You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
sreg yank <eco> <name> <version> and sreg delete <eco> <name> (<version> | --all) are
back, for composer, npm, cargo, nuget, generic, swift and maven. They
authenticate with the token, with GitHub Actions OIDC (--oidc, --oidc-project; _
lets the registry find the project, an admin credential included) or by signing in
through the browser (--login).
sreg login --yank, --delete and --delete-package ask the registry for a short-lived
admin token that may yank or delete exactly the listed versions or packages (needs a
registry that supports the yank and delete login purposes, docs/api.md 6.20).
The client can replace the scope of a secret: Client::update_secret sends PATCH …/secrets/<id> with a description and/or a scope (UpdateSecretRequest); describe_secret keeps working and sends only the description.
sreg whoami lists the operations of a yank or delete login token (ops in the registry's
answer, also in --json) instead of reporting that it has no grants, and the package
versions a publish login token may publish (scopes).
Install sreg-cli 0.2.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.2.3/sreg-cli-installer.sh | sh
A credential may hold admin together with read and publish (registry API, docs/api.md
2.4): the client models document it, and sreg whoami shows the roles and the grants of a token
that both administers and reads or publishes. The legacy kind of such a credential is admin.
Documentation: docs/spec.md and docs/api.md synced with the registry.
Install sreg-cli 0.2.2
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.2.2/sreg-cli-installer.sh | sh
sreg login --publish no longer stops at 20 versions on its own: the registry decides, with
its MAX_PUBLISH_SCOPES setting (20 by default), and its error names the limit.
Documentation: docs/spec.md and docs/api.md synced with the registry (the scope of an
existing secret can be edited with PATCH …/secrets/<id>).
Install sreg-cli 0.2.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.2.1/sreg-cli-installer.sh | sh
Credentials with roles (registry API, docs/api.md 2.4): sreg whoami prints Roles: (the
roles the token may use) and, for a token with both read and publish, a list of grants
for each role. --json output gains roles and access. The client models know roles, read_grants, publish_grants and the scope of a secret, and update_credential sends PATCH with roles and per-role grants. Registries without roles keep working: kind and grants are used when roles and access are missing.
Changed
sreg whoami prints Roles: instead of Kind: (--json still has kind).
Install sreg-cli 0.2.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.2.0/sreg-cli-installer.sh | sh
The "Bump and release" workflow pushes the release commit and tag as the release GitHub App
(SERVERLESS_REGISTRY_RELEASE_APP_ID and SERVERLESS_REGISTRY_RELEASE_APP_PRIVATE_KEY) when
they are set. A ruleset that requires status checks on main rejects the push made with GITHUB_TOKEN (GH013, "Required status check is expected"); the App can be put on the
ruleset's bypass list. RELEASE_TOKEN still takes precedence, and without any of them the
workflow uses GITHUB_TOKEN.
Install sreg-cli 0.1.5
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.1.5/sreg-cli-installer.sh | sh
--archive <file> for sreg npm|composer|cargo|nuget publish: publish an archive built
earlier (.tgz, .zip, .crate, .nupkg) byte for byte. The package, version and
dependencies are read from the manifest inside the archive; no git checkout and no
native packaging tool is needed, and tags in the current directory are ignored. --version is a consistency check (for a Composer archive without a version, the
version to publish). The archive is validated completely before the first request; --tag-prefix, project and workspace selectors and arguments after -- are rejected
together with it. Authentication, --dry-run, --skip-existing and --json work as
before.
sreg cargo publish --archive … --source-registry-index <url>: dependencies that refer
to the given (retired) registry index are described in the sparse index as
dependencies from this registry (registry: null), without changing the archive;
dependencies from other registries keep their identity.
Install sreg-cli 0.1.3
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.1.3/sreg-cli-installer.sh | sh
The GitHub Action repository is renamed to kduma-OSS/serverless-registry-action,
which now also has setup, auth and get actions next to publish
(uses: kduma-OSS/serverless-registry-action/publish@v1); the release job dispatches
its Release workflow there.
Install sreg-cli 0.1.2
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.1.2/sreg-cli-installer.sh | sh
The registry URL may carry the token in its userinfo, Composer style: https://<login>:<password>@packages.example.com/ (both parts percent-decoded). The
credentials need a login and a password, are refused over plain http except for localhost/127.0.0.1, and are stripped from the URL before it is used or printed. --oidc still wins; an explicit --token/REGISTRY_TOKEN that differs from the URL's
credentials is an error. sreg auth writes the URL's credentials, and the GitHub
Action skips OIDC when registry carries them.
sreg generic get <name> <constraint>: a version that is not an exact semver version
(^1.2, ">=1 <2", 1.x) is a constraint resolved by the registry
(GET /generic/<name>/latest?version=<constraint>, with --prerelease and the label
filters); the resolved version is printed on stderr and --json prints the feed
document.
sreg generic get --sole: fail unless the label filter selects exactly one file. The
registry's GET /generic/<name>/<version|latest>/-/download redirects to that file and
names it in X-Resolved-Version and X-Resolved-File; the file is still verified
against the size and SHA-256 of its feed entry. 409 ambiguous lists the candidate
files and exits with 1; --out may name a file path instead of a directory.
Bump and release workflow (.github/workflows/bump-and-release.yml, started by hand
on main): computes the next version (prerelease, patch, minor, release, custom, …) with the dependency-free scripts/bump-version.mjs, sets it in Cargo.toml and Cargo.lock, rolls CHANGELOG.md, commits and tags v<version> and
starts the cargo-dist Release workflow for the tag.
cargo-dist post-announce job (.github/workflows/release-action.yml): after a stable
release it starts the Release workflow of kduma-OSS/serverless-registry-publish-action with the new version as the action's
default sreg-version, authenticated as a GitHub App (repository secrets SERVERLESS_REGISTRY_RELEASE_APP_ID and SERVERLESS_REGISTRY_RELEASE_APP_PRIVATE_KEY).
Without them it only prints a notice; the action repository's hourly sync then picks
the release up.
Changed
The GitHub Action moved to kduma-OSS/serverless-registry-publish-action
(uses: kduma-OSS/serverless-registry-publish-action@v1), with its history; it is
versioned and released there, and the action/ directory and action/VERSION are gone.
Install sreg-cli 0.1.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.1.1/sreg-cli-installer.sh | sh
The registry URL may carry the token in its userinfo, Composer style: https://<login>:<password>@packages.example.com/ (both parts percent-decoded). The
credentials need a login and a password, are refused over plain http except for localhost/127.0.0.1, and are stripped from the URL before it is used or printed. --oidc still wins; an explicit --token/REGISTRY_TOKEN that differs from the URL's
credentials is an error. sreg auth writes the URL's credentials, and the GitHub
Action skips OIDC when registry carries them.
sreg generic get <name> <constraint>: a version that is not an exact semver version
(^1.2, ">=1 <2", 1.x) is a constraint resolved by the registry
(GET /generic/<name>/latest?version=<constraint>, with --prerelease and the label
filters); the resolved version is printed on stderr and --json prints the feed
document.
sreg generic get --sole: fail unless the label filter selects exactly one file. The
registry's GET /generic/<name>/<version|latest>/-/download redirects to that file and
names it in X-Resolved-Version and X-Resolved-File; the file is still verified
against the size and SHA-256 of its feed entry. 409 ambiguous lists the candidate
files and exits with 1; --out may name a file path instead of a directory.
Bump and release workflow (.github/workflows/bump-and-release.yml, started by hand
on main): computes the next version (prerelease, patch, minor, release, custom, …) with the dependency-free scripts/bump-version.mjs, sets it in Cargo.toml and Cargo.lock, rolls CHANGELOG.md, commits and tags v<version> and
starts the cargo-dist Release workflow for the tag.
cargo-dist post-announce job (.github/workflows/release-action.yml): after a stable
release it starts the Release workflow of kduma-OSS/serverless-registry-publish-action with the new version as the action's
default sreg-version, authenticated as a GitHub App (repository secrets SERVERLESS_REGISTRY_RELEASE_APP_ID and SERVERLESS_REGISTRY_RELEASE_APP_PRIVATE_KEY).
Without them it only prints a notice; the action repository's hourly sync then picks
the release up.
Changed
The GitHub Action moved to kduma-OSS/serverless-registry-publish-action
(uses: kduma-OSS/serverless-registry-publish-action@v1), with its history; it is
versioned and released there, and the action/ directory and action/VERSION are gone.
Install sreg-cli 0.1.1-beta.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/kduma-OSS/serverless-registry-cli/releases/download/v0.1.1-beta.1/sreg-cli-installer.sh | sh
