Repository navigation
Validate Release Secrets #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Release Secrets | |
| on: | |
| workflow_dispatch: | |
| jobs: | |
| validate-secrets: | |
| name: Test all release tokens | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Validate npm trusted publishing | |
| run: | | |
| # With trusted publishing, there's no token to validate. | |
| # Instead, verify the packages have trusted publishing configured | |
| # by checking that the repository field matches this repo. | |
| echo "ℹ️ npm uses OIDC trusted publishing — no token to validate" | |
| for pkg in @debugmcp/shared @debugmcp/adapter-mock @debugmcp/adapter-python @debugmcp/mcp-debugger; do | |
| REPO=$(npm view "$pkg" repository.url 2>/dev/null || echo "") | |
| if echo "$REPO" | grep -q "debugmcp/mcp-debugger"; then | |
| echo "✅ $pkg is linked to debugmcp/mcp-debugger" | |
| elif [[ -z "$REPO" ]]; then | |
| echo "⚠️ $pkg not found on npm (first publish?)" | |
| else | |
| echo "⚠️ $pkg repository: $REPO — verify trusted publishing is configured" | |
| fi | |
| done | |
| echo "" | |
| echo "To configure: npmjs.com → each package → Settings → Configure Trusted Publishing" | |
| echo " Repository: debugmcp/mcp-debugger" | |
| echo " Workflow: release.yml" | |
| - name: Validate Docker Hub credentials | |
| env: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} | |
| run: | | |
| if echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin 2>&1; then | |
| echo "✅ Docker Hub credentials are valid" | |
| docker logout > /dev/null 2>&1 | |
| else | |
| echo "❌ Docker Hub credentials are invalid" | |
| echo " Fix: update DOCKER_USERNAME/DOCKER_PASSWORD secrets" | |
| echo "DOCKER_FAILED=true" >> $GITHUB_ENV | |
| fi | |
| - name: Validate PYPI_TOKEN | |
| env: | |
| PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} | |
| run: | | |
| pip install twine > /dev/null 2>&1 | |
| # Create a minimal dummy package to test twine check (doesn't upload) | |
| mkdir -p /tmp/pypi-test && cd /tmp/pypi-test | |
| cat > setup.py << 'SETUP' | |
| from setuptools import setup | |
| setup(name="__dry-run-token-test__", version="0.0.0") | |
| SETUP | |
| python setup.py sdist > /dev/null 2>&1 || true | |
| # Use twine to attempt upload with --skip-existing | |
| # A valid token will get "Skipping" or "File already exists"; an invalid one gets 401/403 | |
| TWINE_OUTPUT=$(python -m twine upload --skip-existing \ | |
| --repository-url https://upload.pypi.org/legacy/ \ | |
| -u __token__ -p "$PYPI_TOKEN" \ | |
| dist/* 2>&1) || true | |
| if echo "$TWINE_OUTPUT" | grep -qiE "403|401|invalid|unauthorized"; then | |
| echo "❌ PYPI_TOKEN is expired or revoked" | |
| echo " Response: $TWINE_OUTPUT" | |
| echo " Fix: regenerate at pypi.org → Account Settings → API tokens, update PYPI_TOKEN secret" | |
| echo "PYPI_FAILED=true" >> $GITHUB_ENV | |
| else | |
| echo "✅ PYPI_TOKEN is valid (twine authenticated successfully)" | |
| fi | |
| - name: Summary | |
| run: | | |
| echo "" | |
| echo "═══════════════════════════════════════════" | |
| if [[ "${NPM_FAILED:-}" == "true" || "${DOCKER_FAILED:-}" == "true" || "${PYPI_FAILED:-}" == "true" ]]; then | |
| echo "❌ Some tokens are invalid. Fix before releasing." | |
| exit 1 | |
| else | |
| echo "✅ All release tokens are valid." | |
| fi | |
| echo "═══════════════════════════════════════════" |