Skip to main content

thv ai-plugin push​

Push a built AI-tool plugin to an OCI registry

Synopsis​

Push a previously built plugin artifact to a remote OCI registry.

Push signs keylessly by default. Use --key to sign with a cosign key pair instead, or --no-sign to publish unsigned.

thv ai-plugin push [reference] [flags]

Options​

  -h, --help                    help for push
      --identity-token string   OIDC identity token (or a path to a file containing one) for keyless signing. Mutually exclusive with --key. If omitted, one is acquired automatically: from the GitHub Actions OIDC token when running with id-token: write permission, otherwise via an interactive browser sign-in
      --key string              Path to a cosign private key to sign the pushed artifact. Requires the locally discovered ToolHive server; for a remote or manually configured API URL, use keyless signing. Encrypted keys are decrypted with COSIGN_PASSWORD read from the 'thv serve' process, which performs the signing. Consumers installing the result project-scoped must pass --public-key with the matching cosign public key the first time; distribute it alongside the artifact. Keyless signing needs no such out-of-band step, since the signer identity is verifiable from the artifact itself
      --no-sign                 Push without signing (consumers will need an explicit unsigned exception to install project-scoped)

Options inherited from parent commands​

      --debug   Enable debug mode

SEE ALSO​