Publishing Plugins

HaloForge uses one publishing toolchain for official and community plugins.

Package

npx @haloforge/plugin-pack check .
npx @haloforge/plugin-pack pack . --release --out dist/package

Generate Catalog Metadata

npx @haloforge/plugin-pack metadata dist/package/<plugin-id>-<version>.hfpkg \
  --signing-key-id haloforge-official-2026-05 \
  --signing-key-env HF_PLUGIN_SIGNING_PRIVATE_KEY \
  --pretty \
  --output dist/catalog-draft.json

Submit

npx @haloforge/plugin-pack submit dist/catalog-draft.json --token-env HF_ADMIN_TOKEN

Official plugin repositories should run this through GitHub Actions and store signing keys in repository secrets.

Review Model

Submitted metadata creates a draft. An admin reviews:

• source label
• package signature
• manifest permissions
• compatibility
• artifact URL
• homepage/repository URL
• trust policy

Only approved items should be published to the public catalog.