docs(ci): record the read:org gotcha for manual registry publishing

[bomly-guy]

io.github.bomly-dev/bomly-cli 0.21.1 is now live in the official MCP Registry. This documents the one thing that cost time getting there.

Publishing the first entry by hand failed twice with:

403 Forbidden ... You have permission to publish: io.github.bomly-guy/*.
Attempting to publish: io.github.bomly-dev/bomly-cli.
If you're trying to publish to a GitHub organization, you may need to make
your organization membership public...

That suggestion is a red herring. Membership was made public, a fresh token was minted afterwards, and it still carried only io.github.bomly-guy/*.

The real cause: the interactive mcp-publisher login github flow does not request the read:org scope, so the registry cannot read the publisher's organization role and falls back to the personal namespace. Passing a token that has read:org fixes it immediately — and the gh CLI's own token already carries it:

mcp-publisher login github --token "$(gh auth token)"

Token claims before and after:

before: [{"action":"publish","resource":"io.github.bomly-guy/*"}]
after:  [{"action":"publish","resource":"io.github.bomly-guy/*"},
         {"action":"publish","resource":"io.github.bomly-dev/*"}]

Adds a short "Publishing the registry entry by hand" section to dev-docs/CI.md so the next person does not re-derive this. Does not touch the CI path, which uses OIDC and is unaffected.

🤖 Generated with Claude Code

[github-actions]

Bomly Diff Summary

Compared 4f36bacc4e38ddcbc9a6ef685f0b3af79d196932 to a75d2aed84c3ea50fac9bb773416fa69b24d20e2.

Overview

Status	Manifests	Dependencies	Findings	Duration
✅ Pass	+0 / ~0 / -0	0 added / 0 version changed / 0 detail changes / 0 removed	0 introduced / 0 persisted / 0 resolved	1m 19s

Dependency Changes

✅ No dependency changes.

Vulnerabilities

✅ No vulnerability changes.

License Changes

✅ No license changes.

Project Posture

✅ No project posture changes (--matchers +scorecard was not selected).

Policy Findings

✅ No policy differences were identified.

[coderabbitai]

Warning

Review limit reached

@bomly-guy, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 35 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5c218151-43ce-4ee1-a1a2-630bab40c18f

📥 Commits

Reviewing files that changed from the base of the PR and between 4f36bac and a75d2ae.

📒 Files selected for processing (1)

• dev-docs/CI.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}