fix: MCP repository field + idempotent publish - #5
Conversation
MCP publish failed with provenance 422 because the package manifest had no `repository` field; npm verifies the provenance attestation's repo URL against `package.json.repository.url` and rejects when they do not match. Add the same shape the SDK uses, with `directory: packages/mcp`, plus `homepage` and `bugs` for parity. Also make both publish steps idempotent. After this incident the SDK published successfully but the MCP step failed; a workflow re-run would now fail at the SDK step with EPUBLISHCONFLICT before reaching MCP. Each step now `npm view`s its own `pkg@ver`, skipping when the version is already on the registry. Lets the existing v0.4.0 tag re-trigger and complete the MCP publish without disturbing the SDK.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| "directory": "packages/mcp" | ||
| }, | ||
| "homepage": "https://github.com/ModernRelay/omnigraph-ts", | ||
| "bugs": "https://github.com/ModernRelay/omnigraph/issues", |
There was a problem hiding this comment.
🟡 Bugs URL points to wrong repository (omnigraph instead of omnigraph-ts)
The newly added bugs field at packages/mcp/package.json:12 points to https://github.com/ModernRelay/omnigraph/issues, but the repository URL (line 8) and homepage (line 11) both correctly reference omnigraph-ts. This will direct users reporting issues to the wrong GitHub repository (or a 404). The same typo exists pre-existing in packages/sdk/package.json:12, and it was copy-pasted into this PR.
| "bugs": "https://github.com/ModernRelay/omnigraph/issues", | |
| "bugs": "https://github.com/ModernRelay/omnigraph-ts/issues", |
Was this helpful? React with 👍 or 👎 to provide feedback.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 5b44e1f. Configure here.
| "directory": "packages/mcp" | ||
| }, | ||
| "homepage": "https://github.com/ModernRelay/omnigraph-ts", | ||
| "bugs": "https://github.com/ModernRelay/omnigraph/issues", |
There was a problem hiding this comment.
Bugs URL points to wrong repository name
Low Severity
The bugs URL references omnigraph while repository.url and homepage both reference omnigraph-ts. This means the bugs link will point to https://github.com/ModernRelay/omnigraph/issues instead of https://github.com/ModernRelay/omnigraph-ts/issues, likely sending users to a nonexistent or unrelated repo's issue tracker. The same inconsistency exists in the SDK's package.json and appears to have been copied for parity.
Reviewed by Cursor Bugbot for commit 5b44e1f. Configure here.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
1 participant
Summary
The 0.4.0 release published the SDK but failed on MCP:
```
422 Unprocessable Entity — Error verifying sigstore provenance bundle:
Failed to validate repository information: package.json: "repository.url" is "",
expected to match "https://github.com/ModernRelay/omnigraph-ts\" from provenance
```
npm provenance verification compares the attestation's source repo against the manifest's `repository.url`. The MCP `package.json` had no `repository` field; the SDK did. Adds the same shape the SDK uses (with `directory: packages/mcp`), plus `homepage` and `bugs` for parity.
Also: a workflow re-run as-is would now fail at the SDK step with `EPUBLISHCONFLICT` (SDK 0.4.0 is already on npm). Both publish steps now check `npm view pkg@ver` and skip when the version already exists. Lets the same v0.4.0 tag re-trigger and complete only the MCP publish.
Recovery flow after merge
The SDK source did not change between the two builds, so the provenance attestation for SDK 0.4.0 (already on sigstore) is still valid for that tarball.
Test plan
🤖 Generated with Claude Code
Note
Medium Risk
Touches the release publishing workflow and npm package metadata; mistakes could block releases or publish unintended tags, but changes are small and well-scoped.
Overview
Fixes npm provenance validation for
@modernrelay/omnigraph-mcpby addingrepository(withdirectory), plushomepageandbugs, so the published manifest matches the sigstore attestation source repo.Updates the GitHub Actions release workflow to make both
pnpm publishsteps idempotent by checkingnpm view pkg@verand skipping publishes when that exact version already exists, enabling safe re-runs after partial failures.Reviewed by Cursor Bugbot for commit 5b44e1f. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Fix MCP provenance failure by adding repository metadata to
packages/mcp/package.json. Make publish steps idempotent by skipping ifpkg@versionexists, so re-running the v0.4.0 tag only publishes@modernrelay/omnigraph-mcp.Bug Fixes
"repository"(withdirectory: packages/mcp), plus"homepage"and"bugs"to pass npm provenance checks.npm view pkg@ver; skip publish for@modernrelay/omnigraphand@modernrelay/omnigraph-mcpif version already exists to avoidEPUBLISHCONFLICT.Migration
git push origin --delete v0.4.0mainand push:git tag -a v0.4.0 -m "Release 0.4.0" origin/main && git push origin v0.4.0releaseenvironment; SDK skips, MCP publishes with provenance.Written for commit 5b44e1f. Summary will update on new commits.