Repository navigation
Automate npm publish and GitHub release on tag push - #10
Merged
Merged
Conversation
- Trigger: v* tag push → install → build → npm publish --provenance (OIDC trusted publishing) → gh release create --generate-notes
- permissions: contents: write (release create) + id-token: write (OIDC token mint)
- runs-on: ubuntu-latest because all mcp tests mock node:child_process / applescript so macOS is not required at the publish stage
- setup-node node-version: 24 to get npm 11.5.1+, which is the minimum for trusted publishing
- registry-url intentionally omitted: setup-node would write a dummy NODE_AUTH_TOKEN template into .npmrc that silently bypasses the OIDC exchange
- cache intentionally omitted on release builds to reduce cache-poisoning supply-chain risk
- actions/checkout and actions/setup-node SHA-pinned to match the existing ci.yml style
- tag name passed via env (TAG) instead of inline ${{ }} expansion in run: to keep workflow-injection guidance explicit
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- actions/checkout v4.3.1 ran on Node 20, which GitHub Actions deprecated 2025-09-19 and now force-runs on Node 24 with a per-job warning - Bump SHA pin to v7.0.0 across both .github/workflows/release.yml (1 occurrence) and .github/workflows/ci.yml (3 occurrences) - actions/setup-node already pinned to v6.4.0 (Node 24 native), no change needed Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
.github/workflows/release.ymlso that pushing av*tag triggersnpm publish(with--provenancevia OIDC trusted publishing) followed by a GitHub Release with auto-generated notes.Permissions:
contents: write(release create) +id-token: write(OIDC token mint). All other defaults left at the most restrictive setting.Notes on choices
runs-on: ubuntu-latest: allmcp/tests mocknode:child_process/applescript, so macOS is not required at the publish stage. Existingci.ymljobs that touch actual AppleScript stay onmacos-latest.setup-nodenode-version: '24'provides npm11.5.1+, the minimum required for trusted publishing.registry-urlintentionally omitted:setup-nodewould otherwise write a dummyNODE_AUTH_TOKENtemplate into.npmrcthat silently bypasses the OIDC exchange (documented gotcha on docs.npmjs.com).cacheintentionally omitted: release builds skip dependency cache to reduce cache-poisoning supply-chain risk.actions/checkoutis pinned to v7.0.0 (Node 24) andactions/setup-nodeto v6.4.0. The sameactions/checkoutSHA bump is applied to the existingci.ymlin this PR to drop the Node 20 deprecation warning.env: TAG: ${{ github.ref_name }}instead of inline${{ }}inrun:to keep workflow-injection guidance explicit.The
@dominion525/familiar-mcpnpm package already has GitHub Actions registered as a Trusted Publisher for this workflow.