Publish Package
HARD GATE — Do not attempt to publish without verifying prerequisites. Missing auth tokens, stale builds, or duplicate versions cause CI failures that are hard to debug post-push.
HARD GATE — Always run
--dry-runfirst. Package registries are append-only — a bad publish cannot be fully undone on most registries.
Publish packages to language-specific registries. Detects package type from manifest files, verifies publish prerequisites, runs the registry-specific publish command, and confirms the version appears on the registry.
Process
1. Detect package type
Read the project root for manifest files to determine the package type:
| Manifest | Registry | Publish command |
|---|---|---|
package.json | npm | npm publish --access public |
Cargo.toml | crates.io | cargo publish |
setup.py / pyproject.toml | PyPI | twine upload dist/* or flit publish |
Formula/<name>.rb | Homebrew | brew bump-formula-pr |
| Multiple detected | Polyglot | Error: specify registry with `--registry <npm |
If no manifest is found, prompt the user to specify the type or pass --type <npm|crates.io|pypi|brew>.
2. Verify prerequisites
Before attempting any publish, run all applicable checks:
npm (package.json):
See REFERENCE.md
crates.io (Cargo.toml):
See REFERENCE.md
PyPI (setup.py / pyproject.toml):
See REFERENCE.md
3. Run publish
After all prerequisite checks pass, run the registry-specific command:
See REFERENCE.md
4. Verify publish success
After publish, confirm the version appears on the registry:
See REFERENCE.md
5. Error handling
On failure, surface actionable hints:
See REFERENCE.md
6. Dry-run mode (--dry-run)
Run --dry-run to verify all prerequisites without actually publishing:
See REFERENCE.md
7. Dry-run mode per registry
See REFERENCE.md
Verify
→ verify: test -f skills/publish-package/SKILL.md && test -f package.json
→ verify: grep -q publish-package SKILL-INDEX.md

