publish-mcp.yml

name: Publish (MCP Registry)

# Publishes the server entry to the MCP Registry. npm is published manually
# (the org's npm account enforces 2FA/OTP, which a CI token can't satisfy), so
# this workflow no longer attempts npm — it only syncs server.json to the
# package version, authenticates via GitHub OIDC, and publishes to the registry.
# The registry validates that the referenced npm version already exists, so run
# this AFTER the manual `npm publish` (tag push, or workflow_dispatch).
on:
  push:
    tags:
      - 'v*'
  workflow_dispatch: {}

permissions:
  contents: read
  id-token: write # mcp-publisher github-oidc

jobs:
  mcp:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Verify tag matches package.json (tag runs only)
        if: github.ref_type == 'tag'
        run: |
          PKG="$(node -p "require('./package.json').version")"
          TAG="${GITHUB_REF_NAME#v}"
          if [ "$PKG" != "$TAG" ]; then
            echo "::error::tag v$TAG does not match package.json version $PKG"
            exit 1
          fi

      - name: Install mcp-publisher
        run: |
          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
          sudo mv mcp-publisher /usr/local/bin/

      - name: Sync server.json version to package.json
        run: |
          node -e "const fs=require('fs');const v=require('./package.json').version;const p='server.json';const j=JSON.parse(fs.readFileSync(p,'utf8'));j.version=v;if(Array.isArray(j.packages))for(const x of j.packages)x.version=v;fs.writeFileSync(p,JSON.stringify(j,null,2)+'\n');"

      - name: Login to MCP Registry (GitHub OIDC)
        run: mcp-publisher login github-oidc

      - name: Publish to MCP Registry
        run: mcp-publisher publish