fix(ci): pin actions to SHAs, add beta provenance, verify publisher binary

.github/workflows/beta-release.yml

@@ -5,18 +5,19 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish-beta:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout source code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
       - name: "Set up Node.js"
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.x
           registry-url: "https://registry.npmjs.org/"
@@ -67,7 +68,7 @@ jobs:
           npm version ${{ steps.get_version.outputs.version }} --no-git-tag-version
 
       - name: "Publish beta to NPM"
-        run: npm publish --tag beta --access public
+        run: npm publish --tag beta --access public --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 

.github/workflows/mcp-ci.yml

@@ -17,9 +17,9 @@ jobs:
         node-version: [22.x]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ matrix.node-version }}
     - run: npm ci

.github/workflows/mcp-registry-publish.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "lts/*"
 
@@ -31,8 +31,14 @@ jobs:
         run: npm run build --if-present
 
       - name: Install MCP Publisher
+        env:
+          MCP_PUBLISHER_VERSION: v1.3.3
+          # sha256 of mcp-publisher_linux_amd64.tar.gz from registry_1.3.3_checksums.txt
+          MCP_PUBLISHER_SHA256: 1113b9d6bf59b000966c4f17752cf87b51db03dcc5482721421fd843ce3bf048
         run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/download/v1.3.3/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher    
+          curl -fsSL -o mcp-publisher.tar.gz "https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}/mcp-publisher_linux_amd64.tar.gz"
+          echo "${MCP_PUBLISHER_SHA256}  mcp-publisher.tar.gz" | sha256sum --check
+          tar xzf mcp-publisher.tar.gz mcp-publisher
       - name: Login to MCP Registry
         run: ./mcp-publisher login github-oidc
 

.github/workflows/npm-publish.yml

@@ -12,12 +12,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout source code"
-        uses: actions/checkout@v2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
       - name: "Set up Node.js"
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22.x
           registry-url: "https://registry.npmjs.org/"
@@ -105,13 +105,14 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: "Create GitHub Release"
-        uses: actions/create-release@v1
-        with:
-          tag_name: ${{ steps.get_version.outputs.version }}
-          release_name: ${{ steps.get_version.outputs.version }}
-          body: |
-            ${{ steps.fetch_prs.outputs.pr_list }}
-
-            Published by ${{ github.actor }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.get_version.outputs.version }}
+          PR_LIST: ${{ steps.fetch_prs.outputs.pr_list }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          gh release create "$VERSION" \
+            --title "$VERSION" \
+            --notes "$PR_LIST
+
+          Published by $ACTOR"