Automate npm and MCP releases

[a-baran-orhan]

Summary

• align the five public PoseCode packages under a fixed Changesets release group
• publish npm packages from main through GitHub OIDC and then publish posecode-mcp metadata to the official MCP Registry
• add weekly grouped Dependabot updates for npm and GitHub Actions
• validate package versions, built entry points, tarball contents, internal dependencies, and MCP metadata in CI
• ship the canonical PoseCode authoring guide inside the MCP npm package
• update MCP installation docs to use posecode-mcp@latest

Why

The repository is prepared at 0.2.x, but npm still serves 0.1.0 for parser/render/share/embed and 0.1.1 for the MCP server. The official MCP Registry also lists 0.1.1. There was no automated release path to keep those registries synchronized with the repository.

Impact

After the one-time npm Trusted Publisher configuration is completed and this PR is merged, Changesets will open a version PR. Merging that release PR will publish all five packages together, create GitHub releases, and update the official MCP Registry.

Validation

• clean npm ci with 0 audit vulnerabilities
• 5 publishable tarballs validated
• typecheck passed
• 271 unit tests passed
• 1,049/1,049 biomechanical checks passed
• production playground build passed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
posecode	Ready	Preview, Comment	Jul 16, 2026 6:47am