fix(ci): split release.yml into version + publish jobs#1836
Merged
felixweinberger merged 1 commit intomainfrom Apr 1, 2026
Merged
fix(ci): split release.yml into version + publish jobs#1836felixweinberger merged 1 commit intomainfrom
felixweinberger merged 1 commit intomainfrom
Conversation
Fixes the failed alpha.1 publish (run 23850387096). Two issues: 1. changesets/action passed 'publish: pnpm run build:all && pnpm changeset publish' as argv, not through a shell — '&&' became a literal arg forwarded to tsdown. Wrapped in package.json ci:publish script. 2. NPM_TOKEN is environment-scoped to 'release' but the job had no environment. Now the publish job has environment: release. Split into two jobs so the Version PR auto-updates (ungated) but publish requires environment approval. The version job's hasChangesets output gates the publish job. Also enables provenance (id-token: write + NPM_CONFIG_PROVENANCE).
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
KKonstantinov
approved these changes
Apr 1, 2026
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
9 tasks
felixweinberger
added a commit
that referenced
this pull request
Apr 1, 2026
Drops NPM_TOKEN/NODE_AUTH_TOKEN from the publish job. npm CLI auto-detects GitHub Actions OIDC (id-token: write was already present from #1836) and exchanges for a short-lived publish credential. Also drops registry-url from setup-node — it writes a .npmrc expecting NODE_AUTH_TOKEN, which short-circuits before OIDC kicks in. npm defaults to npmjs.org without it. Requires trusted publishers configured per-package on npmjs.com: client/server/express/hono/node/fastify → workflow release.yml, environment release.
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failed alpha.1 publish (run 23850387096). Two root causes, one architectural change.
Motivation and Context
Bug 1 —
publish:input not shell-evaluated.changesets/actionpasses thepublish:string as argv.pnpm run build:all && pnpm changeset publishbecamepnpm run build:allwith extra args&&,pnpm,changeset,publish— which pnpm forwarded totsdownas entry points:Never fired before because every previous run was in PR mode. Wrapped in
package.json'sci:publishscript — single command, no shell operators.Bug 2 —
NPM_TOKENenvironment-scoped, job had no environment. The secret lives in thereleaseenvironment (was used bymain.yml's now-deleted publish job).release.ymlhad noenvironment:so the secret resolved empty.Split into two jobs:
version(ungated): runschangesets/actionwith nopublish:input. Only creates/updates the Version PR. OutputshasChangesets.publish(gated):needs: version,if: hasChangesets == 'false',environment: release. Runschangesets/actionwithpublish: pnpm run ci:publish. Approval prompt fires only when actually publishing.Feature PRs land → Version PR updates automatically. Merge Version PR → publish job waits for approval → token visible → publishes.
Also enables provenance (
id-token: write+NPM_CONFIG_PROVENANCE: 'true').How Has This Been Tested?
The build path was verified locally on
changeset-release/main(pnpm install && pnpm build:allclean). The workflow structure follows the documentedchangesets/actionhasChangesetsoutput pattern.After this merges:
versionjob runs →hasChangesets: false(versions still bumped from #1420, no new changesets) →publishjob → approval prompt → publishes alpha.1.Breaking Changes
None.
Types of changes
Checklist
Additional context
The
releaseenvironment's required reviewers (if configured atSettings → Environments → release) become the publish approvers.