Commands

Run each command with bunx @doguyilmaz/tapster <command>. Every command takes --help.

tapster setup

Opens the setup in your browser: choosing the hub, its protection, the GitHub App, the Apple credentials, the hub files, the projects on your computer and the hub’s health. Under Optional extras it also deploys the doorbell, makes the apt and dnf key and stores Sparkle keys and the certificates of single apps. It does what init, add and doctor do. It needs no clone of the hub. See Create the hub.

Option	What it does
--no-open	Prints the link instead of opening the browser.
--port <port>	Listens on another port than 8277. Password managers save entries per address, so keep one port.
--tapster <commit>	Pins the hub workflow to a tapster commit, for a tapster built from a checkout.

The page runs on 127.0.0.1 only. The link it opens works once; press Enter in the terminal for a fresh one. It stops with Ctrl+C, with Close on the page or after two hours without use.

When the tapster service runs, tapster setup without --port or --tapster asks it for a link and opens its page instead. tapster setup --service is what the service itself runs: it opens no browser, prints no link, never stops by itself and reads its port from ~/.config/tapster/service.json.

tapster service

Keeps tapster setup running on this computer, so its page is always there and offers each new tapster release. It needs tapster installed with Homebrew, Bun or npm. See Keep setup running.

Command	What it does
service install	Starts the service now and at every login: a LaunchAgent on macOS, a systemd user unit on Linux. It takes port 8277 or the next free one up to 8299.
service uninstall	Stops the service and removes the LaunchAgent or the unit and ~/.config/tapster. tapster itself stays installed.
service status	Says whether the service is installed, which version runs and at which address.
service logs	Shows the service’s recent log.

tapster init

Run it in a clone of your hub. Each option below adds or changes one part of it. init and init --workflow also rewrite the hub workflow for the tapster that runs them; review the diff before you push.

Command	What it does
init	Protects the hub, creates its App, stores your Apple credentials and writes tapster.yml, the workflow and a README. Each step can run again and skips what is done. See Create the hub.
init --every <minutes>	Sets how often the hub looks for drafts: 5, 6, 10, 12, 15, 20 or 30 minutes. Longer intervals must be 60 minutes times a divisor of 24. The default is 10 for a public hub and 60 for a private one.
init --workflow	Rewrites the hub workflow, pinned to the tapster that runs the command. See Upgrade tapster.
init --tapster <commit>	Pins the workflow to a specific tapster commit. Goes with init or init --workflow.
init --sparkle <label> [--account <account>]	Stores a Sparkle key from your login keychain in the hub. See Mac apps with Sparkle.
init --sparkle <label> --new	Makes a new Sparkle key, keeps it in your login keychain and stores it in the hub.
init --linux	Makes the key that signs the apt and dnf repositories and turns on GitHub Pages. Needs GnuPG. See apt and dnf.
init --doorbell	Deploys the Worker that starts the hub when a project releases, through Cloudflare’s API. Asks for a Cloudflare API token with a hidden prompt. Set CLOUDFLARE_API_TOKEN to skip the prompt. When the token reaches several accounts, tapster asks which one; CLOUDFLARE_ACCOUNT_ID answers that in advance. See Faster releases.
init --rotate app	Stores a new private key for the hub’s App.
init --rotate certificate	Stores a new Developer ID certificate.
init --rotate notary	Stores a new App Store Connect API key.
init --certificate <label>	Stores the Developer ID certificate of the packages with certificate: <label>. For a certificate of another team it also asks for that team’s App Store Connect API key. Adds the certificate to the hub workflow; commit and push it. See Sign apps with another certificate.
init --certificate <label> --notary	Stores a new App Store Connect API key for that certificate’s team.
init --rotate doorbell	Gives the doorbell a new key and redeploys it with the tapster you run and the hub’s schedule. Asks for the token the same way.
init --rotate linux	Makes a new Linux key. The old one keeps signing next to it.
init --rotate linux --finish	Stops signing with the previous Linux key.

See Rotate a key for when and how to rotate.

tapster add

Run it in a clone of a project. It prepares the project’s release workflow, protects the project and proposes it to the hub. See Add a project.

Option	What it does
--hub owner/repo	The hub that publishes this project. add asks once and remembers it in the clone’s git config.
--workflow file.yml	The workflow that runs GoReleaser, when it is not release.yml.
--certificate label	Selects an app-specific Developer ID certificate for a new hub entry, including macOS builds without hub default credentials. Upload it after merging the entry. For existing projects, change the choice under Configuration in setup.
--auto-tag	Lets the project’s release workflow push tags with a deploy key. See Releases tagged by a workflow.
--auto [daily|push|off]	Picks versions and tags automatically. Daily at 03:23 UTC by default; push checks each default-branch push and off returns to manual releases. Includes the tag key when enabled. See Automatic releases.
--allow-dependabot	Leaves branches named dependabot/... open so Dependabot can open pull requests. See Dependabot.
--force	Replaces an existing release workflow.

tapster doctor

Run it in a clone of your hub. It reads the hub as it is on GitHub’s main branch and checks every setting its security depends on. Each finding names the command that fixes it. It takes no options.

tapster mcp

Serves tapster’s tools to an AI assistant over MCP, on stdin and stdout. See Use tapster with an AI assistant. It takes no options.

tapster upgrade

Tells how this tapster was installed and upgrades it. For Homebrew it runs brew update and brew upgrade --cask tapster; for a global Bun or npm install it runs that tool’s install command. For bunx and a checkout it prints what to run instead: bunx @doguyilmaz/tapster@latest or git pull. It takes no options. To move the hub to the new version, open tapster setup and write the Hub files.

tapster –version

Shows the version of tapster and the commit it pins hubs to.