release-sync check #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release-sync check | |
| # Issue #31: confirm every first-party public surface (npm, the Official MCP | |
| # Registry, the GitHub release) is still tracking package.json#version — so a | |
| # half-landed release (e.g. npm published but the registry publish failed) can't | |
| # drift silently and make directories read us as unmaintained. | |
| # | |
| # Runs on a schedule (not on every push — a release needs a moment to propagate, | |
| # and we don't want a false red right after tagging) plus manual dispatch. | |
| # A red run = drift; open release.yml and re-run the missing leg. | |
| on: | |
| schedule: | |
| - cron: "0 7 * * *" # daily 07:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| check: | |
| name: release-sync | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Read-only check — no git ops after checkout, so don't leave the token | |
| # in .git/config. (SHA-pinning the actions is a repo-wide policy choice; | |
| # kept at @v4 to match release.yml / verify-configs.yml until that's done.) | |
| persist-credentials: false | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| # No install: the check is pure fetch (Node 18+ global fetch), no deps. | |
| - name: Check public surfaces track the release | |
| run: npm run check:release-sync | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |