From 3e9950062b1345f926a744d9c8250e5f85c12f37 Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Tue, 21 Apr 2026 16:03:27 +0100 Subject: [PATCH] build: add npm run bump; parallel npm-publish approval (#568) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * ci: automate release process with workflow-driven version bumps and PR flow Adds a Release workflow that bumps all package versions, generates release notes, and opens a PR. Merging the PR auto-tags and creates the GitHub Release, which triggers npm-publish. Also adds `npm run bump` for local use and a release.yml config for categorized auto-generated notes. * ci: simplify release workflow and flatten npm-publish approval chain - Drop auto-generated RELEASES.md prepending (notes are written manually in PR) - Flatten npm-publish job dependencies so all publish jobs wait for approval together instead of sequentially, reducing 3 approval clicks to 1 - Remove Release environment from publish-mcpb (only needs GH_TOKEN) - Use --generate-notes for GitHub Release creation * fix: address review findings in release automation - release.yml: use RELEASE_TOKEN PAT for gh release create so the release:published event triggers npm-publish (GITHUB_TOKEN events don't cascade to other workflows) - release.yml: checkout merge_commit_sha in tag job instead of ref:main to avoid tagging later commits - release.yml: checkout ref:main in prepare job so dispatching from a feature branch doesn't pollute the release PR - release.yml: constrain preid to type:choice[beta] to match npm-publish.yml's tag detection - release.yml: drop -f on push so re-runs fail loudly instead of clobbering manual RELEASES.md edits; drop pr-edit fallback - release.yml: ensure release label exists before gh pr create - release.yml: make tag push idempotent for re-runs after partial failure - bump-version.mjs: update workspace dependency ranges so major bumps don't leave examples pointing at the old major - bump-version.mjs: run npm install --package-lock-only so npm ci on the release PR doesn't fail on lockfile mismatch - npm-publish.yml: add npm-tag detection to publish-examples so beta example releases don't overwrite latest - .github/release.yml: use [bot] suffix in author excludes so dependabot PRs are actually filtered from release notes - CONTRIBUTING.md: document RELEASE_TOKEN setup; fix npm run -- syntax * style: auto-fix prettier formatting * build: add npm run bump; parallel npm-publish approval - scripts/bump-version.mjs (+ npm run bump): bumps root and all workspace package versions, updates examples' ^X.Y.0 dependency range on the root package (matters on major bumps), and refreshes package-lock so npm ci accepts the release PR. - npm-publish.yml: all publish jobs now depend directly on [build, test] instead of chaining, so they enter "waiting for approval" together and a single Review-deployments click approves the lot. Prerelease versions (any X.Y.Z-…) publish under --tag beta so they don't take latest. - CONTRIBUTING.md: release steps now use npm run bump. Dropped from the original change: the workflow_dispatch release.yml (required a long-lived PAT to cascade events), label-based .github/release.yml auto-notes (PRs aren't labeled today), and the release-X.Y npm-tag for non-main branches (no backport branches yet). --------- Co-authored-by: Claude Co-authored-by: github-actions[bot] --- .github/workflows/npm-publish.yml | 20 +++++++++++-- CONTRIBUTING.md | 33 ++++------------------ package.json | 1 + scripts/bump-version.mjs | 47 +++++++++++++++++++++++++++++++ 4 files changed, 70 insertions(+), 31 deletions(-) create mode 100644 scripts/bump-version.mjs diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index ece35d3..0667bbd 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -42,6 +42,10 @@ jobs: - run: npm ci - run: npm test + # All publish jobs depend directly on [build, test] (not on each other) so + # they all enter "waiting for approval" together and can be approved in a + # single "Review deployments" click. + publish: runs-on: ubuntu-latest if: github.event_name == 'release' @@ -88,7 +92,7 @@ jobs: runs-on: ubuntu-latest if: github.event_name == 'release' environment: Release - needs: [publish] + needs: [build, test] permissions: contents: read @@ -134,8 +138,18 @@ jobs: - name: Build example run: npm run build --workspace examples/${{ matrix.example }} + - name: Determine npm tag + id: npm-tag + run: | + VERSION=$(node -p "require('./package.json').version") + if [[ "$VERSION" == *"-"* ]]; then + echo "tag=--tag beta" >> $GITHUB_OUTPUT + else + echo "tag=" >> $GITHUB_OUTPUT + fi + - name: Publish example - run: npm publish --workspace examples/${{ matrix.example }} --provenance --access public + run: npm publish --workspace examples/${{ matrix.example }} --provenance --access public ${{ steps.npm-tag.outputs.tag }} env: NODE_AUTH_TOKEN: ${{ secrets.NPM_SECRET }} @@ -143,7 +157,7 @@ jobs: runs-on: ubuntu-latest if: github.event_name == 'release' environment: Release - needs: [publish-examples] + needs: [build, test] permissions: contents: write diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4c364a2..6a3102b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -539,40 +539,17 @@ Before publishing releases, ensure the following are configured: ### Publishing a Release -Releases are published automatically via GitHub Actions when a GitHub Release is created. - -#### Steps to publish: - -1. **Update the version** in `package.json`: +1. **Bump the version** across the root and all workspace packages: ```bash - # For a regular release - npm version patch # or minor, or major - - # For a beta release - npm version prerelease --preid=beta + npm run bump -- minor # or: patch | major | prerelease --preid=beta | 1.7.0 ``` -2. **Commit the version bump** (if not done by `npm version`): + Commit and open a PR with a grouped changelog in the body (see prior `chore: bump …` PRs for the format). - ```bash - git add package.json - git commit -m "Bump version to X.Y.Z" - git push origin main - ``` +2. **Merge the PR**, then [draft a GitHub Release](https://github.com/modelcontextprotocol/ext-apps/releases/new) — create a `vX.Y.Z` tag on `main`, paste the changelog, publish. -3. **Create a GitHub Release**: - - Go to [Releases](https://github.com/modelcontextprotocol/ext-apps/releases) - - Click "Draft a new release" - - Create a new tag matching the version (e.g., `v0.1.0`) - - Set the target branch (usually `main`) - - Write release notes describing the changes - - Click "Publish release" - -4. **Monitor the workflow**: - - The [npm-publish workflow](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/npm-publish.yml) will trigger automatically - - It runs build and test jobs before publishing - - On success, the package is published to npm with provenance +3. **Approve the deployment** — publishing the Release triggers the [npm-publish workflow](https://github.com/modelcontextprotocol/ext-apps/actions/workflows/npm-publish.yml); all publish jobs wait together for a single "Review deployments" approval. #### npm Tags diff --git a/package.json b/package.json index d1fa9df..bb824ff 100644 --- a/package.json +++ b/package.json @@ -71,6 +71,7 @@ "prettier": "prettier -u \"**/*.{js,jsx,ts,tsx,mjs,json,md,yml,yaml}\" --check", "prettier:fix": "prettier -u \"**/*.{js,jsx,ts,tsx,mjs,json,md,yml,yaml}\" --write", "check:versions": "node scripts/check-versions.mjs", + "bump": "node scripts/bump-version.mjs", "update-lock:docker": "rm -rf node_modules package-lock.json examples/*/node_modules && docker run --rm --platform linux/amd64 -v $(pwd):/work -w /work -e HOME=/tmp node:latest npm i --registry=https://registry.npmjs.org/ --ignore-scripts && rm -rf node_modules examples/*/node_modules && npm i --registry=https://registry.npmjs.org/" }, "author": "Olivier Chafik", diff --git a/scripts/bump-version.mjs b/scripts/bump-version.mjs new file mode 100644 index 0000000..65c878f --- /dev/null +++ b/scripts/bump-version.mjs @@ -0,0 +1,47 @@ +#!/usr/bin/env node +/** + * Bump the version in the root package.json and sync all workspace packages + * to the same version. + * + * Usage: + * node scripts/bump-version.mjs patch + * node scripts/bump-version.mjs minor + * node scripts/bump-version.mjs major + * node scripts/bump-version.mjs 1.4.0 + * node scripts/bump-version.mjs prerelease --preid=beta + * + * Writes the new version to stdout (logs go to stderr). + */ + +import { execSync } from "node:child_process"; +import { readFileSync } from "node:fs"; + +const args = process.argv.slice(2); +if (!args[0]) { + console.error( + "Usage: node scripts/bump-version.mjs [--preid=]", + ); + process.exit(1); +} + +const exec = (cmd) => + execSync(cmd, { stdio: ["inherit", "pipe", "inherit"] }) + .toString() + .trim(); + +const pkgName = JSON.parse(readFileSync("package.json", "utf-8")).name; + +const newVersion = exec( + `npm version ${args.join(" ")} --no-git-tag-version`, +).replace(/^v/, ""); +exec(`npm pkg set version=${newVersion} --workspaces`); + +// Keep workspace dependency ranges compatible (needed on major bumps) +const [major, minor] = newVersion.split("."); +exec(`npm pkg set "dependencies.${pkgName}=^${major}.${minor}.0" --workspaces`); + +// Sync package-lock.json so `npm ci` doesn't reject the release PR +exec("npm install --package-lock-only --ignore-scripts"); + +console.error(`Bumped root + workspaces to ${newVersion}`); +console.log(newVersion);