v2 release fix#1835
Conversation
|
@modelcontextprotocol/client
@modelcontextprotocol/server
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — clean refactor extracting the publish command into a named script with no functional change.
Extended reasoning...
Overview
This PR modifies two files: .github/workflows/release.yml and package.json. It extracts the inline pnpm run build:all && pnpm changeset publish command from the workflow into a named script release:publish in package.json, then references that script from the workflow.
Security Risks
No new security risks are introduced. The extracted script is functionally identical to the previous inline command. The only security note is the pre-existing inconsistency in action pinning (mutable @v6 tags for actions/checkout and actions/setup-node vs. SHA-pinned third-party actions), which is flagged as a pre-existing issue in the inline comments and was not introduced by this PR.
Level of Scrutiny
Low. This is a pure refactor — moving a command from an inline workflow step into a named npm script. The behavior is identical. No logic changes, no new dependencies, no new permissions.
Other Factors
No changeset is needed since this is a CI/workflow-only change. The PR description template was not filled out, but the change is self-explanatory from the diff.
| id: changesets | ||
| uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1 | ||
| with: | ||
| publish: pnpm run build:all && pnpm changeset publish | ||
| publish: pnpm run release:publish | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} |
There was a problem hiding this comment.
🟣 Pre-existing issue: actions/checkout@v6 and actions/setup-node@v6 are not pinned to commit hashes, unlike pnpm/action-setup and changesets/action in the same file. Since this PR already touches release.yml, consider adding hash pins to these two actions for consistency and to reduce supply-chain risk.
Extended reasoning...
Supply-Chain Risk: Inconsistent Action Pinning in release.yml
What the bug is: The release workflow uses a mix of pinning strategies. pnpm/action-setup is referenced as @fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 and changesets/action as @6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1 — both locked to immutable commit SHAs. However, actions/checkout and actions/setup-node use only @v6, a mutable major-version tag that can be silently updated.
The specific code path: Lines 16 and 22 of .github/workflows/release.yml reference actions/checkout@v6 and actions/setup-node@v6 respectively. These tags point to whatever commit the action maintainer pushes to that tag at any given time.
Why existing code does not prevent it: GitHub Actions resolves mutable tags at workflow execution time. There is no mechanism in the workflow itself that validates the integrity of the action code being executed. A compromised or malicious tag update would silently execute attacker-controlled code in the runner.
Impact: This workflow runs on pushes to main, has contents: write and pull-requests: write permissions, and has access to NPM_TOKEN and GITHUB_TOKEN. An attacker who hijacks the actions/checkout@v6 or actions/setup-node@v6 tag could exfiltrate NPM_TOKEN and publish malicious packages to npm under the @modelcontextprotocol namespace. While actions/checkout and actions/setup-node are GitHub-maintained (lower third-party risk), the supply-chain threat model for any mutable reference remains real.
Step-by-step proof of the inconsistency:
pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320— immutable SHA, attacker cannot change what code runschangesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf— immutable SHA, same protectionactions/checkout@v6— mutable tag; if the tag is force-pushed to a malicious commit, the workflow runs that code next timeactions/setup-node@v6— same issue- The workflow then proceeds to call
pnpm run release:publish, which builds all packages and runspnpm changeset publishwithNPM_TOKENin the environment — secrets are exposed to any code running in the job
How to fix: Look up the current commit SHA for actions/checkout@v6 and actions/setup-node@v6 (e.g., via gh api repos/actions/checkout/git/ref/tags/v6) and pin them:
- uses: actions/checkout@<SHA> # v6
- uses: actions/setup-node@<SHA> # v6This is a pre-existing issue not introduced by this PR, but since the PR already modifies this file it is a natural opportunity to add consistency.
1 participant
Motivation and Context
How Has This Been Tested?
Breaking Changes
Types of changes
Checklist
Additional context