ci(mcp-registry): auto-publish to the official MCP Registry via GitHub OIDC by johnxie · Pull Request #36 · taskade/mcp

johnxie · 2026-06-05T00:09:33Z

"Set once, never touch again" — registers io.github.taskade/mcp-server in the official MCP Registry automatically, with no secrets (GitHub OIDC).

Why

The MCP Registry is the canonical index other directories sync from (PulseMCP flips its temporary mirror to the real entry; Glama / mcp.so refresh). Today Taskade isn't in it. This makes registration automatic and self-maintaining.

How it works

Trigger: the @taskade/mcp-server@* tag that changesets pushes right after a successful npm publish (so the npm version always exists before we register it), plus workflow_dispatch for manual runs.
Auth: mcp-publisher login github-oidc — OIDC, so no PAT/secret is stored. io.github.taskade/* is authorized because the workflow runs in a repo under the taskade org.
Self-healing version: a step syncs packages/server/server.json → package.json version at publish time, so server.json can never drift out of sync with npm again (the registry rejects a version that isn't published).

Sequencing with the other PR

chore(server): bump server.json to 0.0.3 to match published npm version #35 bumps the committed server.json to 0.0.3 (fixes the repo + enables a manual publish today).
This PR keeps it in sync automatically on every future release.

To go live now (after merging both)

Click Actions → Publish to MCP Registry → Run workflow once to register the current 0.0.3. Every release after that publishes itself.

Verification

✅ permissions: id-token: write (required for OIDC), contents: read
✅ Decoupled — does not modify the existing release.yml pipeline or its permissions
✅ mcp-publisher install pinned to the official modelcontextprotocol/registry releases
✅ npm package already carries mcpName: io.github.taskade/mcp-server

Refs: official OIDC publishing guide — https://modelcontextprotocol.io/registry/quickstart

…b OIDC Adds a workflow that publishes io.github.taskade/mcp-server to registry.modelcontextprotocol.io with no secrets (GitHub OIDC). - Fires on the `@taskade/mcp-server@*` release tag (pushed by changesets after npm publish), and on manual workflow_dispatch. - Auto-syncs packages/server/server.json version from package.json at publish time, so it can never drift from the published npm version again. "Set once, never touch again": after this + the 0.0.3 server.json bump (#35), the registry entry stays current automatically on every release.

changeset-bot · 2026-06-05T00:09:37Z

⚠️ No Changeset found

Latest commit: b86213f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copilot

Pull request overview

Adds a dedicated GitHub Actions workflow to publish io.github.taskade/mcp-server to the official MCP Registry using GitHub OIDC (no stored secrets), intended to run automatically on release tags and manually via workflow dispatch.

Changes:

Introduces .github/workflows/publish-mcp-registry.yml to publish to the MCP Registry on @taskade/mcp-server@* tags or manual runs.
Adds a step intended to keep packages/server/server.json version aligned at publish time.
Downloads and installs mcp-publisher, authenticates via GitHub OIDC, then runs mcp-publisher publish.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Sync server.json version to the published npm version
+        run: |
+          node -e "const fs=require('fs');const p='packages/server/server.json';const s=JSON.parse(fs.readFileSync(p,'utf8'));const v=require('./packages/server/package.json').version;s.version=v;(s.packages||[]).forEach(k=>{k.version=v});fs.writeFileSync(p,JSON.stringify(s,null,2)+'\n');console.log('server.json synced to '+v)"
+


+      - name: Install mcp-publisher
+        run: |
+          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+          sudo mv mcp-publisher /usr/local/bin/


johnxie · 2026-06-05T00:17:25Z

cc @deanzaka @lxcid — context for review 👇

Adds a decoupled workflow (.github/workflows/publish-mcp-registry.yml) that publishes io.github.taskade/mcp-server to the official MCP Registry via GitHub OIDC — no secrets. It does not touch release.yml or its permissions.

How it behaves:

Trigger: the @taskade/mcp-server@* tag that changesets pushes right after a successful npm publish (so the npm version always exists before we register it), plus workflow_dispatch for manual runs.
Self-healing version: a step syncs packages/server/server.json → package.json version at publish time, so server.json can never drift out of sync with npm again.
Auth: mcp-publisher login github-oidc — authorized for io.github.taskade/* because the workflow runs under the taskade org.

Review notes: permissions: { id-token: write, contents: read }; mcp-publisher pinned to the official modelcontextprotocol/registry releases. After merging this + #35, click Run workflow once to register the current 0.0.3; every release after that self-publishes.

Same hardening Copilot required on the release-step variant: pinned version (reproducible, reviewable bumps), curl -fsSL, tar -xz -f -, set -euo pipefail.

johnxie · 2026-06-09T19:25:32Z

✅ Validated → hardened → merging (supersedes #39)

This design is better than #39 (registry step inside release.yml) on every axis Copilot flagged there:

Concern (from #39 review)	This PR
`id-token: write` granted to the whole release job	✅ isolated in its own workflow, `contents: read` only
registry failure would red the npm release pipeline	✅ separate workflow — npm publish can never be blocked
no manual escape hatch	✅ `workflow_dispatch` for (re)publish
server.json version drift	✅ auto-synced from `package.json` at publish time
unpinned `releases/latest` download	✅ fixed here: pinned `v1.7.9` + `curl -fsSL` + `tar -xz -f -` + `set -euo pipefail` (URL verified → 200)

QA: YAML valid; sync one-liner tested locally (server.json → 0.0.3); pinned asset resolves.

Caveat (noted, not blocking): the tag trigger assumes the release pushes @taskade/mcp-server@* tags. The current release.yml runs yarn run publish directly (not via changesets/action's publish: input), which creates tags locally but may not push them — if the tag trigger doesn't fire on the next release, the workflow_dispatch path covers it and we can add a git push --follow-tags follow-up.

Plan: merge → merge release PR #49 (npm 0.0.4) → manually dispatch this workflow → verify registry.modelcontextprotocol.io listing.

johnxie requested a review from Copilot June 5, 2026 00:12

Copilot started reviewing on behalf of johnxie June 5, 2026 00:13 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

johnxie mentioned this pull request Jun 5, 2026

chore(server): bump server.json to 0.0.3 to match published npm version #35

Closed

ci: pin mcp-publisher to v1.7.9 and harden the download

b86213f

Same hardening Copilot required on the release-step variant: pinned version (reproducible, reviewable bumps), curl -fsSL, tar -xz -f -, set -euo pipefail.

johnxie merged commit 186fdb6 into main Jun 9, 2026
1 check passed

johnxie deleted the ci/auto-publish-mcp-registry branch June 9, 2026 19:25

This was referenced Jun 9, 2026

ci: publish to the official MCP Registry on release #39

Closed

chore: release #49

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(mcp-registry): auto-publish to the official MCP Registry via GitHub OIDC#36

ci(mcp-registry): auto-publish to the official MCP Registry via GitHub OIDC#36
johnxie merged 2 commits into
mainfrom
ci/auto-publish-mcp-registry

johnxie commented Jun 5, 2026

Uh oh!

changeset-bot Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

johnxie commented Jun 5, 2026

Uh oh!

johnxie commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

johnxie commented Jun 5, 2026

Why

How it works

Sequencing with the other PR

To go live now (after merging both)

Verification

Uh oh!

changeset-bot Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

johnxie commented Jun 5, 2026

Uh oh!

johnxie commented Jun 9, 2026

✅ Validated → hardened → merging (supersedes #39)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Jun 5, 2026 •

edited

Loading