Release and Packaging

Auditaur packages are published publicly and the repository is configured for semantic release automation.

Package names

Component	Name	Status
CLI crate	auditaur-cli	Published to crates.io; installs a binary named auditaur.
Core crate	auditaur-core	Published to crates.io for shared models and config.
Collector crate	auditaur-collector	Published to crates.io for SQLite store and receiver types.
Tauri plugin macro crate	tauri-plugin-auditaur-macros	Published to crates.io before the plugin crate; re-exported by tauri-plugin-auditaur.
Tauri plugin crate	tauri-plugin-auditaur	Published to crates.io for Tauri v2 apps.
Frontend package	@auditaur/api	Published to npm; also published to GitHub Packages as @sethjuarez/auditaur-api.

The Rust workspace declares MIT license and repository metadata. Each crate includes crates.io metadata and versioned workspace dependency declarations. The npm package is public-scoped through publishConfig.access = "public". Its source package name remains @auditaur/api; the GitHub Packages workflow temporarily rewrites package metadata at publish time so imports and npmjs installs do not change.

CLI build

Install the CLI:

cargo install auditaur-cli
auditaur doctor

Source checkout development:

cargo run -p auditaur-cli -- apps --json
cargo run -p auditaur-cli -- mcp

Build release binary:

cargo build -p auditaur-cli --release
.\target\release\auditaur.exe doctor

On macOS/Linux, use ./target/release/auditaur.

Semantic release automation

Rust crates use release-plz:

1. .github/workflows/release-rust.yml opens or updates a Rust release PR on pushes to main.
2. Merging the release PR updates versions and changelogs according to Conventional Commits plus release-plz semver checks.
3. release-plz.toml sets release_always = false, so normal pushes only prepare release PRs and publishing happens from release PR merges.
4. Merging the release PR runs release-plz publish for changed Rust crates.
5. The release workflow verifies that tauri-plugin-auditaur depends on tauri-plugin-auditaur-macros at the same version before release-plz runs. Cargo and release-plz then use the workspace dependency graph, so the macro crate must be available before the plugin crate can publish.
6. CI and release workflows run python scripts/check-skill-drift.py so the repo-shipped Auditaur skill/extension files and their packaged CLI assets cannot drift.
7. Publishing requires a CARGO_REGISTRY_TOKEN repository secret until crates.io trusted publishing is configured for existing crates.
8. The CLI is distributed through the auditaur-cli crate. Auditaur does not publish prebuilt GitHub release binaries because Tauri developers already need Rust and Cargo for normal app development.

The frontend package uses release-please:

1. .github/workflows/release-api.yml opens or updates a release PR for packages\api.
2. Merging the release PR creates a GitHub release tagged for @auditaur/api.
3. .github/workflows/publish-api.yml publishes matching @auditaur/api-v* releases to npm with provenance.
4. The same workflow then publishes the built package to GitHub Packages as @sethjuarez/auditaur-api using the release workflow’s GITHUB_TOKEN.
5. Manual workflow dispatch defaults to publish_target: github-packages, so real manual mirror publishes do not publish to npmjs. Select npmjs-and-github-packages only when intentionally exercising the full release publish path.
6. Before a real GitHub Packages publish, the workflow checks whether @sethjuarez/auditaur-api@<version> already exists and skips the mirror publish if it does.
7. Publishing to npm uses npm trusted publishing/OIDC, so no NPM_TOKEN is required after the package is configured on npm. Publishing to GitHub Packages uses packages: write workflow permission and NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}. A separate PAT is only required if the package is later published to a different owner or repository scope that the workflow token cannot write.

Downstream apps that cannot reach npmjs can consume the GitHub Packages copy via an npm alias while preserving imports:

"@auditaur/api": "npm:@sethjuarez/auditaur-api@<version>"

Manual dry runs are available locally:

cargo publish -p auditaur-core --dry-run
cargo publish -p auditaur-collector --dry-run
cargo publish -p tauri-plugin-auditaur-macros --dry-run
cargo publish -p tauri-plugin-auditaur --dry-run
cargo publish -p auditaur-cli --dry-run

cd packages\api
npm publish --dry-run --access public
npm pack --dry-run

Use the publish-api.yml workflow dispatch dry-run to exercise the authenticated GitHub Packages publish path without creating a package version. For real manual mirror publishes, keep the default publish_target: github-packages; this skips npmjs and publishes only the GitHub Packages mirror.

For a single local preflight before a release, run:

.\scripts\preflight-release.ps1

This runs the packaged skill/extension drift check, Rust formatting and targeted tests, API tests/build, docs build, Rust workspace package verification, and gh skill publish .github --dry-run when GitHub CLI is available. Add -IncludeDogfoodSmoke to include the live Windows dogfood app pass, -AllowDirtyPackage while validating uncommitted local changes, or -SkipGhSkillDryRun when GitHub CLI is unavailable.

The live dogfood app smoke is also available as a manual GitHub Actions workflow named Dogfood Smoke. It is intentionally workflow_dispatch only because it launches the Windows Tauri/WebView app and is heavier than normal PR validation.

Release checklist

1. Keep npm trusted publishing configured for @auditaur/api:
   • Publisher: GitHub Actions.
   • Organization/user: sethjuarez.
   • Repository: auditaur.
   • Workflow: publish-api.yml.
   • Environment: leave blank unless this workflow is later updated to use one.
2. Keep .github/workflows/publish-api.yml configured with packages: write and same-repository GITHUB_TOKEN package publishing for @sethjuarez/auditaur-api.
3. Keep CARGO_REGISTRY_TOKEN available until crates.io trusted publishing is configured for all Rust crates.
4. For the first release that includes tauri-plugin-auditaur-macros, confirm the release-plz run lists the macro crate before tauri-plugin-auditaur.
5. Run python scripts/check-skill-drift.py after editing the Auditaur debug skill or gate canvas extension, and keep their matching files in crates\auditaur-cli\assets identical.
6. Run .\scripts\preflight-release.ps1 before publishing release PRs. Use -IncludeDogfoodSmoke when a live Windows dogfood pass is appropriate.
7. Before publishing the agent skill for real, review gh skill publish .github --dry-run warnings. Repo-level warnings such as secret scanning, push protection, and tag rulesets are GitHub repository settings, not code changes.
8. Use Conventional Commits so release-plz and release-please can calculate semantic versions consistently.