dbx/.github/workflows/mcp-release.yml

name: MCP Release

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - 'mcp/src/**'
      - 'mcp/tests/**'
      - 'mcp/package.json'
      - 'mcp/package-lock.json'
      - 'mcp/pnpm-lock.yaml'
      - 'mcp/pnpm-workspace.yaml'
      - 'mcp/tsconfig.json'
      - 'mcp/server.json'

permissions:
  contents: write
  id-token: write

jobs:
  publish:
    name: Bump patch and publish MCP server
    runs-on: ubuntu-latest
    if: github.actor != 'github-actions[bot]' && (github.event_name == 'workflow_dispatch' || !contains(github.event.head_commit.message, '[skip mcp-release]'))

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: https://registry.npmjs.org
          cache: pnpm
          cache-dependency-path: mcp/pnpm-lock.yaml

      - name: Check npm token
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: |
          if [ -z "${NODE_AUTH_TOKEN}" ]; then
            echo "::error::NPM_TOKEN secret is required to publish @dbx-app/mcp-server."
            exit 1
          fi          

      - name: Check release token
        env:
          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
        run: |
          if [ -z "${RELEASE_TOKEN}" ]; then
            echo "::error::MCP_RELEASE_TOKEN secret is required to push the MCP release commit and tag."
            exit 1
          fi          

      - name: Install native build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libsecret-1-dev          

      - name: Install dependencies
        working-directory: mcp
        run: pnpm install --frozen-lockfile

      - name: Run MCP tests
        working-directory: mcp
        run: pnpm test

      - name: Build MCP server
        working-directory: mcp
        run: pnpm build

      - name: Bump MCP patch version
        id: version
        run: |
          node <<'NODE'
          const fs = require('fs');

          const readJson = (path) => JSON.parse(fs.readFileSync(path, 'utf8'));
          const writeJson = (path, data) => {
            fs.writeFileSync(path, `${JSON.stringify(data, null, 2)}\n`);
          };

          const packagePath = 'mcp/package.json';
          const packageLockPath = 'mcp/package-lock.json';
          const serverPath = 'mcp/server.json';

          const pkg = readJson(packagePath);
          const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(pkg.version);
          if (!match) {
            throw new Error(`Unsupported MCP package version: ${pkg.version}`);
          }

          const nextVersion = `${match[1]}.${match[2]}.${Number(match[3]) + 1}`;
          pkg.version = nextVersion;
          writeJson(packagePath, pkg);

          if (fs.existsSync(packageLockPath)) {
            const packageLock = readJson(packageLockPath);
            packageLock.version = nextVersion;
            if (packageLock.packages?.['']) {
              packageLock.packages[''].version = nextVersion;
            }
            writeJson(packageLockPath, packageLock);
          }

          const server = readJson(serverPath);
          server.version = nextVersion;
          for (const packageInfo of server.packages ?? []) {
            if (packageInfo.registryType === 'npm' && packageInfo.identifier === pkg.name) {
              packageInfo.version = nextVersion;
            }
          }
          writeJson(serverPath, server);

          fs.appendFileSync(process.env.GITHUB_OUTPUT, `version=${nextVersion}\n`);
          NODE          

      - name: Check npm version is new
        working-directory: mcp
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          if npm view "@dbx-app/mcp-server@${VERSION}" version >/dev/null 2>&1; then
            echo "::error::@dbx-app/mcp-server@${VERSION} already exists on npm."
            exit 1
          fi          

      - name: Pack MCP package
        working-directory: mcp
        run: npm pack --dry-run

      - name: Configure git author
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"          

      - name: Commit MCP release version
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          git add mcp/package.json mcp/package-lock.json mcp/server.json
          git commit -m "chore(mcp): release ${VERSION} [skip mcp-release]"
          git tag "mcp-v${VERSION}"          

      - name: Push MCP release commit and tag
        env:
          RELEASE_TOKEN: ${{ secrets.MCP_RELEASE_TOKEN }}
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          git remote set-url origin "https://x-access-token:${RELEASE_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
          git push origin HEAD:main
          git push origin "mcp-v${VERSION}"          

      - name: Publish MCP package to npm
        working-directory: mcp
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish --access public --provenance