Releases

Releases

The canonical first release candidate is v0.1.0-rc.1. ShamooRuntime and ShamooTS use the same version and repository-specific tag. All public @shamoo/* packages share that version.

Runtime-first synchronized flow

The order is mandatory:

1. Prepare and verify ShamooRuntime. For the corresponding TypeScript candidate, the checked-in development projectVersion remains the compatible stable base 0.1.0-SNAPSHOT or 0.1.0; the Runtime release workflow passes 0.1.0-rc.1 at build time.
2. Tag the reviewed Runtime commit and push it:

git tag -a v0.1.0-rc.1 -m "ShamooRuntime v0.1.0-rc.1"
git push origin refs/tags/v0.1.0-rc.1

3. Wait for Runtime CI, API coverage, both platform process integrations, packaging, checksums, SBOM, and attestations to succeed. Download and verify the Runtime prerelease.
4. Prepare ShamooTS with every public package and embedded tool version set to 0.1.0-rc.1. Run pnpm contract:check against the matching tagged Runtime checkout, then all repository checks.
5. Only then tag and push ShamooTS:

git tag -a v0.1.0-rc.1 -m "ShamooTS v0.1.0-rc.1"
git push origin refs/tags/v0.1.0-rc.1

The ShamooTS workflow checks out ShamooRuntime at the same tag and rejects noncanonical package/tag versions. Do not move or reuse a tag. Fixes require a new synchronized candidate such as v0.1.0-rc.2, again Runtime first.

Runtime artifacts

The Runtime GitHub prerelease contains exactly:

• shamoo-runtime-paper-0.1.0-rc.1.jar
• shamoo-runtime-velocity-0.1.0-rc.1.jar
• shamoo-runtime.spdx.json
• SHA256SUMS

The Actions artifact is retained for 30 days. GitHub build-provenance attestations cover both JARs, the SBOM, and checksum manifest; artifact-linked SBOM attestations cover the JARs.

TAG=v0.1.0-rc.1
REPO=wasmake/ShamooRuntime
DEST="$PWD/shamoo-runtime-$TAG"
mkdir "$DEST"
gh release download "$TAG" --repo "$REPO" --dir "$DEST"
(cd "$DEST" && sha256sum --check SHA256SUMS)
for artifact in "$DEST"/*.jar "$DEST"/*.spdx.json "$DEST"/SHA256SUMS; do
  gh attestation verify "$artifact" --repo "$REPO"
done

Stop the target server and install only the matching artifact:

install -m 0644 "$DEST/shamoo-runtime-paper-${TAG#v}.jar" /path/to/paper/plugins/
install -m 0644 "$DEST/shamoo-runtime-velocity-${TAG#v}.jar" /path/to/velocity/plugins/

Run only one install command for the target platform. Restart and confirm the expected version in logs.

ShamooTS artifacts

The ShamooTS prerelease and retained 14-day Actions artifact contain:

• one npm-format .tgz tarball for every public @shamoo/* package;
• shamoo-v0.1.0-rc.1.spdx.json;
• SHA256SUMS covering every tarball and the SBOM.

GitHub build-provenance attestations cover all tarballs, the SBOM, and checksum manifest. Runtime JARs are not duplicated in the ShamooTS release.

TAG=v0.1.0-rc.1
REPO=wasmake/ShamooTS
DEST="$PWD/shamoo-ts-$TAG"
mkdir "$DEST"
gh release download "$TAG" --repo "$REPO" --dir "$DEST"
(cd "$DEST" && sha256sum --check SHA256SUMS)
for artifact in "$DEST"/*.tgz "$DEST"/*.spdx.json "$DEST"/SHA256SUMS; do
  gh attestation verify "$artifact" --repo "$REPO"
done
pnpm add "$DEST"/*.tgz

Install all tarballs in one package-manager operation so synchronized transitive Shamoo ranges resolve locally. Do not install any artifact missing from SHA256SUMS or with a failed checksum/attestation.

Distribution status

GitHub prerelease assets are currently the canonical distribution channel. Runtime artifacts are not published to Maven, Paper, Velocity, or another plugin registry. The ShamooTS candidate workflow does not publish to npm. No page in this wiki claims @shamoo/* packages are npm-published. Verify any later deliberate registry publication explicitly before use.

An RC prerelease is immutable as a version identity. Rerunning the workflow may rebuild assets from the same tagged commit, but an RC is not promoted by moving the tag or clearing its prerelease flag. A stable release requires a separately reviewed stable tag and flow.

Sources: ShamooRuntime release guide and ShamooTS release guide.