mirror of
https://github.com/makenotion/notion-mcp-server.git
synced 2026-07-30 08:37:17 -04:00
d282ce9c16
Publishing was fully manual (no release workflow), which risks shipping a stale bundle and relies on a personal npm token. Mirror the notion-sdk-js setup: - publish.yml: on push to main (and manual dispatch), build + test, then `npm publish --provenance` via OIDC trusted publishing (no NPM_TOKEN), skipping if the version already exists, and push a vX.Y.Z tag for "Bump version to" commits. - increment-version.yml: manual workflow to bump the version and open a "Bump version to vX.Y.Z" PR. - RELEASING.md: documents the flow and the one-time npm-side trusted publisher setup that must be configured before the first automated publish. Workflow inputs/commit-message values are passed via env vars, never interpolated into run: shells. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.7 KiB
1.7 KiB
Releasing
@notionhq/notion-mcp-server is published to npm via GitHub Actions using npm
OIDC trusted publishing (no long-lived npm token in CI), with build
provenance attestation. This mirrors the setup used by notion-sdk-js.
One-time setup (required before the first automated publish)
OIDC trusted publishing must be enabled on the npm side, or the publish step will fail with an auth error:
- On npmjs.com, open the package settings for @notionhq/notion-mcp-server → Trusted Publishers (org admin required).
- Add a GitHub Actions trusted publisher:
- Repository:
makenotion/notion-mcp-server - Workflow filename:
publish.yml - Environment: (leave blank)
- Repository:
- Confirm the npm org's 2FA/publishing policy allows automation/OIDC publishes.
No NPM_TOKEN secret is needed once this is configured.
Cutting a release
- Bump the version. Run the Increment Version workflow
(Actions → Increment Version → Run workflow) and pick
patch/minor/major. It opens aBump version to vX.Y.ZPR. (Or bumppackage.jsonmanually in a PR with a commit message startingBump version to.) - Merge the bump PR to
main. - The Publish Package workflow runs on push to
main: it builds, tests,npm publish --provenance(skipping if that version already exists), and pushes avX.Y.Zgit tag.
That's it — the published artifact is the bundled CLI (bin/cli.mjs), rebuilt
in CI so it can never go stale relative to source.
Manual publish (fallback)
Only if the workflow is unavailable. Requires npm publish rights:
npm ci
npm run build # regenerates bin/cli.mjs — do NOT skip
npm test
npm publish --access public