fix(ci): remove the ungated publish workflow that could ship 0.2.0 over the real 0.1.8 - #66
fix(ci): remove the ungated publish workflow that could ship 0.2.0 over the real 0.1.8#66yakimoto wants to merge 1 commit into
Conversation
…er the real 0.1.8
This repo could publish over the real `@wave-av/mcp-server` with nothing but a tag — no
version bump and no edit required. `package.json` here is 0.2.0 while npm serves 0.1.8 as
`latest`, so 0.2.0 is both unpublished and higher, and `npm publish` with no `--tag` writes
to `latest` regardless of semver. One `v*` tag would have become the version every
`npm install @wave-av/mcp-server` resolves to.
What would have shipped is roughly a third of the package it replaced: 13 source files and
7 tool definitions here, against 27 files and 21 tools in the copy that matches what npm
actually serves. Consumers importing any of the other 14 tools would break on a release that
reads, from the version number alone, like a routine minor bump.
This repo is not the publisher, and that is measured rather than assumed: the published
0.1.8 carries `gitHead` e8ae9597e859ffe015590b184fedf9a0948fa5e3, which is not a valid git
object in this repository. `publish.yml` was also its only release workflow, so removing it
leaves the repo with no publish path — which is the correct state until the 21-tool copy is
deliberately reconciled here.
The workflow was ungated in every dimension: no version check, no dist-tag routing, no
environment, `--no-provenance`, and unpinned `actions/checkout@v4` / `actions/setup-node@v4`
mutable tags in a job holding publish rights.
Worth stating precisely, because it changes what this PR is: `NPM_TOKEN` does not currently
exist. It is absent from this repo, from wave-av/{sdk,adk,sdks}, and from the org-level
secret list, so `secrets.NPM_TOKEN` resolves empty and this workflow would fail at auth
rather than publish. That makes this the removal of a latent path rather than a live
incident — and a latent path that re-arms silently the moment anyone adds an NPM_TOKEN for
an unrelated reason is exactly the kind worth deleting while it is quiet.
Closes #65. Part of the publishing audit in wave-av/sdks#42.
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_46d97a92-b7dc-4825-81c8-147a6fa1dde1) |
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. 💤 Files selected but had no reviewable changes (1)
⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
1 participant
Closes #65.
Deletes
.github/workflows/publish.yml. One file, 27 lines, nothing added.What was armed
This repo could publish over the real
@wave-av/mcp-serverwith nothing but a tag — no version bump, no edit. That's the difference from the equivalent hazard in wave-av/adk#64, where the local version is behind the published one and a tag fails on duplicate-version.package.jsonherelatest0.2.0is unpublished and higher, so npm accepts it, andnpm publishwith no--tagwrites tolatestregardless of semver.What would have shipped
Roughly a third of the package it replaced:
src/toolsConsumers importing any of the other 14 tools would break on a release that reads, from the version number alone, like a routine minor bump.
This repo is not the publisher — measured, not assumed
The commit that produced the published
0.1.8does not exist in this repository.publish.ymlwas also this repo's only release workflow, so removing it leaves no publish path — which is the correct state until the 21-tool copy is deliberately reconciled here. If this repo is meant to become the publisher, that should happen on purpose, with a gate, not as a side effect of a tag.The workflow was ungated in every dimension
No version check · no dist-tag routing · no environment ·
--no-provenance· unpinnedactions/checkout@v4andactions/setup-node@v4mutable tags in a job holding publish rights.One correction to the issue, and it changes what this PR is
#65 says "
NPM_TOKENis set on this repo." It isn't — anywhere. Re-measured:So
secrets.NPM_TOKENresolves empty and this workflow would fail at auth rather than publish. That makes this the removal of a latent path, not a live incident — and it means the "revoke the credential" half of the suggested fix is already a no-op, so this PR carries no blast radius at all.A latent path that re-arms silently the moment someone adds an
NPM_TOKENfor an unrelated reason is exactly the kind worth deleting while it's quiet.CI
Cannot run. Actions are refusing every job org-wide on an account-level billing lock (
plan=free,locked=yes). There will be no check here, and an absent check is not a passing one. Nothing to verify by execution in any case — this is a pure deletion, and.github/workflows/still holds_checks.yml,foundation-gate.yml,issue-ops-triage.yml,lint.yml,public-repo-guard.yml.Part of the publishing audit in wave-av/sdks#42.
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.Note
Low Risk
Deletes a latent CI publish path only; no application code or secrets change, and no npm publish can occur from this repo until a new gated workflow is added.
Overview
Removes
.github/workflows/publish.yml, which was the repo’s only path tonpm publishonv*tag pushes. After this change, tagging alone cannot ship@wave-av/mcp-serverfrom here.That workflow had no version or dist-tag checks and would publish to
latestwith--access public --no-provenance. Withpackage.jsonat 0.2.0 while npmlatestis 0.1.8, a successful run would have promoted a much smaller tree (fewer tools) as the default install—not a routine minor bump.Other workflows (
foundation-gate,lint,public-repo-guard, etc.) are unchanged; this is a pure deletion with no runtime blast radius.Reviewed by Cursor Bugbot for commit 9659363. Configure here.
Summary by cubic
Remove the ungated npm publish workflow to prevent accidentally shipping
@wave-av/mcp-server@0.2.0tolatestover the real0.1.8(closes #65). Deleting.github/workflows/publish.ymlleaves no publish path until a gated flow is added.v*tag with no checks, dist-tags, or provenance.NPM_TOKENis set today, so this was a latent path; removing it prevents silent re-arming if a token is added later.Written for commit 9659363. Summary will update on new commits.