From cf28f81cd1935101c84b4c1c9cece984ad6b930a Mon Sep 17 00:00:00 2001 From: Haifeng Zhang Date: Tue, 19 May 2026 17:16:34 +0800 Subject: [PATCH 1/2] fix(ci): publish to npm via trusted publishing (OIDC) The v0.1.2 release run failed at the publish step with npm EOTP: the account enforces 2FA for writes and the NPM_TOKEN granular token does not bypass the one-time-password prompt. Switch release.yml to npm trusted publishing (OIDC), which is the post-2025 recommended path and needs no token: - upgrade npm to >= 11.5.1 (required for OIDC publishing) - drop registry-url and NODE_AUTH_TOKEN; `npm publish` uses the id-token OIDC flow (provenance is recorded automatically) Still needed: configure the package's trusted publisher on npmjs.com for this repo + release.yml. The NPM_TOKEN secret can then be removed. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/release.yml | 16 +++++++++------- README.md | 5 +++-- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5941cdb..f713c8d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,8 +6,9 @@ name: Release # This builds the .mcpb desktop-extension bundle, creates the GitHub Release # with the bundle attached, and publishes the package to npm. # -# Requires an NPM_TOKEN repository secret (an npm automation token) for the -# publish step. +# npm publishing uses trusted publishing (OIDC) — no token. The package's +# trusted publisher must be configured on npmjs.com to allow this repository +# and this workflow file (release.yml). on: push: tags: ["v*"] @@ -17,14 +18,15 @@ jobs: runs-on: ubuntu-latest permissions: contents: write # create the GitHub Release and upload assets - id-token: write # npm publish provenance + id-token: write # OIDC token for npm trusted publishing steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 22 - registry-url: https://registry.npmjs.org cache: npm + # npm trusted publishing (OIDC) requires npm >= 11.5.1. + - run: npm install -g npm@latest - run: npm ci - run: npm test - run: npm run typecheck @@ -40,7 +42,7 @@ jobs: --title "$GITHUB_REF_NAME" \ --generate-notes \ "openmart-mcp-server-${version}.mcpb" + # Publishes via OIDC trusted publishing — no NODE_AUTH_TOKEN. npm also + # records provenance automatically when published this way. - name: Publish to npm - run: npm publish --access public - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + run: npm publish diff --git a/README.md b/README.md index e90e5b2..3d12a5f 100644 --- a/README.md +++ b/README.md @@ -191,8 +191,9 @@ Two GitHub Actions workflows (`.github/workflows/`): - `release.yml` — on a `v*` tag, builds the `.mcpb` bundle, creates the GitHub Release with it attached, and publishes the package to npm. -`release.yml` needs an `NPM_TOKEN` repository secret (an npm automation token) -for the publish step. +`release.yml` publishes to npm via [trusted publishing](https://docs.npmjs.com/trusted-publishers/) +(OIDC) — no token. The package's trusted publisher must be configured on +npmjs.com to allow this repository and the `release.yml` workflow. ## Shared Project Config From 146f092cd344d96a46864282cbf2edfeaf3229dc Mon Sep 17 00:00:00 2001 From: Haifeng Zhang Date: Tue, 19 May 2026 17:21:03 +0800 Subject: [PATCH 2/2] feat(ci): support manual release runs that auto-tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a workflow_dispatch trigger to release.yml with a bump-type input (patch/minor/major). On a manual run the workflow bumps the version with npm version (which also syncs manifest.json), commits, pushes the tag, then builds + releases — so a release can be cut from the Actions tab without running npm version locally. The tag-push trigger still works; version/tag are now resolved from package.json so both paths share the same release steps. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/release.yml | 46 ++++++++++++++++++++++++++--------- README.md | 6 +++-- 2 files changed, 39 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f713c8d..f64e06b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,10 +1,9 @@ name: Release -# Cut a release by pushing a version tag, e.g.: -# npm version patch && git push --follow-tags -# -# This builds the .mcpb desktop-extension bundle, creates the GitHub Release -# with the bundle attached, and publishes the package to npm. +# Two ways to cut a release: +# - push a version tag: npm version patch && git push --follow-tags +# - run this workflow manually from the Actions tab and pick a bump type; +# it bumps package.json/manifest.json, commits, tags, and releases. # # npm publishing uses trusted publishing (OIDC) — no token. The package's # trusted publisher must be configured on npmjs.com to allow this repository @@ -12,12 +11,19 @@ name: Release on: push: tags: ["v*"] + workflow_dispatch: + inputs: + bump: + description: "Version bump" + type: choice + options: [patch, minor, major] + default: patch jobs: release: runs-on: ubuntu-latest permissions: - contents: write # create the GitHub Release and upload assets + contents: write # create the GitHub Release, push the version tag id-token: write # OIDC token for npm trusted publishing steps: - uses: actions/checkout@v4 @@ -28,6 +34,25 @@ jobs: # npm trusted publishing (OIDC) requires npm >= 11.5.1. - run: npm install -g npm@latest - run: npm ci + + # Manual run: bump the version, commit, and create + push the tag. + # (On a tag push the tag already exists, so this is skipped.) + - name: Bump version and tag + if: github.event_name == 'workflow_dispatch' + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + npm version "${{ inputs.bump }}" -m "chore(release): v%s" + git push --follow-tags + + # Version + tag are taken from package.json — consistent for both triggers. + - name: Resolve version + id: v + run: | + version="$(node -p "require('./package.json').version")" + echo "version=$version" >> "$GITHUB_OUTPUT" + echo "tag=v$version" >> "$GITHUB_OUTPUT" + - run: npm test - run: npm run typecheck - name: Build the .mcpb bundle @@ -36,12 +61,11 @@ jobs: env: GH_TOKEN: ${{ github.token }} run: | - version="${GITHUB_REF_NAME#v}" - mv openmart-mcp-server.mcpb "openmart-mcp-server-${version}.mcpb" - gh release create "$GITHUB_REF_NAME" \ - --title "$GITHUB_REF_NAME" \ + mv openmart-mcp-server.mcpb "openmart-mcp-server-${{ steps.v.outputs.version }}.mcpb" + gh release create "${{ steps.v.outputs.tag }}" \ + --title "${{ steps.v.outputs.tag }}" \ --generate-notes \ - "openmart-mcp-server-${version}.mcpb" + "openmart-mcp-server-${{ steps.v.outputs.version }}.mcpb" # Publishes via OIDC trusted publishing — no NODE_AUTH_TOKEN. npm also # records provenance automatically when published this way. - name: Publish to npm diff --git a/README.md b/README.md index 3d12a5f..bee494a 100644 --- a/README.md +++ b/README.md @@ -188,8 +188,10 @@ The package exposes two binaries: Two GitHub Actions workflows (`.github/workflows/`): - `ci.yml` — runs tests, typecheck, and build on every push and pull request. -- `release.yml` — on a `v*` tag, builds the `.mcpb` bundle, creates the GitHub - Release with it attached, and publishes the package to npm. +- `release.yml` — builds the `.mcpb` bundle, creates the GitHub Release with it + attached, and publishes to npm. Triggered by a `v*` tag, or run it manually + from the Actions tab with a version-bump choice (it then bumps, tags, and + releases). `release.yml` publishes to npm via [trusted publishing](https://docs.npmjs.com/trusted-publishers/) (OIDC) — no token. The package's trusted publisher must be configured on