[build] add MCP npm publishing workflow

.github/workflows/build-cli.yml

@@ -3,7 +3,7 @@ name: CLI native builds and npm packages
 on:
   push:
     branches: ["**"]
-    tags-ignore: ["cli-v*"]
+    tags-ignore: ["cli-v*", "mcp-v*"]
   pull_request:
   workflow_dispatch:
   workflow_call:

.github/workflows/build-mcp.yml

@@ -2,8 +2,11 @@ name: MCP package
 
 on:
   push:
+    branches: ["**"]
+    tags-ignore: ["mcp-v*", "cli-v*"]
   pull_request:
   workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read

.github/workflows/build.yml

@@ -10,6 +10,7 @@ on:
       - "!ios-v*"
       - "!android-v*"
       - "!cli-v*"
+      - "!mcp-v*"
   workflow_dispatch:
     inputs:
       desktop_version:

.github/workflows/release-mcp.yml

@@ -0,0 +1,88 @@
+name: Publish MCP to npm
+
+on:
+  push:
+    tags: ["mcp-v*"]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build and validate without publishing (disable only on a matching mcp-v* tag)"
+        type: boolean
+        default: true
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04
+    outputs:
+      dry_run: ${{ steps.release.outputs.dry_run }}
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - name: Validate release version and Git tag
+        id: release
+        env:
+          RELEASE_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
+        run: |
+          python3 scripts/version.py check mcp
+          node apps/mcp/scripts/release-npm.cjs plan
+
+  build:
+    needs: prepare
+    uses: ./.github/workflows/build-mcp.yml
+
+  validate:
+    needs: [prepare, build]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - uses: actions/download-artifact@v7
+        with:
+          name: mcp-package
+          path: ${{ runner.temp }}/mcp-release
+      - name: Validate the universal MCP package without publishing
+        env:
+          RELEASE_DRY_RUN: "true"
+          RELEASE_ARTIFACTS: ${{ runner.temp }}/mcp-release
+        run: node apps/mcp/scripts/release-npm.cjs publish "$RELEASE_ARTIFACTS"
+
+  publish:
+    needs: [prepare, validate]
+    if: needs.prepare.outputs.dry_run == 'false'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: npm-mcp-publish
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - name: Install npm with Trusted Publishing support
+        run: npm install --global npm@12.2.1 --ignore-scripts --no-audit --no-fund
+      - uses: actions/download-artifact@v7
+        with:
+          name: mcp-package
+          path: ${{ runner.temp }}/mcp-release
+      - name: Check native dependencies and publish MCP
+        env:
+          RELEASE_DRY_RUN: "false"
+          RELEASE_ARTIFACTS: ${{ runner.temp }}/mcp-release
+        run: node apps/mcp/scripts/release-npm.cjs publish "$RELEASE_ARTIFACTS"