atmos plugin publish

Publish a verified release layout to an OCI registry.

Experimental

atmos plugin publish --help

Usage

atmos plugin publish <layout> --to=<repository> [--sign]

Before the first registry write, Atmos validates the destination and the signing flags locally. It then re-inspects every platform payload in the layout. Layouts can come from other tools or older versions, so publish never trusts how a layout was built. It applies the same rules as plugin pack: a payload may contain only plugin.yaml, schemas/**/*.json, and the declared executable, and anything hidden, credential-like, state-like, linked, or not a native binary for the platform fails the publish. Nothing is uploaded in that case.

The default output confirms publication and shows the package, version, platforms, immutable digest, repository, and signing result, followed by the inventory of files published for each platform with their sizes and modes. Request a structured format explicitly for automation.

The release tag always comes from metadata.version in plugin.yaml. Publishing the same bytes again is a no-op, and a version tag that already points at different content is rejected, because published releases are immutable.

Arguments and flags

layout

OCI layout produced by plugin pack.

--to

Destination OCI repository, with or without the oci:// prefix, and without a tag or digest, for example oci://registry.example.com/team/oidc. A destination that includes a tag or digest is rejected, because the tag is derived from the manifest version. Existing version tags cannot be replaced with different content.

--sign

Sign the published index digest with Sigstore. Uses the same signing flow as atmos plugin sign.

--cosign-version

Exact managed Cosign 3 version used with --sign. Defaults to 3.1.3. Requires --sign; without it the command fails instead of ignoring the flag.

--yes, -y

Accept Sigstore transparency log publication without prompting when signing. Requires --sign; without it the command fails instead of ignoring the flag.

--format

Output format: table (default), json, yaml, csv, or tsv. Also configurable with ATMOS_PLUGIN_FORMAT.

Examples

atmos plugin publish ./oidc-release --to=oci://registry.example.com/team/oidc
atmos plugin publish ./oidc-release --to=oci://registry.example.com/team/oidc --format=json

Publish and sign a release:

atmos plugin publish ./oidc-release --to=oci://ghcr.io/acme/oidc --sign --yes

Publishing and signing are separate registry operations. If signing fails, the release remains published and the command returns an error with its immutable digest. Retry the same command, or run atmos plugin sign against the reported digest. For repositories requiring signatures, publish with --sign before enabling a release for consumers.

Publishing never modifies a discovery catalog. For small collections, configure the repository under plugins.registries.<name>.repositories; search builds a cached discovery index. For curated collections, a dedicated catalog maintainer can use atmos plugin catalog publish to publish snapshots separately. Serialize catalog writes through one owner or CI concurrency group: revision checks detect stale updates but are not a distributed lock or an atomic compare-and-swap guarantee.