Skip to content

feat(ci): auto-sync the MCP known-latest constant, never a manual bump#6638

Merged
JSONbored merged 1 commit into
mainfrom
fix/mcp-version-audit-auto-refresh
Jul 16, 2026
Merged

feat(ci): auto-sync the MCP known-latest constant, never a manual bump#6638
JSONbored merged 1 commit into
mainfrom
fix/mcp-version-audit-auto-refresh

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Summary

  • apps/loopover-ui/src/lib/mcp-package.ts's MCP_PACKAGE_KNOWN_LATEST_VERSION is a client-side graceful-degradation fallback (shown only when the live npm registry fetch fails or hasn't resolved yet). ui:version-audit already requires it to track @loopover/mcp's real npm dist-tags.latest, but the only way to fix a drift was a manual edit — this repo just hit that exact failure on main.
  • Adds a --write mode to scripts/check-ui-mcp-version-copy.mjs that self-heals the constant instead of failing when the registry check is run with it.
  • Adds a new scheduled workflow (.github/workflows/mcp-ui-version-sync.yml, daily cron + workflow_dispatch) that runs the sync and keeps a standing PR up to date, mirroring orb-stable-release-pr.yml's existing pattern (force-pushed branch, gh pr create/gh pr edit).
  • Nothing ships without a maintainer merging the PR — this workflow never pushes to main directly. CI's own invocation of ui:version-audit never passes --write, so a genuine drift introduced by a contributor PR still fails loud as before.

Scope

  • scripts/check-ui-mcp-version-copy.mjs, scripts/check-ui-mcp-version-copy.d.mts, package.json, test/unit/check-ui-mcp-version-copy-script.test.ts, .github/workflows/mcp-ui-version-sync.yml
  • No other files touched

Validation

  • npx tsc --noEmit — clean
  • npx vitest run test/unit/check-ui-mcp-version-copy-script.test.ts — 14/14 passed (new tests cover writeKnownLatestVersion directly and the --write CLI mode end-to-end against a disposable temp repo layout, never the real source file)
  • npm run ui:version-audit (no --write) — still passes cleanly, unaffected
  • npm run ui:version-audit:sync (new script, --write mode) — confirmed no-op when already in sync
  • npm run actionlint — clean on the new workflow

Safety

  • No secrets touched (workflow uses the default github.token, same as orb-stable-release-pr.yml)

apps/loopover-ui/src/lib/mcp-package.ts's MCP_PACKAGE_KNOWN_LATEST_VERSION is
a client-side graceful-degradation fallback (shown only when the live npm
registry fetch fails or hasn't resolved yet); ui:version-audit already
requires it to track @loopover/mcp's real npm dist-tags.latest, but the only
way to fix a drift was a manual edit.

Adds a --write mode to scripts/check-ui-mcp-version-copy.mjs that self-heals
the constant instead of failing, and a new scheduled workflow
(mcp-ui-version-sync.yml) that runs it daily and keeps a standing PR open
with the sync, mirroring orb-stable-release-pr.yml's pattern. Nothing ships
without a maintainer merging the PR; CI's own invocation of ui:version-audit
never passes --write, so a genuine drift in a contributor PR still fails loud.
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@JSONbored JSONbored self-assigned this Jul 16, 2026
@JSONbored
JSONbored merged commit c1d9fbc into main Jul 16, 2026
6 of 7 checks passed
@JSONbored
JSONbored deleted the fix/mcp-version-audit-auto-refresh branch July 16, 2026 16:44
@loopover-orb loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 16, 2026
@codecov

codecov Bot commented Jul 16, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@codecov

codecov Bot commented Jul 16, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.64%. Comparing base (42805e0) to head (68e4414).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #6638   +/-   ##
=======================================
  Coverage   93.64%   93.64%           
=======================================
  Files         680      680           
  Lines       68026    68026           
  Branches    18673    18673           
=======================================
  Hits        63704    63704           
  Misses       3347     3347           
  Partials      975      975           
Flag Coverage Δ
shard-1 44.02% <ø> (+<0.01%) ⬆️
shard-2 36.78% <ø> (ø)
shard-3 32.41% <ø> (ø)
shard-4 34.76% <ø> (ø)
shard-5 30.97% <ø> (ø)
shard-6 45.71% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant