AttoBot is a package release bot for Julia. It creates pull requests to Julia METADATA when releases are tagged in GitHub, as an alternative to the PkgDev.jl functions register, tag and publish.

To set up AttoBot on your repository, go to https://github.com/integration/attobot and click "Configure" to select the repositories you wish to add. It will only operate on packages with the standard ".jl" suffix (all other packages will be ignored).

If the package is not yet registered in METADATA.jl, it will be automatically added when you make your first release.

Releases are created via GitHub releases: this is some extra functionality built on top of git tags that trigger a webhook used by AttoBot.

1. Click on the "releases" link in the repository banner.
   
2. Click "Draft new release"
   
3. Enter a tag label in the appropriate semver form (i.e. vX.Y.Z where X,Y,Z are numbers): GitHub will create the tag if it doesn't already exist. Include any other details and click "Publish release".

AttoBot will then open a pull request against METADATA and CC you in the process. In certain cases AttoBot may open an issue on the repository if the release is not correct (e.g. if the tag is not in the correct form). If the pull request does not appear within 30 seconds or so, please open an issue.

If you need to make a change before the release before the METADATA pull request has been merged (e.g. if you need to fix your Compat settings), the easiest option is to delete the release (and corresponding tag), then create a new release with the same version number; AttoBot will then update the existing pull request and make a comment that it has been updated. To delete a release and its tag:

1. Click on the "releases" link in the repository banner.
   
2. Click on the title of the release in question
   
3. Click "Delete".
   
4. The tag still exists; click on the tag title
   
5. Click "Delete"
   

AttoBot receives the content of certain GitHub hooks, namely the integration_installation event (which doesn't appear to be documented, but in any case is ignored by AttoBot), and the release event. These contain certain publicly available details about the repository and the user who initiated the event. AttoBot will also make several subsequent queries via the public GitHub api to the repository in question. The contents of these may be retained in server logs.

The user who triggers the release will be marked as the commit author, and if their email is publicly available via GitHub, or they have made a commit to the repository in question using a public email address, then it will appear in the METADATA commit log. If you don't wish for this to happen, then you should make your email address private.

AttoBot should not be enabled on private repositories: not only are these not supported by METADATA (thus any such pull requests will be rejected), but you may inadvertently leak private information.

• Image by kjpargeter / Freepik