Magma Moose
Magma Moose
Diatreme mark Diatreme

One GitHub Action for the entire release: versioning, releases, changelogs, signed commits, provenance-verified Docker promotion and SBOMs.

● v2 ● Marketplace ● MIT ● GitHub.com + GHES
Get it on the Marketplace Install the GitHub App Read the docs
a Magma Moose product · MIT open source
// the problem

Every repo reinvents release automation.

A semantic-release config here, a release-please job there, a hand-rolled tag script somewhere else. Each subtly different, each subtly broken. Diatreme gives an organization one workflow that works across all of them, and carries the deploy-side pieces they leave out.

what you wire today
— a per-repo semantic-release config
— a separate docker build + retag job
— an SBOM/scan step nobody maintains
— a bot PAT that expires at 2am
— ~200 lines of glue YAML per repo
what you run instead
MagmaMoose/diatreme@v2
one action · every release
// 60-second quickstart

One step in your workflow. That's the whole integration.

Install the Diatreme GitHub App, add your versioning tool's config (a pyproject.toml for the example here), and merge a conventional commit to main. You get a tag, a GitHub Release and a changelog entry, automatically.

1. Install the App 2. Add your versioning config 3. Merge a commit
.github/workflows/release.yml
name: Release

on:
  push:
    branches: [main]

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # OIDC → hosted App token broker
    steps:
      - uses: MagmaMoose/diatreme@v2
        with:
          environment: prod
          environments: '["prod"]'
          prerelease-identifiers: '{}'
conventional commit version git tag GitHub Release CHANGELOG.md Docker retag promotion PR
// what you get

Everything the release dance needs, in one action.

Versioning, your way

Auto-detects python-semantic-release, semantic-release (npm), GitVersion or release-please from repo markers, so one shared workflow serves a mixed-stack org.

Retag, not rebuild

The image that passed PR CI as pr-42 becomes v1.2.3 by a provenance-verified, digest-pinned retag. No fresh build, no drift between what you scanned and what you ship.

Supply chain built in

Scan the assembled image and route a CycloneDX SBOM to Dependency-Track, with optional findings to DefectDojo and cosign signing plus SLSA provenance.

Signed release commits

A hosted GitHub App mints the short-lived release token and signs commits as a bot identity. Nothing to register, no PAT to rotate at 2am.

Publish anywhere

npm, NuGet, Maven, Gradle, RubyGems, pip and containers, to GitHub Packages or public registries, with npm provenance and PyPI Trusted Publishing.

Multi-environment promotion

dev → staging → prod ladders with per-environment prerelease identifiers (v1.2.3-rc.1), auto-opened promotion PRs and native auto-merge.

Production guardrail

admin-required-from: @last makes manual dispatch runs targeting production require repo admin. Push and promotion-merge triggers are unaffected.

Enterprise-ready

Works on GitHub.com and GitHub Enterprise (GHES / data residency), for trunk-based and branch-based development alike.

↳ release notes can also aggregate ClickUp tickets and GitHub Projects items from the release range.

// compared to alternatives

One action does what the stack can't do together.

A best-effort comparison against the tools Diatreme consolidates. Corrections welcome via PR.

tool Versioning Docker promote Multi-env prerelease Promotion PRs SBOM / scan Signed bot commits
MagmaMoose/diatreme
semantic-release alone
release-please alone
GitVersion alone
docker retag action alone
// core inputs

Configured by a handful of inputs.

inputtypedefaultdescription
modeenumreleasePipeline mode: ci · release · enable-auto-merge.
environmentsjson["dev","staging","prod"]Environment names in promotion order; the last is always production.
versioning-toolenumautoVersioning backend: auto-detected, or python · npm · gitversion · release-please.
deployment-modelenumtbdHow the target environment is resolved: tbd · bbd · tbd-pr.
prerelease-identifiersjson{"dev":"dev","staging":"rc"}Environment-to-prerelease suffix map; production sheds the suffix.
create-promotion-prbooleanfalseAuto-open the next-environment promotion PR after a prerelease.
auth-modeenumpublic-appToken source: the hosted Diatreme GitHub App by default.
outputs › version 1.2.3 tag v1.2.3 released true is-prerelease false resolved-environment prod

↳ full input & output reference: the docs.

Stop hand-rolling release YAML.

Free and open source. Install the Action, merge a commit, ship a release.

Get it on the Marketplace Read the docs