wharfy 0.19.0 — hand your local credentials to CI

Hand your local credentials to CI

wharfy auth <kind> --print resolves a stored credential the same way wharfy resolves it when it runs, and writes it to stdout.

wharfy auth fury --print | gh secret set PACKAGE_REPO_TOKEN

A value you pull out of the keychain by hand is not always the value wharfy uses — it can still be wrapped. Register that in CI and you get a silent 401, with nothing to tell you whether the token is wrong or the account name is.

• stdout carries the value and nothing else. Everything cosmetic goes to stderr, so it never lands in the pipe.
• --print and --json cannot be combined. A secret in machine-readable output ends up in the context of the agent reading it.

wharfy secrets names the tools your runner needs

Tokens are not enough. If the build tool is missing on the runner, the job fails anyway — so secrets prints what to install, too.

$ wharfy secrets
tools wharfy shells out to (they must be on PATH wherever wharfy runs):
  ✗ goreleaser               cross-compile, archive and package the Go build path — build / release / publish shell out to it (BYO inputs, prebuilt: / bundle:, do not need it)
    go install github.com/goreleaser/goreleaser/v2@latest   # or: uses: goreleaser/goreleaser-action@v6 with: {install-only: true}

If you ship a binary you bring yourself (prebuilt: / bundle:), you do not need goreleaser — and secrets takes that into account.

publish catches apt/rpm packages that nobody can install yet

An upload can succeed and still leave your users unable to install. The response is 200, so from your side nothing looks wrong.

publish now reads the public index right after it writes, and warns with pkg_not_indexed if that version is not there. The upload itself succeeded, so it is not a failure.

verify says the same thing: when an apt/rpm package is missing, the first explanation is “waiting on the index, or still private” — not “broken”.

verify works without local records

verify used to start from the record of what you published (.wharfy/state.json). That record is generated locally, so it reaches neither another job nor a fresh clone. A workflow that checks out and runs verify saw most channels fall through to skipped, and checked almost nothing.

Now the version to verify falls through a chain:

No local record, or a HEAD that has moved past the tag — the version you shipped still gets verified.

$ wharfy verify
✓ verified homebrew; partial releases, script, goinstall, apt, rpm; skipped scoop

Fixed

• Re-running release on the same tag always failed — uploading an asset that already existed came back as 422 already_exists. When publish failed partway and you wanted to rerun the whole thing, release died first and you never reached publish; the only way through was to delete the GitHub Release by hand. The same tag can now be released as many times as you like.

Getting it

brew upgrade wharfy / scoop update wharfy / go install github.com/ShiroDoromoto/wharfy/cmd/wharfy@latest. On Linux, from the apt / yum repo.