Add step for publishing to MCP Registry

[joelverhagen]

This adds a new step for the release event to publish to the Official MCP Registry.

Summary of changes:

• Add server.json which is the MCP Server manifest
  • Used metadata from the GH MCP Registry
  • Used the name com.microsoft/playwright-mcp
• Add publish-release-mcp-registry job that runs manually
  • Install Microsoft Go for compliant Go crypto
  • Log in to Azure for Key Vault access
  • Publish to the MCP Registry in the microsoft.com namespace.
• Add mcpName to the package.json which the MCP Registry validates.

The publishing requires some secret variables:

• AZURE_MCP_REGISTRY_CLIENT_ID - service principal client ID (app ID) with Get Key and Sign access to a Key Vault
• AZURE_MCP_REGISTRY_TENANT_ID - tenant ID for the service principal (should be a production tenant)
• AZURE_MCP_REGISTRY_SUBSCRIPTION_ID - Azure subscription ID holding the Key Vault
• KV_NAME - the Key Vault name, e.g. mykeyvault
• KV_KEY_NAME - the name of a Key in the Key Vault, needs to be ECDSA P-384.

I can provide internal documentation for how to set up the service principal (managed identity is easiest), vault, and key as well as registering the key so it can be used for the microsoft.com namespace.

Note: after the new job is proven to work as expected, we can switch it to automatically running after the publish-release-npm job on the release event.

[Skn0tt]

Thanks! Left a couple of comments from a first cursory look.

[Skn0tt]

I setup a Keyvault and key, and populated the KV_KEY_NAME and KV_NAME secrets.

[yury-s]

Can you update the PR description as we don't commit go-install.ps1 anymore and some vars have changed?

[joelverhagen]

@yury-s, thanks for the approval. Any input on this point?

Note: if we need to iterate on the MCP Registry publish step, it might be worth allowing the publish-release-mcp-registry step to execute without the publish-release-npm and allow it to run on workflow_dispatch. Alternatively, we could allow the npm publish step to fail with "duplicate version", making the npm publish step idempotent.

[joelverhagen]

Currently the public key is not declared on microsoft.com. I sent an email to @Skn0tt on how to do this, so the record is owned by your team.

[yury-s]

Currently the public key is not declared on microsoft.com. I sent an email to @Skn0tt on how to do this, so the record is owned by your team.

Can you cc me as well, I may be able to do it earlier?

@yury-s, thanks for the approval. Any input on this point?

Note: if we need to iterate on the MCP Registry publish step, it might be worth allowing the publish-release-mcp-registry step to execute without the publish-release-npm and allow it to run on workflow_dispatch. Alternatively, we could allow the npm publish step to fail with "duplicate version", making the npm publish step idempotent.

I guess you wan to give it try without waiting for the next mcp release. We can allow it to run on workflow_dispatch for now and once you tested it, we can restore the dependency on the npm publish step.