Review-required flow

Some registries turn on review. On a review-required registry, publishers can ship versions but can't promote them to latest on their own — an admin approves the promotion through the dashboard. This gives a team a gate between "published" and "what everyone installs."

What changes for publishers

A registry with reviewRequired enabled restricts the latest dist-tag. Publishers can:

• Publish new versions.
• Move prerelease dist-tags (like beta).

Publishers cannot move latest — that's an admin action. So the standard move is to publish under a prerelease tag:

skillhub publish --tag beta --to @studio/design-systems

Reading the publish result

When the review policy withholds the latest tag, the publish still succeeds — the version exists — but the tag doesn't move. In the result:

• tag is null (the version published, but the requested tag was withheld).
• scanStatus may be pending while the server-side scan is still running.

{
  "ok": true,
  "data": {
    "published": [
      { "ref": "@studio/design-systems/tokens-workflow", "version": "2.0.0", "tag": null, "scanStatus": "pending" }
    ],
    "skipped": []
  }
}

A null tag here isn't an error — it means "the version is up, awaiting review."

The review queue

Reviewers work from the dashboard review queue: a per-registry list of prerelease versions waiting to be promoted. From there an admin can:

• Approve — moves the tag to the version (optionally with a comment).
• Request changes — notifies the publisher that something needs fixing.

To decide, a reviewer compares the pending version against what's currently promoted. The dashboard renders a server-computed diff of the changed files, so an admin can see exactly what moves before they approve it:

The whole chain is recorded in the registry's audit log.

Promoting to latest

There is no CLI review or approve command — approval happens in the dashboard. The CLI side of the flow is just two pieces:

• Publishers ship prereleases with publish --tag <prerelease>.
• Admins promote a reviewed version with skillhub tag:

skillhub tag @studio/design-systems/tokens-workflow@2.0.0 latest

Related

• Versions & dist-tags — the version/tag split this flow builds on.
• Registries & org publishing — the roles that decide who can promote.