Get started

ReleaseKit

Self-hostable release workflows with Preview, Nightly, and Production.

ReleaseKit is release infrastructure for desktop apps and packages. Your repository defines the workflow, your organization’s runner executes it, and ReleaseKit coordinates candidates, secrets, artifacts, approvals, feeds, and promotion.

npm install -g @sandbox-technologies/release-kit
release-kit login
release-kit preview

release-kit preview creates an artifact-only candidate from your current branch and prints a dashboard link where you can watch its workflow jobs.

The Model

Every project has three lanes.

Production and Nightly update the app version file in Git, push that version commit, and wait for approval in ReleaseKit before users update. Production and Nightly are independent feeds; approving one does not move users subscribed to the other.

Setup

• Connect GitHub.
• Register an organization runner and assign it to the project.
• Choose the Production branch and optional Nightly branch.
• Add release-kit.yml with ordered build steps, artifacts, and target arches.
• Add an Apple signing profile.
• For npm package workflows, connect the npm credential under Organization → Integrations, then enable the detected package under Project settings → Publishing.
• Use the CLI or dashboard to create candidates.

There is no workflow dropdown or GitHub environment to choose. Build and verification steps live in release-kit.yml; lanes, approval, and publication live in ReleaseKit. Package registry credentials live with the organization, while package and npm channel mappings live with each project.

For npm releases, declare the packed tarball with the npm-package artifact role. ReleaseKit validates the package name, version, access, and integrity from the tarball itself, then publishes it with the project’s configured Production or Nightly dist-tag. The npm credential is available only to the managed publisher.

Every organization receives an immutable public release host such as sandbox-technologies.releases.release-kit.dev. Candidates snapshot that host, so changing a project’s default affects only future releases. Electron builds receive the non-secret host as RELEASE_KIT_ARTIFACT_BASE_URL; ReleaseKit publishes and verifies the immutable assets before sending the package to npm.

Boundary

Your repository owns source code, build and verification steps, and app update integration. Your runner owns execution and artifact production. ReleaseKit owns workflow scheduling, scoped build-secret leases, publishing credentials, artifact records, feeds, policy, approvals, publication, and rollback.