Serverless Registry GitHub Actions

Composite GitHub Actions for Serverless Registry, built on the sreg CLI. Every action installs sreg from its GitHub releases (checksum verified) on Linux, macOS and Windows runners.

Publish

- uses: kduma-OSS/serverless-registry-action/publish@v1
  with:
    ecosystem: composer
    registry: https://packages.example.com
    token: ${{ secrets.REGISTRY_PUBLISH_TOKEN }}

Packaging tools (npm, cargo, dotnet, swift, Maven/Gradle) are not installed by the action - set them up in earlier steps. Main inputs:

Outputs: name, version, url, skipped.

Authentication

Without secrets, using GitHub Actions OIDC (the registry needs a publish credential with a gh secret trusting the repository):

permissions:
  contents: read
  id-token: write
steps:
  - uses: actions/checkout@v4
  - uses: kduma-OSS/serverless-registry-action/publish@v1
    with:
      ecosystem: composer
      registry: https://packages.example.com

Alternatively pass a token, or put credentials into the registry URL (store it as a secret).

Monorepos

on:
  push:
    tags: ["sdk/v*"]
jobs:
  publish:
    runs-on: ubuntu-latest
    permissions: { contents: read, id-token: write }
    steps:
      - uses: actions/checkout@v4
      - uses: kduma-OSS/serverless-registry-action/publish@v1
        with:
          ecosystem: composer
          registry: https://packages.example.com
          path: packages/sdk
          tag-prefix: sdk/v

Publishing a prebuilt archive

Build, test and protect the archive in one job, download that artifact in the publishing job and pass it as archive: exactly those bytes are uploaded, the package, version and dependencies are read from the manifest inside the archive, and neither a checkout nor npm, cargo, dotnet or git is needed.

publish:
  runs-on: ubuntu-latest
  permissions:
    id-token: write
  steps:
    - uses: actions/download-artifact@v4
      with:
        name: dist
        path: dist
    - uses: kduma-OSS/serverless-registry-action/publish@v1
      with:
        ecosystem: npm
        registry: https://packages.example.com
        archive: dist/package.tgz

version is then only a consistency check; tag-prefix, path, workspace, package, project and args cannot be combined with archive. To migrate a crate built for a retired registry add source-registry-index: sparse+https://old.example.com/cargo/index/. archive needs an sreg release that has --archive (0.1.3 or newer) - set sreg-version accordingly if the action's default is older.

Auth

Lets package managers install from the registry, right before the install step:

- uses: kduma-OSS/serverless-registry-action/auth@v1
  with:
    ecosystem: composer
    registry: https://packages.example.com
- run: composer install

Supports composer, npm, cargo, nuget, swift and maven; takes a read token or OIDC. Optional inputs: write (credentials file), registry-name, npm-scope, cargo-config, swift-scope. Output: file.

Get

- id: tool
  uses: kduma-OSS/serverless-registry-action/get@v1
  with:
    registry: https://packages.example.com
    token: ${{ secrets.REGISTRY_TOKEN }}
    name: tools/acme-tool
    version: ^1.2
    labels: os=linux
    sole: true
    out: bin/acme-tool.tar.gz

Outputs: version, files, path.

Versioning and pinning

@v1 follows the latest 1.x release; @v1.2.3 or a commit SHA pins it. Each release installs a default sreg release, and a new stable sreg is picked up by a patch release within an hour. Use sreg-version to pin sreg yourself (a pinned version must be raised manually when the registry requires a newer client - exit code 3).

Documentation

• README with all inputs and per-ecosystem examples
• Release process