Configuration Reference

Complete configuration file reference

Anodizer uses .anodizer.yaml (or .anodizer.toml) in your project root.

Top-Level Fields

Use cases: smoke-test artifacts against the staged dist tree, run external validators (antivirus, vulnerability scanners), stage external state, or abort the release before any publisher writes to a registry.

A non-zero exit code from any hook aborts the release before publish runs. Hooks fire in declared order. Use --skip=before-publish to bypass. | | binary_signs | list of SignConfig | [] | Binary-specific signing configs (same shape as signs but only for binary artifacts). The artifacts field on each entry is constrained at parse time to binary / none (or omitted) — a broader filter on binary_signs would silently match nothing because the loop only iterates Binary artifacts. Constraint lives in deserialize_binary_signs. | | changelog | ChangelogConfig | — | Changelog generation configuration. | | cloudsmiths | list of CloudSmithConfig | — | CloudSmith publisher configurations. | | crates | list of CrateConfig | [] | List of crates in this project. | | defaults | Defaults | — | Default values applied to all crates unless overridden. | | dist | string | ./dist | Output directory for build artifacts (default: ./dist). | | docker_signs | list of DockerSignConfig | — | Docker image signing configurations. | | dockerhub | list of DockerHubConfig | — | DockerHub description sync configurations. | | env | list of string | — | Environment variables available to all template expressions.

List of KEY=VALUE strings: env: ["MY_VAR=hello", "DEPLOY_ENV=staging"]. Order is preserved so chained env applications (sign + sbom + notarize) see entries in declared order. Values are rendered through the template engine before being set, so expressions like {{ Tag }} or {{ Date }} are expanded. | | env_files | EnvFilesConfig | — | Environment file configuration. Accepts either: - A list of .env file paths: [".env", ".release.env"] - A struct with token file paths: { github_token: "~/.config/goreleaser/github_token" } | | force_token | ForceTokenKind | — | Force a specific token type for authentication. When set, overrides automatic token detection from environment variables. | | gemfury | list of GemFuryConfig | — | GemFury (fury.io) deb/rpm/apk publishing configurations. Mirrors The gemfury: block. The legacy spelling furies: is accepted via serde alias; a one-time deprecation warning is emitted by [warn_on_legacy_furies_alias]. | | git | GitConfig | — | Git-level tag discovery and sorting settings. | | gitea_urls | GiteaUrlsConfig | — | Custom Gitea API/download URLs for self-hosted Gitea installations. | | github_urls | GitHubUrlsConfig | — | Custom GitHub API/upload/download URLs for GitHub Enterprise installations. | | gitlab_urls | GitLabUrlsConfig | — | Custom GitLab API/download URLs for self-hosted GitLab installations. | | homebrew_casks | list of HomebrewCaskConfig | — | Top-level Homebrew Cask configurations. homebrew_casks is a top-level array with its own repository, commit_author, directory, skip_upload, hooks, dependencies, conflicts, completions, manpages, structured uninstall/zap, etc. | | includes | list of IncludeSpec | — | Additional config files to merge into this config. Supports plain string paths, from_file: for structured file paths, and from_url: for fetching configs from URLs with optional headers. | | makeselfs | list of MakeselfConfig | [] | Makeself self-extracting archive configurations. | | mcp | McpConfig | {"name":null,"title":null,"description":null,"homepage":null,"packages":[],"transports":[],"skip":null,"repository":{"url":"","source":"","id":"","subfolder":""},"auth":{"type":"none"},"registry":null,"if":null,"retain_on_rollback":null} | MCP (Model Context Protocol) server registry publishing configuration. When name is empty (the default), the publisher is skipped. The mcp: publisher block. | | metadata | MetadataConfig | — | Project metadata configuration (applied to metadata.json output files). | | milestones | list of MilestoneConfig | — | Milestone closing configurations. | | monorepo | MonorepoConfig | — | Monorepo configuration. When configured, tag discovery filters by tag_prefix and the working directory is scoped to dir. | | nightly | NightlyConfig | — | Nightly release configuration. | | notarize | NotarizeConfig | — | macOS code signing and notarization configuration. | | npms | list of NpmConfig | — | NPM package registry publishing configurations. One entry per published package. In the default optional-deps mode anodizer emits npm's native per-platform packages (biome / git-cliff pattern); in postinstall mode it emits a download shim (the npms: parity). | | partial | PartialConfig | — | Partial/split build configuration for fan-out CI pipelines. | | project_name | string | — | Human-readable project name used in templates and release titles. | | publishers | list of PublisherConfig | — | Generic artifact publisher configurations. | | release | ReleaseConfig | — | GitHub release configuration shared by all crates. | | report_sizes | bool | — | When true, log artifact file sizes after building. | | retry | RetryConfig | — | Top-level retry configuration applied to network-bound operations (announcers, git providers, HTTP uploads, docker pipes). When omitted, RetryConfig::default() is used (10 attempts, 10s base, 5m cap — the project-level retry policy). | | sboms | list of SbomConfig | [] | Software bill of materials (SBOM) generation configurations. | | schemastore | SchemastoreConfig | {"repository":null,"commit_author":null,"versioned":null,"skip":null,"if":null,"schemas":[],"retain_on_rollback":null} | SchemaStore publisher. Registers the project's JSON Schema(s) on SchemaStore at release time. When schemas is empty (the default), the publisher is skipped. The schemastore: publisher block. | | signs | list of SignConfig | [] | Signing configurations for binaries, archives, and checksums. | | snapshot | SnapshotConfig | — | Snapshot release configuration (local/non-tag builds). | | source | SourceConfig | — | Source archive configuration. | | srpms | SrpmConfig | — | Source RPM configuration. Renamed from srpm: (singular) for spelling parity with Defaults.srpms and the rest of the plural-name packaging fields. The srpm: spelling is still accepted via serde alias for back-compat. | | tag | TagConfig | — | Automatic semantic version tagging configuration. | | template_files | list of TemplateFileConfig | — | Template files to render and include as release artifacts. File contents are processed through the template engine. | | uploads | list of UploadConfig | — | Generic HTTP upload configurations. | | upx | list of UpxConfig | [] | UPX binary compression configurations. | | variables | map | — | Custom template variables accessible as {{ Var.<key> }} in templates. Provides a way to define reusable values, especially useful with config includes.

Stored as a BTreeMap so rendering iterates in deterministic (sorted) key order — without this guarantee, a value that references another variable (b: "{{ Var.a }}_v2") could render before its dependency on a different process / host. The current resolver is single-pass (one render per value), so cross-variable references only resolve when the referenced key sorts earlier. | | verify_release | VerifyReleaseConfig | {"enabled":false,"assert_assets":true,"install_smoke":null} | Opt-in post-release verification gate. Runs LAST (after the release is created and every publisher has run) and REPORTS post-publish defects — missing assets, failed install smoke-tests, glibc-ceiling violations. Because it runs after the irreversible publish, a failure exits non-zero to flag CI but never undoes the release. Off unless verify_release.enabled: true. | | version | integer | — | Schema version. Currently supports 1 (implicit default) and 2. | | version_files | list of string | — | Repo-committed files that embed the release version outside Cargo.toml (e.g. a Helm Chart.yaml, an install doc, a README badge), given as repo-root-relative path strings. At tag time each listed file has its occurrences of the old version rewritten to the new version — both the bare (0.1.0) and v-prefixed (v0.1.0) forms, word-boundary anchored — and is staged into the same bump commit as Cargo.toml / Cargo.lock, so these files never drift from the tag.

yaml version_files: - charts/cfgd/Chart.yaml - docs/installation.md | | workspaces | list of WorkspaceConfig | — | Independent workspace roots in a monorepo. |

after

Top-level lifecycle hooks for before and after blocks. Each block carries a list of hook commands that run around the entire pipeline (not individual stages).

The canonical key is hooks: for both before: and after: to the conventional spelling. The post: spelling is accepted as a serde alias on hooks for back-compat with the previous anodizer spelling; users with after: { post: [...] } keep working and a deprecation warning is logged when both spellings appear in the same block (see [HooksConfig::merge_hook_aliases]).

announce

Announce-stage integrations.

Message bodies are secret-redacted before send: known secret env values are masked (a real token becomes $NAME). Redaction is on by default; anodizer notify --allow-secrets opts a single send out for a trusted private channel, while anodizer's own log output stays redacted regardless.

Announcers run concurrently; any still running when this deadline elapses is abandoned with a warning rather than awaited. This bounds the stage so unreachable channels cannot accumulate into a hang that trips the pipeline timeout after publishers already crossed one-way doors. Raise it only if a slow-but-reachable channel legitimately needs longer. | | discord | DiscordAnnounce | — | Discord announcement configuration. | | discourse | DiscourseAnnounce | — | Discourse announcement configuration. | | email | EmailAnnounce | — | Email announcement configuration. accepts the historical smtp: key as an alias because the field was renamed smtp: -> email: in v1.21+ and kept the alias for migration. Keeping the alias avoids forcing a re-yaml of legacy configs. | | gate_on | AnnounceGate | required_publishers | Selects when AnnounceStage runs vs. skips based on the PublishReport written by PublishStage/BlobStage. Default is required_publishers (announce only if every required publisher succeeded). See [AnnounceGate] for the other variants. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the entire announce stage is skipped. Render failure hard-errors. The announce.if:. Distinct from skip: (always-skip predicate) — both surfaces are documented. | | linkedin | LinkedInAnnounce | — | LinkedIn announcement configuration. | | mastodon | MastodonAnnounce | — | Mastodon announcement configuration. | | mattermost | MattermostAnnounce | — | Mattermost announcement configuration. | | opencollective | OpenCollectiveAnnounce | — | OpenCollective announcement configuration. | | reddit | RedditAnnounce | — | Reddit announcement configuration. | | skip | StringOrBool | — | Template-conditional skip: if rendered to "true", skip the entire announce stage. | | slack | SlackAnnounce | — | Slack announcement configuration. | | teams | TeamsAnnounce | — | Microsoft Teams announcement configuration. | | telegram | TelegramAnnounce | — | Telegram announcement configuration. | | twitter | TwitterAnnounce | — | Twitter/X announcement configuration. | | webhook | WebhookConfig | — | Generic webhook announcement configuration. |

appimages

AppImage packaging configuration.

Drives the AppImage stage, which bundles a built Linux binary plus its desktop integration (a .desktop entry + icon) into a single self-contained, runnable .AppImage file via linuxdeploy's appimage output plugin. One .AppImage is produced per matching Linux target so a multi-arch build yields distinct, non-colliding outputs.

YAML: yaml appimages: - id: helix ids: [helix-bin] desktop: contrib/Helix.desktop icon: contrib/helix.png appdir_extra: - src: runtime/ dst: usr/lib/helix/runtime update_information: "gh-releases-zsync|helix-editor|helix|latest|helix-*.AppImage.zsync" runtime_harvest: command: "{{ ArtifactPath }} --populate-runtime {{ HarvestDir }}" dir: runtime/

artifactories

Artifactory upload configuration. Uploads artifacts to JFrog Artifactory repositories.

yaml artifactories: - target: "https://repo.example.com/{{ .ProjectName }}/{{ .Tag }}/{{ .ArtifactName }}" exclude: ["*.sha256", "*.sig", "*.cdx.json"] | | extra_files | list of ExtraFileSpec | — | Extra files to upload alongside build artifacts. | | extra_files_only | bool | — | When true, upload only extra_files (skip normal artifacts). | | exts | list of string | — | File extension filter: only upload artifacts matching these extensions. | | ids | list of string | — | Build IDs filter: only upload artifacts from builds whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the artifactory publisher is skipped. Render failure hard-errors. The artifactories[].if:. | | meta | bool | — | Include metadata artifacts in uploaded artifacts. | | method | string | — | HTTP method to use for uploads (default: "PUT"). | | mode | string | — | Upload mode: "archive" (upload archives) or "binary" (upload binaries). | | name | string | — | Human-readable name for this publisher (used in logs). | | overwrite | bool | — | Re-upload an artifact even when an identical one already exists at the target path (default: false).

With the default, a re-run that finds the same version's artifact already uploaded with a matching SHA-256 records an idempotent SKIP rather than re-PUTting it — so re-running a partially-failed release is safe. A path that already holds a different artifact for the same version still hard-errors (immutable-version drift) unless overwrite is set. With overwrite: true, every artifact is PUT unconditionally (Artifactory replaces the stored copy), restoring blind-overwrite behaviour for repos configured to allow it. | | password | string | — | Artifactory password or API key (or env var reference). | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | signature | bool | — | Include signatures in uploaded artifacts. | | skip | StringOrBool | — | Template-conditional skip: if rendered result is "true", skip this publisher. | | target | string | — | Target URL template for uploads (supports template variables). | | trusted_certificates | string | — | PEM-encoded trusted CA certificates for TLS verification. Appended to the system certificate pool. | | username | string | — | Artifactory username for authentication. |

attestations

SLSA build-provenance / attestation configuration for binaries and archives.

Two modes select how anodizer participates in attestation:

• [AttestationMode::Subjects] (the default) emits a subjects manifest (dist/attestation-subjects.json) that anodizer-action feeds to GitHub's actions/attest-build-provenance. anodizer does NOT mint a GitHub-trusted attestation itself in this mode — the Action's OIDC identity does. This is the path fd / biome / gping use. - [AttestationMode::Emit] generates a self-contained in-toto v1 statement carrying an SLSA provenance v1 predicate over the selected artifacts, writes it as a release asset (attestation.intoto.jsonl), and lets the existing signs: stage sign it (keyed, not OIDC). This is for users who can't run the Action (the --with-provenance toggle).

YAML: yaml attestations: enabled: true mode: subjects # or: emit ; default = subjects artifacts: [archive, binary, checksum]

Defaults to [archive, binary, checksum] when omitted. | | enabled | bool | false | Enable attestation. When false (the default), the stage is a no-op. | | mode | AttestationMode | — | Participation mode: subjects (default) writes a manifest for actions/attest-build-provenance; emit generates and signs an in-toto SLSA provenance statement as a release asset. | | skip | StringOrBool | — | Skip the attestation stage. Accepts a bool or a template string. |

aur_sources

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this config. Accepts the legacy disable: spelling via serde alias for back-compat. | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. | | url_template | string | — | Custom URL template for download URLs. |

before

Top-level lifecycle hooks for before and after blocks. Each block carries a list of hook commands that run around the entire pipeline (not individual stages).

The canonical key is hooks: for both before: and after: to the conventional spelling. The post: spelling is accepted as a serde alias on hooks for back-compat with the previous anodizer spelling; users with after: { post: [...] } keep working and a deprecation warning is logged when both spellings appear in the same block (see [HooksConfig::merge_hook_aliases]).

before_publish

Top-level lifecycle hooks for before and after blocks. Each block carries a list of hook commands that run around the entire pipeline (not individual stages).

The canonical key is hooks: for both before: and after: to the conventional spelling. The post: spelling is accepted as a serde alias on hooks for back-compat with the previous anodizer spelling; users with after: { post: [...] } keep working and a deprecation warning is logged when both spellings appear in the same block (see [HooksConfig::merge_hook_aliases]).

binary_signs

changelog

With use: git the intersect is precise (commits are filtered by their touched files). With use: github only the first path is used for API queries; with use: gitlab / gitea path filtering is unsupported, so a narrowing paths there is coarse and a warning is emitted. Supports template rendering. | | skip | StringOrBool | — | Skip changelog generation. Accepts bool or template string (e.g. "{{ if IsSnapshot }}true{{ endif }}" for conditional skip).

Accepts disable: as an alias so imported configs (which use changelog.disable:) parse cleanly without a rename. Anodizer's broader convention is skip: (mirrors release.skip_upload, stage-level skip: flags), so the canonical key stays skip:. | | snapshot | bool | — | When true, render the changelog even in snapshot mode. Anodizer matches the default (skip changelog on snapshot) and lets users opt back in here for local preview / draft generation. Wired in crates/stage-changelog/src/lib.rs::ChangelogStage::run. | | sort | string | — | Sort order for changelog entries: "asc" or "desc" (default: "asc"). | | title | string | — | Title heading for the changelog. Default: "Changelog". Supports templates. | | use | string | — | Changelog source: "git" (default), "github", or "github-native". "github" fetches commits via the GitHub API, enriching entries with author login information (available as the {{ Logins }} per-entry template variable and the {{ AllLogins }} release-wide variable). "github-native" delegates entirely to GitHub's auto-generated notes. |

cloudsmiths

CloudSmith publisher configuration. Pushes packages to CloudSmith repositories.

yaml cloudsmiths: - organization: my-org repository: my-repo exclude: ["*.sha256", "*.sig", "*.cdx.json"] | | formats | list of string | — | Package format filter: only publish artifacts matching these formats. | | ids | list of string | — | Build IDs filter: only publish artifacts from builds whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the CloudSmith publisher is skipped. Render failure hard-errors. Config key: cloudsmiths[].if:. | | keep_versions | integer | — | Retain only the N most-recent release versions of each published package, pruning older ones from the CloudSmith repository after a successful upload.

This is opt-in and destructive: leaving it unset (the default) prunes nothing. When set, after the just-uploaded artifacts are confirmed present the publisher lists every version of this package in the repository, ranks the distinct release versions by SemVer (newest first), keeps the top N — which always includes the version just published — and issues DELETE for every artifact (all formats and architectures) belonging to versions ranked beyond N. Other packages sharing the repository are never touched.

All package formats of one release are treated as the same version: the deb/rpm epoch (1:0.9.1-1) and apk revision (0.9.1-r1) suffixes are normalized to the base SemVer (0.9.1) before ranking, so keeping 2 versions keeps every .deb/.rpm/.apk of the two newest releases.

Pruning is best-effort: it runs only after the upload (the real work) has already succeeded, is skipped entirely in dry-run and snapshot mode, and a list/delete failure emits a prominent warning and continues rather than failing the release or rolling anything back. keep_versions: 0 is rejected — anodizer never prunes every version.

Primarily a remedy for storage-capped repositories (e.g. the CloudSmith free plan's 500 MB limit, which offers no server-side retention policy).

yaml cloudsmiths: - organization: acme repository: tools keep_versions: 3 # keep the 3 newest releases, prune older ones | | organization | string | — | CloudSmith organization slug. | | repository | string | — | CloudSmith repository slug. | | republish | StringOrBool | — | When true, allow republishing over existing package versions. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | secret_name | string | — | Environment variable name containing the CloudSmith API key. | | skip | StringOrBool | — | Template-conditional skip: if rendered result is "true", skip this publisher. |

crates

Fires once per crate in EVERY multi-crate mode — workspace per-crate AND workspace lockstep with multiple publisher crates — in both a full anodizer release and anodizer release --publish-only, matching the per-crate iteration of before_publish: and the publishers. With an explicit --crate subset only the selected crates' hooks fire. No-op in a single-crate config with no crates: block (use the top-level before: there). | | before_publish | HooksConfig | — | Hooks that run immediately before THIS crate's publishers dispatch, once per matching artifact (the same per-artifact semantics as the top-level before_publish:), scoped to the crate's own artifacts and template vars. Honors the per-entry ids: / artifacts: filters. A non-zero exit aborts the release before that crate publishes to any registry. The top-level before_publish: still fires once over the full artifact set; this one targets a single crate's artifacts. | | binstall | BinstallConfig | — | cargo-binstall metadata configuration for this crate. | | blobs | list of BlobConfig | — | Cloud storage (S3/GCS/Azure) upload configurations for this crate. | | builds | list of BuildConfig | — | Build configurations for this crate. One entry per binary by default. | | checksum | ChecksumConfig | — | Checksum configuration for this crate. | | cross | CrossStrategy | — | Cross-compilation strategy for this crate: auto, zigbuild, cross, or cargo. | | depends_on | list of string | — | Other crates this crate depends on; ensures release ordering. | | dmgs | list of DmgConfig | — | macOS DMG disk image configurations for this crate. | | docker_digest | DockerDigestConfig | — | Docker image digest file configuration for this crate. | | docker_manifests | list of DockerManifestConfig | — | Docker multi-platform manifest configurations for this crate. | | dockers_v2 | list of DockerV2Config | — | Docker V2 image build configurations for this crate (canonical API: images+tags, annotations, build_args, sbom, disable). The legacy docker: block was removed; this is the only docker surface. The docker_v2: spelling is still accepted via serde alias for back-compat. | | flatpaks | list of FlatpakConfig | — | Linux Flatpak bundle configurations for this crate. | | msis | list of MsiConfig | — | Windows MSI installer configurations for this crate. | | name | string | — | Crate name as published (must match the Cargo.toml package name). | | nfpms | list of NfpmConfig | — | Linux package (deb, rpm, apk) configurations for this crate. Renamed from nfpm: (singular) for spelling parity with Defaults.nfpms and the rest of the plural-name per-crate packaging lists (dmgs, msis, pkgs, nsis, ...). The nfpm: spelling is still accepted via serde alias for back-compat. | | no_unique_dist_dir | StringOrBool | — | When true (or template evaluating to "true"), all build outputs are placed in a flat dist/ directory instead of dist/{target}/. | | nsis | list of NsisConfig | — | NSIS installer configurations for this crate. | | path | string | — | Relative path to the crate directory from the project root. | | pkgs | list of PkgConfig | — | macOS PKG installer configurations for this crate. | | publish | PublishConfig | — | Publishing targets (Homebrew, Scoop, AUR, etc.) for this crate. | | release | ReleaseConfig | — | GitHub release configuration for this crate. | | snapcrafts | list of SnapcraftConfig | — | Snapcraft package configurations for this crate. | | tag_template | string | — | Git tag template used to tag and identify releases (supports templates). | | universal_binaries | list of UniversalBinaryConfig | — | macOS universal binary (fat binary) configurations for this crate. | | version | string | — | Pinned semver version. When set, anodizer bump --strict refuses to edit this crate's Cargo.toml to anything other than this value; without --strict, the bump proceeds with a warning. Lets a release captain freeze a crate's version while still running broad --workspace bumps. | | version_files | list of string | — | Repo-committed files that embed this crate's release version outside Cargo.toml (repo-root-relative path strings). At tag time each file has its occurrences of the old version rewritten to the new version — both bare and v-prefixed forms, word-boundary anchored — and is staged into the same bump commit as this crate's Cargo.toml. Overrides the workspace-level defaults.version_files. | | version_sync | VersionSyncConfig | — | Automatic version number synchronization configuration for this crate. |

defaults

Workspace-level defaults that path-mirror the CrateConfig (and select top-level Config) shape. Each field here is folded into every resolved crate by defaults_merge::apply_defaults according to the deep-merge / merge-by-identity semantics documented in defaults_merge.

Multi-publisher fields are single-struct on both sides today: defaults supplies one struct per publisher, and per-crate publish.* fields are also single-struct. A future change may introduce list-or-scalar via OneOrMany<T> on the per-crate side so a crate can declare multiple homebrew taps / scoop buckets / etc.; the defaults side would stay single-struct and merge into the first per-crate entry by identity.

docker_signs

dockerhub

DockerHub description sync configuration. Pushes image descriptions and README content to DockerHub repositories.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | secret_name | string | — | Environment variable name containing the DockerHub token. | | skip | StringOrBool | — | Skip this publisher. Accepts bool or template string. Accepts the legacy disable: spelling via serde alias for back-compat with imported configs (the legacy disable: spelling). | | username | string | — | DockerHub username for authentication. |

gemfury

GemFury package registry publisher configuration.

Pushes deb / rpm / apk artifacts to https://push.fury.io/<account>. Authenticates via HTTP Basic auth using the push token as the username (empty password) — the conventional Fury push surface.

yaml gemfury: - account: my-account exclude: ["*.sha256", "*.sig", "*.cdx.json"] | | formats | list of string | — | Package format filter: only push artifacts matching these formats. Defaults to ["apk", "deb", "rpm"]. | | id | string | — | Unique identifier for selecting this entry from the CLI (--id=...). | | ids | list of string | — | Build IDs filter: only include artifacts whose archive id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the GemFury publisher entry is skipped. Render failure hard-errors. Exposes the gemfury[].if: conditional gate; distinct from skip: (which expresses "always skip") and provides config-import parity. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: true — GemFury is a Manager-group publisher (mutable but reversible via the delete API), so a failed publish aborts by default to avoid surprising the operator with a half-released version. Set to false to log failures but continue. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | secret_name | string | — | Environment variable name carrying the push token. Default FURY_PUSH_TOKEN. The actual token VALUE is read from this env var at publish/rollback time. | | skip | StringOrBool | — | Template-conditional skip: if rendered result is "true", skip this publisher entry. Accepts bool or template string. Accepts the legacy disable: spelling via serde alias for back-compat with imported gemfury[].disable: configs. | | token | string | — | Push token used as the HTTP Basic auth username (empty password). When unset, the env var named by secret_name (default FURY_PUSH_TOKEN) is consulted at publish time. NEVER logged. |

git

Git-level tag discovery and sorting settings.

Controls how anodizer discovers and orders tags when determining the current and previous versions. This is separate from TagConfig, which controls version bumping logic.

Accepted values: - "-version:refname" (default) — lexicographic version sort on the tag name. - "-version:creatordate" — sort by the tag's creation date (newest first). - "semver" — strict SemVer 2.0.0 ordering computed in Rust; prereleases sort below their release per spec section 11. Bypasses git's native sort. - "smartsemver" — same ordering as "semver", but when the current version (resolved from the template Version variable) is non-prerelease, prerelease tags are filtered out before previous-tag selection. Prevents v0.2.0-beta.3 from being picked as the predecessor of v0.2.0 (which would otherwise produce an empty changelog). |

gitea_urls

Custom Gitea API/download URLs for self-hosted Gitea installations. Gitea API/download URL overrides.

github_urls

Custom GitHub API/upload/download URLs for GitHub Enterprise installations. GitHub API/download URL overrides.

gitlab_urls

Custom GitLab API/download URLs for self-hosted GitLab installations. GitLab API/download URL overrides.

homebrew_casks

Unified Homebrew Cask configuration.

Used at both call-sites: - homebrew_casks: — top-level array; carries repository, commit_author, directory, ids, url, structured uninstall/zap, etc. - crates[].publish.homebrew_cask: — per-crate override; same shape, with url_template as the simpler URL alternative.

Fields from both original types are present; any field may be None at either call-site. The union avoids a two-type bifurcation while keeping both axes.

Each entry is either a bare string ("my-cli" → emits binary "my-cli") or a structured { name, target } object ({ name: "my-cli", target: "mycli" } → emits binary "my-cli", target: "mycli"). The target: form mirrors the Homebrew Ruby cask DSL for binary renames — without it, a wrapped binary installs at the wrong path. Cask binary entry. | | binary | string | — | Deprecated singular spelling of [Self::binaries]. The upstream replaced binary: foo with binaries: [foo]; this field captures the legacy spelling so imported configs keep parsing. apply_homebrew_cask_legacy_singulars folds the value into [Self::binaries] at config-load time and emits a one-time deprecation warning per occurrence. The field is excluded from serialization so a round-tripped config emits only the canonical plural form. | | caveats | string | — | Custom caveats shown after install. | | commit_author | CommitAuthorConfig | — | Commit author with optional signing. | | commit_msg_template | string | — | Custom commit message template. Default: "Brew cask update for {{ ProjectName }} version {{ Tag }}" | | completions | HomebrewCaskCompletions | — | Shell completion definitions. | | conflicts | list of HomebrewCaskConflictEntry | — | Conflicting casks or formulae. | | custom_block | string | — | Arbitrary Ruby code inserted into the cask block. | | dependencies | list of HomebrewCaskDependencyEntry | — | Cask dependencies (other casks or formulae). | | description | string | — | Cask description. | | directory | string | — | Subdirectory in the tap repo for cask placement (default: "Casks"). | | generate_completions_from_executable | HomebrewCaskGeneratedCompletions | — | Auto-generate shell completions from an executable. | | homepage | string | — | Project homepage URL. | | hooks | HomebrewCaskHooks | — | Pre/post install/uninstall hooks. | | ids | list of string | — | Build IDs filter: only include artifacts from builds whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the Homebrew Cask config is skipped. Render failure hard-errors. Config key: homebrew_casks[].if:. | | license | string | — | License identifier (SPDX). | | livecheck | HomebrewLivecheck | — | livecheck stanza configuration for the cask. When unset, the cask emits livecheck do\n skip "Auto-generated on release."\nend (a binary cask's download URL/sha256 are rewritten on every release, so brew livecheck has nothing stable to poll). Set strategy: / url: / regex: (with skip: false) to opt into active version detection — the same shape a Homebrew cask livecheck do … end block accepts. Reuses the formula livecheck config type. | | manpage | string | — | Deprecated singular spelling of [Self::manpages]. The upstream replaced manpage: foo.1 with manpages: [foo.1]; this field captures the legacy spelling so imported configs keep parsing. apply_homebrew_cask_legacy_singulars folds the value into [Self::manpages] at config-load time and emits a one-time deprecation warning per occurrence. The field is excluded from serialization so a round-tripped config emits only the canonical plural form. | | manpages | list of string | — | Manual page references to install. | | name | string | — | Cask name (default: crate / project name). | | repository | RepositoryConfig | — | Unified repository config for the Homebrew tap. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | service | string | — | Homebrew service definition. | | skip_upload | StringOrBool | — | Skip publishing the cask. "true" always skips; "auto" skips for prerelease versions. Accepts bool or template string. | | uninstall | HomebrewCaskUninstall | — | Structured uninstall stanza configuration. | | update_existing_pr | StringOrBool | — | When true, force-push the updated cask file to the existing PR branch when a PR for the same head branch already exists. The PR content is updated in place rather than creating a duplicate. When false (default), the push is skipped and a warning is emitted so the operator sees that the publisher did not update the PR. | | url | HomebrewCaskURL | — | Structured download URL configuration (top-level axis). | | url_template | string | — | Simple URL template for the .dmg/.zip download (per-crate shorthand).

Cannot be combined with url.template: — set one or the other. If both are present, config validation rejects the config at parse time. Use url: for the structured form (verified domain, custom headers, etc.) or url_template: for a bare string shorthand — never both simultaneously. | | zap | HomebrewCaskUninstall | — | Deep uninstall (zap) stanza configuration. |

makeselfs

mcp

MCP server registry publisher configuration.

Publishes an apiv0.ServerJSON document to the MCP registry (https://registry.modelcontextprotocol.io/v0/publish by default). MCP config (server details flattened onto the publisher block).

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this publisher when the expression evaluates truthy. Accepts a bool or a Tera template that renders to "true"/"false" (e.g. "{{ if .IsSnapshot }}true{{ endif }}"). Accepts the legacy disable: spelling via serde alias for back-compat with imported imported configs (the MCP config field MCP.Disable string). | | title | string | — | Optional human-readable title shown in registry UIs (max 100 chars). Templated; supports {{ ProjectName \| title }}, {{ Version }}, etc. | | transports | list of McpTransport | [] | Top-level transports list. Intentional config-portability shim: McpConfig carries deny_unknown_fields, so a migrated an imported config containing transports: would fail to parse if the field were absent. The list is accepted and discarded — the current MCP server schema derives transports per-package via packages[].transport, so the top-level list is never read after deserialization and is intentionally not emitted to the registry. |

metadata

milestones

monorepo

Monorepo configuration.

When configured, tag discovery filters by tag_prefix and the working directory is scoped to dir.

This is DIFFERENT from TagConfig.tag_prefix: - MonorepoConfig.tag_prefix: tags in git already HAVE the prefix (e.g. subproject1/v1.2.3). The prefix is STRIPPED for {{ Tag }} while {{ PrefixedTag }} retains the full tag. - TagConfig.tag_prefix: a prefix to PREPEND when constructing {{ PrefixedTag }} from a plain tag.

When monorepo is configured, it takes precedence over tag.tag_prefix for PrefixedTag / PrefixedPreviousTag behavior.

Used for changelog path filtering (when no explicit changelog.paths or crate.path is configured) and as the default build dir. | | tag_prefix | string | — | Tag prefix for this subproject (e.g. "subproject1/").

Tags matching this prefix are selected during tag discovery, and the prefix is stripped from {{ Tag }} while {{ PrefixedTag }} retains the full tag. |

nightly

Back-compat alias for retention: { keep_last: 1 }. When both keep_single_release and retention are set, retention wins. Destructive: deletes a published release via the GitHub Releases API. GitHub-only. | | name_template | string | — | Template for the release name. Default: "{{ ProjectName }}-nightly". | | publish_release | bool | — | Whether to publish a GitHub Release at all. Default: true. Set false for nightly-only docker pushes / blob uploads. | | publish_repo | string | — | Publish the nightly release to a DIFFERENT repository than the source repo, in "owner/repo" form (e.g. "nushell/nightly"). Default (None) publishes to the configured release.github repo, unchanged.

When set, the nightly release create, asset upload, AND retention (keep_single_release / retention.keep_last) delete calls all target this repo. The active SCM token is assumed to have write access to publish_repo. GitHub-only (the nushell adoption target). | | retention | RetentionConfig | — | Retention policy for nightly releases on GitHub. Generalizes keep_single_release (which is keep_last: 1): keeps the N newest nightly releases matching the nightly tag/name and deletes the rest (releases + the tags anodizer created for them). Operates on publish_repo when set. Default (None): no retention sweep. | | tag_name | string | — | Tag name used for the nightly release. Default: "nightly". Templates allowed. | | version_template | string | — | Template for the rendered version string the nightly run sets on Version / RawVersion. Default: "{{ incpatch(v=Version) }}-{{ ShortCommit }}-nightly" — produces commit-immutable nightly versions (two same-day commits yield two distinct nightly versions).

The {{ NightlyBuild }} template var (a stateless per-base-version build counter derived from git rev-list --count <last-tag>..HEAD) enables nushell-style schemes such as "{{ Base }}-nightly.{{ NightlyBuild }}+{{ ShortCommit }}". |

notarize

Top-level notarization configuration supporting both cross-platform (rcodesign) and native macOS (codesign + xcrun notarytool) modes.

npms

NPM package registry publisher configuration.

In the default optional-deps mode anodizer emits one thin npm package per built platform (with os/cpu/libc selectors derived from the target triple) plus a metapackage whose optionalDependencies lists every platform package; npm's native resolution installs only the one matching the host. In postinstall mode a single package carries a postinstall script that downloads the matching release archive at npm install time. Each npms[] entry produces one publish.

Default: true — NPM is a Manager-group publisher (one-way 72-hour unpublish window), so a failed publish aborts by default to avoid surprising the operator with a half-released version. Set to false to log failures but continue. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | scope | string | — | npm scope for the per-platform packages emitted in optional-deps mode (e.g. @biomejs). The per-platform packages are named <scope>/<bin>-<os>-<cpu>[-<libc>]. Required for optional-deps mode; ignored in postinstall mode. | | skip | StringOrBool | — | Skip this publisher. Accepts bool or template string. Accepts the legacy disable: spelling via serde alias for back-compat. | | tag | string | — | NPM dist-tag for the publish (default latest). Templated. | | templated_extra_files | list of NpmTemplatedExtraFile | — | Template-rendered file mappings (src may be a glob; rendered contents written to dst). | | token | string | — | Auth token for the registry. Falls back to the NPM_TOKEN env var when unset. Stored in .npmrc as //<registry>/:_authToken=... at publish time and never passed via argv. | | url_template | string | — | Override the download URL emitted into the postinstall script (templated). When unset, anodizer derives the URL from the release context. Only consulted in postinstall mode. |

partial

The legacy goos spelling is accepted as a back-compat alias for os (folded at parse time, with a deprecation warning); imported configs keep loading. |

publishers

release

yaml release: github: { owner: my-org, name: my-repo } exclude: ["*.sha256", "*.sig", "*.cdx.json"] | | extra_files | list of ExtraFileSpec | — | Extra files to upload to the release beyond build artifacts.

Paths / globs are resolved relative to the project root. .. segments are accepted, so an entry like ../sibling/dist/* will reach outside the project tree — security-conscious users should keep the entries inside the repo or canonicalise them before invoking the release pipeline. | | footer | ContentSource | — | Text appended to the release body (inline string, from_file, or from_url). | | gitea | ScmRepoConfig | — | Gitea repository to release to (owner and name). | | github | ScmRepoConfig | — | GitHub repository to release to (owner and name). | | gitlab | ScmRepoConfig | — | GitLab repository to release to (owner and name). | | header | ContentSource | — | Text prepended to the release body (inline string, from_file, or from_url). | | ids | list of string | — | Artifact IDs filter for uploads. Release-wide artifacts (checksums, source archive, extra files, metadata) always upload regardless of the filter, and derived artifacts (signatures, certificates, SBOMs) inherit the verdict of the artifact they derive from — a signature uploads iff the artifact it signs uploads. | | include_meta | bool | — | Upload metadata.json and artifacts.json as release assets. | | make_latest | object | — | Mark release as latest: true, false, or "auto" (latest non-prerelease). | | mode | string | — | Release mode: "keep-existing", "append", "prepend", or "replace". | | name_template | string | — | Release title template (supports templates). | | on_failure | OnFailureConfig | — | In-process failure policy: what anodizer release does after a release-pipeline failure. rollback (default) deletes the run's release tag(s) and reverts the version-bump commit so the same version can be re-cut; hold leaves everything in place for forensics and manual recovery (release --rollback-only --from-run=<id>). rollback automatically degrades to hold the moment any one-way-door (Submitter) publisher has landed: the version is burned at a registry that never accepts it twice, so destructive rollback is refused and fix-forward is the only path. Root-level policy — in workspace configs (lockstep or per-crate) the top-level release.on_failure governs the whole run; setting it in a crate-level release: block is rejected at config load (validate_on_failure_root_only). | | prerelease | object | — | Mark release as pre-release: true, false, or "auto" (inferred from tag). | | provider | ForceTokenKind | — | Explicit publish target — the SCM provider whose release.<provider> block the publisher uses. When set, overrides the implicit token-type fallback chain in [crate::scm::resolve_token_type].

Use this for cross-platform publishing pattern: source repo on one provider (e.g. GitLab) but releases land on another (e.g. GitHub). Without it, the publish target is inferred from which *_TOKEN env-var is set — fine for single-provider setups but ambiguous when both tokens are available.

yaml release: provider: github github: owner: my-org name: my-app | | replace_existing_artifacts | bool | — | When true, replace existing release artifacts with the same name. | | replace_existing_draft | bool | — | When true, replace an existing draft release instead of failing. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: true — a failure here aborts the release. Set to false to log failures but continue. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip the release stage. Accepts bool or template string (e.g. "{{ if IsSnapshot }}true{{ endif }}" for conditional skip). Template strings are supported here. Accepts the legacy disable: spelling via serde alias for back-compat with imported configs (the legacy disable: spelling). | | skip_upload | StringOrBool | — | Skip uploading artifacts: true, false, or "auto" (skip for snapshots). Accepts bool or template string. | | tag | string | — | Override the release tag (template string). When set, this tag is used as the tag_name in the GitHub release API instead of the crate's tag_template. Useful in monorepo setups to strip a tag prefix (e.g. "{{ Tag }}" to publish v1.0.0 instead of myapp/v1.0.0). A cross-platform publishing feature provided for free by anodizer. | | target_commitish | string | — | Target branch or SHA for the release tag. | | templated_extra_files | list of TemplatedExtraFile | — | Extra files whose contents are rendered through the template engine before upload. Unlike extra_files which copy as-is, template variables like {{ Tag }} are expanded.

Same path-traversal caveat as extra_files: .. segments reach outside the project tree. | | upload_concurrency | integer | — | Maximum number of asset-upload requests in flight simultaneously.

GitHub's secondary rate-limit is triggered by burst traffic. Keeping this value low avoids tripping the limit even for releases with many artifacts. Default: 4. Override at runtime with ANODIZER_GITHUB_UPLOAD_CONCURRENCY. | | upload_pace | HumanDuration | — | Minimum interval between successive asset-upload starts (a humantime string, e.g. "200ms", "1s", "0s").

This is a proactive pace that smooths the initial burst of upload requests, layered on top of [Self::upload_concurrency] (the concurrency cap) and the reactive secondary-rate-limit backoff. With the concurrency cap alone, the first N uploads fire in the same instant — exactly the burst pattern that trips GitHub's secondary rate limit. Spacing each upload's start by this interval (with ±20% jitter so concurrent releases don't synchronise) makes the burst far less likely to trip the limit in the first place.

Default: "200ms" — at the default concurrency of 4 this caps the initial start rate at ~5/s, which is below the burst threshold yet adds negligible wall-clock to a normal release (upload time is dominated by transfer, not start-spacing). Set to "0s" to disable pacing entirely (rely on the concurrency cap + reactive backoff). Override at runtime with ANODIZER_GITHUB_UPLOAD_PACE_MS (integer milliseconds; 0 disables). | | use_existing_draft | bool | — | Reuse an existing draft release instead of creating a new one. |

retry

User-facing retry configuration block (retry: at config root).

All fields are optional in YAML; missing fields fall back to the defaults (10 attempts, 10s base delay, 5m cap).

sboms

schemastore

Top-level schemastore: block. Shared fields here are defaults for every entry in schemas; a per-entry field overrides them (cascade).

signs

snapshot

source

srpms

tag

Off by default. Only enable with a workflow_run-triggered release workflow: [skip ci] on the bump commit (which becomes the tag target) ALSO suppresses an on: push: tags: release trigger, so enabling this with a tag-push-triggered release silently skips the release. Leave off for the tag-push pattern; enable for the workflow_run pattern to skip the (already crate-gated, harmless) redundant CI re-run. | | tag_context | string | — | Source for determining the previous tag: "repo" (default) or "branch". | | tag_post_hooks | list of HookEntry | — | Commands to run after anodizer tag successfully creates and pushes the tag. Env and template vars same as tag_pre_hooks. | | tag_pre_hooks | list of HookEntry | — | Commands to run before anodizer tag creates the tag. Useful for updating lockfiles or committing sibling changes that must be part of the tagged commit. Env: ANODIZER_CURRENT_TAG, ANODIZER_PREVIOUS_TAG are set; template vars {{ Tag }}, {{ PreviousTag }}, {{ Version }}, {{ PrefixedTag }} are available. | | tag_prefix | string | — | Prefix prepended to version tags (e.g., "v" produces "v1.2.3"). | | verbose | bool | — | When true, print verbose tag calculation output. |

template_files

Configuration for a template file that is rendered through the template engine and placed in the dist directory as a release artifact.

All rendered template files are uploaded to the release by default. Both src and dst paths support template rendering.

uploads

yaml uploads: - name: mirror target: "https://mirror.example.com/{{ .ArtifactName }}" exclude: ["*.sha256", "*.sig", "*.cdx.json"] | | extra_files | list of ExtraFileSpec | — | Extra files to include in uploading. | | extra_files_only | bool | — | Upload only extra files, skip normal artifacts. | | exts | list of string | — | File extension filter: only upload artifacts with these extensions. | | ids | list of string | — | Build IDs filter: only upload artifacts whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the upload is skipped. Render failure hard-errors. The uploads[].if: conditional gate. | | meta | bool | — | Include metadata artifacts in uploaded artifacts. | | method | string | — | HTTP method: PUT or POST (default: PUT). | | mode | string | — | Upload mode: "archive" (default) or "binary". | | name | string | — | Human-readable name for this upload config. | | overwrite | bool | — | Re-upload an artifact even when an identical one already exists at the target path (default: false).

With the default, a re-run that finds the same version's artifact already uploaded with a matching SHA-256 records an idempotent SKIP rather than re-PUTting it — so re-running a partially-failed release is safe. A path that already holds a different artifact for the same version still hard-errors (immutable-version drift) unless overwrite is set. With overwrite: true, every artifact is PUT unconditionally. | | password | string | — | Password for HTTP basic auth.

Strongly prefer {{ Env.UPLOAD_PASSWORD }} (or any other env-var template) over an in-config literal — plaintext values here are NOT redacted from dry-run output and will land in dist/config.yaml when the pipeline runs with --dry-run / --snapshot. Resolution order: rendered password template → env UPLOAD_{NAME}_SECRET. Password-resolution cascade. | | required | bool | — | Override whether this upload failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this upload's artifacts in place rather than issuing a server-side DELETE. Default false. | | signature | bool | — | Include signatures in uploaded artifacts. | | skip | StringOrBool | — | Skip condition template (if rendered to "true", skip this upload). | | target | string | — | Target URL template (supports template variables like {{ ProjectName }}, {{ Version }}). | | trusted_certificates | string | — | Path to PEM-encoded trusted CA certificates. | | username | string | — | Username for HTTP basic auth. Resolution order: rendered username template → env UPLOAD_{NAME}_USERNAME. Set this to a literal value or a {{ Env.X }} template. |

upx

verify_release

Top-level verify_release: block.

See the module-level docs for the verification lifecycle. The gate is a no-op unless enabled: true.

workspaces

A workspace represents an independent project root within a monorepo. Each workspace has its own crates, changelog, and release configuration, allowing independently-versioned components that aren't Cargo workspace members.

List of KEY=VALUE strings. Order is preserved. Values are template-rendered at pipeline startup. | | name | string | — | Workspace identifier used in logs and template variables. | | signs | list of SignConfig | [] | Signing configurations for binaries, archives, and checksums. | | skip | list of string | [] | Pipeline stages to skip when releasing this workspace. Stage names match the CLI --skip flag (e.g., announce, publish). |

crates[].dockers_v2

Docker V2 configuration — the canonical Docker build API.

Notable surface: - images + tags (cleaner separation than a single image_templates list) - annotations map for OCI annotations (--annotation) - build_args map for build-time variables - skip as a [StringOrBool] template for conditional opt-out - sbom as a [StringOrBool] — when truthy, adds --sbom=true to buildx - flags for arbitrary extra docker build flags - platforms is the only target selector — no per-arch field overrides

Each value is template-expanded and forwarded verbatim to buildx (one argv token per pair, no shell tokenization). Prefer {{ Env.VAR }} over raw user-config strings for secrets — buildx records build-args in image history by default, so plaintext values here propagate into the image metadata. | | dockerfile | string | — | Path to the Dockerfile relative to the project root. | | extra_files | list of string | — | Extra files to copy into the Docker build context. | | flags | list of string | — | Arbitrary extra flags passed to the docker build command. | | hooks | BuildHooksConfig | — | Pre/post hooks for this dockers_v2 config. Each hook accepts the same cmd/dir/env/output shape as build/archive hooks. pre hooks run after the staging directory is prepared but before docker buildx build; post hooks run after the image digest is captured. Hook commands, working directories, and env values are template-expanded; in addition to the standard template surface, hooks see:

• {{ Images }} — list of image:tag references for this build. Iterate via {% for img in Images %}{{ img }}{% endfor %} to mirror a list exposure of the same field; {{ Images \| join(sep=",") }} reproduces a flat comma-separated string for legacy templates. - {{ Dockerfile }} — path to the rendered Dockerfile - {{ ContextDir }} — path to the buildx context staging directory - {{ Digest }} — image manifest digest (post hooks only) - {{ BaseImage }} / {{ BaseImageDigest }} — final-stage base image (the BaseImage / BaseImageDigest overlay) | | id | string | — | Unique identifier for this Docker V2 config. | | ids | list of string | — | Build IDs filter: only include binary artifacts whose metadata id is in this list. | | images | list of string | [] | Base image names (e.g., ["ghcr.io/owner/app"]). Combined with tags to form full references. | | labels | map | — | OCI labels to apply to the image via --label key=value flags. | | oci_labels | StringOrBool | — | Auto-inject the standard predefined org.opencontainers.image.* labels (created, source, revision, version, title, description, licenses, url, documentation, vendor), derived from project/git/Cargo context. Default ON; set oci_labels: false to opt out. Each auto-label is emitted only when its value is derivable, and any key the user also supplies in labels: wins (the auto value never clobbers an explicit user label). created is derived from SOURCE_DATE_EPOCH for byte-reproducibility (never wall-clock) and is omitted when no reproducible source date is resolvable. | | platforms | list of string | — | Target platforms for multi-arch builds (e.g., ["linux/amd64", "linux/arm64"]). | | retry | DockerRetryConfig | — | Retry configuration for docker push operations. | | sbom | StringOrBool | — | When truthy, adds --sbom=true to buildx. Supports templates. | | skip | StringOrBool | — | When truthy, skip this docker build entirely. Supports templates. Accepts the legacy disable: spelling via serde alias for back-compat. | | tags | list of string | [] | Tag suffixes (e.g., ["latest", "{{ Version }}"]). Each image is tagged with each tag. | | use | string | — | Docker backend for build commands: "buildx" (default) or "podman".

The default "buildx" invokes docker buildx build with the full set of BuildKit features (multi-platform, attestations, --rewrite-timestamp, SBOM, OCI exporter). Setting use: podman swaps the binary to podman build and disables every buildx-only flag — anodizer rejects configs that mix use: podman with sbom: true, --rewrite-timestamp, --provenance, --attest, --cache-from, --cache-to, --output, or --sbom because plain podman does not recognise them.

Linux-only. The podman backend is restricted to Linux hosts. Configs setting use: podman on macOS or Windows fail at config-validation time with a clear error rather than blowing up later when podman is not on PATH. |

crates[].docker_manifests

Deprecated: prefer dockers_v2 (which produces multi-arch manifests via the platforms: field automatically). DockerManifestConfig is retained for back-compat with imported configs and for the niche case of stitching together manifest lists from images that were not built by dockers_v2 in the same run.

The v1 docker / docker manifest pipes deprecated in favour of the v2 buildx flow. The rustdoc here is the load-bearing surface for the deprecation: it flows into the schemars-generated JSON Schema (consumed by IDEs / editor tooling) and rustdoc HTML, both of which are how downstream config authors discover that the v2 pipe is the preferred entry point.

crates[].docker_digest

Controls docker image digest file creation.

After each docker image push, a digest file (containing the sha256 digest) is written to the dist directory. This config controls whether that happens and how the files are named.

crates[].nfpms

When set, the auto-emitted binary content entry is installed under this name (in bindir) instead of the built file's name; the archive/build output is untouched. Use this to resolve Debian/RPM name clashes — e.g. fd ships its binary as fdfind in the Debian package while the tarball keeps fd. Templated. | | bindir | string | — | Installation directory for binaries (default: /usr/bin). | | changelog | string | — | Path to a YAML-format changelog file for deb/rpm packages. | | conflicts | list of string | — | Packages this package conflicts with. | | contents | list of NfpmContent | — | Files to include in the package beyond the main binary. | | deb | NfpmDebConfig | — | Deb-specific configuration. | | dependencies | map | — | Runtime package dependencies keyed by format (e.g., {"deb": ["libc6"], "rpm": ["glibc"]}). | | description | string | — | Package description (multiline supported). | | epoch | string | — | Package epoch for versioning (integer as string). | | file_name_template | string | — | Package filename template (supports templates). | | formats | list of string | [] | Package formats to produce: deb, rpm, apk, archlinux (at least one required). | | homepage | string | — | Project homepage URL. | | id | string | — | Unique identifier for cross-referencing this nFPM config. | | ids | list of string | — | Build IDs filter: only include artifacts from builds whose id is in this list. Accepts the deprecated builds: spelling via serde alias for back-compat with imported configs (the legacy builds key marked deprecated, aliasing ids). | | if | string | — | Template-conditional: skip this nfpm config if rendered result is "false" or empty. Conditional-skip gate. | | ipk | NfpmIpkConfig | — | IPK-specific configuration (OpenWrt packages). | | libdirs | NfpmLibdirs | — | CGo library installation directories (header, carchive, cshared). | | license | string | — | SPDX license identifier (e.g., "MIT", "Apache-2.0"). | | maintainer | string | — | Package maintainer in "Name " format. | | meta | bool | — | Whether this is a meta-package (no files, only dependencies). | | mtime | string | — | Default modification time for files in the package. | | overrides | map | — | Per-format setting overrides (e.g., {"deb": {compression: "xz"}}). | | package_name | string | — | Package name (defaults to crate name). | | prerelease | string | — | Prerelease version suffix. | | priority | string | — | Package priority (e.g. "optional", "required"). | | provides | list of string | — | Virtual packages provided by this package. | | recommends | list of string | — | Packages recommended (soft dependency) by this package. | | release | string | — | Package release number. | | replaces | list of string | — | Packages this package replaces (for upgrade paths from old package names). | | rpm | NfpmRpmConfig | — | RPM-specific configuration. | | scripts | NfpmScripts | — | Package lifecycle scripts (preinstall, postinstall, preremove, postremove). | | section | string | — | Package section (e.g. "utils", "devel"). | | suggests | list of string | — | Packages suggested (weaker than recommends) by this package. | | templated_contents | list of NfpmContent | — | Extra file contents whose source files are Tera-rendered before packaging. Each entry mirrors contents; the difference is that at stage time the file at src is read, rendered through the template engine, written to a temp file, and then included in the package at dst using the temp file as the real source. Useful for shipping config files with templated values (version, commit, maintainer, etc.). | | templated_scripts | NfpmScripts | — | Lifecycle scripts whose script-file bodies are Tera-rendered before packaging Each path is read, rendered through the template engine, written to a temp file, and used as the real script. If a field is set on both scripts and templated_scripts, the templated version wins. | | umask | integer | — | File permission umask. Accepts a YAML int (18), an octal-prefixed string ("0o022"), or a leading-zero octal string ("022"). | | vendor | string | — | Package vendor name — the distributing entity recorded in the rpm/deb Vendor field. When unset, derived from the crate's first Cargo.toml [package].authors entry with any <email> suffix stripped (e.g. "Ada Lovelace <ada@x>" → "Ada Lovelace"). | | version_metadata | string | — | Version metadata (e.g. git commit hash). |

crates[].publish

Uses the unified HomebrewCaskConfig which carries all fields from both the per-crate cask config and the top-level homebrew_casks: config. | | krew | KrewConfig | — | Krew (kubectl plugin manager) manifest publishing configuration. | | nix | NixConfig | — | Nix derivation publishing configuration. | | on_error | list of HookEntry | — | Hooks that fire once per FAILED publisher, after rollback has been attempted. Each entry is a standard hook (cmd / dir / env / output); the template surface adds {{ .Publisher }}, {{ .Error }}, {{ .Version }}, {{ .Tag }}, {{ .Group }} (Assets/Manager/Submitter), {{ .Required }}, and {{ .RolledBack }} — true if any publisher was rolled back (or rollback was attempted and failed) during this run. The same values are also exported to the hook process as environment variables: ANODIZER_PUBLISHER, ANODIZER_ERROR, ANODIZER_VERSION, ANODIZER_TAG, ANODIZER_GROUP, ANODIZER_REQUIRED, ANODIZER_ROLLED_BACK. A hook's own failure is logged as a warning and never changes the release outcome.

Security: the rendered cmd string is parsed by sh -c, and {{ .Error }} carries untrusted remote text (HTTP error bodies, git stderr) — interpolating it into cmd lets crafted error content break quoting and execute. Read untrusted values from the env vars instead ($ANODIZER_ERROR), and pass anodizer notify --raw so the text is sent literally rather than Tera-rendered. The outbound notification body is secret-redacted by default, so a secret reference smuggled into the error body is masked (sent as $NAME) even without --raw; --raw stays recommended because it avoids re-rendering already-final text and keeps untrusted content out of the shell-parsed cmd string:

yaml publish: on_error: - cmd: 'anodizer notify --raw "anodizer: $ANODIZER_PUBLISHER failed @ $ANODIZER_VERSION: $ANODIZER_ERROR"' | | scoop | ScoopConfig | — | Scoop manifest publishing configuration. | | winget | WingetConfig | — | WinGet manifest publishing configuration. |

crates[].publish.cargo

cargo publish flag surface.

Presence under publish: opts the crate in; use skip: true (or a truthy template) to opt out. There is no enabled field — presence is the on-switch.

Fields intentionally omitted because anodizer owns them: - --package / --workspace / --exclude: the top-level crates[] axis owns crate selection. - --dry-run: pipeline-level CLI ergonomics (anodizer release --dry-run). - -v / -q / --color: CLI ergonomics, not config. - --config / -Z: cargo CLI escape hatches; out of scope.

Default: true — a failure here aborts the release. Set to false to log failures but continue. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this publisher; supports template strings or bool. Truthy renders disable the publisher without removing the block. | | target | string | — | Build target triple for the verification step (--target). | | target_dir | string | — | Override the cargo target directory (--target-dir). | | wait_for_workspace_deps | WaitForWorkspaceDepsConfig | — | Pre-publish gate that polls crates.io for every workspace-internal dep of the crate being published, blocking until each is queryable at its expected version. Required for multi-tag-multi-crate workspaces (e.g. cfgd) where per-crate tags fire independent Release.yml runs that would otherwise race the sparse-index propagation.

Single-crate workspaces and lockstep-bumped monorepos (anodizer itself) leave this off — there is no inter-tag race to gate on. |

crates[].publish.homebrew

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | service | string | — | Homebrew service block content (alternative to plist). | | skip_upload | StringOrBool | — | Skip publishing the formula. "true" always skips; "auto" skips for prerelease versions. Accepts bool or template string. | | test | string | — | Ruby test block content for the formula (run by brew test). | | url_headers | list of string | — | HTTP headers to include in download requests (e.g. for private repos). | | url_template | string | — | Custom URL template for download URLs (overrides release URL). |

crates[].publish.homebrew_cask

Unified Homebrew Cask configuration.

Used at both call-sites: - homebrew_casks: — top-level array; carries repository, commit_author, directory, ids, url, structured uninstall/zap, etc. - crates[].publish.homebrew_cask: — per-crate override; same shape, with url_template as the simpler URL alternative.

Fields from both original types are present; any field may be None at either call-site. The union avoids a two-type bifurcation while keeping both axes.

Each entry is either a bare string ("my-cli" → emits binary "my-cli") or a structured { name, target } object ({ name: "my-cli", target: "mycli" } → emits binary "my-cli", target: "mycli"). The target: form mirrors the Homebrew Ruby cask DSL for binary renames — without it, a wrapped binary installs at the wrong path. Cask binary entry. | | binary | string | — | Deprecated singular spelling of [Self::binaries]. The upstream replaced binary: foo with binaries: [foo]; this field captures the legacy spelling so imported configs keep parsing. apply_homebrew_cask_legacy_singulars folds the value into [Self::binaries] at config-load time and emits a one-time deprecation warning per occurrence. The field is excluded from serialization so a round-tripped config emits only the canonical plural form. | | caveats | string | — | Custom caveats shown after install. | | commit_author | CommitAuthorConfig | — | Commit author with optional signing. | | commit_msg_template | string | — | Custom commit message template. Default: "Brew cask update for {{ ProjectName }} version {{ Tag }}" | | completions | HomebrewCaskCompletions | — | Shell completion definitions. | | conflicts | list of HomebrewCaskConflictEntry | — | Conflicting casks or formulae. | | custom_block | string | — | Arbitrary Ruby code inserted into the cask block. | | dependencies | list of HomebrewCaskDependencyEntry | — | Cask dependencies (other casks or formulae). | | description | string | — | Cask description. | | directory | string | — | Subdirectory in the tap repo for cask placement (default: "Casks"). | | generate_completions_from_executable | HomebrewCaskGeneratedCompletions | — | Auto-generate shell completions from an executable. | | homepage | string | — | Project homepage URL. | | hooks | HomebrewCaskHooks | — | Pre/post install/uninstall hooks. | | ids | list of string | — | Build IDs filter: only include artifacts from builds whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the Homebrew Cask config is skipped. Render failure hard-errors. Config key: homebrew_casks[].if:. | | license | string | — | License identifier (SPDX). | | livecheck | HomebrewLivecheck | — | livecheck stanza configuration for the cask. When unset, the cask emits livecheck do\n skip "Auto-generated on release."\nend (a binary cask's download URL/sha256 are rewritten on every release, so brew livecheck has nothing stable to poll). Set strategy: / url: / regex: (with skip: false) to opt into active version detection — the same shape a Homebrew cask livecheck do … end block accepts. Reuses the formula livecheck config type. | | manpage | string | — | Deprecated singular spelling of [Self::manpages]. The upstream replaced manpage: foo.1 with manpages: [foo.1]; this field captures the legacy spelling so imported configs keep parsing. apply_homebrew_cask_legacy_singulars folds the value into [Self::manpages] at config-load time and emits a one-time deprecation warning per occurrence. The field is excluded from serialization so a round-tripped config emits only the canonical plural form. | | manpages | list of string | — | Manual page references to install. | | name | string | — | Cask name (default: crate / project name). | | repository | RepositoryConfig | — | Unified repository config for the Homebrew tap. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | service | string | — | Homebrew service definition. | | skip_upload | StringOrBool | — | Skip publishing the cask. "true" always skips; "auto" skips for prerelease versions. Accepts bool or template string. | | uninstall | HomebrewCaskUninstall | — | Structured uninstall stanza configuration. | | update_existing_pr | StringOrBool | — | When true, force-push the updated cask file to the existing PR branch when a PR for the same head branch already exists. The PR content is updated in place rather than creating a duplicate. When false (default), the push is skipped and a warning is emitted so the operator sees that the publisher did not update the PR. | | url | HomebrewCaskURL | — | Structured download URL configuration (top-level axis). | | url_template | string | — | Simple URL template for the .dmg/.zip download (per-crate shorthand).

Cannot be combined with url.template: — set one or the other. If both are present, config validation rejects the config at parse time. Use url: for the structured form (verified domain, custom headers, etc.) or url_template: for a bare string shorthand — never both simultaneously. | | zap | HomebrewCaskUninstall | — | Deep uninstall (zap) stanza configuration. |

crates[].publish.scoop

Example: checkver: "github" or checkver: "v([\\d.]+)". | | commit_author | CommitAuthorConfig | — | Commit author with optional signing. | | commit_msg_template | string | — | Custom commit message template. | | depends | list of string | — | Application dependencies (other Scoop packages). | | description | string | — | Short description of the package (shown in scoop info). | | directory | string | — | Subdirectory in the bucket repo for manifest placement. | | homepage | string | — | Project homepage URL. Falls back to the GitHub-derived URL when unset. | | ids | list of string | — | Build IDs filter: only include artifacts whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the Scoop publisher is skipped. Render failure hard-errors. Config key: scoop[].if:. | | license | string | — | SPDX license identifier (e.g., "MIT", "Apache-2.0"). | | name | string | — | Override the manifest name (default: crate name). | | persist | list of string | — | Data paths persisted between Scoop updates. | | post_install | list of string | — | Commands to run after installation. | | pre_install | list of string | — | Commands to run before installation. | | repository | RepositoryConfig | — | Unified repository config with branch, token, PR, git SSH support. (Replaces the legacy bucket: BucketConfig owner/name-only form.) | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | shortcuts | list of list of string | — | Start menu shortcuts as [executable, label] pairs. | | skip_upload | StringOrBool | — | Skip publishing the manifest. "true" always skips; "auto" skips for prerelease versions. Accepts bool or template string. | | url_template | string | — | Custom URL template for download URLs (overrides release URL). | | use | string | — | Artifact selection: "archive" (default), "msi", or "nsis". |

crates[].publish.chocolatey

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip pushing to the Chocolatey community repository. Bool, string, or template expression (e.g. "{{ IsSnapshot }}"). Accepts the legacy skip_publish: spelling for back-compat with configs; canonical name is skip: to align with every other publisher. | | source_repo | string | — | Push source URL (default: "https://push.chocolatey.org/"). | | summary | string | — | Short summary of the package. | | tags | list of string | — | Tags for the Chocolatey gallery (joined with single spaces in the emitted nuspec). Always a typed list — the legacy space-separated-string form was dropped now for IDE-completion friendliness and to remove whitespace ambiguity. | | title | string | — | Package title (default: project name). | | url_template | string | — | Custom URL template for download URLs (overrides release URL). | | use | string | — | Artifact selection: "archive" (default), "msi", or "nsis". |

crates[].publish.winget

Example: yaml documentations: - label: "User Guide" url: "https://github.com/owner/repo/blob/master/GUIDE.md" | | homepage | string | — | Project homepage URL. | | ids | list of string | — | Build IDs filter: only include artifacts whose id is in this list. | | if | string | — | Template-conditional gate: when the rendered result is falsy ("false" / "0" / "no" / empty), the WinGet publisher is skipped. Render failure hard-errors. Config key: winget[].if:. | | installation_notes | string | — | Post-install notes shown to the user. | | license | string | — | License identifier (required, e.g. "MIT"). | | license_url | string | — | License URL. | | moniker | string | — | Short invoke alias shown as the package Moniker (e.g. rg for ripgrep, fd for fd). This is the command users type, NOT the package/crate name. When unset, anodizer derives it from the single published binary name; with multiple binaries and no override the Moniker is omitted (winget treats it as optional).

Example: moniker: "rg". | | name | string | — | Override the package name (default: crate name). | | package_identifier | string | — | WinGet package identifier (e.g. "Publisher.AppName"). Auto-generated if empty. | | package_name | string | — | Package name as displayed (default: same as name). | | path | string | — | Manifest file path (auto-generated if empty from publisher/name/version). | | post_publish_poll | PostPublishPollConfig | — | Post-publish PR-validation polling settings. Polling is disabled by default — winget-pkgs PR validation routinely takes hours to days, and blocking a CI workflow on that wait is wrong. Opt in per-publisher with post_publish_poll: { enabled: true } when running locally and willing to wait, or disable globally via --no-post-publish-poll. | | privacy_url | string | — | Privacy policy URL. | | product_code | string | — | Product code for the installer (used in Add/Remove Programs). | | publisher | string | — | Publisher name (required). | | publisher_support_url | string | — | Publisher support URL. | | publisher_url | string | — | Publisher homepage URL shown in the WinGet manifest. | | release_notes | string | — | Release notes for this version. | | release_notes_url | string | — | URL to full release notes. | | repository | RepositoryConfig | — | Unified repository config with branch, token, PR, git SSH support. (Replaces the legacy manifests_repo: WingetManifestsRepoConfig.) | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | short_description | string | — | Short description (required, max 256 chars). | | silent_switch | string | — | Silent-install switch string emitted as InstallerSwitches.Silent for actual installers (wix/msi/exe/nsis). When unset, anodizer derives the switch from the installer type (/quiet for msi, /S for exe/nsis). Never emitted for zip/portable artifacts.

Example: silent_switch: "/qn". | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. Accepts bool or template string. | | tags | list of string | — | Tags for package discovery (lowercased, spaces→hyphens). | | update_existing_pr | StringOrBool | — | When true, force-push the updated manifest to the existing PR branch when a PR for the same head branch already exists. The PR content is updated in place rather than creating a duplicate. When false (default), the push is skipped and a warning is emitted so the operator sees that the publisher did not update the PR. | | upgrade_behavior | string | — | Installer UpgradeBehavior for every installer entry. winget accepts install, uninstallPrevious, and deny. Defaults to install — the correct behavior for portable-zip CLI tools (uninstallPrevious forces a clobbering reinstall).

Example: upgrade_behavior: "uninstallPrevious". | | url_template | string | — | Custom URL template for download URLs (overrides release URL). | | use | string | — | Artifact selection: "archive" (default), "msi", or "nsis". |

crates[].publish.aur

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this AUR config. Accepts bool or template string (e.g. "{{ if .IsSnapshot }}true{{ endif }}" for conditional skip). Accepts the legacy disable: spelling via serde alias for back-compat. | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. Accepts bool or template string. | | url_template | string | — | Custom URL template for download URLs (overrides release URL). |

crates[].publish.aur_source

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this config. Accepts the legacy disable: spelling via serde alias for back-compat. | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. | | url_template | string | — | Custom URL template for download URLs. |

crates[].publish.krew

• auto (default): probe whether the plugin already exists in kubernetes-sigs/krew-index. Already present → bot (the hosted krew-release-bot opens the version-bump PR server-side); definitively absent → pr-direct (anodizer opens the initial fork PR). A probe that can't reach a definitive answer (rate-limit, network error) hard-errors rather than guessing, so a transient blip never routes an existing plugin into a maintainer-hostile fork PR. - bot: always POST to the krew-release-bot webhook. Use when the plugin is known to be in krew-index and you want to skip the membership probe entirely. - pr-direct: always open a fork PR against krew-index. Use for the initial submission, or a self-hosted krew-index mirror the hosted bot can't reach. | | name | string | — | Override the plugin name (default: crate name). | | repository | RepositoryConfig | — | Unified repository config with branch, token, PR, git SSH support. (Replaces the legacy manifests_repo: / upstream_repo: form.) The upstream PR target is derived from repository.pull_request.base when set, falling back to the canonical kubernetes-sigs/krew-index. | | required | bool | — | Override whether this publisher failing should fail the overall release.

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | short_description | string | — | One-line summary of the kubectl plugin (max 255 chars). | | skip | StringOrBool | — | Skip this Krew config. Accepts bool or template string (e.g. "{{ if .IsSnapshot }}true{{ endif }}" for conditional skip). Distinct from skip_upload so users can opt out of generating the manifest entirely (common when a project is not a kubectl plugin and has no krew channel). | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. Accepts bool or template string. | | update_existing_pr | StringOrBool | — | When true, force-push the updated plugin manifest to the existing PR branch when a PR for the same head branch already exists. The PR content is updated in place rather than creating a duplicate. When false (default), the push is skipped and a warning is emitted so the operator sees that the publisher did not update the PR. | | url_template | string | — | Custom URL template for download URLs (overrides release URL). |

crates[].publish.nix

Default: false — a failure here is logged but does not abort the release. Set to true to fail the release on any error. | | retain_on_rollback | bool | — | When true, a triggered rollback leaves this publisher's work in place rather than attempting to undo it. Default false. | | skip | StringOrBool | — | Skip this Nix config. Accepts bool or template string (e.g. "{{ if .IsSnapshot }}true{{ endif }}" for conditional skip). Distinct from skip_upload so users can model both intents — disable means "don't generate at all", skip_upload means "generate but don't push". Without this field, nix: { skip: true } was silently dropped by the serde unknown-field default. | | skip_upload | StringOrBool | — | Skip publishing. "true" always skips; "auto" skips for prereleases. Accepts bool or template string. | | url_template | string | — | Custom URL template for download URLs (overrides release URL). |