# Diatreme — release orchestration in a single GitHub Action

> One GitHub Action for the whole release: semantic versioning, releases, signed commits, provenance-verified Docker promotion and SBOMs. GitHub.com or GHES.

Canonical: <https://www.magmamoose.com/diatreme/> · Last updated: 2026-10-23

One GitHub Action for the entire release: versioning, releases, changelogs, signed commits, provenance-verified Docker promotion and SBOMs.

v2 · Marketplace · Apache-2.0 · GitHub.com + GHES

- [Get it on the Marketplace](https://github.com/marketplace/actions/diatreme)
- [Install the GitHub App](https://github.com/apps/diatreme/installations/new)
- [Read the docs](https://docs.magmamoose.com/diatreme/)

a Magma Moose product · Apache-2.0 open source

*the problem*

## Every repo reinvents release automation.

A semantic-release config here, a release-please job there, a hand-rolled tag script somewhere else. Each subtly different, each subtly broken. Diatreme gives an organization one workflow that works across all of them, and carries the deploy-side pieces they leave out.

**what you wire today**

- a per-repo semantic-release config
- a separate docker build + retag job
- an SBOM/scan step nobody maintains
- a bot PAT that expires at 2am
- ~200 lines of glue YAML per repo

**what you run instead**

MagmaMoose/diatreme@v2

one action · every release

*60-second quickstart*

## One step in your workflow. That's the whole integration.

Install the Diatreme GitHub App, add your versioning tool's config (a `pyproject.toml` for the example here), and merge a conventional commit to `main`. You get a tag, a GitHub Release and a changelog entry, automatically.

1. Install the App · 2. Add your versioning config · 3. Merge a commit

.github/workflows/release.yml:

```yaml
name: Release

on:
  push:
    branches: [main]

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write   # OIDC → hosted App token broker
    steps:
      - uses: MagmaMoose/diatreme@v2
        with:
          environment: prod
          environments: '["prod"]'
          prerelease-identifiers: '{}'
```

conventional commit → version → git tag → GitHub Release → CHANGELOG.md → Docker retag → promotion PR

*what you get*

## Everything the release dance needs, in one action.

### Versioning, your way

Auto-detects python-semantic-release, semantic-release (npm), GitVersion or release-please from repo markers, so one shared workflow serves a mixed-stack org.

### Retag, not rebuild

The image that passed PR CI as `pr-42` becomes `v1.2.3` by a provenance-verified, digest-pinned retag. No fresh build, no drift between what you scanned and what you ship.

### Supply chain built in

Scan the assembled image and route a CycloneDX SBOM to Dependency-Track, with optional findings to DefectDojo and cosign signing plus SLSA provenance.

### Signed release commits

A hosted GitHub App mints the short-lived release token and signs commits as a bot identity. Nothing to register, no PAT to rotate at 2am.

### Publish anywhere

npm, NuGet, Maven, Gradle, RubyGems, pip and containers, to GitHub Packages or public registries, with npm provenance and PyPI Trusted Publishing.

### Multi-environment promotion

dev → staging → prod ladders with per-environment prerelease identifiers (`v1.2.3-rc.1`), auto-opened promotion PRs and native auto-merge.

### Production guardrail

`admin-required-from: @last` makes manual dispatch runs targeting production require repo admin. Push and promotion-merge triggers are unaffected.

### Enterprise-ready

Works on GitHub.com and GitHub Enterprise (GHES / data residency), for trunk-based and branch-based development alike.

release notes can also aggregate ClickUp tickets and GitHub Projects items from the release range.

*compared to alternatives*

## One action does what the stack can't do together.

A best-effort comparison against the tools Diatreme consolidates. Corrections welcome via PR.

| tool | Versioning | Docker promote | Multi-env prerelease | Promotion PRs | SBOM / scan | Signed bot commits |
| --- | --- | --- | --- | --- | --- | --- |
| MagmaMoose/diatreme | Yes | Yes | Yes | Yes | Yes | Yes |
| semantic-release alone | Yes | No | No | No | No | No |
| release-please alone | Yes | No | No | No | No | No |
| GitVersion alone | Yes | No | No | No | No | No |
| docker retag action alone | No | Yes | No | No | No | No |

*core inputs*

## Configured by a handful of inputs.

| input | type | default | description |
| --- | --- | --- | --- |
| `mode` | `enum` | `release` | Pipeline mode: ci · release · enable-auto-merge. |
| `environments` | `json` | `["dev","staging","prod"]` | Environment names in promotion order; the last is always production. |
| `versioning-tool` | `enum` | `auto` | Versioning backend: auto-detected, or python · npm · gitversion · release-please. |
| `deployment-model` | `enum` | `tbd` | How the target environment is resolved: tbd · bbd · tbd-pr. |
| `prerelease-identifiers` | `json` | `{"dev":"dev","staging":"rc"}` | Environment-to-prerelease suffix map; production sheds the suffix. |
| `create-promotion-pr` | `boolean` | `false` | Auto-open the next-environment promotion PR after a prerelease. |
| `auth-mode` | `enum` | `public-app` | Token source: the hosted Diatreme GitHub App by default. |

outputs › version 1.2.3 · tag v1.2.3 · released true · is-prerelease false · resolved-environment prod

full input & output reference: [the docs](https://docs.magmamoose.com/diatreme/).

## Stop hand-rolling release YAML.

Free and open source. Install the Action, merge a commit, ship a release.

- [Get it on the Marketplace](https://github.com/marketplace/actions/diatreme)
- [Read the docs](https://docs.magmamoose.com/diatreme/)

## Links

- [Company: Contact](mailto:hello@magmamoose.com)
- [Company: LinkedIn](https://www.linkedin.com/company/magmamoose)