From a75d2aed84c3ea50fac9bb773416fa69b24d20e2 Mon Sep 17 00:00:00 2001 From: Ahmed ElMallah Date: Fri, 31 Jul 2026 00:16:47 -0700 Subject: [PATCH] docs(ci): record the read:org gotcha for manual registry publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Publishing the first registry entry by hand failed twice with a 403 naming io.github.bomly-guy/* instead of io.github.bomly-dev/*. The interactive `mcp-publisher login github` flow does not request the read:org scope, so the registry cannot read the publisher's org role and falls back to the personal namespace. The 403 suggests making org membership public. That is a red herring — membership was made public and a freshly minted token still carried only the personal namespace. Passing a token that has read:org (the gh CLI's own token does) grants both namespaces immediately. io.github.bomly-dev/bomly-cli 0.21.1 is now live in the registry. Co-Authored-By: Claude Opus 5 --- dev-docs/CI.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/dev-docs/CI.md b/dev-docs/CI.md index d4ff2551..9c4a31ea 100644 --- a/dev-docs/CI.md +++ b/dev-docs/CI.md @@ -270,6 +270,19 @@ Two jobs at the end of `release.yml` publish the `bomly-mcp` npm wrapper and the gh variable set PUBLISH_MCP_REGISTRY -R bomly-dev/bomly-cli --body true ``` +### Publishing the registry entry by hand + +Rarely needed — the release workflow does it — but useful for a first listing or a fix-up: + +```bash +mcp-publisher login github --token "$(gh auth token)" +mcp-publisher publish +``` + +**Use `--token`, not the bare interactive `mcp-publisher login github`.** The interactive OAuth flow does not request the `read:org` scope, so the registry cannot read your organization role and grants only your personal namespace (`io.github./*`). Publishing then fails with a 403 naming the wrong namespace. The error suggests making your org membership public; that alone does **not** fix it. A token carrying `read:org` does — and the `gh` CLI's own token already has it. + +Publishing under `io.github.bomly-dev/*` also requires being an **Owner** of the org, which the registry checks. + ### Notes - **npm version floor.** Trusted publishing needs npm >= 11.5.1, which is newer than the runner image's bundled npm. The job installs `npm@^11.5.1` explicitly rather than inheriting whatever the image ships.