release.yml

name: Release

# Publishes the `inkstudioai` package to npm, then its server.json to the
# MCP Registry. Release: set the same version in package.json and in both
# version fields of server.json, merge, then push a tag `v<version>`.
#
# npm: trusted publishing (OIDC), so there is no npm token. On npmjs.com,
# package inkstudioai > Settings > Trusted Publisher > GitHub Actions:
# user ciroartz, repository inkstudioai-cli, workflow release.yml.
# From a public repository, npm adds provenance on its own.
#
# MCP Registry: GitHub OIDC login, which owns the io.github.ciroartz/ namespace.

on:
  push:
    tags: ["v*"]

concurrency:
  group: release
  cancel-in-progress: false

permissions:
  contents: read
  id-token: write

jobs:
  release:
    runs-on: ubuntu-latest
    # This job can prove its identity to npm, so actions and npm are pinned.
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          persist-credentials: false

      # Trusted publishing needs Node 22.14 or later and npm 11.5.1 or later.
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
          registry-url: https://registry.npmjs.org

      - name: Update npm
        run: npm install -g npm@11.21.1

      - name: Run the tests
        run: node --test test/*.test.mjs

      - name: Check that the tag, package.json, and server.json agree
        run: |
          version=$(node -p "require('./package.json').version")
          server=$(node -p "const s = require('./server.json'); s.version + ' ' + s.packages[0].version")
          if [ "${GITHUB_REF_NAME}" != "v${version}" ] || [ "${server}" != "${version} ${version}" ]; then
            echo "Tag ${GITHUB_REF_NAME}, package.json ${version}, and server.json (${server}) must match." >&2
            exit 1
          fi

      # A pinned release with its SHA-256 (from registry_<version>_checksums.txt
      # of that release), not whatever "latest" is. Change both values together.
      - name: Install mcp-publisher
        env:
          MCP_PUBLISHER_VERSION: v1.8.4
          MCP_PUBLISHER_SHA256: 5dc2fd415369c73551259f31cd33e2aacc9e0d1021e7f08fef1492d93b781628
        run: |
          curl -fsSL -o mcp-publisher.tar.gz "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
          echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum --check --strict
          tar xzf mcp-publisher.tar.gz mcp-publisher
          # Before the npm step, so a bad server.json stops the release early.
          ./mcp-publisher validate server.json

      # The first version is published by hand (npm can set up trusted
      # publishing only for a package that exists), so skip a published version.
      - name: Publish to npm
        run: |
          version=$(node -p "require('./package.json').version")
          if npm view "inkstudioai@${version}" version >/dev/null 2>&1; then
            echo "inkstudioai@${version} is already on npm, so this step skips the publish."
          else
            npm publish --access public
          fi

      - name: Publish to the MCP Registry
        run: |
          # The registry checks the version and mcpName on npm. npm processes a new
          # version for a few minutes before it shows it, so wait up to 10 minutes.
          # Log in on each attempt: the registry token is short-lived.
          for attempt in $(seq 1 20); do
            ./mcp-publisher login github-oidc && ./mcp-publisher publish && exit 0
            sleep 30
          done
          exit 1