From adefdb603854c951cbb327fd8e6c3839a1a0a906 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Thu, 30 Jul 2026 12:55:11 -0700
Subject: [PATCH] fix(ci): allow dist/ in the MCP pack allowlist, which is the
 only thing it ships

#9946 unblocked the MCP publish build; packing then failed on the very next
step with "Unexpected file in package tarball".

The allowlist permits package/(bin|lib|scripts)/, which describes a source
layout this package has not had for some time. Its package.json ships
`files: ["dist", "scripts", ...]` and both `bin` entries point at
dist/bin/*.js -- so dist/ is not stray output, it is the entire package.

Verified against a real `npm pack`: the tarball contains dist/, scripts/ and
the four metadata files, and the old pattern rejected exactly the 9 dist/
entries. With the corrected pattern all three smoke-test stages pass locally --
allowlist clean, secret scan clean, and the installed binary answers --help.

The mismatch stayed invisible because the build step failed first, so packing
never ran. Fixing one exposed the next: this is the second half of the same
never-succeeded publish.
---
 .github/workflows/publish-mcp.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml
index c6fddc5e2a..d5ee08ea3d 100644
--- a/.github/workflows/publish-mcp.yml
+++ b/.github/workflows/publish-mcp.yml
@@ -153,7 +153,11 @@ jobs:
           PACK_JSON="$(npm pack --workspace @loopover/mcp --pack-destination "$RUNNER_TEMP" --json)"
           TARBALL="$(node -e 'const fs=require("fs"); const input=fs.readFileSync(0,"utf8"); process.stdout.write(JSON.parse(input)[0].filename)' <<< "$PACK_JSON")"
           TARBALL_PATH="$RUNNER_TEMP/$TARBALL"
-          UNEXPECTED_FILES="$(tar -tzf "$TARBALL_PATH" | grep -Ev '^(package/(bin|lib|scripts)/.+|package/(package.json|README.md|CHANGELOG.md|LICENSE))$' || true)"
+          # Allowlist mirrors packages/loopover-mcp/package.json's own `files`: the package ships COMPILED
+          # output under dist/ (its `bin` entries are dist/bin/*.js), plus the runtime scripts/ it declares.
+          # `bin|lib` here described a pre-dist source layout the package has not had for some time -- the
+          # mismatch stayed invisible only because the build step above failed first, so packing never ran.
+          UNEXPECTED_FILES="$(tar -tzf "$TARBALL_PATH" | grep -Ev '^(package/(dist|scripts)/.+|package/(package.json|README.md|CHANGELOG.md|LICENSE))$' || true)"
           if [ -n "$UNEXPECTED_FILES" ]; then
             printf '%s\n' "$UNEXPECTED_FILES"
             echo "Unexpected file in package tarball"