Make repo public + tag v1.0.0 to unblock plugin distribution

未关闭
  • 哪里不对？
#48 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
功能
描述清晰度
描述清楚
活跃度
冷清
技术栈
node.js, typescript
领域
build-system, devops, release, security

调研方向

先从 package.json 和 README 中的安装片段开始，然后运行列出的历史记录和 secret-scanning 检查。使用 npx 在一台全新的机器上验证该 package，并在创建 v1.0.0 之前检查 release checklist。完成的标准是 repository 公开、tag 包含可正常工作的 dist 输出，并且外部安装成功。

由索引模型根据 Issue 内容生成。

描述

enhancement

Make repo public + tag v1.0.0 to unblock plugin distribution

Why

Azure/documentdb-agent-kit ships plugin configs for Claude / Codex / Cursor / Gemini / Copilot / VS Code that point at an npm package (documentdb-mcp-server) that was unpublished on 2025-04-17. Every plugin install is broken today.

The fastest unblock is to publish this MCP server's source as a public repo and have the plugins fetch via npx github:microsoft/documentdb-mcp#v1.0.0. A polished npm package (v2) ships later — see #TBD.

Pre-flight hygiene (do before flipping visibility)

The repo currently passes secret-scanning with push protection enabled, but a public flip will trigger Snyk and other external scanners. Run through these once:

  • Git history sweep for credentials in past commits: 
    git log -p --all | rg -i 'password|token|connection|secret|api[_-]?key' | head -200
    If anything legitimate-looking turns up, rewrite history (git filter-repo) before going public.
  • gh secret-scanning alerts list -R microsoft/documentdb-mcp — confirm zero open alerts.
  • README install snippets all reference github:microsoft/documentdb-mcp consistently (the VS Code / Cursor install badges already do; double-check the manual-install and Docker sections).
  • package.json audit:
    • name, version, description, license, repository, homepage are correct
    • bin field points at the right entry script (so npx knows what to run)
    • files field whitelists everything npx needs (compiled output + manifests)
    • prepare or prepack script builds TS so npx can compile on first install
  • Compiled-output strategy decision: ship dist/ in the GitHub repo, OR rely on a prepare script. npx github:... does run prepare, but it adds 30–60s to cold start. Recommend: commit dist/ to the v1.0.0 tag specifically, even if it's .gitignored on main, so the public spec installs fast.
  • LICENSE present (MIT or whatever Microsoft OSPO requires).
  • SECURITY.md present per Microsoft OSPO requirements for public repos.
  • CODE_OF_CONDUCT.md + SUPPORT.md per Microsoft OSPO.
  • OSPO clearance: confirm the repo has been through Microsoft Open Source Programs Office release review.

Flip + tag

  • Set visibility → Public (Settings → Danger Zone)
  • Verify external npx -y github:microsoft/documentdb-mcp works from a fresh machine with no GitHub auth
  • Create release tag v1.0.0 on the commit that has the validated dist/
  • Update README to reference the tag explicitly in install snippets

Post-flip validation

  • Trigger a Snyk re-scan and confirm no new High/Critical findings
  • Confirm secret-scanning, Dependabot, and CodeQL are all enabled on the now-public repo
  • Hand off to Azure/documentdb-agent-kit#TBD to swap the plugin configs

Done when

  • Repo is public
  • v1.0.0 tag exists with a working dist/
  • Fresh npx -y github:microsoft/documentdb-mcp#v1.0.0 succeeds on a machine outside the Microsoft network
  • Agent-kit unblock issue is unblocked
主要语言
TypeScript
星标
3
派生
4
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/documentdb-mcp 的其他 Issue

查看 microsoft/documentdb-mcp 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。