stado release catalog

Invocation

stado release catalog <COMMAND>

Purpose

Manage the Stado-owned product and source policy catalog

Required inputs and options

This command has no command-specific inputs or options.

Output and state effect

This command group selects one of the subcommands listed below; use its exact child invocation to perform an operation.

Refusals

Before dispatch, Stado refuses a missing required token shown in the invocation, an unknown option, or a value outside a listed value set; argument-usage failures exit with code 2.

Subcommands

enroll — Set up everything a checkout's release manifest needs from the fleet: its release publisher, the build secrets its platforms and deliveries read (declared for and granted to the workload agent), for a service its rollout policy (created from runtime.port when absent) with, when the service directory does not know the service yet, its directory route called by the manifest's runtime.consumers, its own consumer with exactly `runtime.grants` and its bearer on every rollout target, and the product's entry in the release catalog the daily batch builds from; a required platform declaring no post-build tests is refused. `build submit` and `release submit` run the same steps (and name it)
sync — Register products from checked-out manifests or one central catalog
audit — Audit Stado's catalog without contacting repository hosts: every declared publisher must have a catalog entry and every required platform tests. Exits nonzero and names each finding on any refusal
declare-publisher — Declare one product's release publisher across the fleet: mint its item on the vault owner, grant the release client access, declare it on every participating host, then reconcile each host's verifier grant. `build submit` and `release submit` run this themselves for a product this host has not declared, with this host as the client and the vault owner read from `skarbiec bond status`; run it by hand only to declare further API targets or reloads
withdraw-publisher — Withdraw a retired product's release publisher declaration from the vault owner, this host and every --target, then reconcile each host's release verifier. Refuses while the release catalog still holds the product. The vault item stays, so a returning product re-declares
retire — Retire a product from the release pipeline: the inverse of `enroll`. Removes its entry from the release catalog the daily batch builds from, then withdraws its release publisher as `withdraw-publisher` does. A product the catalog does not hold is refused by name. Published releases stay; a returning product enrolls again
adopt — Add an application checkout to the release pipeline: write its release manifest and scripts from what its project states, declare its publisher, register it. Without --apply only the plan is printed
pin-input — Make one committed revision of another repository, or only the paths of it the build reads (--path, repeatable), an immutable build input of the product in CHECKOUT: archive it, store it create-only under the product's sources, and write `inputs.<name>` of its `.wisent-release.json`. The build reads it from WISENT_INPUT_<NAME>_DIR. --cargo publishes Cargo.lock's private crates, --git-bundle the commit's history, --swiftpm a Swift package's committed resolution