Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

release skill: document the v1 release procedure, and the advisory-fork merge constraints

Abierto
  • ¿Algo no está bien?
#2,755 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
54/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
github-actions, typescript
Área
devops, documentation, release, security

Línea de trabajo

Start with .claude/skills/release/SKILL.md, especially “The v1 line,” and inspect the prior v1 releases and workflow referenced in the issue to confirm the steps and constraints. Update the release procedure and record the advisory-fork merge constraints in the appropriate skill. Run npm run verify:skills and the listing budget check; done means both pass and the skill retains disable-model-invocation: true.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

documentation v2

Problem

The release skill (.claude/skills/release/SKILL.md) is a v2 procedure. Its "The v1 line" section is four sentences saying v1 ships flat from v1/main to v1-latest, with no steps. Cutting 1.0.3 (#2753) meant reconstructing the procedure from the earlier releases and the v1 workflow, and the first attempt got two details wrong:

  • The tag is bare (1.0.3), like 1.0.0–1.0.2, not v1.0.3. The v1 release tags ruleset protects refs/tags/1.*.
  • The release must not be marked Latest. Every v1 release has latest=false; checking it would take the Latest badge from v2.

Proposed change

Expand "The v1 line" in the release skill into a real procedure:

  1. Bump: a PR against v1/main (labels v1 + chore, linked to a v1 release issue on board #11, no milestone). Edit the four package.json versions, the three @modelcontextprotocol/inspector-* ranges in the root package.json, and the 8 matching package-lock.json fields directly. Don't use npm run update-version: its trailing bare npm install re-resolves the whole tree (see #2080). npm run check-version must pass and npm ci must leave the lockfile untouched.
  2. Merge order: the bump merges last, after the fixes it ships.
  3. Release: gh release create <x.y.z> --target v1/main --title <x.y.z> --latest=false.
  4. What CI does: the release event runs build, then publish (OIDC trusted publishing, npm run publish-all → --tag v1-latest), plus publish-github-container-registry.
  5. Verify: npm view @modelcontextprotocol/inspector dist-tags shows v1-latest at the new version, and latest is still on v2.
  6. Release notes when the fixes are unpublished security advisories: keep the notes neutral at release time, then edit the release to link the advisories once they are published.

Also worth recording in the skill or in security-advisory, both learned on this release:

  • Advisory-fork PRs cannot satisfy required Actions checks. Private forks don't run Actions, so v2/main's required DCO check and v1/main's required build check stay "Expected" forever, and the advisory page offers no bypass. The workable path was to remove only the required_status_checks rule from the ruleset while merging, then restore it from a snapshot.
  • Merging an advisory merges all of its fork's PRs at once. An advisory with one PR per line (e.g. v2 + v1) lands both together, which interacts with any planned cross-advisory merge order.
  • Use "Create a merge commit" when several fix branches have been chained on top of each other. Squash or rebase breaks the chain.

Keep the release skill disable-model-invocation: true, and re-run npm run verify:skills and the listing budget check after editing.

Lenguaje dominante
TypeScript
Estrellas
11.1k
Forks
1.6k
Merge medio
5 h 29 min
PR fusionados (30 d)
158

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de modelcontextprotocol/inspector

Todos los issues de modelcontextprotocol/inspector

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.