shell-tool-mcp cannot be released until its publish job asks for permissions the caller grants

[charliewwdev]

shell-tool-mcp.yml is a reusable workflow, and its publish job declares:

permissions:
  id-token: write
  contents: read

A called workflow may only reduce the caller's permissions, never raise them. This repository's default token permissions do not include id-token: write, so any workflow that calls this one is rejected before a single job starts — reported only as "This run likely failed because of a workflow file issue", with no jobs and no logs.

That is why it has been removed from rust-release.yml for now. It was contributing nothing to the release anyway: the release job explicitly deleted its artifacts before publishing, and shell-tool-mcp-ci.yml already builds it on its own.

To bring it back, either grant the permission on the calling job:

  shell-tool-mcp:
    permissions:
      id-token: write
      contents: read
    uses: ./.github/workflows/shell-tool-mcp.yml

or drop OIDC publishing from it.

While looking: the publish step configures npm with scope: "@openai", inherited from upstream. The package is @ai-dashboad/opencli-shell-tool-mcp, so that scope is wrong here and would have to be fixed before anything is published.