Releases are now triggered deliberately via workflow_dispatch. The
schedule produced a year of unattended runs stuck awaiting environment
approval, every real release was manually dispatched anyway, and two
runs on the same UTC day collide on the date-based tag. Rename the
workflow to "Release" accordingly and update RELEASING.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Review findings: RELEASING.md claimed publishing happens exclusively
from release.yml with no registry tokens, but typescript.yml and
python.yml still carried release:[published] publish jobs — never
fired (releases are created with GITHUB_TOKEN, which suppresses
workflow triggers) and unable to succeed under OIDC (typescript.yml's
still referenced the deleted NPM_TOKEN). Remove both jobs and their
release triggers; the workflows are now pure CI.
Also:
- add skip-existing to the PyPI publish action so re-runs tolerate
already-uploaded files, and describe the per-registry guard
accurately in RELEASING.md (npm aborts; PyPI skips)
- correct the fresh-dispatch note: same-day dispatches collide on the
date-granular tag rather than minting a new version
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Review findings from the PR:
- release.py's has_changes() only counted .py/.ts files, so the README
touches meant to enroll the four TS packages in the npm matrix would
have been ignored. Include .md — READMEs ship inside the published
package (npm tarball / PyPI long_description), so doc changes are
release-relevant.
- uv run --frozen pytest for consistency with the job's other uv calls.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Gate both publish jobs on the package's test suite: npm test
--if-present before the npm build/publish, and pytest (when a tests/
or test/ directory exists, matching python.yml's guard) before the
PyPI build/publish. Previously nothing between tagging and publishing
ran a single test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
The NPM_TOKEN used by publish-npm is dead (npm classic-token sunset) —
both June release attempts failed publishing with a disguised auth error
(E404 on the publish PUT) after PyPI legs succeeded. Each
@modelcontextprotocol/* package's npm trusted publisher is being bound to
this workflow (release.yml) + the release environment, so publish-npm now
authenticates via OIDC instead of a token:
- add id-token: write permission to publish-npm (required to mint the
OIDC token; contents: read added explicitly since setting permissions
drops the defaults)
- upgrade the npm CLI in the publish job (trusted publishing requires
npm >= 11.5.1; Node 22 bundles an older npm)
- drop NODE_AUTH_TOKEN from the publish step
Also touch each TypeScript server's README (add everything's missing
License section; link each package's npm page) so scripts/release.py
includes all four packages in the next npm publish matrix — they've been
stranded on npm at 2026.1.26 while PyPI advanced to 2026.6.16.
See #4463 for the rollout plan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
* fix: regenerate uv.lock after version bump in release script
When the release script bumps the version in pyproject.toml, it needs
to also regenerate the uv.lock file. Otherwise the lockfile becomes
out of sync and `uv sync --locked` fails in CI with:
"The lockfile at uv.lock needs to be updated"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: use --frozen instead of --locked in release workflow
The release script bumps the version in pyproject.toml, which causes
the lockfile to be out of sync (uv includes the package's own version
in the lockfile). Using --frozen skips the lockfile freshness check
while still using pinned dependency versions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The update-packages job needs to push tags to the repository but was
missing the required `permissions: contents: write`. This caused the
workflow to fail with a 403 error when trying to push the version tag.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in publish-pypi job,
- only proceed if there are python packages to publish
- in publish-npm job,
- only proceed if there are npm packages to publish
