GitHub Releases¶

registry: github publishes built files as the assets of a GitHub release on the package's record tag. Use it for binaries, archives, or a copy of a package's wheels or .vsix.

  - name: onto-cli-binaries
    registry: github
    manifest: crates/onto-cli/Cargo.toml
    version: "0.2.0"
    tag: "onto-cli-bin-v{version}"
    artifacts:
      - kind: rust-binary
        bin: onto
        crate: onto-cli

A github package's name is free: check does not compare it with the manifest. Its version still comes from the manifest. It needs at least one artifact (rust-binary, python, maturin, vsix or command).

notes, checksums and attest shape the release: notes from a command (for example a CHANGELOG section), one SHA256SUMS-style file over every asset, and build provenance attestations. See GitHub release options.

Credentials and setup¶

None. The publish-github job uses the job's github.token with contents: write. It has no environment. A package with attest: true also needs id-token: write and attestations: write on the job (the template grants them; add them to a release.yml installed before).

Publish¶

The publish-github action, for each selected github package in order:

1. runs preflight;
2. takes the package's files from dist/release--<slug>--*/ (every build job's output, including the .sha256 files), and fails if there are none;
3. writes its checksums file beside them and runs its notes command, if it has them (release.py github-release);
4. with attest: true, attests every file but the .sha256 ones;
5. creates the release on the tag as a draft, if it does not exist: gh release create <tag> --draft --verify-tag --title "<name> <version>" with --notes-file (from notes) or --generate-notes, and --prerelease when the version contains -;
6. uploads the files with gh release upload --clobber;
7. downloads every asset the release now serves into a new directory and checks each .sha256, and the checksums file, against the files;
8. publishes the release (gh release edit <tag> --draft=false).

A run that stops before step 8 leaves a draft. A draft does not count as published, so the next run (release.py tag again) selects the package, uploads into the same draft and publishes it.

Then it runs verify --registry github --timeout 120.

Inputs¶

Verify¶

A github package counts as published when the release on its tag exists, is not a draft, and has at least one asset. verify reads the GitHub API with GH_TOKEN or GITHUB_TOKEN when set.

Consume¶

Nothing beyond step 7: the action has already downloaded every file as a stranger would and checked its checksum.