Registries¶

A package's registry field says where it is published. rab supports five:

`registry`	Where	Publishes	Credential	Environment
`github`	GitHub Releases	built artifacts	the job's `github.token`	none
`crates.io`	crates.io	from source	Trusted Publishing; a token for first versions	`crates-io`
`pypi`	PyPI	built artifacts	Trusted Publishing	`pypi`
`npm`	npm	from source	Trusted Publishing, or a token	`npm`
`vscode`	VS Code Marketplace, and Open VSX with `open-vsx: true`	built artifacts	personal access tokens	`vscode-marketplace`

Two more channels are made from a github package's release once it is out, set on that package rather than as a registry:

Setting	Where	Publishes	Credential	Environment
`homebrew`	a Homebrew tap	a formula, as a pull request on the tap	a token for the tap	`homebrew`
`chocolatey`	Chocolatey	a package that installs the release's archive	an API key	`chocolatey`

Unlike a registry's version, these two can be published again until they are done: see the retry policy.

Every publish action follows the same steps:

preflight: refuse any selected version already on the registry (rule 1), in case another run published it since the gate;
upload, in rab.yml order;
verify: wait until the registry serves every selected version;
consume, for crates.io and PyPI: use each version as a stranger would. (npm's action currently consumes only in verify-only runs; see npm.)

Each action takes a verify-only input (default "false"). With "true" it skips the preflight and the upload, and only verifies (and consumes). The template passes the gate's verify-only output.

Trusted Publishing means the registry trusts a GitHub Actions OIDC token that names your repository, workflow file and environment, instead of a long-lived secret. The trusted publisher you configure on the registry must name release.yml and the environment in the table above.