-
-
Notifications
You must be signed in to change notification settings - Fork 8
Copilot/fix path collisions #38
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| name: Publish pmll-memory-mcp to npm | ||
|
|
||
| on: | ||
| release: | ||
| types: [published] | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| publish-npm: | ||
| name: Publish to npm (OIDC Trusted Publisher) | ||
| runs-on: ubuntu-latest | ||
| defaults: | ||
| run: | ||
| working-directory: mcp | ||
| permissions: | ||
| contents: read | ||
| id-token: write # Required for npm OIDC provenance | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: "20" | ||
| registry-url: "https://registry.npmjs.org" | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Build | ||
| run: npm run build | ||
|
|
||
| - name: Run tests | ||
| run: npm test | ||
|
|
||
| - name: Publish to npm with provenance | ||
| run: npm publish --provenance --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | ||
|
|
||
| publish-mcp-registry: | ||
| name: Publish to MCP Registry | ||
| needs: publish-npm | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install mcp-publisher | ||
| run: | | ||
| set -euo pipefail | ||
| MCP_PUBLISHER_VERSION="v0.1.0" | ||
| OS="$(uname -s | tr '[:upper:]' '[:lower:]')" | ||
| ARCH="$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')" | ||
| TARBALL="mcp-publisher_${OS}_${ARCH}.tar.gz" | ||
| BASE_URL="https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}" | ||
|
|
||
| echo "Downloading ${TARBALL} for mcp-publisher ${MCP_PUBLISHER_VERSION}..." | ||
| curl -L "${BASE_URL}/${TARBALL}" -o "${TARBALL}" | ||
|
|
||
| echo "Downloading checksums for mcp-publisher ${MCP_PUBLISHER_VERSION}..." | ||
| curl -L "${BASE_URL}/checksums.txt" -o checksums.txt | ||
|
|
||
| echo "Verifying checksum for ${TARBALL}..." | ||
| grep " ${TARBALL}\$" checksums.txt | sha256sum -c - | ||
|
|
||
| echo "Extracting mcp-publisher..." | ||
| tar xzf "${TARBALL}" mcp-publisher | ||
| sudo mv mcp-publisher /usr/local/bin/ | ||
|
|
||
| - name: Publish to MCP Registry | ||
| env: | ||
| MCP_REGISTRY_TOKEN: ${{ secrets.MCP_REGISTRY_TOKEN }} | ||
| run: | | ||
| if [ -z "$MCP_REGISTRY_TOKEN" ]; then | ||
| echo "::warning::MCP_REGISTRY_TOKEN not set; skipping MCP Registry publish." | ||
| exit 0 | ||
| fi | ||
| mcp-publisher publish | ||
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When using OIDC-based provenance (
--provenancewithid-token: write), npm's OIDC authentication is handled automatically without requiring aNODE_AUTH_TOKEN. However, ifNPM_TOKENis still expected as a fallback or for authentication, it should be noted that mixing OIDC provenance with a classic token can cause conflicts. If the intent is to use purely OIDC trusted publishing (as the job name suggests), theNODE_AUTH_TOKENenv var should be removed and theregistry-urlconfiguration alone is sufficient for OIDC. KeepingNODE_AUTH_TOKENset to a secret that may not exist could cause the publish step to fail if npm attempts token-based auth over OIDC.