dub-publish 0.3.0

= dub-publish

CLI to manage packages on the https://code.dlang.org[DUB package registry] — register, update, webhooks, logo, docs URL, categories, permissions, and remove.

Official dub has no publish / submit command. This tool automates the browser "My packages" flows.

== Install

[source,console]

git clone https://github.com/dlang-supplemental/dub-publish.git cd dub-publish dub build

Put the resulting dub-publish binary on your PATH, or run via dub run from a clone.

=== From CI (reusable workflow)

[source,yaml]

jobs: publish:

uses: dlang-supplemental/dub-publish/.github/workflows/register-package.yml@main
with:
  package: mypkg
  url: https://github.com/org/repo
  root: .
secrets:
  DUB_REGISTRY_USER: ${{ secrets.DUB_REGISTRY_USER }}
  DUB_REGISTRY_PASSWORD: ${{ secrets.DUB_REGISTRY_PASSWORD }}

== Quick start

[source,console]

dub-publish login --user yourname --save-credentials

prompts for password (no echo); stores it under the local config dir

dub-publish register --ignore-fork dub-publish hooks -n mypkg dub-publish update -n mypkg

CI still uses env vars / GitHub secrets (DUB_REGISTRY_USER, DUB_REGISTRY_PASSWORD) — do not rely on the local store in Actions.

== Commands

login:: Verify credentials. With --save-credentials, store them locally after a silent password prompt if needed. logout:: Delete the local credential store. register / publish:: Log in and POST /register_package. Idempotent if already registered (then refreshes). update:: Queue a metadata refresh (login, or --secret webhook). status:: Check whether a package exists. remove:: Owner delete (remove + remove_confirm). Requires --yes. logo:: Upload logo (--logo-file). png/jpeg/gif/bmp, max 1 MiB. logo-delete:: Reset to default logo. docs-url:: Set documentation URL (--docs-url). categories:: Set up to four categories (--category repeatable). hooks:: Enable/regenerate webhook secret; print + save secret and clean generic/GitHub/GitLab URLs (avoids https://github.com/dlang/dub-registry/issues/614[#614] malformation). hooks-disable:: Revoke webhook secret. repo:: Transfer repository coordinates (--kind / --owner / --project). perms-add:: Add a shared user (--username, --perm update|metadata|source|admin). leave:: Leave a shared package.

== Options

• --registry — default https://code.dlang.org
• --user / --password — or DUB_REGISTRY_USER / DUB_REGISTRY_PASSWORD
• --url — repository URL (default: git remote get-url origin)
• --package / -n — package name (default: from dub.json / dub.sdl)
• --ignore-fork — register even when the repo is a fork
• --dry-run — print what would happen
• --save-credentials — store user/password locally (see below)
• --secret-out / --hooks-out — override paths for hooks output files

=== Local credentials

Passwords are not one-way hashed: the CLI must replay them to the registry. Industry practice for this is OS-backed reversible protection:

• Windows: DPAPI bound to the current user (credentials.v1)
• Elsewhere: Base64 payload in credentials.v1 with file mode 0600

Paths:

• Windows: %LOCALAPPDATA%\dlang-supplemental\dub-publish\credentials.v1
• Unix: ~/.dlang-supplemental/dub-publish/credentials.v1

Legacy plaintext credentials files are upgraded automatically on load.

Webhook outputs (from hooks):

• %LOCALAPPDATA%\dlang-supplemental\dub-publish\hooks\<pkg>.secret
• %LOCALAPPDATA%\dlang-supplemental\dub-publish\hooks\<pkg>.hooks.txt

== How versions get published

Registration only links the repository. New versions appear when you push SemVer tags (v1.2.3); the registry polls about twice an hour. You can also trigger an immediate refresh:

[source,console]

dub-publish update -n mypkg --secret YOURPACKAGESECRET

== Changelog

See link:CHANGELOG.adoc[CHANGELOG].

== License

Boost Software License 1.0.