Per-ref cancellation is for superseded branch amend-pushes; on main,
every merge keeps its own CI run so failures stay attributable to a
specific commit.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Previously push-triggered CI ran only on main, so same-repo branches
got no CI until a PR was opened (fork contributions were and remain
covered by pull_request, which fires on open and on every subsequent
push). Run on all pushes, and add a per-ref concurrency group so rapid
amend-pushes cancel superseded runs. Same-repo branches with an open
PR will run under both events; acceptable at this repo's scale.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Releases are now triggered deliberately via workflow_dispatch. The
schedule produced a year of unattended runs stuck awaiting environment
approval, every real release was manually dispatched anyway, and two
runs on the same UTC day collide on the date-based tag. Rename the
workflow to "Release" accordingly and update RELEASING.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Review findings: RELEASING.md claimed publishing happens exclusively
from release.yml with no registry tokens, but typescript.yml and
python.yml still carried release:[published] publish jobs — never
fired (releases are created with GITHUB_TOKEN, which suppresses
workflow triggers) and unable to succeed under OIDC (typescript.yml's
still referenced the deleted NPM_TOKEN). Remove both jobs and their
release triggers; the workflows are now pure CI.
Also:
- add skip-existing to the PyPI publish action so re-runs tolerate
already-uploaded files, and describe the per-registry guard
accurately in RELEASING.md (npm aborts; PyPI skips)
- correct the fresh-dispatch note: same-day dispatches collide on the
date-granular tag rather than minting a new version
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Review findings from the PR:
- release.py's has_changes() only counted .py/.ts files, so the README
touches meant to enroll the four TS packages in the npm matrix would
have been ignored. Include .md — READMEs ship inside the published
package (npm tarball / PyPI long_description), so doc changes are
release-relevant.
- uv run --frozen pytest for consistency with the job's other uv calls.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
Gate both publish jobs on the package's test suite: npm test
--if-present before the npm build/publish, and pytest (when a tests/
or test/ directory exists, matching python.yml's guard) before the
PyPI build/publish. Previously nothing between tagging and publishing
ran a single test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
The NPM_TOKEN used by publish-npm is dead (npm classic-token sunset) —
both June release attempts failed publishing with a disguised auth error
(E404 on the publish PUT) after PyPI legs succeeded. Each
@modelcontextprotocol/* package's npm trusted publisher is being bound to
this workflow (release.yml) + the release environment, so publish-npm now
authenticates via OIDC instead of a token:
- add id-token: write permission to publish-npm (required to mint the
OIDC token; contents: read added explicitly since setting permissions
drops the defaults)
- upgrade the npm CLI in the publish job (trusted publishing requires
npm >= 11.5.1; Node 22 bundles an older npm)
- drop NODE_AUTH_TOKEN from the publish step
Also touch each TypeScript server's README (add everything's missing
License section; link each package's npm page) so scripts/release.py
includes all four packages in the next npm publish matrix — they've been
stranded on npm at 2026.1.26 while PyPI advanced to 2026.6.16.
See #4463 for the rollout plan.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AViME1R9ES2UXT1uQDx1TG
The Third-Party Servers section (Official Integrations + Community
Servers) has been superseded by the MCP Registry at
https://registry.modelcontextprotocol.io/. The README already carried a
deprecation note and CONTRIBUTING.md froze new additions. This removes
the list, updates CONTRIBUTING.md to describe the new state, and
refreshes the readme-pr-check workflow's bot comment.
Adds a GitHub Actions workflow that:
- Detects PRs that only modify README.md
- Comments explaining we no longer accept new server additions
- Directs contributors to the MCP registry instead
- Allows updates/removals via /i-promise-this-is-not-a-new-server
- Uses labels (readme: pending / readme: ready for review) for filtering
- Minimizes bot comment after confirmation to reduce clutter
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 10
Claude-Permission-Prompts: 0
Claude-Escapes: 0
* fix: regenerate uv.lock after version bump in release script
When the release script bumps the version in pyproject.toml, it needs
to also regenerate the uv.lock file. Otherwise the lockfile becomes
out of sync and `uv sync --locked` fails in CI with:
"The lockfile at uv.lock needs to be updated"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* fix: use --frozen instead of --locked in release workflow
The release script bumps the version in pyproject.toml, which causes
the lockfile to be out of sync (uv includes the package's own version
in the lockfile). Using --frozen skips the lockfile freshness check
while still using pinned dependency versions.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
The update-packages job needs to push tags to the repository but was
missing the required `permissions: contents: write`. This caused the
workflow to fail with a 403 error when trying to push the version tag.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Add mcp__mcp-docs and WebFetch to allowedTools so Claude can use
the MCP docs server and fetch schema content from GitHub URLs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Cliff Hall <cliff@futurescale.com>
- Add .mcp.json with mcp-docs HTTP server configuration
- Update claude.yml to load MCP server config with --mcp-config
- Change --system-prompt to --append-system-prompt to preserve defaults
- Extend instructions to use mcp-docs for MCP-related work
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
The 'Check if tests exist' step was actually running tests with
continue-on-error: true. If tests failed, it would set has-tests=false
and skip the actual test step, making CI appear green even with failing tests.
Simplified to use 'npm test --if-present' which:
- Runs tests if a test script exists (and fails if tests fail)
- Does nothing and exits 0 if no test script exists
- Removes the need for the complex check logic
Fixes the issue where PR #3014 had failing tests but CI was green.
Updates the Claude Code GitHub Action to use the stable v1 GA release instead of the beta version.
## Changes
- Updates action version from `@beta` to `@v1`
- Migrates `allowed_tools` to `claude_args: --allowedTools`
- Migrates `custom_instructions` to `claude_args: --system-prompt`
- Retains `additional_permissions` and `assignee_trigger` (both still supported in v1)
## Behavior
The action continues to work the same way:
- Triggers on `@claude` mentions in comments, reviews, and issues
- Triggers when assigned to an issue as "claude"
- Allows Claude to run Bash commands
- Allows Claude to read CI results on PRs
- Applies custom instructions for posting concise summaries
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in create-release job condition
- check for all combinations of publish results that should lead to a release creation
- npm = success / pypi = skipped
- npm = skipped / pypi = success
- npm = success / pypi = success
- in publish-pypi job,
- only proceed if there are python packages to publish
- in publish-npm job,
- only proceed if there are npm packages to publish
- Added test job that runs before build
- Tests are conditionally executed only for packages that have test scripts
- Filesystem tests will now run automatically in CI on every push and PR
- Build job now depends on successful test completion
