Releasing

This repository is pre-1.0. Workspace packages remain private until a deliberate release change flips that policy. Never publish from a dirty tree or from an unreviewed generated-output diff.

Preflight

From a committed release branch, verify the frozen versions, generated output, package manifests, and packed artifacts:

vp check
vp test
vp run check-goldens
vp run check-pack-manifests
vp run build
vp run --no-cache check-clean-worktree

vp run build includes the recursive package build and packed-artifact smoke checks. The clean-worktree guard is intentionally uncached and should be the last pre-publish check. Also review the release notes, provider support matrix, security notes, and known limitations.

Publish order

When the release owner deliberately changes all publishable manifests from private to public and assigns one shared version, publish in dependency order:

@klyro/core
@klyro/catalog and @klyro/renderer-compose
@klyro/platform-node
@klyro/cli

Use the repository’s configured npm account, public access policy, 2FA, and provenance/SBOM controls where available. Publish each package with the workspace package manager, wait for its registry metadata to become available, and verify that the next package resolves the released dependency versions.

Post-publish verification

From a clean temporary directory, verify the published CLI through the supported entry points (npm, npx, and pnpm dlx) and run:

klyro --help
klyro --version
klyro validate --config klyro.yaml
klyro plan --config klyro.yaml
klyro generate --config klyro.yaml --out ./generated

Inspect the generated project, run docker compose config when Docker is available, and confirm that no secret values entered the source, artifacts, or diagnostics.

Tag the exact commit only after these checks pass. Do not reuse a published version for a correction; follow the registry’s deprecation policy and publish a new version instead.