fix(release): install the MCPB CLI before packing by asachs01 · Pull Request #53 · wyre-technology/.github

asachs01 · 2026-08-17T17:39:19Z

Fixes the mcpb job failing on 24 of 26 repos: pack scripts call npx mcpb pack, but only autotask-mcp and blumira-mcp carry @anthropic-ai/mcpb as a dependency, so elsewhere npx fetches a package literally named mcpb and 404s. The hand-rolled workflows all ran npm install -g @anthropic-ai/mcpb; I dropped it after validating only against autotask-mcp. Caught live on atera-mcp.

Also corrects a false claim in this file's comments: a pack failure was said to be unable to skip the deploy chain. True within this workflow, false from the caller's side — a caller invokes the whole file as ONE job, so any failure here fails the caller's release job and skips deploy: needs: release. Confirmed on atera-mcp (docker/registry/security succeeded, mcpb failed, deploy skipped). A bug in this job is deploy-blocking; the comments now say so.

No continue-on-error added — silently dropping the bundle is the original #244 failure mode.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

The mcpb job failed on 24 of the 26 repos with a pack:mcpb script. Pack scripts shell out to `npx mcpb pack`, which needs the mcpb CLI on PATH. Only autotask-mcp and blumira-mcp carry @anthropic-ai/mcpb as a dependency; everywhere else npx tried to fetch a package literally named "mcpb" from the public registry: npm error 404 Not Found - GET https://registry.npmjs.org/mcpb The hand-rolled per-repo workflows all ran `npm install -g @anthropic-ai/mcpb` for exactly this reason. This job omitted it because it was validated only against autotask-mcp — one of the two repos where the omission is invisible. Caught live on atera-mcp. npx resolves node_modules/.bin before the global prefix, so a repo that pins its own @anthropic-ai/mcpb version still wins; this is a fallback, not an override. Also corrects a false claim in this file's own comments. They said a pack failure "cannot cascade into skipping the deploy chain" because mcpb needs only `release`. That is true within this workflow and false from the caller's side: a caller invokes this whole file as ONE job, so any failure here fails the caller's `release` job and skips a caller `deploy: needs: release`. Confirmed on atera-mcp — docker, mcp-registry and security all succeeded, mcpb failed, deploy was skipped anyway. A bug in this job is deploy-blocking, and the comments now say so.

8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore xero-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore halopsa-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore syncro-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore threatlocker-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore spanning-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore unitrends-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore liongard-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore huntress-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore ninjaone-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes. * fix(test): decode SSE responses in gateway concurrency test The v2 SDK's legacy stateless serving answers POSTs as text/event-stream, so res.json() threw "Unexpected token 'e'" and failed the release job. Use the shared mcpJson helper, as worker.test.ts already does. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com> --------- Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>

* fix(ci): restore salesbuildr-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore superops-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore datto-bcdr-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore datto-rmm-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore kaseya-vsa-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore kaseya-bms-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore connectwise-manage-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore datto-saas-protection-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore kaseya-quote-manager-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): adopt upstream mcpb job, drop the local stopgap Bumps the mcp-server-release.yml pin to 8deff29, which carries the `mcpb` job upstreamed in wyre-technology/.github#43, and removes this repo's local stopgap job — exactly what its own comment asked for: Restore it here until the step is upstreamed into mcp-server-release.yml. The upstream job is a strict superset: same checkout-tag / stamp-version / pack / upload sequence, plus an `npm ci` (this repo's stopgap relied on pack:mcpb bootstrapping its own deps), GitHub Packages auth for @wyre-technology/* deps, and a glob upload that does not assume the bundle filename. It needs only `release`, never `docker`, so a pack failure cannot cascade into skipping deploy. Leaving both in place would have run the pack twice and uploaded the same asset twice with --clobber — harmless but wasteful and confusing. Pin range diffed before bumping (d28a612..8deff29): 4 commits, netting the mcpb job plus #40's provenance/digest-verify hardening. That exact combination has run green end-to-end three times on autotask-mcp (v2.32.7-.9). * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

* fix(ci): restore qbo-mcp.mcpb as a release asset Bumps the mcp-server-release.yml pin to 8deff29, which adds the `mcpb` job that packs and attaches the Claude Desktop bundle to the GitHub release. The hand-rolled per-repo workflows the shared pipeline replaced each carried a 'Pack and upload MCPB bundle' step. It was not carried over, so every repo that migrated silently stopped attaching its bundle while its README still told users to download it. 25 of the 26 repos with a pack:mcpb script were affected. Reported as autotask-mcp#244. Pin range diffed before bumping (d28a612..8deff29): 8deff29 accept lowercase `config` in the digest verify check (#46) 3b76ae0 use .Image.Config in the digest verify template (#45) ebbdf5a pack and upload the .mcpb bundle as a release asset (#43) 0e04141 pin provenance:false + verify digest before deploy (#40) Net effect: one new `mcpb` job, plus #40's provenance/digest-verify hardening on the docker job. This exact combination has run green end-to-end (build, bundle, registry, security, deploy) three times on autotask-mcp: v2.32.7, v2.32.8, v2.32.9. * fix(ci): re-pin to 8bfc9b3 — MCPB CLI install + verify job 8deff29's mcpb job omitted the MCPB CLI install, so `npx mcpb pack` 404'd on the 24 repos that do not carry @anthropic-ai/mcpb as a dependency (caught live on atera-mcp). Fixed in wyre-technology/.github#53. Pin range 8deff29..8bfc9b3 also includes #47, which adds an unconditional build/lint/test `verify` job and makes `release` need it. That is a behaviour change: a repo failing build, lint or test can no longer publish a release. Because `verify` is unconditional it also runs on this PR, so this PR's own checks now show whether this repo passes.

asachs01 merged commit 8bfc9b3 into main Aug 17, 2026
3 of 4 checks passed

Navigation Menu

Uh oh!

fix(release): install the MCPB CLI before packing - #53

fix(release): install the MCPB CLI before packing#53
asachs01 merged 1 commit into
mainfrom
fix/mcpb-cli-install

asachs01 commented Aug 17, 2026 •

edited by blacksmith-sh Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

asachs01 commented Aug 17, 2026 • edited by blacksmith-sh Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

asachs01 commented Aug 17, 2026 •

edited by blacksmith-sh Bot

Loading