Summary
Wire the actual publish/release job into .github/workflows/main.yml for the single-package v2 @modelcontextprotocol/inspector. This is the remaining half of #1636: the packaging correctness (single package, source maps off, clients/web/build fix, single-source version, npm run pack:verify) landed in PR #1637, but the CI workflow still has no publish job — it only runs validate/coverage/smoke.
This is deliberately scoped as a follow-up because the release job lands at the v2/main → main cutover (v2 replacing v1), not before.
Background
- v1
main.yml (current main) has a publish job (npm run publish-all = npm publish --workspaces + root) and a GHCR Docker publish job, gated on github.event_name == 'release'.
- v2
main.yml (this branch) has no publish job at all.
- v2 is not a workspace: one root package, one version (now single-sourced from the root
package.json — the client package.jsons carry no version). So --workspaces / publish-all no longer applies.
Scope
- Single-package publish job. Add a release-gated job that publishes just
@modelcontextprotocol/inspector (npm publish, prepack builds all clients). It should run npm run pack:verify first as the pre-publish gate — that already builds, packs, installs the tarball into a clean consumer, and drives the installed bin end to end.
- Provenance / release environment. Port the v1
environment: release, id-token: write, and the --provenance flag (repo is public now).
- GHCR Docker image. Decide whether the container publish job carries over and what it builds (launcher entrypoint).
- Version bump / tagging flow. Define how a release is cut now that the version lives only in the root
package.json (single npm version at the root; no per-client sync needed).
- CI network note.
pack:verify needs registry access (it installs the tarball's runtime deps); confirm that's acceptable in the release job (it is fetching, not publishing, at that step).
Out of scope
Acceptance
.github/workflows/main.yml (on the v2 line) has a release-gated job that publishes the single @modelcontextprotocol/inspector package, gated behind npm run pack:verify, with provenance, plus a decision on GHCR.- A documented release procedure (version bump → tag/release → publish) for the single-package/single-version model.
Summary
Wire the actual publish/release job into
.github/workflows/main.ymlfor the single-package v2@modelcontextprotocol/inspector. This is the remaining half of #1636: the packaging correctness (single package, source maps off,clients/web/buildfix, single-source version,npm run pack:verify) landed in PR #1637, but the CI workflow still has no publish job — it only runs validate/coverage/smoke.This is deliberately scoped as a follow-up because the release job lands at the
v2/main→maincutover (v2 replacing v1), not before.Background
main.yml(currentmain) has apublishjob (npm run publish-all=npm publish --workspaces+ root) and a GHCR Docker publish job, gated ongithub.event_name == 'release'.main.yml(this branch) has no publish job at all.package.json— the clientpackage.jsons carry noversion). So--workspaces/publish-allno longer applies.Scope
@modelcontextprotocol/inspector(npm publish,prepackbuilds all clients). It should runnpm run pack:verifyfirst as the pre-publish gate — that already builds, packs, installs the tarball into a clean consumer, and drives the installed bin end to end.environment: release,id-token: write, and the--provenanceflag (repo is public now).package.json(singlenpm versionat the root; no per-client sync needed).pack:verifyneeds registry access (it installs the tarball's runtime deps); confirm that's acceptable in the release job (it is fetching, not publishing, at that step).Out of scope
corepackage (still deferred; tracked on Create v2 publishing pipeline for main.yml (single inspector package) #1636).Acceptance
.github/workflows/main.yml(on the v2 line) has a release-gated job that publishes the single@modelcontextprotocol/inspectorpackage, gated behindnpm run pack:verify, with provenance, plus a decision on GHCR.