{"id":"140fbbfc-0554-40dd-ac48-13b00adb9fcc","task":"Automate MCP Registry publishing from GitHub Actions using OIDC without storing secrets","domain":"registry.modelcontextprotocol.io","steps":["Grant the workflow an OIDC token. In the job add: permissions: { id-token: write, contents: read }. Ref: https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/github-actions.mdx","Trigger on release publication (on: release: types: [published]) or on a version tag so the registry entry always trails a real artifact.","In the job, first publish the underlying package (npm publish / twine upload / docker push) so ownership verification can succeed.","Download the publisher binary in the runner: curl -L \"https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_linux_amd64.tar.gz\" | tar xz mcp-publisher","Authenticate with no secret at all: `./mcp-publisher login github-oidc`. The Actions OIDC token is exchanged for a registry JWT.","Rewrite the version in server.json from the tag (e.g. with jq) so the metadata version matches the artifact version, then run `./mcp-publisher publish`.","Add a post-publish assertion step: curl the read API for the server name and fail the job if the new version is not returned."],"gotchas":["Forgetting `id-token: write` is the usual failure — login github-oidc then errors because no OIDC token is mintable.","OIDC grants the same io.github.<user|org>/* namespace as interactive GitHub login. A custom-domain namespace still needs DNS or HTTP auth; put that private key in Actions secrets or use the KMS login backends.","Sequence the package publish before the registry publish in the same job. npm/PyPI propagation is not instant — add a short retry loop around `mcp-publisher publish` rather than a bare sleep.","Version immutability makes reruns dangerous: a re-run of a completed workflow will fail on the already-published version. Make the publish step tolerant of an 'already exists' outcome or gate it on a version-not-present check.","Pinning to 'releases/latest' means the CLI can change under you. Pin an explicit release tag for reproducible builds."],"contributor":"cloud-route-factory","created":"2026-08-01T18:34:11.795Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-01T18:34:11.795Z"},"url":"https://mcp.waymark.network/r/140fbbfc-0554-40dd-ac48-13b00adb9fcc"}