Automate npm and MCP releases

.changeset/README.md

@@ -0,0 +1,14 @@
+# Changesets
+
+Add a changeset for every pull request that changes a public PoseCode package:
+
+```bash
+npm run changeset
+```
+
+Choose the affected package and the SemVer impact, then commit the generated
+Markdown file with the code change. The five public packages are released as a
+fixed group so their versions and internal dependency ranges stay aligned.
+
+Changes that only affect tests, internal tooling, or the private playground do
+not need a changeset.

.changeset/config.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [
+    [
+      "posecode-parser",
+      "posecode-render",
+      "posecode-share",
+      "posecode-embed",
+      "posecode-mcp"
+    ]
+  ],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/fresh-poses-ship.md

@@ -0,0 +1,5 @@
+---
+"posecode-mcp": patch
+---
+
+Ship the current authoring guide with the MCP npm package and prepare all public packages for automated releases.

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Europe/Istanbul
+    versioning-strategy: increase-if-necessary
+    open-pull-requests-limit: 10
+    groups:
+      production-dependencies:
+        dependency-type: production
+      development-dependencies:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:15"
+      timezone: Europe/Istanbul
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -22,12 +24,19 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Require a changeset for public package changes
+        if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main'
+        run: npx changeset status --since="${{ github.event.pull_request.base.sha }}"
+
       - name: Build publishable packages
         run: npm run build:packages
 
       - name: Typecheck
         run: npm run typecheck
 
+      - name: Validate package tarballs and MCP metadata
+        run: npm run check:packages
+
       - name: Build playground
         run: npm run build
 

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release packages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release:
+    name: Version or publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Create release pull request or publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          version: npm run version-packages
+          publish: npm run release
+          commit: "chore: release packages"
+          title: "chore: release packages"
+          createGithubReleases: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install MCP Registry publisher
+        if: steps.changesets.outputs.published == 'true'
+        working-directory: packages/posecode-mcp
+        run: |
+          curl --fail --location --silent --show-error \
+            "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz" \
+            | tar xz mcp-publisher
+
+      - name: Authenticate to MCP Registry
+        if: steps.changesets.outputs.published == 'true'
+        working-directory: packages/posecode-mcp
+        run: ./mcp-publisher login github-oidc
+
+      - name: Publish MCP Registry metadata
+        if: steps.changesets.outputs.published == 'true'
+        working-directory: packages/posecode-mcp
+        run: ./mcp-publisher publish

README.md

@@ -287,7 +287,7 @@ Posecode includes a Model Context Protocol server for AI agents.
 Run it with:
 
 ```bash
-npx posecode-mcp
+npx -y posecode-mcp@latest
 ```
 
 Example MCP client configuration:
@@ -297,22 +297,16 @@ Example MCP client configuration:
   "mcpServers": {
     "posecode": {
       "command": "npx",
-      "args": ["-y", "posecode-mcp"]
+      "args": ["-y", "posecode-mcp@latest"]
     }
   }
 }
 ```
 
-Depending on the final Build Week implementation, the MCP server can expose tools such as:
+The MCP server exposes:
 
 - `validate_posecode`
 - `render_posecode`
-- `share_posecode`
-- `generate_posecode`
-- `critique_posecode`
-- `revise_posecode`
-
-> Only list tools that are actually implemented before submitting.
 
 See [`packages/posecode-mcp`](packages/posecode-mcp) for the complete configuration and tool documentation.
 

RELEASING.md

@@ -0,0 +1,55 @@
+# Releasing PoseCode packages
+
+PoseCode publishes five npm packages as one fixed-version release:
+
+- `posecode-parser`
+- `posecode-render`
+- `posecode-share`
+- `posecode-embed`
+- `posecode-mcp`
+
+The release workflow also publishes `packages/posecode-mcp/server.json` to the
+official MCP Registry after npm publication succeeds.
+
+## One-time repository setup
+
+For each npm package above, configure an npm trusted publisher with:
+
+- Provider: GitHub Actions
+- Organization: `posecode-dev`
+- Repository: `posecode`
+- Workflow filename: `release.yml`
+- Allowed action: npm publish
+
+The workflow uses GitHub OIDC, so no long-lived npm token is required. In the
+GitHub repository Actions settings, allow GitHub Actions to create pull
+requests. The workflow also needs the permissions declared in
+`.github/workflows/release.yml`.
+
+## Normal release flow
+
+1. Run `npm run changeset` in each pull request that changes a public package.
+2. Merge the pull request into `main`.
+3. Review and merge the automatically maintained `chore: release packages`
+   pull request.
+4. The next release workflow publishes the npm packages, creates GitHub
+   releases, and updates the official MCP Registry through GitHub OIDC.
+
+The first run can be started from the Actions tab with **Release packages → Run
+workflow** after trusted publishing is configured. If changesets are waiting,
+merge the generated release pull request; the following run publishes every
+local package version that is newer than npm.
+
+## Local verification
+
+```bash
+npm ci
+npm run typecheck
+npm run build:packages
+npm run check:packages
+npm test
+```
+
+`npm run check:packages` fails if public package versions drift, built entry
+points are missing from a tarball, internal dependency versions disagree, or
+the MCP Registry manifest does not match `posecode-mcp`.

editors/vscode/package.json

@@ -39,7 +39,7 @@
   "devDependencies": {
     "@types/node": "^22.10.2",
     "@types/vscode": "^1.85.0",
-    "esbuild": "^0.24.2",
+    "esbuild": "^0.28.1",
     "typescript": "^5.7.2"
   }
 }