4f3e7fa167`publish-all` had no `--tag`, so npm assigned `latest` to whatever it published. That was correct for 1.0.1 — the deprecation release had to take `latest` to reach npx users — but it becomes a trap the moment 2.0.0 ships: a 1.0.2 security fix published from `v1/main` would move `latest` back to v1, and every `npx @modelcontextprotocol/inspector` in the world would silently get the deprecated line. `--tag v1` on both halves covers all four package names — `--workspaces` fans out to inspector-client/-server/-cli, and the second invocation is the root. Nothing enforces this flag, and the cost of dropping it surfaces months later in a way that looks like an npm bug rather than a missing argument, so the workflow carries a comment at the point of use. Phase 3 of the v2 go-live runbook (#1804 §1). Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
123 lines
3.2 KiB
YAML
123 lines
3.2 KiB
YAML
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- v1/main
|
|
pull_request:
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
- name: Check formatting
|
|
run: npm run prettier-check
|
|
|
|
- name: Check version consistency
|
|
run: npm run check-version
|
|
|
|
- name: Check linting
|
|
working-directory: ./client
|
|
run: npm run lint
|
|
|
|
- name: Run client tests
|
|
working-directory: ./client
|
|
run: npm test
|
|
|
|
- run: npm run build
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
# OIDC trusted publishing requires npm >=11.5.1; Node 22's bundled npm is 10.x.
|
|
- name: Ensure npm CLI supports OIDC trusted publishing
|
|
run: npm install -g npm@^11.5.1
|
|
|
|
# `publish-all` pins `--tag v1` on all four packages. Do NOT remove it:
|
|
# without an explicit tag npm assigns `latest`, so a v1 security release
|
|
# would drag `latest` back from v2 and every `npx
|
|
# @modelcontextprotocol/inspector` would silently get deprecated v1.
|
|
- run: npm run publish-all
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: "true"
|
|
|
|
publish-github-container-registry:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Log in to the Container registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build and push Docker image
|
|
id: push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
- name: Generate artifact attestation
|
|
uses: actions/attest-build-provenance@v4
|
|
with:
|
|
subject-name: ghcr.io/${{ github.repository }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|
|
push-to-registry: true
|