Skip to content
Soxom

Publishing to registries

When a Production Release cuts a new semver tag, Soxom can push the tagged artifact to the language’s public registry. Publishing is configured per SDK Target and per environment, so you can publish your TypeScript SDK to npm but keep your Java SDK Git-only, for example.

Supported registries

Section titled “Supported registries”
SDK TargetRegistryWhat gets published
TypeScriptnpm (or private scope)A tarball of main at the tag
PythonPyPI (or compatible)Source dist + wheel
JavaMaven CentralJAR + sources + javadoc + signed POM
GoNone requiredThe tag in the Production Repository is the release

Go modules use the version control tag directly, so once the Production Repository carries a v1.2.0 tag, consumers can go get github.com/myorg/acme-sdk-go@v1.2.0 without any further action from Soxom.

Setup

Section titled “Setup”

  1. Provide registry credentials.

    In the dashboard, open your Project’s Settings → Registries page and add credentials for each Target you want to publish:

    • npm — an automation token with publish permission for the target scope.
    • PyPI — an API token scoped to the project.
    • Maven Central — a Sonatype OSSRH username/password plus a GPG private key for artifact signing.

    Credentials are encrypted at rest and only ever used during a Production Release.

  2. Pick automatic or manual publishing.

    Per Target, choose:

    • Automatic on tag — Soxom publishes immediately after the Production Release PR is merged and the tag is cut.
    • Manual — the tag is created, but you trigger publishing from the dashboard’s release page when you’re ready.

  3. For npm: choose scope and visibility.

    Set the scope (e.g., @myorg) and whether the package is public or restricted. Soxom passes the corresponding --access flag to npm publish.

  4. For Maven Central: confirm coordinates.

    Maven Central requires a groupId you’ve already claimed in Sonatype. Soxom uses the group_id and artifact_id from your soxom.yaml targets.java block. Make sure they match the namespace your Sonatype account is authorized to publish under.

  5. Cut a release.

    Merge the next Staging Release PR and then the Production Release PR. Soxom tags the Production Repository and — if you chose automatic publishing — pushes to the registry.

Private registries

Section titled “Private registries”

Every supported registry can be pointed at a custom URL with a custom credential pair:

  • npm — private scopes on npmjs.com, GitHub Packages, or any npm-compatible registry. Configure the registry URL and a scoped auth token.
  • PyPI — self-hosted devpi, AWS CodeArtifact, GitHub Packages, or another PEP 503 index. Provide the index URL and credentials.
  • Maven Central alternatives — any Sonatype Nexus or compatible Maven repository. Provide the deployment URL plus signing key.

Private and public registries can coexist on the same Target if you want to dual-publish.

Opting out

Section titled “Opting out”

If you don’t configure a registry for a Target, Soxom still creates the semver tag in the Production Repository on every release. Consumers depend on the Git URL directly:

Terminal window
# Go (always works, no registry needed)
go get github.com/myorg/acme-sdk-go@v1.2.0


# Python via Git
pip install git+https://github.com/myorg/acme-sdk-python@v1.2.0


# npm via Git
npm install github:myorg/acme-sdk-typescript#v1.2.0

Failure handling

Section titled “Failure handling”

If a publish step fails (bad credentials, network error, registry rejecting the version), the tag remains in the Production Repository and the release page shows the publish as failed with logs. Fix the underlying issue and click Retry publish — Soxom does not re-tag, it just re-runs the publish step.

Next steps

Section titled “Next steps”