Repository navigation
fix(ci): the registry needs DNS auth, not OIDC - #6
Merged
Merged
Conversation
The publish was rejected 403: You have permission to publish: io.github.greencalculus/* Attempting to publish: com.greencalculus/api GitHub OIDC only ever grants the io.github.<org> namespace. We publish under a DNS namespace, which is proved by signing with the key behind the v=MCPv1 TXT record on greencalculus.com. That record is already live; the private half was not persisted by whoever first published, so it needs regenerating. The registry step now signs with MCP_PRIVATE_KEY, and skips with an explanation on the job summary when that secret is absent — npm still publishes either way, so a missing key costs the registry entry rather than the whole release. scripts/rotate-registry-key.sh generates a pair, pipes the private half straight into the repo secret without printing it, and prints the TXT record to publish. Both halves are length-checked before anything is set. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V5hFP2B2vU4dUMYgM1NEVs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The second run got further — manifest valid, OIDC login succeeded — then the publish was rejected:
GitHub OIDC only ever grants the
io.github.<org>namespace. We publish undercom.greencalculus/api, a DNS namespace, which is proved by signing with the key behind thev=MCPv1TXT record on greencalculus.com. That record is live — but the private half was never persisted by whoever first published, so it has to be regenerated.Renaming the server to
io.github.greencalculus/apiwould make OIDC work and is the wrong trade: it abandons the published identity that existing clients and directory listings already reference.Changes
MCP_PRIVATE_KEYviamcp-publisher login dns.maintoday.scripts/rotate-registry-key.shgenerates a fresh pair, pipes the private half straight into the repo secret without printing it, and prints the TXT record to publish. Both halves are length-checked (64 hex / 44 base64) before anything is set.Verified
bash -non the script; workflow YAML parses.After merge
Two steps, in this order, and then the registry catches up on its own:
./scripts/rotate-registry-key.shv=MCPv1TXT record on greencalculus.com with the line it prints.The weekly run picks it up with no further pushes.
🤖 Generated with Claude Code
https://claude.ai/code/session_01V5hFP2B2vU4dUMYgM1NEVs