Releasing the SDKs

1. Bump every SDK to the new version — the npm packages' package.json, sdk/python/pyproject.toml, sdk/ruby/lib/antibot/version.rb, both .csproj files, sdk/flutter/pubspec.yaml and sdk/java/pom.xml — and check they agree: node sdk/scripts/check-versions.mjs 1.2.0.
2. Tag the commit sdk-v1.2.0 and push the tag. .github/workflows/release.yml checks the versions against the tag again, then publishes to each registry whose token is a repository secret: NPM_TOKEN (npm, with provenance), PYPI_TOKEN, RUBYGEMS_API_KEY, NUGET_API_KEY, PUB_CREDENTIALS (pub.dev), and for Maven Central a Central Portal user token (MAVEN_CENTRAL_USERNAME, MAVEN_CENTRAL_PASSWORD) with the armoured key that signs every artifact (MAVEN_GPG_KEY, MAVEN_GPG_PASSPHRASE). A registry without its secret is skipped, and the run says so.

Before the first release, the names have to be yours on each registry: @antibot/* on npm, antibot on PyPI, RubyGems and pub.dev, Antibot and Antibot.AspNetCore on NuGet, and the dev.antibot namespace on Maven Central (verified there by a DNS record on antibot.dev). As of October 2026 two of them are someone else's: antibot on PyPI (twenty releases, the last in May 2025) and AntiBot on NuGet (2016; NuGet's ids ignore case) — those two packages need other names (antibot-sdk and Antibot.Sdk were free).

Not published by the workflow: the Go module (a tag on its own repository), the PHP package (Packagist reads a repository of its own; split sdk/php out), and the Android and iOS SDKs (Maven Central and Swift Package Manager, from repositories of their own).