mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-14 02:29:33 +01:00
The registry does not follow npm, so every release waited on a by-hand mcp-publisher publish, behind a browser login that expires between releases. Release now calls publish-mcp.yml once npm took a release. It signs in with the workflow's OIDC token, which the registry accepts for the io.github.Ark0N/ namespace, so it needs no secret and no browser. It skips a version the registry already has, waits until npm serves a new one, and can be run by hand with gh workflow run publish-mcp.yml. The id-token right sits on its own job, which runs nothing from the repository: it reads server.json and runs one pinned, checksummed binary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>