Publish to the Hub

Rig Hub is the community registry. Browse, search, and install rigs published by others. Publish your own with a single command.

1. Authenticate

rig login

Opens a browser for device-flow OAuth. After you complete it, the CLI receives a token and stores it at ~/.config/rig/config.json.

You only need to do this once per machine. To clear:

rig logout

2. Publish

rig hub publish

The CLI:

Packs the rig (if no artifact is provided), producing dist/<name>-<version>.rig.tgz.
Validates the manifest.
Authenticates against the Hub using your stored token.
POSTs to https://userig.xyz/api/v1/packages/{author}/{name}/versions with the artifact, manifest JSON, version, and (if present) a base64-encoded README.

If the response is 200 OK, your rig is live at https://userig.xyz/packages/{author}/{name}.

You can also publish a pre-built artifact:

rig hub publish ./dist/my-rig-1.0.0.rig.tgz

Identity

The [rig].author field in rig.toml must match your authenticated Hub username. If it doesn't, the publish is rejected. This prevents impersonation.

If you want to publish under a different name (e.g. a team or org account), log in as that user.

Version conflicts

The Hub rejects publishes that try to overwrite an existing author/name@version. Bump [rig].version and publish again. See Versioning.

Privacy

Everything in the artifact is public once published. The Hub itself does not strip or transform contents. Run rig inspect before publishing.

For collaborative rigs

If the rig has [sync] enabled, rig hub publish checks the sync state first and refuses if:

There are unresolved conflicts.
There are apply errors.
The daemon is offline.

Override (rarely needed):

rig hub publish --force-offline-publish

Use only when you're certain — see Publishing under collab.

Flags

Flag	What
`--hub`	Target the Hub (vs. `--registry`).
`--force-offline-publish`	Skip the collab sync precondition. Solo rigs ignore this.
`--plain`	Plain output.
`--json`	Machine-readable summary.

What the Hub stores

The artifact itself in object storage.
The manifest as queryable metadata (powers search and package pages).
The README (markdown) for rendering on the package page.
Install counts and basic stats per version.

What it does not store:

Your .env values (those are never in the artifact).
Anything you didn't put in [package].include.
Your Hub auth token (that stays on your machine).