# Build and publish

Build never leaves the repository. Each repo calls a shared publish
workflow — one per language/framework and kind (`publish-node-app`,
`publish-solution`, `publish-config`, …) owned by
`WilldanGroup/switchboard-kit` — that installs, tests, packages, and cuts
the semantic-release version. Artifacts land in the org devops buckets
through the OIDC deploy roles; no credentials live in GitHub.

Every publish:

1. lands a **build** row — commit, test result, artifact, channel;
2. advances a **channel** head — `alpha/<branch>` for branch builds,
   `beta` for every merge to the default branch;
3. deploys nowhere by itself — environments *follow* channels, and
   `stable` advances only when a [release](/releases) is approved.

A version on a channel traces back to the build that made it, and every
environment the version reached is on the build row.

`GET /v1/builds?repo=…` and `GET /v1/channels?repo=…` in the
[API reference](/api).