From 8a17700c604704e0ab177fdfb0e3473a3e1dbdd8 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Fri, 17 Jul 2026 13:22:05 -0700 Subject: [PATCH 1/2] fix(release): scope publish-mcp.yml's validation gate to the MCP package publish-engine.yml/publish-miner.yml/publish-ui-kit.yml already validate only their own package (a workspace test run + pack/smoke-test); publish-mcp.yml was the outlier, running the entire npm run test:ci (every workspace, every drift-check, ui:lint/build, migrations) as its gate. This coupled an MCP release to the health of the whole monorepo -- confirmed live when an unrelated packages/loopover-miner env-reference doc going stale blocked MCP's publish outright, despite MCP's own package code being completely unaffected and despite main's required CI already covering whole-repo health on every PR merge (including release-please's own release PRs). Scoped down to match its siblings: MCP's own syntax check (build:mcp) plus its own CLI test suite specifically -- npx vitest run mcp-cli-, i.e. test/unit/mcp-cli-*.test.ts (confirmed via import analysis: these import packages/loopover-mcp/package.json and spawn the built binary), not the sibling test/unit/mcp-*.test.ts files that exercise the Worker's separate remote MCP server (src/mcp/server.ts, a different deployable). Also added the "verify release commit is on main" safety check every other publish workflow already has, which publish-mcp.yml was missing in both its validate and publish jobs. --- .github/workflows/publish-mcp.yml | 52 ++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml index 023d40dd9b..75937af7d7 100644 --- a/.github/workflows/publish-mcp.yml +++ b/.github/workflows/publish-mcp.yml @@ -21,7 +21,7 @@ concurrency: cancel-in-progress: false jobs: - # Unprivileged: resolves the version, runs the full test gate, and packs the tarball -- all with + # Unprivileged: resolves the version, runs the MCP package's own build/test/pack, all with # contents: read only. npm ci here executes dependency lifecycle scripts; keeping that in a job # with no write/id-token permission means a compromised build dependency has nothing to abuse # (Superagent P2 / mirrors metagraphed's publish-client.yml "validate" job, codex #251). @@ -40,6 +40,17 @@ jobs: fetch-depth: 0 persist-credentials: false + - name: Verify release commit is on main + env: + RELEASE_SHA: ${{ github.sha }} + run: | + set -euo pipefail + git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + if ! git merge-base --is-ancestor "$RELEASE_SHA" refs/remotes/origin/main; then + echo "::error::MCP package releases must be cut from a commit reachable from main." + exit 1 + fi + - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: @@ -77,16 +88,30 @@ jobs: - name: Install dependencies run: npm ci - # packages/loopover-mcp's own test suite pulls in src/mcp/find-opportunities.ts transitively - # (via packages/loopover-miner/lib/opportunity-fanout.js), which imports @loopover/engine. - # That package's dist/ is gitignored (see ci.yml's own build --workspace @loopover/engine - # step for the same reason) -- without building it first, the MCP release validation gate below - # fails with "Failed to resolve entry for package @loopover/engine" on every run. + # packages/loopover-mcp's CLI test suite (test/unit/mcp-cli-*.test.ts) spawns the real binary, + # which imports @loopover/engine. That package's dist/ is gitignored (see ci.yml's own + # build --workspace @loopover/engine step for the same reason) -- without building it first, + # the CLI test suite below fails with "Failed to resolve entry for package @loopover/engine". - name: Build loopover-engine run: npm run build --workspace @loopover/engine - - name: MCP release validation gate - run: npm run test:release:mcp + # engine/miner/ui-kit's own publish workflows only validate their OWN package (a workspace + # test run + pack/smoke-test) -- mcp previously ran the full npm run test:ci (every workspace, + # every drift-check, ui:lint/build, migrations, etc.), coupling an MCP release to the health of + # the entire monorepo. Confirmed harmful live: an unrelated packages/loopover-miner env-reference + # doc going stale blocked MCP's publish outright, even though MCP's own package code was + # completely unaffected -- and main's required CI already re-verifies whole-repo health on + # every PR, including release-please's own, so re-running all of it here is redundant with what + # already gated the merge. Scoped down to match its siblings instead: MCP's own syntax check + # (node --check, same as build:mcp) plus its own CLI test suite -- test/unit/mcp-cli-*.test.ts + # specifically (imports packages/loopover-mcp and spawns the built binary), NOT the sibling + # test/unit/mcp-*.test.ts files that exercise the Worker's separate remote MCP server + # (src/mcp/server.ts, a different deployable entirely). + - name: MCP package syntax validation + run: npm run build:mcp + + - name: MCP CLI test suite + run: npx vitest run mcp-cli- # Build + pack happen in THIS unprivileged job (no id-token). The privileged publish job below # never runs npm install/build, so a compromised build dependency can't reach the OIDC token. @@ -138,6 +163,17 @@ jobs: fetch-depth: 0 persist-credentials: false + - name: Verify release commit is on main + env: + RELEASE_SHA: ${{ github.sha }} + run: | + set -euo pipefail + git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main + if ! git merge-base --is-ancestor "$RELEASE_SHA" refs/remotes/origin/main; then + echo "::error::MCP package releases must be cut from a commit reachable from main." + exit 1 + fi + - name: Setup Node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: From 541eab359ff87a2b8f4bbcfb50967662742ae98d Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Fri, 17 Jul 2026 13:28:47 -0700 Subject: [PATCH 2/2] chore(release): cut mcp v3.1.1 and miner v3.1.1 mcp-v3.1.0 and miner-v3.1.0 are tagged and merged but stuck: GitHub's tag-protection ruleset rejects moving them to include the release pipeline fixes (#7054, #7060, #7064), and workflow_dispatch resolves a run's YAML from the ref it's dispatched against, so re-running those exact tags would still use the pre-fix workflow definitions. Bumping to fresh, never-tagged versions is the documented human-override path (publish-mcp.yml's own on: comment) around this exact situation. mcp v3.1.1 picks up one real fix that landed after v3.1.0's cut (#6990/#7052). miner v3.1.1 picks up two (bdb11d9, 77ca20f). --- package-lock.json | 4 ++-- packages/loopover-mcp/CHANGELOG.md | 5 +++++ packages/loopover-mcp/package.json | 2 +- packages/loopover-miner/CHANGELOG.md | 12 ++++++++++++ packages/loopover-miner/package.json | 2 +- 5 files changed, 21 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index ecf3688d8a..735f688610 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20749,7 +20749,7 @@ }, "packages/loopover-mcp": { "name": "@loopover/mcp", - "version": "3.1.0", + "version": "3.1.1", "license": "AGPL-3.0-only", "dependencies": { "@loopover/engine": "^3.2.0", @@ -20766,7 +20766,7 @@ }, "packages/loopover-miner": { "name": "@loopover/miner", - "version": "3.1.0", + "version": "3.1.1", "license": "AGPL-3.0-only", "dependencies": { "@loopover/engine": "^3.2.0", diff --git a/packages/loopover-mcp/CHANGELOG.md b/packages/loopover-mcp/CHANGELOG.md index 0ccca8412b..277cdb1732 100644 --- a/packages/loopover-mcp/CHANGELOG.md +++ b/packages/loopover-mcp/CHANGELOG.md @@ -1,5 +1,10 @@ # Changelog +## mcp-v3.1.1 - 2026-07-17 + +### Fixes +- Blunt slop-risk / issue-slop REST + CLI to match the MCP tools (#6990) (#7052) + ## [3.1.0](https://github.com/JSONbored/loopover/compare/mcp-v3.0.0...mcp-v3.1.0) (2026-07-17) diff --git a/packages/loopover-mcp/package.json b/packages/loopover-mcp/package.json index 16403262f3..46d85a3a58 100644 --- a/packages/loopover-mcp/package.json +++ b/packages/loopover-mcp/package.json @@ -1,6 +1,6 @@ { "name": "@loopover/mcp", - "version": "3.1.0", + "version": "3.1.1", "license": "AGPL-3.0-only", "type": "module", "description": "Local stdio MCP wrapper for the LoopOver Gittensor base-agent.", diff --git a/packages/loopover-miner/CHANGELOG.md b/packages/loopover-miner/CHANGELOG.md index c93119e39f..cd5a4a0c2b 100644 --- a/packages/loopover-miner/CHANGELOG.md +++ b/packages/loopover-miner/CHANGELOG.md @@ -1,5 +1,17 @@ # Changelog +## [3.1.1](https://github.com/JSONbored/loopover/compare/miner-v3.1.0...miner-v3.1.1) (2026-07-17) + + +### Fixes + +* **miner:** bound oauth-device-flow.js's GitHub fetches with a request timeout ([77ca20f](https://github.com/JSONbored/loopover/commit/77ca20fdcc30d05137b41a5848bce156110c238a)) +* **miner:** fail closed when a chat-action handler throws ([bdb11d9](https://github.com/JSONbored/loopover/commit/bdb11d974d961594b4555582bd2b7c811b8cde16)) + +### Chores + +- Re-cut release: miner-v3.1.0's release PR merged but the tag/publish never completed (release-please's own trigger only ran on a 2-day cron, and npm's Trusted Publisher config pointed at the pre-rebrand repo identity). + ## [3.1.0](https://github.com/JSONbored/loopover/compare/miner-v3.0.0...miner-v3.1.0) (2026-07-17) diff --git a/packages/loopover-miner/package.json b/packages/loopover-miner/package.json index f939c094fd..5ba1712f27 100644 --- a/packages/loopover-miner/package.json +++ b/packages/loopover-miner/package.json @@ -1,6 +1,6 @@ { "name": "@loopover/miner", - "version": "3.1.0", + "version": "3.1.1", "license": "AGPL-3.0-only", "type": "module", "description": "Foundation CLI for the local LoopOver miner runtime.",