vlt publish

Usage:

$ vlt publish

Create a tarball from a package and publish it to the configured registry. This command will pack the package in the current directory or specified folder, and then upload it to the configured registry.

The registry is the package's publishConfig.registry if set, else --registry, else a configured alias. publishConfig.registry alone is enough.

Options

tag

Publish the package with the given tag

$ vlt publish --tag=<tag>

access

Set access level (public or restricted)

$ vlt publish --access=<level>

otp

Provide an OTP to use when publishing a package.

$ vlt publish --otp=<otp>

publish-directory

Directory to use for pack and publish operations instead of the current directory. The directory must exist and nothing will be copied to it.

$ vlt publish --publish-directory=<path>

dry-run

Show what would be published without actually publishing.

$ vlt publish --dry-run

Publishing workspaces

--recursive publishes every workspace in the monorepo. To publish only some of them, pass --workspace=<path|glob>, --workspace-group=<name> or a DSS query with --scope=<query>.

$ vlt publish --recursive

With any of these flags, vlt skips the packages it shouldn't publish and keeps going, even if the selection matches only one package:

• Private packages show up as skipped (private).
• Versions already on the registry show up as skipped (already published). vlt finds them in the registry's package metadata before anything runs, or when the registry refuses the publish because the version exists. Packages with a publish directory are only caught the second way.

Skipped packages are included in the output, including --view=json. Any other failure, such as an authentication error, still stops the run. --dry-run shows only the skips found before anything runs.

Without these flags, a private package or an existing version is still an error.

Publishing in CI

Service token

For the vlt.io registry, publish from CI with a service token. A personal token answers every publish with a one-time-password challenge and fails unattended with EOTP. Set it as VLT_TOKEN:

      - run: vlt publish
      env:
        VLT_TOKEN: ${{ secrets.VLT_TOKEN }}

See CI & automation for the full workflow, and Authentication — CI for how token environment variables are named.

OIDC

If your CI provider supports OpenID Connect, vlt can publish without any stored tokens. On GitHub Actions, add id-token: write to your job's permissions and vlt handles authentication automatically.

See Authentication — OIDC for full details on supported providers and configuration.

jobs:
publish:
  runs-on: ubuntu-latest
  permissions:
    contents: read
    id-token: write
  steps:
    - uses: actions/checkout@v4
    - uses: vltpkg/setup-vlt@v1
    - run: vlt publish