wharfy 0.18.0 — release from GitHub Actions

Release from GitHub Actions

wharfy never stops to ask you anything, needs no terminal, and reads the tokens it needs from the environment. The commands you already run locally go straight into a workflow.

- run: wharfy release --yes
- run: wharfy publish --yes

Trigger it on a tag push, or run it by hand.

wharfy secrets tells you what to register

Different channels need different tokens. wharfy secrets reads your channels: and prints what is needed, and how to hand it to a workflow.

$ wharfy secrets
credentials your channels need (wharfy reads them from the environment):
  ✗ GITHUB_TOKEN             container, homebrew, releases, script
    upload the release, write your tap/bucket, open gated PRs, push to ghcr

in a GitHub Actions workflow:
  permissions:
    contents: write
    packages: write
  env:
    GITHUB_TOKEN: ${{ secrets.WHARFY_GITHUB_TOKEN }}
  note: GITHUB_TOKEN must be a PAT (repo scope): homebrew writes to your homebrew tap repo — the token Actions hands the workflow can only write to this repository
✓ 1 credential(s) needed; 1 not set in this environment
next:
  gh secret set WHARFY_GITHUB_TOKEN # register for CI: GITHUB_TOKEN (upload the release, write your tap/bucket, open gated PRs, push to ghcr)

• ✗ marks what you have not set yet.
• permissions: and env: paste straight into the workflow.
• The last line is the command that registers the secret.

Add --json for the same thing as JSON.

Writing to a tap or a bucket needs a PAT

The token GitHub Actions hands a workflow can only write to that one repository. Your homebrew tap, your scoop bucket, and the fork a winget submission goes through are all separate repositories, so a channel that writes to one of them needs a PAT you register yourself. secrets tells you which case you are in.

If you codesign your macOS binaries, the certificate (WHARFY_SIGN_P12) and its password are listed too — and that job needs a macOS runner.

Fixed

• container failed with a 401 in CI — wharfy now logs in to ghcr itself, instead of depending on what your local docker happens to be logged into.
• With prebuilt:, publish --yes recorded the container channel as published without pushing the image — it pushes now. Running publish container --yes on its own was always correct.

Getting it

brew upgrade wharfy / scoop update wharfy / go install github.com/ShiroDoromoto/wharfy/cmd/wharfy@latest. On Linux, from the apt / yum repo.