immutable source of truth for the entire release pipeline.

In src/cli/cli.c at line 4444, the helper function cbm_tag_version() returns the embedded version string, allowing the binary to self-identify its release version:

// From src/cli/cli.c (line 4444)
const char* cbm_tag_version(void) {
    return "v0.8.1";  // Embedded at build time
}

Automated CI Build and Release Pipeline

The continuous integration workflow defined in .github/workflows/_build.yml orchestrates the entire release process. When a maintainer pushes a semantic version tag, the pipeline automatically triggers builds for all supported architectures (Linux amd64/arm64, macOS amd64/arm64, and Windows amd64).

The build script at scripts/build.sh accepts a --version flag (line 7) to stamp the binary with the exact Git tag:

# From scripts/build.sh (line 7)

./scripts/build.sh --version $(git describe --tags --exact-match)

The CI pipeline enhances supply chain security by signing artifacts with Sigstore Cosign, running VirusTotal scans, and generating SHA-256 checksums, achieving SLSA Level 3 attestation standards.

Package Manager Integration

Version propagation extends beyond GitHub Releases into multiple package ecosystems. The repository maintains dedicated packaging configurations in the pkg/ directory that reference specific GitHub release artifacts by their semantic version tags.

For example, the Homebrew formula at pkg/homebrew/Formula/codebase-memory-mcp.rb specifies the exact release URL:

# pkg/homebrew/Formula/codebase-memory-mcp.rb

url "https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/codebase-memory-mcp-darwin-arm64.tar.gz"

Similarly, Winget manifests in pkg/winget/manifests/ and the AUR PKGBUILD at pkg/aur/PKGBUILD embed the tag version and corresponding download URLs, ensuring package managers distribute identical binaries to those available on GitHub.

Runtime Version Verification and Update Checks

The distributed binary includes built-in version introspection and update notification capabilities. Users can query the embedded version string via command line:

codebase-memory-mcp --version

# Output: v0.8.1

Additionally, the implementation includes an automatic update check described in the README's "Keeping Up to Date" section and documented in docs/CONFIGURATION.md. On startup, the binary queries the GitHub Releases API to detect newer tags and notifies users when updates are available through the codebase-memory-mcp update subcommand.

Verifying Release Integrity

Each GitHub Release includes a checksums.txt file containing SHA-256 hashes for all platform-specific archives. Users can verify downloaded artifacts against these cryptographic signatures:

# Download the release archive and checksums

curl -L -o cbm.tar.gz \
  https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/codebase-memory-mcp-linux-amd64.tar.gz
curl -L -o checksums.txt \
  https://github.com/DeusData/codebase-memory-mcp/releases/download/v0.8.1/checksums.txt

# Verify the checksum

sha256sum -c <(grep codebase-memory-mcp-linux-amd64.tar.gz checksums.txt)

# Output: OK

To inspect available versions programmatically, query the GitHub API:

curl -s https://api.github.com/repos/DeusData/codebase-memory-mcp/tags \
| jq -r '.[].name' | head -n 5

# v0.8.1

# v0.8.0

# v0.7.0

Summary

• Semantic Git tags (vMAJOR.MINOR.PATCH) trigger the entire release pipeline and are embedded into binaries via cbm_tag_version() in src/cli/cli.c.
• Automated CI/CD in .github/workflows/_build.yml builds cross-platform binaries, signs them with Sigstore, runs VirusTotal scans, and generates SHA-256 checksums for SLSA Level 3 compliance.
• Package manager manifests in pkg/homebrew/, pkg/winget/, and pkg/aur/ pin exact release versions to ensure consistent distribution across ecosystems.
• Runtime verification allows users to check installed versions via --version and receive automatic update notifications through the GitHub Releases API.
• Cryptographic verification via checksums.txt ensures downloaded artifacts match the officially released binaries.

Frequently Asked Questions

How does codebase-memory-mcp handle version tagging?

The project uses semantic versioning tags in the format vMAJOR.MINOR.PATCH (e.g., v0.8.1). These Git tags trigger the CI pipeline in .github/workflows/_build.yml and are embedded into the binary at compile time through the scripts/build.sh --version flag (line 7).

Where is the version number stored in the source code?

The version string is defined in src/cli/cli.c at line 4444 within the cbm_tag_version() function. This value is compiled into the binary during the build process, allowing the --version flag to return the exact tag associated with that release.

How can I verify that my downloaded binary is authentic?

Each release includes a checksums.txt file containing SHA-256 hashes. Download the archive and checksums from the GitHub Releases page, then run sha256sum -c to verify the hash matches. Additionally, binaries are signed with Sigstore Cosign, providing SLSA Level 3 attestation for supply chain security.

Does the tool automatically notify me of new releases?

Yes. The binary implements an update-on-start check that queries the GitHub Releases API for newer tags. If a more recent version exists, the tool notifies the user on the first tool call, as documented in the README under the "Keeping Up to Date" section and in docs/CONFIGURATION.md, and available via the codebase-memory-mcp update command.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}