From 9659363fe80faeeb33f615f28fc58290e99e8f0c Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Mon, 27 Jul 2026 21:41:56 -0400 Subject: [PATCH] fix(ci): remove the ungated publish workflow that could ship 0.2.0 over the real 0.1.8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo could publish over the real `@wave-av/mcp-server` with nothing but a tag — no version bump and no edit required. `package.json` here is 0.2.0 while npm serves 0.1.8 as `latest`, so 0.2.0 is both unpublished and higher, and `npm publish` with no `--tag` writes to `latest` regardless of semver. One `v*` tag would have become the version every `npm install @wave-av/mcp-server` resolves to. What would have shipped is roughly a third of the package it replaced: 13 source files and 7 tool definitions here, against 27 files and 21 tools in the copy that matches what npm actually serves. Consumers importing any of the other 14 tools would break on a release that reads, from the version number alone, like a routine minor bump. This repo is not the publisher, and that is measured rather than assumed: the published 0.1.8 carries `gitHead` e8ae9597e859ffe015590b184fedf9a0948fa5e3, which is not a valid git object in this repository. `publish.yml` was also its only release workflow, so removing it leaves the repo with no publish path — which is the correct state until the 21-tool copy is deliberately reconciled here. The workflow was ungated in every dimension: no version check, no dist-tag routing, no environment, `--no-provenance`, and unpinned `actions/checkout@v4` / `actions/setup-node@v4` mutable tags in a job holding publish rights. Worth stating precisely, because it changes what this PR is: `NPM_TOKEN` does not currently exist. It is absent from this repo, from wave-av/{sdk,adk,sdks}, and from the org-level secret list, so `secrets.NPM_TOKEN` resolves empty and this workflow would fail at auth rather than publish. That makes this the removal of a latent path rather than a live incident — and a latent path that re-arms silently the moment anyone adds an NPM_TOKEN for an unrelated reason is exactly the kind worth deleting while it is quiet. Closes #65. Part of the publishing audit in wave-av/sdks#42. --- .github/workflows/publish.yml | 27 --------------------------- 1 file changed, 27 deletions(-) delete mode 100644 .github/workflows/publish.yml diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml deleted file mode 100644 index 00213b8..0000000 --- a/.github/workflows/publish.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Publish to npm - -on: - push: - tags: ['v*'] - -permissions: - contents: read - -jobs: - publish: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - uses: actions/setup-node@v4 - with: - node-version: '22' - registry-url: 'https://registry.npmjs.org' - - - run: npm ci - - - run: npm run build - - - run: npm publish --access public --no-provenance - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}