release.yml

name: Release

# Publishes to npm and the official MCP Registry when a version tag (vX.Y.Z) is pushed.
#
# Credentials:
#   - npm: NO token. Uses npm Trusted Publishing (OIDC). Configure a trusted
#     publisher on the @noteboxd/mcp package (npmjs.com -> package -> Settings ->
#     Trusted Publishers) bound to this repo + workflow file "release.yml".
#   - MCP Registry: the DNS namespace (com.noteboxd) is authenticated with the
#     ed25519 key behind the noteboxd.com TXT record, provided as the
#     MCP_DNS_PRIVATE_KEY secret (its repository access must include this repo).
#
# Cut a release:
#   1. Bump the version in package.json, server.json, and src/config.ts (keep equal).
#   2. git commit + git tag vX.Y.Z + git push --follow-tags

on:
  push:
    tags:
      - "v*"

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # required for npm Trusted Publishing (OIDC)
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          registry-url: "https://registry.npmjs.org"

      - name: Verify tag matches package.json and server.json versions
        run: |
          TAG="${GITHUB_REF_NAME#v}"
          PKG="$(node -p "require('./package.json').version")"
          SRV="$(node -p "require('./server.json').version")"
          if [ "$TAG" != "$PKG" ] || [ "$TAG" != "$SRV" ]; then
            echo "Version mismatch: tag=$TAG package.json=$PKG server.json=$SRV"
            exit 1
          fi

      - name: Install dependencies
        run: npm install

      - name: Upgrade npm (Trusted Publishing requires npm >= 11.5)
        run: npm install -g npm@latest

      - name: Publish to npm (OIDC, no token)
        run: npm publish

      - name: Install mcp-publisher
        run: |
          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
          sudo mv mcp-publisher /usr/local/bin/

      - name: Publish to MCP Registry (DNS auth)
        env:
          MCP_DNS_PRIVATE_KEY: ${{ secrets.MCP_DNS_PRIVATE_KEY }}
        run: |
          mcp-publisher login dns --domain noteboxd.com --private-key "$MCP_DNS_PRIVATE_KEY"
          mcp-publisher publish