Skip to content

ci: enable trusted publishing for MCP and CLI #779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aymericr merged 1 commit into from
Sep 8, 2026
+9 −4
Merged

ci: enable trusted publishing for MCP and CLI #779

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ jobs:
environment: npm
permissions:
contents: write
id-token: write
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -83,6 +84,14 @@ jobs:
node-version: 22
registry-url: "https://registry.npmjs.org"

- name: Enable npm trusted publishing
run: |
npm install --global npm@11.19.1
node --version
npm --version
test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}"
test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}"

- name: Install dependencies
run: bun install --frozen-lockfile

Expand Down Expand Up @@ -312,8 +321,6 @@ jobs:
- name: Build & publish mcp
if: inputs.package == 'mcp' || inputs.package == 'all'
working-directory: packages/mcp
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

@cursor cursor Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trusted publishing blocked by auth token

High Severity

Removing NODE_AUTH_TOKEN from the MCP and CLI publish steps leaves the setup-node registry-url _authToken entry in .npmrc. npm then treats classic auth as already configured and skips the OIDC exchange, so those publishes fail instead of using trusted publishing.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 4462595. Configure here.

run: |
bun run build
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand Down Expand Up @@ -347,8 +354,6 @@ jobs:

- name: Publish CLI
if: inputs.package == 'cli' || inputs.package == 'all'
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
run: |
cd packages/cli
if [ "${{ inputs.dry-run }}" = "true" ]; then
Expand Down
Loading