Tell the marketplace when a game is released

[nicodes]

Cutting a release built the package, tagged it, uploaded it — and stopped. Somebody then had to run termcade publish by hand, or the catalog never learned the release existed. That is how a marketplace ends up behind its own games.

Publishing after the release, not before

Publishing is a claim that a package is at these coordinates, and the registry verifies it by fetching. Claiming first would have it fetch something not yet uploaded.

A scoped key, not a password

TERMCADE_TOKEN is a publish key scoped to the aviorstudio handle. It publishes and nothing else — it cannot read a library, mint another key, or touch an account — so a leak is bounded by one handle.

Without the secret the release still cuts and the step warns with the exact command to run by hand. A release that failed after tagging is much harder to unpick than one the registry has not been told about yet.

The secret is read into the environment and the step decides from there, rather than through a step-level if on the secrets context — that evaluates to something unhelpful instead of failing loudly, and a publish step that silently never ran is precisely the failure this exists to prevent.

A bug this surfaced

Every release note, and the README, said:

termcade add aviorstudio/<game>@<version>

Pinning was removed, so the instruction shipped with each release is one the arcade now refuses:

termcade: versions cannot be pinned — `termcade add aviorstudio/tetris` installs what aviorstudio/tetris currently ships

Fixed in both places.

To turn it on

termcade keys new termcade-games aviorstudio

then set the token as the TERMCADE_TOKEN secret on this repository.

🤖 Generated with Claude Code