ci: publish to the official MCP Registry on release by johnxie · Pull Request #39 · taskade/mcp

johnxie · 2026-06-05T11:04:47Z

What & why

The Taskade server is not yet in the official MCP Registry (verified: registry.modelcontextprotocol.io/v0/servers?search=taskade → 0 results). The registry is the upstream source most aggregators (Glama, MCPfinder, …) ingest, so listing once propagates discovery ecosystem-wide.

This wires packages/server/server.json to publish automatically on release via the mcp-publisher CLI using GitHub Actions OIDC (no stored secrets). The assets are already in place — server.json (io.github.taskade/mcp-server) + package.json mcpName are the registry ownership handshake.

Changes

release.yml: add job permissions (id-token: write for OIDC) + a Publish to MCP Registry step gated on the same hasChangesets == 'false' condition as the npm publish.

Zero-regression

Purely additive CI step; the existing changesets + npm publish path is untouched.
Step only runs on release (never on PRs). Binary is downloaded at runtime, not added to deps.
mcp-publisher_linux_amd64.tar.gz asset + login github-oidc confirmed against registry release v1.7.9.

⚠️ One-time manual step (maintainer)

Before the first automated run, a maintainer with org access must seed the namespace once:

cd packages/server
mcp-publisher login github   # browser OAuth → grants io.github.taskade/* namespace
mcp-publisher publish

Depends on

fix: sync version to 0.0.3 and correct root license to MIT #38 (version sync) should merge first so the published registry version matches npm.

Adds a github-oidc mcp-publisher step to release.yml that publishes packages/server/server.json to registry.modelcontextprotocol.io whenever an npm release happens (same gate as the existing npm publish). Uses GitHub Actions OIDC — no stored secrets. server.json + package.json mcpName (io.github.taskade/mcp-server) are already the ownership handshake. Requires a one-time manual namespace seed by a maintainer before the first automated run: mcp-publisher login github && mcp-publisher publish.

changeset-bot · 2026-06-05T11:04:52Z

⚠️ No Changeset found

Latest commit: b759288

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copilot

Pull request overview

This PR updates the release workflow to automatically publish the MCP server manifest (packages/server/server.json) to the official MCP Registry during the release pipeline, using GitHub Actions OIDC (no stored registry secrets).

Changes:

Adds explicit job-level permissions, including id-token: write, to enable GitHub OIDC login.
Adds a new “Publish to MCP Registry” step gated on the same hasChangesets == 'false' condition as the npm publish step.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish


+        if: steps.changesets.outputs.hasChangesets == 'false'
+        working-directory: packages/server
+        run: |
+          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" | tar xz mcp-publisher


Addresses Copilot review on the registry-publish step: - Pin mcp-publisher to v1.7.9 (reproducible, reviewable releases) instead of 'latest' (supply-chain hygiene). - Use 'tar -xz -f -' to explicitly read the archive from stdin (portable on GNU tar / Ubuntu runners) and 'curl -fsSL' to fail on HTTP errors.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

+        run: |
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" | tar -xz -f - mcp-publisher
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish


+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" | tar -xz -f - mcp-publisher
+          ./mcp-publisher login github-oidc
+          ./mcp-publisher publish


+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write # required for mcp-publisher GitHub OIDC login


Addresses Copilot review: without pipefail a transient curl failure could be masked in the curl|tar pipeline. Fail fast on any error in the run block. (Deferred as acceptable: pinned version already mitigates the supply-chain risk; full sigstore verification and per-step OIDC scoping would require a separate job and are noted for follow-up.)

johnxie · 2026-06-05T11:54:58Z

✅ Validated → fixed → ⚠️ re-review requested (not auto-merging)

Copilot finding	Verdict	Action
`tar xz` without `-f -` may fail on GNU tar (Ubuntu)	VALID	`tar -xz -f -` + `curl -fsSL`.
`releases/latest` is non-reproducible / supply-chain risk	VALID	Pinned `MCP_PUBLISHER_VERSION=v1.7.9` (URL verified resolves).
`curl \| tar` can mask a failed download (no pipefail)	VALID	Added `set -euo pipefail`.
No checksum/signature verification of the downloaded binary	valid, deferred	Pinned version mitigates; full sigstore verify is heavier — follow-up.
`id-token: write` granted to the whole job	valid, standard	GH `permissions` are job/workflow-scoped, not per-step; isolating needs a separate job — follow-up.

QA: release.yml valid YAML; pinned asset URL resolves (HTTP 302 → asset).

Why not auto-merged: this step publishes to the official MCP Registry on the next release via mcp-publisher login github-oidc. That depends on registry-side GitHub-OIDC trust for the io.github.taskade namespace, which I can't verify from here. To avoid a red release pipeline, a maintainer should confirm/seed it (mcp-publisher login github && mcp-publisher publish) before merge. Confidence to auto-merge: low → re-review requested.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

+          set -euo pipefail
+          curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" | tar -xz -f - mcp-publisher
+          ./mcp-publisher login github-oidc


johnxie · 2026-06-09T19:25:37Z

Superseded by #36 — closing

#36 landed the same capability with a strictly better architecture, addressing this PR's open Copilot concerns by construction:

separate workflow → id-token: write no longer granted to the npm-release job (the exact OIDC-scoping concern raised here)
registry publish failure cannot red the release pipeline (my original reason for holding this PR)
workflow_dispatch gives the manual seed/test path without merging risk
server.json version auto-sync prevents the drift class permanently
same supply-chain hardening (pinned v1.7.9, pipefail, tar -f -) applied there

First publish will be verified via manual dispatch after release PR #49 lands.

johnxie requested a review from Copilot June 5, 2026 11:04

Copilot started reviewing on behalf of johnxie June 5, 2026 11:05 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

johnxie mentioned this pull request Jun 5, 2026

docs: one-click Add to Cursor / Install in VS Code badges #42

Merged

johnxie requested a review from Copilot June 5, 2026 11:31

Copilot started reviewing on behalf of johnxie June 5, 2026 11:32 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

johnxie requested a review from Copilot June 5, 2026 11:54

Copilot started reviewing on behalf of johnxie June 5, 2026 11:55 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

Comment on lines +60 to +62

set -euo pipefail

curl -fsSL "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz" | tar -xz -f - mcp-publisher

./mcp-publisher login github-oidc

johnxie mentioned this pull request Jun 9, 2026

ci(mcp-registry): auto-publish to the official MCP Registry via GitHub OIDC #36

Merged

johnxie closed this Jun 9, 2026

johnxie deleted the feat/mcp-registry-publish branch June 9, 2026 19:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: publish to the official MCP Registry on release#39

ci: publish to the official MCP Registry on release#39
johnxie wants to merge 3 commits into
mainfrom
feat/mcp-registry-publish

johnxie commented Jun 5, 2026

Uh oh!

changeset-bot Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

johnxie commented Jun 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

johnxie commented Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

johnxie commented Jun 5, 2026

What & why

Changes

Zero-regression

⚠️ One-time manual step (maintainer)

Depends on

Uh oh!

changeset-bot Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

johnxie commented Jun 5, 2026

✅ Validated → fixed → ⚠️ re-review requested (not auto-merging)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

johnxie commented Jun 9, 2026

Superseded by #36 — closing

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Jun 5, 2026 •

edited

Loading