ci: publish to the MCP registry, not just npm - #27
Merged
Conversation
publish.yml published to npm but never to the MCP registry, so the registry (and everything that ingests it — PulseMCP, Glama, LobeHub) stayed frozen at the 2026-06-12 publish while npm moved 2-3 minor versions ahead. - Sync server.json version and packages[].version from package.json at publish time, so the two cannot drift again, and bring the checked-in file current. - Add an mcp-publisher step using github-oidc auth (id-token: write was already granted for npm provenance), pinned to registry v1.8.0. - Gate the registry publish on its own registry-version check rather than the npm gate, so a workflow_dispatch can push a registry-only catch-up without requiring a package version bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The MCP registry has been frozen at the June 2026 publish while npm moved 2-3 minor versions ahead. Root cause:
publish.ymlpublishes to npm and cuts a GitHub release, but never callsmcp-publisher. Nothing has ever updated the registry.That matters more than one stale listing — PulseMCP, Glama, and LobeHub all auto-ingest from the registry, so one fix corrects every downstream directory permanently.
Changes
server.jsonsynced topackage.json, plus a step that derivesversionand everypackages[].versionfrompackage.jsonat publish time so it cannot drift again.mcp-publisher,login github-oidc) after npm publish, gated on its own registry-version check.Why the registry step has its own gate
The existing
changedgate comparespackage.jsonto npm, which today sayschanged=falsein every one of these repos. Hanging the registry step off it would have made this fix inert — noworkflow_dispatchcould repair the frozen registry, and drift would persist until the next version bump. The new check queries the registry directly, so a manual dispatch now performs a registry-only catch-up.Notes
mcp-publisherpinned to v1.8.0 rather than trackinglatest;curl -fadded so a bad URL fails instead of piping an HTML error page intotar.id-token: writewas already present for npm provenance, confirmed per repo. No permissions changes.mcp-publishervalidates that the npm package carries a matchingmcpName, so on a run where npm publish just happened there may be brief propagation lag. Re-dispatching succeeds.Verified: YAML parsed and schema-validated against the committed blobs,
mcpNamematchesserver.jsonnamein-repo and vianpm view.🤖 Generated with Claude Code