@ricardochen1996/browser-use-mcp 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -7,6 +7,25 @@ uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-10-27
+
+Release tooling and documentation only: the server behaves exactly as 0.1.0.
+
+### Changed
+
+- **npm Trusted Publishing.** A `vX.Y.Z` tag release now publishes through npm's OIDC trusted
+  publishing when no `NPM_TOKEN` secret is configured: the package names this repository,
+  `.github/workflows/release.yml` and the `npm` environment, so npm exchanges the job's short-lived
+  OIDC token for publish access and generates provenance without a long-lived token. A repository
+  that adds an `NPM_TOKEN` secret keeps working the old way.
+- GitHub Actions runs the unit suite on Node 22.19 and 24 and every end-to-end suite as its own
+  annotated step on Ubuntu (Chrome plus a managed Python 3.12 environment); a failing unit test is
+  published as an annotation, so a red run is diagnosable from the run page without the job log.
+- The release workflow fetches annotated tag objects explicitly (checkout can leave a lightweight
+  ref), refuses to continue when the tag or version disagree, skips a version that is already on
+  npm, and attaches the verified `dist/` tarball to the GitHub Release.
+- README (English and Chinese) documents the trusted-publisher path and the tag workflow.
+
 ## [0.1.0] - 2026-10-27
 
 The first public version of `browser-use-mcp`: an MCP server that gives any agent a browser it can
@@ -161,5 +180,6 @@ These are the pre-release fixes that made the first version safe to publish.
 - `browser-use-mcp` is MIT licensed and bundles or vendors MIT work from `dsh-browser-use`,
   `jev-ultrafast` and `browser-harness`; see [NOTICE](NOTICE).
 
-[Unreleased]: https://github.com/ricardochen1996/browser-use-mcp/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/ricardochen1996/browser-use-mcp/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/ricardochen1996/browser-use-mcp/releases/tag/v0.1.1
 [0.1.0]: https://github.com/ricardochen1996/browser-use-mcp/releases/tag/v0.1.0

package/README.md

@@ -445,8 +445,12 @@ into a test state root on their first run. Release history is in [CHANGELOG.md](
 
 **Releases** are tagged `vX.Y.Z` on `main`; the [release workflow](.github/workflows/release.yml)
 validates the annotated tag against `package.json`, reruns CI (unit plus real-browser e2e), publishes
-to npm with provenance using the `NPM_TOKEN` repository secret, and creates the GitHub Release. Bump
-the version, add its `CHANGELOG.md` section, then `git tag -a vX.Y.Z -m "vX.Y.Z"` and push the tag.
+to npm with provenance, and creates the GitHub Release with the verified tarball attached. It accepts
+either an `NPM_TOKEN` repository secret (an automation or publish-capable granular token) or npm
+**Trusted Publishing**: name this repository and `.github/workflows/release.yml` as the package's
+trusted publisher and the OIDC token of the job is used instead. An already-published version is
+skipped, so a re-run only refreshes the GitHub Release. Bump the version, add its `CHANGELOG.md`
+section, then `git tag -a vX.Y.Z -m "vX.Y.Z"` and push the tag.
 
 ---
 

package/README.zh-CN.md

@@ -321,7 +321,7 @@ npm run doctor      # CLI 自检
 
 默认测试不花模型调用、不需要任何凭据；e2e 测试首次运行会把引擎装进一个测试用的状态根。版本历史见 [CHANGELOG.md](CHANGELOG.md)。
 
-**发布**：在 `main` 上打标注 tag `vX.Y.Z`，[release 工作流](.github/workflows/release.yml) 会校验 tag 与 `package.json` 一致、重跑 CI（单元 + 真浏览器 e2e）、用仓库 secret `NPM_TOKEN` 带 provenance 发布到 npm，并创建 GitHub Release。流程是幂等的：已发布的版本会被跳过，不会让重跑失败。
+**发布**：在 `main` 上打标注 tag `vX.Y.Z`，[release 工作流](.github/workflows/release.yml) 会校验 tag 与 `package.json` 一致、重跑 CI（单元 + 真浏览器 e2e）、带 provenance 发布到 npm，并创建 GitHub Release，附上校验过的 tarball。凭据二选一：仓库 secret `NPM_TOKEN`（automation 或带 publish 权限的 granular token），或在 npm 上把本仓库与 `.github/workflows/release.yml` 配成 **Trusted Publisher**，工作流会用 OIDC 换取短期发布凭据。已发布的版本会被跳过，重跑只刷新 GitHub Release。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ricardochen1996/browser-use-mcp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "An MCP server that gives any agent a browser it can see and click: the page is read as an indexed action space, and every step is one guarded operation on an observed target.",
   "type": "module",
   "license": "MIT",