publish-npm.yml

name: Publish Release

on:
  workflow_dispatch: # Disabled - upstream artifact, not needed for Pathfinder operations
concurrency:
  group: publish-release-delorenj-mcp-server-trello
  cancel-in-progress: false

env:
  # Reviewed upstream MCP Registry release v1.7.9.
  MCP_REGISTRY_COMMIT: 35b20719ee7714ad18d0f81af6798ac0a46e2b9b

jobs:
  publish-npm:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    outputs:
      package_version: ${{ steps.version.outputs.package_version }}
      release_ready: ${{ steps.verify-npm.outputs.release_ready }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.3.13

      - name: Setup Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          # Trusted Publishing requires Node >= 22.14.0.
          node-version: '22.x'
          registry-url: 'https://registry.npmjs.org'

      - name: Upgrade npm for Trusted Publishing
        # Trusted Publishing requires npm CLI >= 11.5.1.
        run: npm install -g npm@latest

      - name: Verify requested version
        id: version
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          MANUAL_VERSION: ${{ inputs.version }}
        run: |
          package_name=$(node -p "require('./package.json').name")
          package_version=$(node -p "require('./package.json').version")
          requested_version="${RELEASE_TAG#v}"
          if [ -z "$requested_version" ]; then
            requested_version="$MANUAL_VERSION"
          fi

          if [ "$requested_version" != "$package_version" ]; then
            echo "Requested version $requested_version does not match package.json version $package_version" >&2
            exit 1
          fi

          echo "package_name=$package_name" >> "$GITHUB_OUTPUT"
          echo "package_version=$package_version" >> "$GITHUB_OUTPUT"
          echo "dist_tag=$(node scripts/npm-dist-tag.js "$package_version")" >> "$GITHUB_OUTPUT"

          published_versions=$(node scripts/npm-published-versions.js "$package_name")
          if PUBLISHED_VERSIONS="$published_versions" PACKAGE_VERSION="$package_version" node -e \
            'process.exit(JSON.parse(process.env.PUBLISHED_VERSIONS).includes(process.env.PACKAGE_VERSION) ? 0 : 1)'; then
            echo "$package_name@$package_version is already published; publication will be idempotent."
            echo "should_publish=false" >> "$GITHUB_OUTPUT"
          else
            echo "should_publish=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run tests with fixed coverage baseline
        # Release validation must not rewrite the committed coverage ratchet.
        run: bun run test:coverage -- --coverage.thresholds.autoUpdate=false

      - name: Build project
        run: bun run build

      - name: Pack release artifact
        id: pack
        run: |
          pack_dir="$RUNNER_TEMP/npm-pack"
          mkdir -p "$pack_dir"
          pack_json=$(npm pack --json --pack-destination "$pack_dir")
          tarball=$(PACK_JSON="$pack_json" PACK_DIR="$pack_dir" node -e \
            'const path = require("node:path"); const data = JSON.parse(process.env.PACK_JSON); const pack = Array.isArray(data) ? data[0] : Object.values(data)[0]; process.stdout.write(path.join(process.env.PACK_DIR, pack.filename))')
          echo "tarball=$tarball" >> "$GITHUB_OUTPUT"

      - name: Smoke test installed package binary
        env:
          TARBALL: ${{ steps.pack.outputs.tarball }}
        run: |
          smoke_dir="$RUNNER_TEMP/npm-smoke"
          mkdir -p "$smoke_dir"
          cd "$smoke_dir"
          npm init --yes >/dev/null
          npm install --ignore-scripts "$TARBALL"
          test -x node_modules/.bin/mcp-server-trello
          set +e
          TRELLO_API_KEY=smoke TRELLO_TOKEN=smoke timeout 3s node_modules/.bin/mcp-server-trello </dev/null
          smoke_status=$?
          set -e
          if [ "$smoke_status" -ne 0 ] && [ "$smoke_status" -ne 124 ]; then
            echo "Installed binary exited unexpectedly with status $smoke_status" >&2
            exit "$smoke_status"
          fi

      - name: Publish to npm
        if: steps.version.outputs.should_publish == 'true'
        env:
          TARBALL: ${{ steps.pack.outputs.tarball }}
          DIST_TAG: ${{ steps.version.outputs.dist_tag }}
        run: npm publish "$TARBALL" --tag "$DIST_TAG"

      - name: Verify npm package is available
        id: verify-npm
        env:
          PACKAGE_NAME: ${{ steps.version.outputs.package_name }}
          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
        run: |
          for delay in 1 2 4 8 15 30; do
            published_version=$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" version 2>/dev/null || true)
            if [ "$published_version" = "$PACKAGE_VERSION" ]; then
              echo "release_ready=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            sleep "$delay"
          done
          published_version=$(npm view "$PACKAGE_NAME@$PACKAGE_VERSION" version 2>/dev/null || true)
          if [ "$published_version" = "$PACKAGE_VERSION" ]; then
            echo "release_ready=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "$PACKAGE_NAME@$PACKAGE_VERSION is not available from npm" >&2
          exit 1

  publish-registry:
    if: github.event_name == 'release' && needs.publish-npm.outputs.release_ready == 'true'
    needs: publish-npm
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Verify package and Registry manifest versions
        env:
          PUBLISHED_VERSION: ${{ needs.publish-npm.outputs.package_version }}
        run: |
          node <<'NODE'
          const packageJson = require('./package.json');
          const manifest = require('./server.json');
          const npmPackage = manifest.packages.find(
            (entry) => entry.registryType === 'npm' && entry.identifier === packageJson.name
          );
          const versions = {
            package: packageJson.version,
            server: manifest.version,
            registryPackage: npmPackage?.version,
            publishedPackage: process.env.PUBLISHED_VERSION,
          };
          if (!npmPackage || new Set(Object.values(versions)).size !== 1) {
            console.error('Version parity check failed:', versions);
            process.exit(1);
          }
          console.log(`Version parity verified: ${packageJson.name}@${packageJson.version}`);
          NODE

      - name: Check MCP Registry publication status
        id: registry-status
        run: |
          registry_path=$(node -e \
            'const manifest = require("./server.json"); process.stdout.write(`${encodeURIComponent(manifest.name)}/versions/${encodeURIComponent(manifest.version)}`)')
          status=$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' \
            "https://registry.modelcontextprotocol.io/v0.1/servers/$registry_path")
          case "$status" in
            200)
              echo "Server version is already present in the MCP Registry; skipping."
              echo "should_publish=false" >> "$GITHUB_OUTPUT"
              ;;
            404)
              echo "should_publish=true" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "MCP Registry lookup failed with HTTP $status" >&2
              exit 1
              ;;
          esac

      - name: Build pinned mcp-publisher
        if: steps.registry-status.outputs.should_publish == 'true'
        run: |
          git init "$RUNNER_TEMP/mcp-registry"
          git -C "$RUNNER_TEMP/mcp-registry" remote add origin https://github.com/modelcontextprotocol/registry.git
          git -C "$RUNNER_TEMP/mcp-registry" fetch --depth 1 origin "$MCP_REGISTRY_COMMIT"
          git -C "$RUNNER_TEMP/mcp-registry" checkout --detach FETCH_HEAD
          make -C "$RUNNER_TEMP/mcp-registry" publisher
          cp "$RUNNER_TEMP/mcp-registry/bin/mcp-publisher" "$GITHUB_WORKSPACE/"

      - name: Authenticate with GitHub OIDC
        if: steps.registry-status.outputs.should_publish == 'true'
        run: ./mcp-publisher login github-oidc

      - name: Publish to MCP Registry
        if: steps.registry-status.outputs.should_publish == 'true'
        run: ./mcp-publisher publish