dub-publish 0.3.1

= dub-publish

CLI to manage packages on the https://code.dlang.org[DUB package registry] — register, update, webhooks, logo, docs URL, categories, permissions, and remove.

Official dub has no publish / submit command. This tool automates the browser "My packages" flows.

== Install

[source,console]

git clone https://github.com/dlang-supplemental/dub-publish.git cd dub-publish dub build

Put the resulting dub-publish binary on your PATH, or run via dub run from a clone.

=== From CI (reusable workflow)

[source,yaml]

jobs: publish:

uses: dlang-supplemental/dub-publish/.github/workflows/register-package.yml@main
with:
  package: mypkg
  url: https://github.com/org/repo
  root: .
secrets:
  DUB_REGISTRY_USER: ${{ secrets.DUB_REGISTRY_USER }}
  DUB_REGISTRY_PASSWORD: ${{ secrets.DUB_REGISTRY_PASSWORD }}

== Quick start

Agent / script friendly (password never on the argv):

[source,console]

PowerShell

dub-publish login --user yourname --password-file $env:USERPROFILE.secrets\dub-password.txt --save-credentials

or pipe

Get-Content $env:USERPROFILE.secrets\dub-password.txt -TotalCount 1 | dub-publish login --user yourname --password-stdin --save-credentials

After that, later commands reuse the local store (no password flags):

[source,console]

dub-publish register --ignore-fork dub-publish hooks -n mypkg dub-publish update -n mypkg

Interactive humans can use --prompt-password (TTY, no echo). -p / --password works but appears in shell history and process lists — dub-publish itself does not log it.

CI still uses env vars / GitHub secrets (DUB_REGISTRY_USER, DUB_REGISTRY_PASSWORD) — do not rely on the local store in Actions.

== Commands

login:: Verify credentials. Pair with --save-credentials to persist them. Password via --password-file, --password-stdin, -p / env, saved store, or --prompt-password. logout:: Delete the local credential store. register / publish:: Log in and POST /register_package. Idempotent if already registered (then refreshes). update:: Queue a metadata refresh (login, or --secret webhook). status:: Check whether a package exists. remove:: Owner delete (remove + remove_confirm). Requires --yes. logo:: Upload logo (--logo-file). png/jpeg/gif/bmp, max 1 MiB. logo-delete:: Reset to default logo. docs-url:: Set documentation URL (--docs-url). categories:: Set up to four categories (--category repeatable). hooks:: Enable/regenerate webhook secret; print + save secret and clean generic/GitHub/GitLab URLs (avoids https://github.com/dlang/dub-registry/issues/614[#614] malformation). hooks-disable:: Revoke webhook secret. repo:: Transfer repository coordinates (--kind / --owner / --project). perms-add:: Add a shared user (--username, --perm update|metadata|source|admin). leave:: Leave a shared package.

== Options

• --registry — default https://code.dlang.org
• --user / --password — or DUB_REGISTRY_USER / DUB_REGISTRY_PASSWORD
• --password-file — read password from file (first line); preferred for agents
• --password-stdin — read password from stdin (first line)
• --prompt-password — interactive TTY prompt (opt-in)
• --url — repository URL (default: git remote get-url origin)
• --package / -n — package name (default: from dub.json / dub.sdl)
• --ignore-fork — register even when the repo is a fork
• --dry-run — print what would happen
• --save-credentials — store user/password locally (see below)
• --secret-out / --hooks-out — override paths for hooks output files

=== Local credentials

Passwords are not one-way hashed: the CLI must replay them to the registry. Industry practice for this is OS-backed reversible protection:

• Windows: DPAPI bound to the current user (credentials.v1)
• Elsewhere: Base64 payload in credentials.v1 with file mode 0600

Paths:

• Windows: %LOCALAPPDATA%\dlang-supplemental\dub-publish\credentials.v1
• Unix: ~/.dlang-supplemental/dub-publish/credentials.v1

Legacy plaintext credentials files are upgraded automatically on load.

About -p: the app does not write the password to its own logs, but the shell may keep it in history and other local users can see it in the process list. Prefer --password-file / --password-stdin / saved store.

Webhook outputs (from hooks):

• %LOCALAPPDATA%\dlang-supplemental\dub-publish\hooks\<pkg>.secret
• %LOCALAPPDATA%\dlang-supplemental\dub-publish\hooks\<pkg>.hooks.txt

== How versions get published

Registration only links the repository. New versions appear when you push SemVer tags (v1.2.3); the registry polls about twice an hour. You can also trigger an immediate refresh:

[source,console]

dub-publish update -n mypkg --secret YOURPACKAGESECRET

== Changelog

See link:CHANGELOG.adoc[CHANGELOG].

== License

Boost Software License 1.0.