release.yml

name: Release

on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      force_publish:
        description: 'Publish package versions from release_tag without creating a release'
        type: boolean
        default: false
      release_tag:
        description: 'Existing GitHub release tag to publish when force_publish is enabled'
        type: string
        default: ''

permissions:
  contents: write
  pull-requests: write
  id-token: write # required for npm OIDC trusted publishing

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  release-please:
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: generate-token
        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
        with:
          client-id: ${{ secrets.GH_APP_ID }}
          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}

      - name: Run release-please
        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
        id: release
        with:
          token: ${{ steps.generate-token.outputs.token }}

      - name: Validate force publish ref
        if: ${{ inputs.force_publish == true }}
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          WORKFLOW_REF_TYPE: ${{ github.ref_type }}
          WORKFLOW_REF_NAME: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          if [ "$WORKFLOW_REF_TYPE" != "branch" ] || [ "$WORKFLOW_REF_NAME" != "main" ]; then
            echo "Select main when running force_publish."
            exit 1
          fi
          if [ -z "$RELEASE_TAG" ]; then
            echo "Enter an existing GitHub release tag when running force_publish."
            exit 1
          fi
          if gh api --silent "repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_TAG"; then
            echo "Force publishing from release tag $RELEASE_TAG."
            exit 0
          fi
          echo "Selected tag $RELEASE_TAG is not associated with a GitHub Release."
          exit 1

      # Everything below runs when a release PR is merged, or when
      # force_publish is manually enabled for retrying current package versions.
      # Shared setup steps gate on releases_created (true if any package released)
      # or force_publish.
      # Per-package publish steps gate on <path>--release_created so only the
      # released package(s) are published each run. force_publish runs all
      # publish steps; already-published npm versions and MCP registry
      # versions are skipped below.
      # Ref: https://github.com/googleapis/release-please-action#path-outputs

      - name: Checkout repository
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
        if: ${{ steps.release.outputs.releases_created || inputs.force_publish == true }}
        with:
          ref: ${{ inputs.force_publish == true && inputs.release_tag || github.sha }}

      - name: Setup tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        if: ${{ steps.release.outputs.releases_created || inputs.force_publish == true }}
        with:
          install: true
          cache: true

      - name: Configure DepthFirst dependency firewall
        shell: bash
        env:
          DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
        run: |
          if [ -n "$DF_FIREWALL_TOKEN" ]; then
            {
              echo "registry=https://firewall.depthfirst.com/npm/"
              echo "//firewall.depthfirst.com/npm/:_authToken=${DF_FIREWALL_TOKEN}"
            } >> ~/.npmrc
          fi

      - name: Install dependencies
        if: ${{ steps.release.outputs.releases_created || inputs.force_publish == true }}
        run: pnpm install --frozen-lockfile

      - name: Restore npm registry
        if: ${{ steps.release.outputs.releases_created || inputs.force_publish == true }}
        run: npm config set registry https://registry.npmjs.org/

      - name: Build packages
        if: ${{ steps.release.outputs.releases_created || inputs.force_publish == true }}
        run: pnpm --filter @supabase/mcp-utils --filter @supabase/mcp-server-supabase --filter @supabase/mcp-server-postgrest build

      - name: Publish @supabase/mcp-utils to npm
        if: ${{ steps.release.outputs['packages/mcp-utils--release_created'] || inputs.force_publish == true }}
        working-directory: packages/mcp-utils
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          NPM_VIEW_STDERR=$(mktemp)
          EXISTING=$(npm view "@supabase/mcp-utils@$VERSION" version 2>"$NPM_VIEW_STDERR") || STATUS=$?
          if [ -n "$EXISTING" ]; then
            echo "Version $VERSION already published, skipping."
            rm -f "$NPM_VIEW_STDERR"
            exit 0
          elif [ "${STATUS:-0}" -ne 0 ] && ! grep -qiE 'E404|not found' "$NPM_VIEW_STDERR"; then
            cat "$NPM_VIEW_STDERR"
            rm -f "$NPM_VIEW_STDERR"
            exit 1
          fi
          rm -f "$NPM_VIEW_STDERR"
          pnpm publish --no-git-checks --ignore-scripts --access public --provenance

      - name: Publish @supabase/mcp-server-supabase to npm
        if: ${{ steps.release.outputs['packages/mcp-server-supabase--release_created'] || inputs.force_publish == true }}
        working-directory: packages/mcp-server-supabase
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          NPM_VIEW_STDERR=$(mktemp)
          EXISTING=$(npm view "@supabase/mcp-server-supabase@$VERSION" version 2>"$NPM_VIEW_STDERR") || STATUS=$?
          if [ -n "$EXISTING" ]; then
            echo "Version $VERSION already published, skipping."
            rm -f "$NPM_VIEW_STDERR"
            exit 0
          elif [ "${STATUS:-0}" -ne 0 ] && ! grep -qiE 'E404|not found' "$NPM_VIEW_STDERR"; then
            cat "$NPM_VIEW_STDERR"
            rm -f "$NPM_VIEW_STDERR"
            exit 1
          fi
          rm -f "$NPM_VIEW_STDERR"
          pnpm publish --no-git-checks --ignore-scripts --access public --provenance

      - name: Publish @supabase/mcp-server-postgrest to npm
        if: ${{ steps.release.outputs['packages/mcp-server-postgrest--release_created'] || inputs.force_publish == true }}
        working-directory: packages/mcp-server-postgrest
        run: |
          set -euo pipefail
          VERSION=$(node -p "require('./package.json').version")
          NPM_VIEW_STDERR=$(mktemp)
          EXISTING=$(npm view "@supabase/mcp-server-postgrest@$VERSION" version 2>"$NPM_VIEW_STDERR") || STATUS=$?
          if [ -n "$EXISTING" ]; then
            echo "Version $VERSION already published, skipping."
            rm -f "$NPM_VIEW_STDERR"
            exit 0
          elif [ "${STATUS:-0}" -ne 0 ] && ! grep -qiE 'E404|not found' "$NPM_VIEW_STDERR"; then
            cat "$NPM_VIEW_STDERR"
            rm -f "$NPM_VIEW_STDERR"
            exit 1
          fi
          rm -f "$NPM_VIEW_STDERR"
          pnpm publish --no-git-checks --ignore-scripts --access public --provenance

      # The MCP registry rejects re-publishing an existing version.
      # Probe the registry first and gate both login and publish on the result.
      - name: Check MCP registry version
        id: mcp-registry-check
        if: ${{ steps.release.outputs['packages/mcp-server-supabase--release_created'] || inputs.force_publish == true }}
        working-directory: packages/mcp-server-supabase
        run: |
          set -euo pipefail
          ALREADY_PUBLISHED=$(node -e '
            const { name, version } = require("./server.json");
            const url = `https://registry.modelcontextprotocol.io/v0/servers?search=${encodeURIComponent(name)}&version=${encodeURIComponent(version)}`;
            fetch(url)
              .then((res) => {
                if (!res.ok) throw new Error(`Registry query failed: ${res.status} ${res.statusText}`);
                return res.json();
              })
              .then((data) => {
                const exists = (data.servers ?? []).some(
                  (entry) => entry.server?.name === name && entry.server?.version === version
                );
                process.stdout.write(exists ? "true" : "false");
              })
              .catch((err) => {
                console.error(err.message);
                process.exit(1);
              });
          ')
          echo "already_published=$ALREADY_PUBLISHED" >> "$GITHUB_OUTPUT"
          if [ "$ALREADY_PUBLISHED" = "true" ]; then
            VERSION=$(node -p "require('./server.json').version")
            echo "MCP registry version $VERSION already published, skipping."
          fi

      - name: Authenticate to MCP registry
        if: ${{ steps.mcp-registry-check.outputs.already_published == 'false' }}
        working-directory: packages/mcp-server-supabase
        env:
          DOMAIN_VERIFICATION_KEY: ${{ secrets.DOMAIN_VERIFICATION_KEY }}
        run: pnpm registry:login

      - name: Publish to MCP registry
        if: ${{ steps.mcp-registry-check.outputs.already_published == 'false' }}
        working-directory: packages/mcp-server-supabase
        run: pnpm registry:publish