add protected npm publishing - #1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 290f551ef0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | ||
| with: | ||
| node-version: "24" |
There was a problem hiding this comment.
When this job runs with the npm version bundled by the selected Node 24 release, publishing can fail before uploading because no npm token is provided and older npm clients do not implement trusted-publisher authentication; for example, the inspected Node 24.15.0 distribution contains npm 11.4.2. The npm trusted-publishing documentation requires npm CLI 11.5.1 or later, so explicitly install a supported npm version instead of assuming node-version: "24" supplies one.
Useful? React with 👍 / 👎.
| exit 1 | ||
| fi | ||
| - name: Publish to npm with trusted publishing | ||
| run: npm publish --provenance --access public |
There was a problem hiding this comment.
When a GitHub prerelease is published, the release: published trigger also invokes this job and the version check accepts prerelease versions, but this command omits --tag. The npm CLI documentation states that publishing sets latest unless --tag is used, so a beta or release candidate would become the default version installed by users; either skip prereleases or publish them under a non-latest tag.
Useful? React with 👍 / 👎.
| test('release version is 0.1.0', async () => { | ||
| const packageJson = JSON.parse(await readFile(packagePath, 'utf8')); | ||
| assert.equal(packageJson.version, '0.1.0'); |
There was a problem hiding this comment.
On the next legitimate version bump, npm test in both CI and this release workflow will fail solely because this assertion still requires 0.1.0, even when package.json, the lockfile, and the release tag agree. This makes every future release depend on updating an unrelated test constant; validate version consistency or SemVer shape instead of freezing the current release number.
Useful? React with 👍 / 👎.
1 participant
What changed
Why
This prepares future MCP package releases to publish through npm OIDC with minimal permissions and without a long-lived npm token.
Validation
npm ci --ignore-scriptsnpm testnpm run test:coveragenpm run checknpm run pack:checknpm audit --omit=devgit diff --check