Release Pipeline

You can publish agents manually with selu publish, but for real projects, automate the process with CI/CD. This guide shows a GitHub Actions workflow that validates, tests, builds, and publishes your agent on every tagged release.

Workflow overview

The pipeline runs on every Git tag matching v* (e.g. v1.2.0):

1. Validate agent.yaml and manifest.yaml schemas.
2. Build all capability Docker images.
3. Run snapshot tests.
4. Push images to the Selu registry.
5. Submit the agent for marketplace review.

GitHub Actions workflow

.github/workflows/release.yml

name: Release Agent

on:
  push:
    tags:
      - 'v*'

env:
  SELU_TOKEN: ${{ secrets.SELU_PUBLISH_TOKEN }}

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Selu CLI
        run: |
          curl -fsSL https://get.selu.bot/cli | sh
          selu --version

      - name: Validate
        run: selu validate .

      - name: Build capabilities
        run: selu build .

      - name: Run snapshot tests
        run: selu test snapshot run .

      - name: Publish
        run: selu publish .

Secrets

You need one secret in your GitHub repository:

Secret	Description
SELU_PUBLISH_TOKEN	API token from your Selu marketplace account. Generate it at https://marketplace.selu.bot/settings/tokens.

Caution

Keep your publish token secret. Anyone with this token can publish or update agents under your account. Rotate it if you suspect a leak.

Docker image tagging

When selu build builds your capability images, it tags them as:

registry.selu.bot/<author>/<agent-name>/<capability-name>:<version>

For example:

registry.selu.bot/your-username/weather-agent/weather:1.2.0

The version comes from your agent.yaml. Make sure the version in agent.yaml matches the Git tag (minus the v prefix).

Version matching

A common pattern is to extract the version from the Git tag and verify it matches agent.yaml:

      - name: Check version match
        run: |
          TAG_VERSION="${GITHUB_REF#refs/tags/v}"
          YAML_VERSION=$(selu info . --field version)
          if [ "$TAG_VERSION" != "$YAML_VERSION" ]; then
            echo "Tag v$TAG_VERSION doesn't match agent.yaml version $YAML_VERSION"
            exit 1
          fi

Multi-capability builds

If your agent has multiple capabilities, selu build builds all of them in parallel by default. Each capability gets its own Docker image. You can build selectively with:

selu build . --capability weather   # build only the weather capability

Branch protection

For production agents, we recommend:

• Require PR reviews before merging to main.
• Only create release tags from main.
• Use GitHub’s tag protection rules to prevent accidental tag pushes.

Next steps

• Versioning — Semver rules and upgrade policies.
• Marketplace Guidelines — What the reviewer checks.