Configuration and hooks
.yasrt.yaml in the repository root, and the minimum is one line: product: image. Everything else is optional, documented in schema/yasrt.schema.json and validated by yasrt check.
productderives non-release paths and the tag format:image,package,extension,custom- Organisation defaults sit underneath the repository's file via
--defaults - Hooks call any executable at five points of the release
The file
product: image # image | package | extension | custom
product derives the paths that cannot trigger a release, and the tag format:
| product | Non-release paths | Tag format |
|---|---|---|
image | CHANGELOG.md, README.md, docs/** – not the CI file, that one builds the image | 1.2.3 |
package | the above plus.gitlab-ci.yml, .gitlab/**, .github/** | v1.2.3 |
extension | as package | v1.2.3 |
custom | nothing derived; non_release_paths is required | 1.2.3 |
The default rules are semantic-release's: a breaking change is a major, feat a minor, fix, perf and revert a patch, everything else nothing.
Organisation defaults
--defaults file (repeatable, or a :-separated list in YASRT_DEFAULTS) lays YAML files underneath the repository's: maps merge, scalars and lists replace, the repository wins. That is where a bot identity, chore → patch for dependency bumps or a hook manifest as a non-release path belong: said once, in the CI template every repository includes anyway, instead of in every repository.
Hooks
Extension points, in the order they run. A hook is any executable; it receives the release context as JSON on stdin and as RELEASE_* environment variables, and reports failure with a non-zero exit code.
hooks:
before_tag:
- run: ./scripts/policy-check
name: policy gate
timeout: 90s
after_tag:
- run: ./scripts/publish.sh
after_release:
- run: ./scripts/notify.sh
allow_failure: true
on_failure:
- run: ./scripts/page-someone.sh| Event | When | Failure |
|---|---|---|
after_analysis | in next, after the decision | reported |
before_tag | in release, before any write | aborts, repository untouched |
after_tag | tag on the remote, release commit not yet made | aborts |
after_release | last, after the forge release and the triggers | reported |
on_failure | when release ends in error; receives error and failed_step | reported |
args are passed verbatim, without a shell, so nothing is split or glob-expanded. Hooks inherit the job's environment (a hook that needs a token reads it there) and never receive one in the payload; what they print lands in the run report, secrets masked.
Everything else is optional and documented in schema/yasrt.schema.json, which editors use for completion and yasrt check validates against; the whole surface is in docs/SPEC.md §5.
Removing yasrt
Delete .yasrt.yaml and the CI jobs. yasrt keeps no state of its own: everything it produces is a tag, a commit, a release on the forge and a job artefact. On GitLab, switch the job-token push setting off afterwards if nothing else needs it.
Next
Forges and signing
GitLab, GitHub and Forgejo compared, and how the release commit and tag are signed.