modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 5

ci: derive the npm dist-tag from the version instead of defaulting to latest (#1834)

Browse source 
`npm publish` defaults to `--tag latest` regardless of semver prerelease
status, and the publish step passed no `--tag`. So cutting the `2.0.0-rc.1`
release that #1818 calls for would have published the release candidate to
`latest` — pointing every `npx @modelcontextprotocol/inspector` at an RC. That
is the same class of failure #1816 fixed for v1, except triggered deliberately
by following the runbook.

Derives the tag from the version: a hyphen after the patch component means a
prerelease (`2.0.0-rc.1` → `next`), anything else is a release (`2.0.0` →
`latest`). Build metadata (`2.0.0+build.5`) is correctly not a prerelease.

Implemented as a shell `case` rather than with `semver`, which is only a
transitive dependency here and should not be relied on in CI.

Also makes the RC step of #1818 possible at all — there was previously no way
to pass a dist-tag through a release-triggered publish.


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-07-28 00:15:58 -04:00 • committed by GitHub
commit 145002925f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 17 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

18
.github/workflows/main.yml vendored
View file

@ -169,7 +169,23 @@ jobs:
# prepack); the redundancy is intentional — each is a clean-tree rebuild
# and the `prepack` one is what actually populates the published tarball,
# so don't "optimize" it away.
run: npm publish --access public --provenance
#
# The dist-tag is derived from the version, and passing it explicitly is
# NOT optional: `npm publish` defaults to `--tag latest` regardless of
# semver prerelease status, so publishing `2.0.0-rc.1` without this would
# point every `npx @modelcontextprotocol/inspector` at a release
# candidate. A prerelease is a hyphen after the patch component
# (`2.0.0-rc.1`); build metadata uses `+` and is not a prerelease. Done
# in shell rather than with `semver` because that package is only a
# transitive dependency here and must not be relied on in CI.
run: |
VERSION="$(node -p "require('./package.json').version")"
case "$VERSION" in
*-*) NPM_TAG=next ;;
*) NPM_TAG=latest ;;
esac
echo "Publishing $VERSION under dist-tag '$NPM_TAG'"
npm publish --access public --provenance --tag "$NPM_TAG"
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}