Publishing from CI

Push a release straight from your build pipeline with a Sanctum token.

1 min read

When your build runs somewhere else, upload the archive over HTTP instead of putting it on the disk first.

POST /api/v1/products/{product-slug}/versions/upload

Requires a bearer token. Rate limited to 20 requests per minute.

Getting a token#

Admin → API tokens → Create. The token is shown once, at creation. Store it in your CI secrets immediately — it cannot be retrieved again, only revoked and replaced.

Uploading#

curl -X POST https://your-panel.example/api/v1/products/my-plugin/versions/upload 
  -H "Authorization: Bearer $PANEL_TOKEN" 
  -F "version=1.4.2" 
  -F "file=@dist/my-plugin-1.4.2.zip"

The panel stores the archive on the private disk, computes its hash, and creates the version record.

In a pipeline#

- name: Publish release
  run: |
    curl --fail-with-body -X POST 
      "https://your-panel.example/api/v1/products/my-plugin/versions/upload" 
      -H "Authorization: Bearer ${{ secrets.PANEL_TOKEN }}" 
      -F "version=${GITHUB_REF_NAME#v}" 
      -F "file=@dist/my-plugin-${GITHUB_REF_NAME#v}.zip"

--fail-with-body matters: without it curl exits zero on an HTTP error and your pipeline reports a green build for a release that was never published.

Token hygiene#

One token per pipeline, named for where it is used, so revoking one does not break the others.
Revoke immediately if a token is ever printed into a build log.
Tokens are listed with their creation and last-used dates under API tokens.