feat: tag-triggered npm release automation + CHANGELOG

.github/workflows/release.yml

@@ -0,0 +1,66 @@
+# Release automation for @betanyc/nyc-record-mcp.
+#
+# Trigger: pushing a tag matching `v*` (e.g. `v1.0.2`). The workflow verifies
+# the tag matches the version in package.json, runs the test suite, publishes
+# to npm with provenance, and creates a GitHub Release with auto-generated
+# notes.
+#
+# Prerequisite: an `NPM_TOKEN` repository secret (npm automation token with
+# publish rights on @betanyc/nyc-record-mcp). Provenance requires the
+# id-token: write permission and publishing from GitHub Actions.
+#
+# Release procedure: bump `version` in package.json (+ lockfile) on main,
+# then `git tag vX.Y.Z && git push origin vX.Y.Z`. Nothing publishes without
+# a tag push.
+#
+# Owned by the software-engineer agent per BetaNYC engineering standards.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write # create the GitHub Release
+  id-token: write # npm provenance attestation
+
+jobs:
+  release:
+    name: Publish to npm + GitHub Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22.x"
+          cache: "npm"
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Test
+        run: npm test --if-present
+
+      - name: Verify tag matches package.json version
+        run: |
+          PKG_VERSION="v$(node -p "require('./package.json').version")"
+          if [ "${GITHUB_REF_NAME}" != "${PKG_VERSION}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match package.json version ${PKG_VERSION}" >&2
+            exit 1
+          fi
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create GitHub Release
+        run: gh release create "${GITHUB_REF_NAME}" --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Fixed
+
+- Stop double-encoding the SoQL `like` pattern in `get_notices_by_agency` —
+  agency queries with special characters now match correctly ([#6])
+
+### Security
+
+- Bump transitive `hono` 4.12.21 → 4.12.27 (GHSA-wwfh-h76j-fc44) ([#4])
+
+### Added
+
+- Build-only CI workflow on GitHub Actions (Node 20/22 matrix) ([#3])
+- Tag-triggered npm release automation and this changelog
+
+### Changed
+
+- Documentation: clear API-key subsection in the README ([#2]), Related
+  projects section crediting socrata-mcp-server
+- Sync package-lock.json self-version to package.json
+
+## [1.0.1] - 2026-05-22
+
+### Changed
+
+- Add npm keywords for discoverability
+
+## [1.0.0] - 2026-05-21
+
+### Added
+
+- Initial release: MCP server for NYC City Record notices via NYC Open Data
+  (SODA API), with tools for searching notices, filtering by agency, type,
+  and date range, and retrieving procurement notices, public hearings, and
+  open solicitations
+
+[Unreleased]: https://github.com/BetaNYC/nyc-record-mcp/compare/cf5a4da...HEAD
+[1.0.1]: https://github.com/BetaNYC/nyc-record-mcp/compare/65deb20...cf5a4da
+[1.0.0]: https://github.com/BetaNYC/nyc-record-mcp/releases
+[#2]: https://github.com/BetaNYC/nyc-record-mcp/pull/2
+[#3]: https://github.com/BetaNYC/nyc-record-mcp/pull/3
+[#4]: https://github.com/BetaNYC/nyc-record-mcp/pull/4
+[#6]: https://github.com/BetaNYC/nyc-record-mcp/pull/6

README.md

@@ -296,6 +296,12 @@ Issues and pull requests welcome at [github.com/BetaNYC/nyc-record-mcp](https://
 
 ---
 
+## Releases
+
+Releases are automated. Pushing a tag matching `v*` (e.g. `v1.0.2`) runs tests, verifies the tag matches the `package.json` version, publishes to npm with provenance, and creates a GitHub Release with generated notes. See [CHANGELOG.md](CHANGELOG.md) for version history. Requires the `NPM_TOKEN` repository secret.
+
+---
+
 ## Support our work
 
 Freedom isn't free. [Support BetaNYC](https://beta.nyc/donate/).
@@ -310,4 +316,4 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
 
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.