Skip to content

Commit d282ce9

Browse files
ksinderclaude
ksinder
and
claude
authored
Set up npm trusted publishing (OIDC) release workflows (#318)
Publishing was fully manual (no release workflow), which risks shipping a stale bundle and relies on a personal npm token. Mirror the notion-sdk-js setup: - publish.yml: on push to main (and manual dispatch), build + test, then `npm publish --provenance` via OIDC trusted publishing (no NPM_TOKEN), skipping if the version already exists, and push a vX.Y.Z tag for "Bump version to" commits. - increment-version.yml: manual workflow to bump the version and open a "Bump version to vX.Y.Z" PR. - RELEASING.md: documents the flow and the one-time npm-side trusted publisher setup that must be configured before the first automated publish. Workflow inputs/commit-message values are passed via env vars, never interpolated into run: shells. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent 604eef9 commit d282ce9

3 files changed

Lines changed: 175 additions & 0 deletions

File tree

‎.github/workflows/increment-version.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Increment Version
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version_type:
7+
description: "Version type to increment"
8+
required: true
9+
type: choice
10+
options:
11+
- patch
12+
- minor
13+
- major
14+
- premajor
15+
16+
permissions: {}
17+
18+
jobs:
19+
increment-version:
20+
runs-on: ubuntu-latest
21+
22+
permissions:
23+
contents: write
24+
pull-requests: write
25+
steps:
26+
# v4.2.2
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
28+
with:
29+
token: ${{ secrets.GITHUB_TOKEN }}
30+
31+
# v4.1.0
32+
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
33+
with:
34+
node-version: "22"
35+
registry-url: "https://registry.npmjs.org"
36+
37+
- name: Configure Git
38+
run: |
39+
git config --global user.name "github-actions[bot]"
40+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
41+
42+
- name: Bump version
43+
run: |
44+
npm version "${VERSION_TYPE}" --no-git-tag-version
45+
NEW_VERSION=$(node -p "require('./package.json').version")
46+
echo "NEW_VERSION=$NEW_VERSION" >> "$GITHUB_ENV"
47+
env:
48+
VERSION_TYPE: ${{ github.event.inputs.version_type }}
49+
50+
- name: Update package-lock.json
51+
run: npm install --package-lock-only
52+
53+
- name: Create branch and commit changes
54+
run: |
55+
BRANCH_NAME="version-bump-v${NEW_VERSION}"
56+
git checkout -b "$BRANCH_NAME"
57+
git add package.json package-lock.json
58+
git commit -m "Bump version to v${NEW_VERSION}"
59+
git push origin "$BRANCH_NAME"
60+
echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
61+
62+
- name: Create pull request
63+
env:
64+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
65+
run: |
66+
gh pr create \
67+
--title "Bump version to v${NEW_VERSION}" \
68+
--body "Automated version bump to v${NEW_VERSION}. Merging to main publishes the package via the Publish workflow." \
69+
--base main \
70+
--head "${BRANCH_NAME}" \
71+
--assignee "${GITHUB_ACTOR}"

‎.github/workflows/publish.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Publish Package
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
workflow_dispatch: {}
8+
9+
permissions: {}
10+
11+
jobs:
12+
publish:
13+
runs-on: ubuntu-latest
14+
15+
permissions:
16+
id-token: write # Required for OIDC trusted publishing / npm provenance
17+
contents: write # Required to create and push tags
18+
19+
steps:
20+
# v4.2.2
21+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
22+
23+
# v4.1.0
24+
- uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
25+
with:
26+
node-version: "22"
27+
registry-url: "https://registry.npmjs.org"
28+
29+
- name: Update npm
30+
# npm >= 11.5.1 is required for OIDC trusted publishing
31+
run: npm install -g npm@11.11.1
32+
33+
- run: npm ci
34+
- run: npm run build
35+
- run: npm test
36+
37+
- name: Publish to npm
38+
run: |
39+
PACKAGE_NAME=$(jq -r '.name' package.json)
40+
PACKAGE_VERSION=$(jq -r '.version' package.json)
41+
if npm view "$PACKAGE_NAME" versions | grep -q "\"$PACKAGE_VERSION\""; then
42+
echo "$PACKAGE_NAME@$PACKAGE_VERSION already exists on npm. Skipping publish."
43+
else
44+
echo "Publishing $PACKAGE_NAME@$PACKAGE_VERSION..."
45+
npm publish --ignore-scripts --provenance --access public
46+
fi
47+
48+
- name: Create and push tag
49+
if: github.event_name == 'push' && contains(github.event.head_commit.message, 'Bump version to')
50+
run: |
51+
git config --global user.name "github-actions[bot]"
52+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
53+
VERSION=$(jq -r '.version' package.json)
54+
if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
55+
echo "Tag v${VERSION} already exists. Skipping."
56+
else
57+
git tag -a "v${VERSION}" -m "v${VERSION}"
58+
git push origin "v${VERSION}"
59+
fi

‎RELEASING.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Releasing
2+
3+
`@notionhq/notion-mcp-server` is published to npm via GitHub Actions using npm
4+
**OIDC trusted publishing** (no long-lived npm token in CI), with build
5+
provenance attestation. This mirrors the setup used by `notion-sdk-js`.
6+
7+
## One-time setup (required before the first automated publish)
8+
9+
OIDC trusted publishing must be enabled on the npm side, or the publish step
10+
will fail with an auth error:
11+
12+
1. On npmjs.com, open the package settings for **@notionhq/notion-mcp-server**
13+
→ **Trusted Publishers** (org admin required).
14+
2. Add a GitHub Actions trusted publisher:
15+
- Repository: `makenotion/notion-mcp-server`
16+
- Workflow filename: `publish.yml`
17+
- Environment: _(leave blank)_
18+
3. Confirm the npm org's 2FA/publishing policy allows automation/OIDC publishes.
19+
20+
No `NPM_TOKEN` secret is needed once this is configured.
21+
22+
## Cutting a release
23+
24+
1. **Bump the version.** Run the **Increment Version** workflow
25+
(Actions → Increment Version → Run workflow) and pick `patch` / `minor` /
26+
`major`. It opens a `Bump version to vX.Y.Z` PR. (Or bump `package.json`
27+
manually in a PR with a commit message starting `Bump version to`.)
28+
2. **Merge the bump PR to `main`.**
29+
3. The **Publish Package** workflow runs on push to `main`: it builds, tests,
30+
`npm publish --provenance` (skipping if that version already exists), and
31+
pushes a `vX.Y.Z` git tag.
32+
33+
That's it — the published artifact is the bundled CLI (`bin/cli.mjs`), rebuilt
34+
in CI so it can never go stale relative to source.
35+
36+
## Manual publish (fallback)
37+
38+
Only if the workflow is unavailable. Requires npm publish rights:
39+
40+
```bash
41+
npm ci
42+
npm run build # regenerates bin/cli.mjs — do NOT skip
43+
npm test
44+
npm publish --access public
45+
```

0 commit comments

Comments
 (0)