pkgtruth/.github/workflows/release.yml at main · hxckya/pkgtruth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: Release

on:
  push:
    tags: ["v*"]

# Both publishes authenticate by OIDC, so this repository holds no tokens.
# npm verifies the workflow identity through a Trusted Publisher configured
# on npmjs.com; the MCP Registry verifies it through github-oidc.
permissions:
  id-token: write
  contents: write # to create the GitHub Release

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # the release notes list commits since the previous tag
      - uses: actions/setup-node@v5
        with:
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'
          cache: npm

      # OIDC trusted publishing landed in npm 11.5.1; the npm bundled with
      # Node 22 is older and falls back to an anonymous publish, which the
      # registry rejects as a 404 rather than a 401.
      - name: Use an npm that can do trusted publishing
        run: |
          npm install -g npm@latest
          echo "npm $(npm --version) / node $(node --version)"

      - run: npm ci

      # A broken release is worse than a late one — the whole suite runs first.
      - name: Test
        run: npm run test:online

      # package.json, server.json and the Claude Code plugin files must all
      # carry the tagged version (scripts/check-versions.mjs).
      - name: Verify the tag matches every version field
        run: node scripts/check-versions.mjs "${GITHUB_REF#refs/tags/}"

      - name: Publish to npm
        run: npm publish

      - name: Install mcp-publisher
        run: |
          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher

      - name: Publish to the MCP Registry
        run: |
          ./mcp-publisher login github-oidc
          ./mcp-publisher publish

      # Last, so a failed publish never leaves a release pointing at nothing.
      # Notes come from commit subjects: this repository has no PRs to
      # auto-generate from.
      - name: Create the GitHub Release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${GITHUB_REF#refs/tags/}"
          PREV=$(git describe --tags --abbrev=0 --match 'v*' "$TAG^" 2>/dev/null || true)
          {
            echo "## Changes"
            echo
            if [ -n "$PREV" ]; then
              git log --no-merges --pretty='- %s (%h)' "$PREV..$TAG"
            else
              git log --no-merges --pretty='- %s (%h)' "$TAG"
            fi
            echo
            echo "npm: https://www.npmjs.com/package/pkgtruth/v/${TAG#v} · MCP Registry: \`io.github.hxckya/pkgtruth\` · Claude Code: \`/plugin marketplace add hxckya/pkgtruth\`"
            if [ -n "$PREV" ]; then
              echo
              echo "Full changelog: https://github.com/hxckya/pkgtruth/compare/$PREV...$TAG"
            fi
          } > /tmp/notes.md
          gh release create "$TAG" --title "$TAG" --notes-file /tmp/notes.md --verify-tag