https://github.com/wheels-dev/wheels-packages
Official registry for Wheels packages. Manifests and distribution tarballs for the Wheels ecosystem.
https://github.com/wheels-dev/wheels-packages
Last synced: about 1 month ago
JSON representation
Official registry for Wheels packages. Manifests and distribution tarballs for the Wheels ecosystem.
- Host: GitHub
- URL: https://github.com/wheels-dev/wheels-packages
- Owner: wheels-dev
- License: apache-2.0
- Created: 2026-04-23T19:53:40.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-04-23T23:15:30.000Z (about 1 month ago)
- Last Synced: 2026-04-24T01:16:25.795Z (about 1 month ago)
- Homepage: https://wheels.dev/packages
- Size: 18.6 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
# Wheels Packages
The official registry for [Wheels](https://wheels.dev) packages. This repo holds package manifests and hosts their distribution tarballs as GitHub Release assets.
## What lives here
```
packages/
wheels-sentry/
manifest.json ← authoritative metadata, version history
README.md ← listing blurb, shown on wheels.dev/packages
wheels-hotwire/
wheels-basecoat/
wheels-legacy-adapter/
schema/
manifest.schema.json ← JSONSchema used on PRs (nullable tarball/sha256)
manifest.strict.schema.json ← JSONSchema used on main (tarball/sha256 required)
.github/workflows/
validate.yml ← runs on every PR and on push to main
mirror-tarball.yml ← packages + uploads release asset on PR merge
```
## How distribution works
1. Author opens a PR adding or appending a version entry with `tarball` and `sha256` set to `null`.
2. `validate.yml` checks the permissive schema, name uniqueness, that `source.repo` + `sourceTag` resolve, and that the tagged source passes the file-type allowlist + 10 MB size cap.
3. Maintainer reviews and merges.
4. `mirror-tarball.yml` fires: clones `source.repo` at `sourceTag`, produces a deterministic tarball (`tar --sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner | gzip -n`), uploads it as a GH Release asset at tag `-`, computes sha256, and bot-commits both values back into the manifest.
5. The strict-schema job on `main` re-validates — if the mirror didn't populate both fields, this job fails and surfaces the drift immediately.
The mirror workflow can also be triggered manually (`workflow_dispatch`) to backfill any version entries left as `null` across the registry.
## How users install packages
Once the CLI ships in Wheels 4.1:
```bash
wheels packages list
wheels packages install wheels-sentry
wheels packages install wheels-sentry@1.0.0
wheels packages update wheels-sentry
```
The CLI reads manifests from this repo, downloads the tarball listed in the manifest (hosted as a GH Release asset on this repo), verifies the sha256, and activates the package into `vendor/` in the consumer's Wheels app.
## How authors submit packages
See [`CONTRIBUTING.md`](CONTRIBUTING.md).
## License
Registry tooling and manifests: Apache 2.0. Each listed package carries its own license, declared in its manifest.