Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

release skill: document the v1 release procedure, and the advisory-fork merge constraints

未关闭
  • 哪里不对？
#2,755 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
54/100
Issue 类型
文档
描述清晰度
描述清楚
活跃度
活跃
技术栈
github-actions, typescript
领域
devops, documentation, release, security

调研方向

Start with .claude/skills/release/SKILL.md, especially “The v1 line,” and inspect the prior v1 releases and workflow referenced in the issue to confirm the steps and constraints. Update the release procedure and record the advisory-fork merge constraints in the appropriate skill. Run npm run verify:skills and the listing budget check; done means both pass and the skill retains disable-model-invocation: true.

由索引模型根据 Issue 内容生成。

描述

documentation v2

Problem

The release skill (.claude/skills/release/SKILL.md) is a v2 procedure. Its "The v1 line" section is four sentences saying v1 ships flat from v1/main to v1-latest, with no steps. Cutting 1.0.3 (#2753) meant reconstructing the procedure from the earlier releases and the v1 workflow, and the first attempt got two details wrong:

  • The tag is bare (1.0.3), like 1.0.0–1.0.2, not v1.0.3. The v1 release tags ruleset protects refs/tags/1.*.
  • The release must not be marked Latest. Every v1 release has latest=false; checking it would take the Latest badge from v2.

Proposed change

Expand "The v1 line" in the release skill into a real procedure:

  1. Bump: a PR against v1/main (labels v1 + chore, linked to a v1 release issue on board #11, no milestone). Edit the four package.json versions, the three @modelcontextprotocol/inspector-* ranges in the root package.json, and the 8 matching package-lock.json fields directly. Don't use npm run update-version: its trailing bare npm install re-resolves the whole tree (see #2080). npm run check-version must pass and npm ci must leave the lockfile untouched.
  2. Merge order: the bump merges last, after the fixes it ships.
  3. Release: gh release create <x.y.z> --target v1/main --title <x.y.z> --latest=false.
  4. What CI does: the release event runs build, then publish (OIDC trusted publishing, npm run publish-all → --tag v1-latest), plus publish-github-container-registry.
  5. Verify: npm view @modelcontextprotocol/inspector dist-tags shows v1-latest at the new version, and latest is still on v2.
  6. Release notes when the fixes are unpublished security advisories: keep the notes neutral at release time, then edit the release to link the advisories once they are published.

Also worth recording in the skill or in security-advisory, both learned on this release:

  • Advisory-fork PRs cannot satisfy required Actions checks. Private forks don't run Actions, so v2/main's required DCO check and v1/main's required build check stay "Expected" forever, and the advisory page offers no bypass. The workable path was to remove only the required_status_checks rule from the ruleset while merging, then restore it from a snapshot.
  • Merging an advisory merges all of its fork's PRs at once. An advisory with one PR per line (e.g. v2 + v1) lands both together, which interacts with any planned cross-advisory merge order.
  • Use "Create a merge commit" when several fix branches have been chained on top of each other. Squash or rebase breaks the chain.

Keep the release skill disable-model-invocation: true, and re-run npm run verify:skills and the listing budget check after editing.

主要语言
TypeScript
星标
11.1k
派生
1.6k
平均合并
5 小时 29 分钟
30 天内合并 PR
158

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

modelcontextprotocol/inspector 的其他 Issue

查看 modelcontextprotocol/inspector 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。