Releases are published from wangxpych/mcp-interceptor by
.github/workflows/publish.yml.
Version 0.1.0 is the one-time bootstrap release because npm requires a package
to exist before a trusted publisher can be configured. After that bootstrap,
the package trusts only GitHub Actions workflow publish.yml in this repository
and uses short-lived OIDC credentials. No persistent npm token is stored in the
repository.
- Update
package.jsonandCHANGELOG.md. - Run
pnpm release:check. - Merge the release commit to
mainand confirm CI. - Publish a non-prerelease GitHub Release tagged
v<package version>. - Verify npm metadata, provenance, installation, and ESM import from a fresh temporary project.
The workflow rejects tags that do not match package.json.