`e2e_tests.yml` filtered on `branches: [main]` for both `push` and
`pull_request` — the same leftover as main.yml, but with a sharper
consequence: `main` never matches on this branch, so the filter matched
nothing and the suite has never run on `v1/main` at all. The branch's full
run history contains zero `Playwright Tests` runs, only
`Run install, format, lint, build, and test on every push` and `CLI Tests`.
Repointed both filters at `v1/main` so the gate actually gates. Unlike the
main.yml change this is a real behavior change — it turns a dead workflow
back on — so it is deliberately a separate commit.
Refs #2065
Signed-off-by: cliffhall <cliff@futurescale.com>
The push filter still listed `main`, and `pull_request` carried no branch
filter at all — both leftovers from when the v1 line was itself `main`.
Neither describes the topology now: `v1/main` publishes straight to the
`v1-latest` dist-tag and never merges into `main`, which carries v2 and
publishes `latest`.
No behavior change on any path that runs today. For `push`, GitHub runs the
workflow file from the pushed commit, so this file was only ever consulted
for `v1/main`; `main` could not match unless a commit on that branch carried
a v1-shaped tree. The same resolution rule made the unfiltered
`pull_request` harmless, since a PR's workflow comes from its merge ref.
The `release` trigger is untouched, so publishing is unaffected — it is
gated on the event type and the release's target commit, never on these
filters.
The value is that the file now states its intent, and the stale `main`
entry can no longer become live if anything is ever restored onto that
branch.
Closes#2065
Signed-off-by: cliffhall <cliff@futurescale.com>
Addresses the round-1 Copilot review.
- createPinnedAgent: Node's net.connect runs with autoSelectFamily on
(Node >= 20), so it calls the lookup hook with `{ all: true }` and
requires an ARRAY of `{ address, family }`. The scalar-only callback
failed every hostname request with ERR_INVALID_IP_ADDRESS, so /fetch
could only reach literal-IP targets. Both callback shapes are now
supported. Reproduced against Node 22/26 before and after.
- Tests: cover the `{ all: true }` shape for IPv4 and IPv6, and add an
end-to-end request through the agent over the production path
(node-fetch -> http.Agent -> net.connect) using an unresolvable
hostname, so the request can only succeed via the pinned IP. Verified
these three fail without the fix. Replaced the `Function`-typed casts
with a typed pinnedLookup() helper.
- CI: run the new server suite (.github/workflows/main.yml) and add a
root `test-server` script, so this regression coverage is enforced.
- package-lock.json: sync the server workspace manifest mirror with the
added @types/node and vitest devDependencies.
- index.ts: drop the `agent as any` cast and its eslint-disable — the
node-fetch RequestInit already types `agent`, and tsc is clean without
the suppression.
- Formatting: prettier-check now passes (it failed on the two new files).
Signed-off-by: cliffhall <cliff@futurescale.com>
#1828 pinned v1 publishes to `--tag v1`, following the runbook (#1804 §1). That
tag name is not legal: npm rejects any dist-tag that parses as a SemVer range,
and `v1` parses as `1.x`.
npm error Tag name must not be a valid SemVer range: v1
Found while running the companion `npm dist-tag add` step, which failed the
same way. So the merged flag would not have "published to the wrong tag" — the
next v1 security release would have failed to publish at all, and only at
release time.
`v1-latest` is accepted (verified against semver.validRange, along with
`legacy`, which was the other candidate). The workflow comment now records both
failure modes so neither the flag nor the specific tag name gets "cleaned up"
later.
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
`publish-all` had no `--tag`, so npm assigned `latest` to whatever it
published. That was correct for 1.0.1 — the deprecation release had to take
`latest` to reach npx users — but it becomes a trap the moment 2.0.0 ships: a
1.0.2 security fix published from `v1/main` would move `latest` back to v1, and
every `npx @modelcontextprotocol/inspector` in the world would silently get the
deprecated line.
`--tag v1` on both halves covers all four package names — `--workspaces` fans
out to inspector-client/-server/-cli, and the second invocation is the root.
Nothing enforces this flag, and the cost of dropping it surfaces months later
in a way that looks like an npm bug rather than a missing argument, so the
workflow carries a comment at the point of use.
Phase 3 of the v2 go-live runbook (#1804 §1).
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The "Check formatting" step in main.yml ran `npx prettier --check .`
before `npm install`, so npx fetched the LATEST prettier rather than the
version pinned in package-lock.json. This made the format check
non-deterministic and red on open PRs whenever the latest published
prettier differed from the pinned one.
- Pin prettier to exact 3.9.5 in devDependencies and update the lockfile
- Reformat the repo with the pinned prettier (expected source churn)
- Move the format check after `npm install --no-package-lock` and run it
via `npm run prettier-check` so CI uses the locally-installed pinned
prettier
Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Per review feedback on PR #1270: replace the three-way `==` OR chain in
each of the four trigger branches with a single contains(fromJSON(...))
check against a shared list. Same semantics, less duplication, and the
allowed-roles list is now defined once per branch instead of three times.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Previously the workflow's `if:` only checked the event type and the
presence of `@claude` in the body. The job would start for any commenter
and only later fail when the action attempted privileged operations on
behalf of a user without write access. That produced noisy red runs and
wasted runner minutes for what is effectively an authorization rejection.
Add an `author_association` check (OWNER, MEMBER, or COLLABORATOR) to
each of the four trigger branches (issue_comment, pull_request_review_comment,
pull_request_review, issues), so the job is short-circuited at workflow
evaluation time and never starts for unauthorized invokers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Upgrade npm to ^11.5.1 in the publish job (Node 22 bundles npm 10.x,
which lacks OIDC trusted publishing support)
- Drop NODE_AUTH_TOKEN / NPM_TOKEN secret in favor of OIDC
- Enable provenance attestation via NPM_CONFIG_PROVENANCE
The publish job already had id-token: write and registry-url configured.
Configure Dependabot to automatically detect updates to the actions used in
GitHub Actions (e.g., `actions/checkout`) and create pull requests for them.
For example, `actions/checkout@v4` is likely updatable, as v6 is already available:
9f3b4ff/.github/workflows/main.yml (L15)
This PR enables Dependabot to update such GitHub Actions dependencies.
Updates to outdated actions packages in `.github/workflows` are intentionally not included in this PR,
as they will be updated by the initial Dependabot run as part of verifying its behavior.
Based on experience, checking for updates on a weekly interval should work well.
* Pinned server-everything, fixed all tests to work with current pinned version, fixed problem with undetected failures (isError: true payloads).
* First working vitest implementation
* Refactoring some single-use configs fixtures and into the refeencing tests
* No tests refere to server-everything (or any other server from a registry), all tests actually validate what they say they test.
* Removed server-everything dep from CI, minor cleanup
* Addressed Claude PR review comments: Added tsx dev dependency, beefed up process termination (possible leak on Windows), beefed up http server cleanup (close all connections), removed unused hasValidJsonOutput, reduced CLI timeout to give it breathing room with vitest timeout.
* Made both stdio and http test servers fully composable, cleaned up types, terminology, and usage.
Add mcp__mcp-docs to allowedTools so Claude can actually use the
MCP documentation server when reviewing MCP-related code.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add .mcp.json with mcp-docs HTTP server configuration
- Update claude.yml to use --mcp-config and --append-system-prompt
- Add instructions for Claude to use MCP docs and schema references
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Modify claude.yml
1. Added "Get PR details" step (NEW - lines 28-51)
This new step runs ONLY when the trigger is a PR-related comment. It:
- Detects if it's a PR comment vs regular issue
- Fetches the PR information using GitHub API
- Extracts the fork's repository name and commit SHA
- Sets them as outputs (steps.pr.outputs.sha and steps.pr.outputs.repo)
Why? The original workflow couldn't see fork PR code because it only checked out the main repo.
2. Split checkout into TWO conditional steps (CHANGED - lines 53-62)
Before: One checkout step that always checked out main repo with fetch-depth: 1
After: Two checkout steps:
- "Checkout PR branch" - Runs if PR details were fetched successfully, checks out the fork's PR branch
- "Checkout repository" - Runs otherwise (for regular issues), checks out main repo
Why? Need different checkout behavior for PRs (checkout fork) vs issues (checkout main).
3. Changed fetch-depth from 1 to 0 (CHANGED)
Before: fetch-depth: 1 (only latest commit)
After: fetch-depth: 0 (full git history)
Why? Claude Code needs more context to understand the codebase and provide better reviews.
Summary
The original workflow could only see the main repo's code. When you commented @claude on a fork PR, it would review the wrong code!
These changes make it check out the actual PR branch from the fork when reviewing PRs, while keeping the original behavior for regular issues.
Clarify in contribution guidelines that during V2 development, V1
contributions should focus on bug fixes and MCP spec compliance.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
