Publish Artifact

sfp publish pushes the artifacts produced by sfp build to a registry, and can tag the published versions in your git repository.

Artifacts are read from the directory given by -d/--artifactdir, which defaults to artifacts.

Where artifacts are published

Publishing has two destinations, and a run can use either or both.

Destination	When it is used
Internal registry — the registry the sfp server keeps	Whenever an sfp server is configured. No flags required.
External registry — an npm-compatible registry, or anything reachable from a script	When `--npm` or `--scriptpath` is passed.

The command reports the mode it resolved as Internal, External Only (no sfp server configured), or Internal + External.

# Server configured — publishes to the internal registry
sfp publish

# Server configured, and also to an external npm registry
sfp publish --npm --scope myorg

# No server — external only
sfp publish --npm --scope myorg --npmrcpath .npmrc

With no sfp server configured and neither --npm nor --scriptpath passed, publish has nowhere to send the artifacts and does nothing.

Publishing to an npm-compatible registry

Pass --npm to publish externally. Authentication comes from an .npmrc, an auth token, or the sfp server:

--npmrcpath — path to an .npmrc holding the registry URL and a token with publish permission. When an sfp server is configured and this flag is not set, the .npmrc is fetched from the server. Otherwise it defaults to the one in your home directory.
--npmauthtoken — a registry token. Defaults to GITHUB_TOKEN in GitHub Actions, CI_JOB_TOKEN in GitLab CI, or NPM_TOKEN.
--provider — github, gitlab or npm. Auto-detected from the CI environment when not set. With github or gitlab outside CI you must also pass --repository.
--scope — the user or organisation scope of the npm package. Required with --npm when no sfp server is configured.

There is no registry-URL flag. The registry comes from the .npmrc.

Registry providers

Follow your registry's own instructions to produce an .npmrc with the correct URL and a token that can publish:

Publishing somewhere that is not npm

Where artifacts live in storage that is not an npm registry, pass --scriptpath instead of --npm. sfp calls the script once per artifact.

sfp publish --scriptpath scripts/publish-artifact.sh

Publishing only promoted packages

-p/--publishpromotedonly restricts publishing to package versions that have been promoted. It requires --devhubalias, since promotion state is read from the DevHub.

sfp publish --npm --scope myorg --publishpromotedonly --devhubalias mydevhub

Tagging an artifact

The publish command can tag published artifacts in version control. These tags are what sfp build --diffcheck uses to work out which packages changed.

Flag	Description
`--gittag`	Tag the current commit with an annotated tag holding the package name and version. Does not push
`--pushgittag`	Push the tags created by this command to the repository
`--gittaglimit`	Minimum number of tags to retain per package
`--gittagage`	Number of days a tag is retained; older tags are deleted

sfp publish --npm --scope myorg --gittag --pushgittag

Flags

Flag	Description	Required
`-d`, `--artifactdir`	Directory containing the artifacts to publish (default `artifacts`)	Yes
`--npm`	Publish to an npm-compatible registry	No
`--scope`	User or organisation scope of the npm package	With `--npm` and no server
`--npmrcpath`	Path to the `.npmrc` used to authenticate. Requires `--npm`	No
`--npmauthtoken`	Registry auth token	No
`--provider`	`github`, `gitlab` or `npm`. Requires `--npm`	No
`-f`, `--scriptpath`	Script that publishes each artifact, for non-npm registries	No
`-p`, `--publishpromotedonly`	Publish only promoted package versions. Requires `--devhubalias`	No
`-v`, `--devhubalias`	DevHub used to read promotion state	No
`-t`, `--tag`	Tag recorded against the publish	No
`--gittag`	Create an annotated git tag per published artifact	No
`--pushgittag`	Push the created git tags	No
`--gittaglimit`	Minimum number of tags retained per package	No
`--gittagage`	Age in days beyond which tags are deleted	No

--npmtag is deprecated. sfp tags the artifact with the branch name automatically.

Fetching Artifacts — retrieving published artifacts
Building artifacts — producing the artifacts to publish

On this page