Releases

Releases

The canonical first release candidate is v0.1.0-rc.1. ShamooRuntime and ShamooTS use the same version and repository-specific tag. All public @shamoo/* packages share that version.

Runtime-first synchronized flow

The order is mandatory:

1. Prepare, review, and merge ShamooRuntime. The checked-in development version remains 0.1.0-SNAPSHOT, while the release workflow builds and tests 0.1.0-rc.1. The JAR advertises the RC identity and Runtime compatibility negotiation exposes the stable 0.1.0 base required by default ^0.1.0 plugin descriptors.
2. Update local main, tag that merged Runtime commit, and push it:

git switch main
git pull --ff-only origin main
git tag -a v0.1.0-rc.1 -m "ShamooRuntime v0.1.0-rc.1"
git push origin refs/tags/v0.1.0-rc.1

3. Wait for Runtime CI, API coverage, both platform process integrations, packaging, checksums, SBOM, and attestations to succeed. Download and verify the Runtime prerelease.
4. Prepare, review, and merge ShamooTS with every public package and embedded tool version set to 0.1.0-rc.1. Run pnpm contract:check against the matching tagged Runtime checkout, then all repository checks.
5. Only then update local main, tag the merged ShamooTS commit, and push it:

git switch main
git pull --ff-only origin main
git tag -a v0.1.0-rc.1 -m "ShamooTS v0.1.0-rc.1"
git push origin refs/tags/v0.1.0-rc.1

Both workflows reject tagged commits outside main; the ShamooTS workflow also checks out ShamooRuntime at the same tag and rejects noncanonical package/tag versions. Do not move or reuse a tag. Fixes require a new synchronized candidate such as v0.1.0-rc.2, again Runtime first.

Runtime artifacts

The Runtime GitHub prerelease contains exactly:

• shamoo-runtime-paper-0.1.0-rc.1.jar
• shamoo-runtime-velocity-0.1.0-rc.1.jar
• shamoo-runtime.spdx.json
• SHA256SUMS

The Actions artifact is retained for 30 days. GitHub build-provenance attestations cover both JARs, the SBOM, and checksum manifest; artifact-linked SBOM attestations cover the JARs.

set -euo pipefail
TAG=v0.1.0-rc.1
REPO=wasmake/ShamooRuntime
DEST="$PWD/shamoo-runtime-$TAG"
mkdir "$DEST"
gh release download "$TAG" --repo "$REPO" --dir "$DEST"
(cd "$DEST" && sha256sum --check SHA256SUMS)
for artifact in "$DEST"/*.jar "$DEST"/*.spdx.json "$DEST"/SHA256SUMS; do
  gh attestation verify "$artifact" \
    --repo "$REPO" \
    --signer-workflow "$REPO/.github/workflows/release-candidate.yml" \
    --source-ref "refs/tags/$TAG"
done
for artifact in "$DEST"/*.jar; do
  gh attestation verify "$artifact" \
    --repo "$REPO" \
    --signer-workflow "$REPO/.github/workflows/release-candidate.yml" \
    --source-ref "refs/tags/$TAG" \
    --predicate-type https://spdx.dev/Document/v2.3
done

Stop the target server and install only the matching artifact:

install -m 0644 "$DEST/shamoo-runtime-paper-${TAG#v}.jar" /path/to/paper/plugins/
install -m 0644 "$DEST/shamoo-runtime-velocity-${TAG#v}.jar" /path/to/velocity/plugins/

Run only one install command for the target platform. Restart and confirm the expected version in logs.

ShamooTS artifacts

The ShamooTS prerelease and retained 14-day Actions artifact contain:

• exactly 34 npm-format .tgz tarballs, one for every public @shamoo/* package;
• shamoo-v0.1.0-rc.1.spdx.json;
• SHA256SUMS covering every tarball and the SBOM.

GitHub build-provenance attestations cover all tarballs, the SBOM, and checksum manifest. Artifact-linked SBOM attestations cover all tarballs. Runtime JARs are not duplicated in the ShamooTS release.

set -euo pipefail
TAG=v0.1.0-rc.1
REPO=wasmake/ShamooTS
DEST="$PWD/shamoo-ts-$TAG"
mkdir "$DEST"
gh release download "$TAG" --repo "$REPO" --dir "$DEST"
(cd "$DEST" && sha256sum --check SHA256SUMS)
for artifact in "$DEST"/*.tgz "$DEST"/*.spdx.json "$DEST"/SHA256SUMS; do
  gh attestation verify "$artifact" \
    --repo "$REPO" \
    --signer-workflow "$REPO/.github/workflows/release-candidate.yml" \
    --source-ref "refs/tags/$TAG"
done
for artifact in "$DEST"/*.tgz; do
  gh attestation verify "$artifact" \
    --repo "$REPO" \
    --signer-workflow "$REPO/.github/workflows/release-candidate.yml" \
    --source-ref "refs/tags/$TAG" \
    --predicate-type https://spdx.dev/Document/v2.3
done
pnpm add "$DEST"/*.tgz

Install all tarballs in one package-manager operation so synchronized transitive Shamoo ranges resolve locally. Do not install any artifact missing from SHA256SUMS or with a failed checksum/attestation.

Distribution status

GitHub prerelease assets are currently the canonical distribution channel. Runtime artifacts are not published to Maven, Paper, Velocity, or another plugin registry. The ShamooTS candidate workflow does not publish to npm. No page in this wiki claims @shamoo/* packages are npm-published. Verify any later deliberate registry publication explicitly before use.

An RC prerelease is immutable as a version identity. Publication fails if a release already exists for the tag; assets are never replaced. An RC is not promoted by moving the tag or clearing its prerelease flag. A stable release requires a separately reviewed stable tag and flow.

Sources: ShamooRuntime release guide and ShamooTS release guide.