Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

release skill: document the v1 release procedure, and the advisory-fork merge constraints

Aperta
  • Qualcosa non va?
#2,755 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
54/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, typescript
Ambito
devops, documentation, release, security

Direzione di ricerca

Start with .claude/skills/release/SKILL.md, especially “The v1 line,” and inspect the prior v1 releases and workflow referenced in the issue to confirm the steps and constraints. Update the release procedure and record the advisory-fork merge constraints in the appropriate skill. Run npm run verify:skills and the listing budget check; done means both pass and the skill retains disable-model-invocation: true.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

documentation v2

Problem

The release skill (.claude/skills/release/SKILL.md) is a v2 procedure. Its "The v1 line" section is four sentences saying v1 ships flat from v1/main to v1-latest, with no steps. Cutting 1.0.3 (#2753) meant reconstructing the procedure from the earlier releases and the v1 workflow, and the first attempt got two details wrong:

  • The tag is bare (1.0.3), like 1.0.0–1.0.2, not v1.0.3. The v1 release tags ruleset protects refs/tags/1.*.
  • The release must not be marked Latest. Every v1 release has latest=false; checking it would take the Latest badge from v2.

Proposed change

Expand "The v1 line" in the release skill into a real procedure:

  1. Bump: a PR against v1/main (labels v1 + chore, linked to a v1 release issue on board #11, no milestone). Edit the four package.json versions, the three @modelcontextprotocol/inspector-* ranges in the root package.json, and the 8 matching package-lock.json fields directly. Don't use npm run update-version: its trailing bare npm install re-resolves the whole tree (see #2080). npm run check-version must pass and npm ci must leave the lockfile untouched.
  2. Merge order: the bump merges last, after the fixes it ships.
  3. Release: gh release create <x.y.z> --target v1/main --title <x.y.z> --latest=false.
  4. What CI does: the release event runs build, then publish (OIDC trusted publishing, npm run publish-all → --tag v1-latest), plus publish-github-container-registry.
  5. Verify: npm view @modelcontextprotocol/inspector dist-tags shows v1-latest at the new version, and latest is still on v2.
  6. Release notes when the fixes are unpublished security advisories: keep the notes neutral at release time, then edit the release to link the advisories once they are published.

Also worth recording in the skill or in security-advisory, both learned on this release:

  • Advisory-fork PRs cannot satisfy required Actions checks. Private forks don't run Actions, so v2/main's required DCO check and v1/main's required build check stay "Expected" forever, and the advisory page offers no bypass. The workable path was to remove only the required_status_checks rule from the ruleset while merging, then restore it from a snapshot.
  • Merging an advisory merges all of its fork's PRs at once. An advisory with one PR per line (e.g. v2 + v1) lands both together, which interacts with any planned cross-advisory merge order.
  • Use "Create a merge commit" when several fix branches have been chained on top of each other. Squash or rebase breaks the chain.

Keep the release skill disable-model-invocation: true, and re-run npm run verify:skills and the listing budget check after editing.

Lingua principale
TypeScript
Stelle
11.1k
Fork
1.6k
Merge medio
5h 29m
PR unite (30g)
158

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di modelcontextprotocol/inspector

Tutte le issue di modelcontextprotocol/inspector

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.