Review-required registries

Some registries need a second pair of eyes before a version goes live. A registry can have reviewRequired enabled — a registry-level setting, surfaced in the registry's data — to gate promotion to the latest channel.

What changes for publishers

On a review-required registry, a publisher can publish and tag prereleases only. Promoting a version to the latest dist-tag requires an admin. So publishing still works exactly as usual — you just can't move latest yourself:

skillhub publish --tag beta

How it shows up in output

When the review policy withholds the dist-tag, the publish --json payload reflects it:

• The per-skill tag field is null — the version was published, but the tag did not move.
• scanStatus may be pending while the server-side scan completes.

The version is safely stored; it simply isn't promoted yet.

The review queue

Reviewers work from the dashboard review queue — a registry-level list of prerelease versions awaiting promotion. Because every version is a content-hashed snapshot, a reviewer can read the change between two versions as a unified, red/green diff — reviewing a skill update just like code:

From there an admin can:

• Approve — moves the tag (optionally with a comment).
• Request changes — notifies the publisher.

The whole chain — publish, review, approval or change request — is recorded in the audit log.

No CLI approve command

Review and promotion are a dashboard flow; there is no CLI review or approve command. The CLI side is publish --tag <prerelease> for publishers and, for admins, moving the tag once a version is approved:

skillhub tag @studio/design-systems/tokens-workflow@1.2.3 latest

To open the registry's dashboard page:

skillhub open @studio/design-systems