Run the final checks and publish a release

Tests and compilation run on your computer using the commands in polyform.toml. The Polyform website receives the finished implementation list and release information, not a build job.

1. Configure the release

[release]
build_command = ["cargo", "build", "--release", "--locked"]
manifest_command = ["cargo", "run", "--", "variants", "--json"]
artifact = "target/release/zip-safe"
artifact_name = "zip-safe"

The manifest command prints the accepted implementation list; the build command creates the exact artifact Polyform will sign.

2. Run checks and build

polyform check
polyform build

polyform check records passing conformance and fuzzing evidence. polyform build runs the declared release build and refuses to succeed unless the configured artifact exists.

3. Create a release signing key

polyform keygen

This writes .polyform/signing-key.json. Back it up privately and do not commit it. The signature lets users verify that the downloaded program came from this project. When you publish, Polyform also creates a separate composition key for the server and certifies it with this release key. Your release key stays on your computer.

4. Create a CLI token

Open your dashboard, choose Create CLI token, and copy it. The dashboard also lists existing tokens so you can revoke a lost token or rotate one after publishing.

5. Put the program online and publish

gh release create v0.1.0 target/release/zip-safe
export POLYFORM_TOKEN="pf_…"
polyform publish \
  --project you/zip-safe \
  --server https://omalled.com/polyform \
  --artifact-url https://github.com/you/zip-safe/releases/download/v0.1.0/zip-safe

The GitHub CLI uploads the exact local artifact without depending on browser file permissions. If you use GitHub’s web form instead, choose the file through the native macOS picker. Hosted project names always use owner/slug, even when the application field in the manifest has a different name.