sysand publish#

Publish a KPAR to a Sysand index.

Usage#

sysand publish [OPTIONS] --index <URL> [PATH]

Description#

Publishes a .kpar file to a Sysand-compatible package index. The project must be built first using sysand build.

Authentication is required. See Authentication for how to configure credentials. In the default auto mode, sysand publish first uses trusted publishing when it detects a supported CI environment. If trusted publishing is unavailable, it falls back to bearer token credentials that match the publish URL: SYSAND_CRED_<X>_BEARER_TOKEN environment credentials first, then credentials stored with sysand auth login. Outside supported trusted-publishing environments, the command fails before making the upload request unless a matching bearer token is configured (and exactly one within the source used).

--index is required for sysand publish.

The package identifier used during publish is derived from project metadata. The publisher and name fields must follow the naming and normalization rules in Project identifiers.

Additional pre-publish validation rules:

  • version must be a valid Semantic Versioning 2.0 version and must not carry SemVer build metadata (+...).

  • license is required and must be a valid SPDX license expression. See Project metadata: license for examples.

  • The archive must also contain the license text for every license and exception the expression names, as LICENSES/<identifier>.txt (for example LICENSES/MIT.txt). sysand build warns when the file is missing; sysand publish refuses. Add it with sysand include.

  • The project must list at least one source file: an empty checksum field in .meta.json is rejected. Note that sysand include records a license text as the project’s license rather than as a source file, so a project holding only a license still counts as empty.

  • The KPAR must have a metamodel set in .meta.json.

  • All usages must be pkg:sysand/ PURLs or standard libraries.

  • The archive must be at most 100 MiB. This is the client’s own pre-upload check and applies to any index. The Sysand Index additionally enforces its own server-side limits, listed in KPAR archive validation.

Without [PATH], running the command from a workspace (rather than a project) errors and asks for an explicit path.

Arguments#

  • [PATH]: Path to the .kpar file to publish. If not provided, looks for a KPAR in the output directory matching the current project’s name and version (e.g. output/<name>-<version>.kpar).

Options#

  • --index <URL>: URL of the package index to publish to. Required. It must point to a path containing sysand-index-config.json (for example, https://sysand.com or https://test.sysand.com), and that file must set api_root, because the upload URL is always derived from the api_root the index advertises. Pointing --index at the API root itself does not work: no sysand-index-config.json is served there, so the command fails saying the index does not advertise a publish endpoint.

  • --trusted-publishing <MODE>: How to use CI trusted publishing for acquiring publish credentials. Possible values: auto, always, never [default: auto]

Global options#

  • -v, --verbose: Use verbose output

  • -q, --quiet: Do not output log messages

  • --no-config: Disable discovery of configuration files [env: SYSAND_NO_CONFIG]

  • --config-file <CONFIG_FILE>: Give path to sysand.toml to use for configuration [env: SYSAND_CONFIG_FILE]

  • -h, --help: Print help

Examples#

Build and publish the current project:

$ sysand build
$ sysand publish --index https://sysand.com

Publish a specific KPAR file:

$ sysand publish --index https://sysand.com ./my-project-1.0.0.kpar

See also#