mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-11-14 10:39:32 +01:00
Codeman maintainer
f66a9a574d
The registry does not follow npm, so every release waited on a by-hand mcp-publisher publish, behind a browser login that expires between releases. Release now calls publish-mcp.yml once npm took a release. It signs in with the workflow's OIDC token, which the registry accepts for the io.github.Ark0N/ namespace, so it needs no secret and no browser. It skips a version the registry already has, waits until npm serves a new one, and can be run by hand with gh workflow run publish-mcp.yml. The id-token right sits on its own job, which runs nothing from the repository: it reads server.json and runs one pinned, checksummed binary. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
88 lines
2.8 KiB
YAML
88 lines
2.8 KiB
YAML
name: Release
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
|
|
concurrency: ${{ github.workflow }}-${{ github.ref }}
|
|
|
|
jobs:
|
|
release:
|
|
name: Release
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
outputs:
|
|
published: ${{ steps.changesets.outputs.published }}
|
|
steps:
|
|
- name: Checkout repo
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
registry-url: https://registry.npmjs.org
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
- name: Create release PR or publish
|
|
id: changesets
|
|
uses: changesets/action@v1
|
|
with:
|
|
publish: npm run release
|
|
version: npm run version-packages
|
|
title: "chore: version packages"
|
|
commit: "chore: version packages"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
|
|
|
|
- name: Rename release tag to codeman
|
|
if: steps.changesets.outputs.published == 'true'
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
VERSION=$(node -p "require('./package.json').version")
|
|
OLD_TAG="aicodeman@${VERSION}"
|
|
NEW_TAG="codeman@${VERSION}"
|
|
|
|
# Update the GitHub release BEFORE deleting the old tag.
|
|
# make_latest pins the "Latest" badge to the Codeman release. This repo
|
|
# publishes TWO packages (aicodeman + xterm-zerolag-input), changesets
|
|
# creates a GitHub release for each, and GitHub awards "Latest" to
|
|
# whichever was published LAST. That is a race: 1.9.2 kept the badge,
|
|
# 1.9.4 lost it to xterm-zerolag-input@0.1.7 by two seconds. All package
|
|
# releases already exist by the time this step runs, so setting it here
|
|
# is deterministic.
|
|
RELEASE_ID=$(gh release view "$OLD_TAG" --json databaseId -q .databaseId 2>/dev/null || true)
|
|
if [ -n "$RELEASE_ID" ]; then
|
|
gh api -X PATCH "repos/${{ github.repository }}/releases/${RELEASE_ID}" \
|
|
-f tag_name="$NEW_TAG" \
|
|
-f name="$NEW_TAG" \
|
|
-f make_latest=true
|
|
fi
|
|
|
|
# Retag
|
|
git tag "$NEW_TAG" "$OLD_TAG" 2>/dev/null || true
|
|
git tag -d "$OLD_TAG" 2>/dev/null || true
|
|
git push origin "$NEW_TAG" ":refs/tags/$OLD_TAG" 2>/dev/null || true
|
|
|
|
# Its own job: this one alone holds id-token, and a registry failure shows as itself
|
|
# without touching the npm publish or the tag above.
|
|
mcp-registry:
|
|
name: MCP registry
|
|
needs: release
|
|
if: needs.release.outputs.published == 'true'
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
uses: ./.github/workflows/publish-mcp.yml
|