Consumer update automation

TableTheory distributes Go, TypeScript, and Python through immutable GitHub Releases only. There is no npm or PyPI registry publication. Consumers should therefore pin exact release assets and let automation update those URLs.

Find the current release

Use GitHub release metadata as the source of truth:

# Latest stable release tag and URL.
gh release view --repo theory-cloud/TableTheory --json tagName,publishedAt,url

# Recent stable and prerelease tags.
gh release list --repo theory-cloud/TableTheory --exclude-drafts --limit 10

Without the GitHub CLI, use the GitHub API:

curl -fsSL https://api.github.com/repos/theory-cloud/TableTheory/releases/latest | jq -r '.tag_name'

Release tags include the leading v (vX.Y.Z). TypeScript asset names use the same version without the leading v: theory-cloud-tabletheory-ts-X.Y.Z.tgz. Python wheel asset names also omit the leading v: tabletheory_py-X.Y.Z-py3-none-any.whl. For release candidates, the Git tag keeps the semver prerelease form (vX.Y.Z-rc.N) and the Python wheel uses PEP 440 form (X.Y.ZrcN).

Renovate config for release assets

Renovate’s built-in npm and pip managers cannot see TableTheory’s direct GitHub Release asset URLs as registry packages. Use regex custom managers backed by the github-releases datasource instead. The config below updates stable TypeScript tarball and Python wheel URLs in prose Markdown docs and package manifests.

Do not point a URL-only manager at an integrity-bearing file (package-lock.json, a pip --hash requirements file, or any lockfile that records a resolved URL together with an SRI/hash). The manager replaces the URL string but cannot regenerate the adjacent integrity value, so the update PR would fail npm ci / pip install --require-hashes with an integrity error. Regenerate those files with their own package manager (npm install --save-exact <url>, pip install --require-hashes) instead.

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "customManagers": [
    {
      "customType": "regex",
      "description": "Update TableTheory TypeScript GitHub Release asset URLs",
      "managerFilePatterns": [
        "/(^|/)package\\.json$/",
        "/(^|/)README\\.md$/",
        "/(^|/)docs/.+\\.md$/"
      ],
      "matchStrings": [
        "https://github\\.com/theory-cloud/[Tt]able[Tt]heory/releases/download/v(?<currentValue>\\d+\\.\\d+\\.\\d+)/theory-cloud-tabletheory-ts-(?<assetVersion>\\d+\\.\\d+\\.\\d+)\\.tgz"
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "theory-cloud/TableTheory",
      "versioningTemplate": "semver",
      "extractVersionTemplate": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
      "autoReplaceStringTemplate": "https://github.com/theory-cloud/TableTheory/releases/download/v}/theory-cloud-tabletheory-ts-}.tgz"
    },
    {
      "customType": "regex",
      "description": "Update TableTheory Python wheel GitHub Release asset URLs",
      "managerFilePatterns": [
        "/(^|/)README\\.md$/",
        "/(^|/)docs/.+\\.md$/"
      ],
      "matchStrings": [
        "https://github\\.com/theory-cloud/[Tt]able[Tt]heory/releases/download/v(?<currentValue>\\d+\\.\\d+\\.\\d+)/tabletheory_py-(?<assetVersion>\\d+\\.\\d+\\.\\d+)-py3-none-any\\.whl"
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "theory-cloud/TableTheory",
      "versioningTemplate": "semver",
      "extractVersionTemplate": "^v(?<version>\\d+\\.\\d+\\.\\d+)$",
      "autoReplaceStringTemplate": "https://github.com/theory-cloud/TableTheory/releases/download/v}/tabletheory_py-}-py3-none-any.whl"
    }
  ]
}

Notes:

• The snippet intentionally tracks stable X.Y.Z assets. Release-candidate pins (X.Y.Z-rc.N / X.Y.ZrcN) are validation choices and should be advanced deliberately.
• If your Renovate configuration restricts enabled managers, include "custom.regex" in enabledManagers.
• Keep --save-exact for TypeScript installs and ==X.Y.Z constraints for Python when you want reproducible builds.
• package-lock.json and hashed requirements*.txt files are deliberately excluded from the managers above: a URL-only regex manager would rewrite the release URL while leaving the adjacent SRI/hash stale, so npm ci / pip install --require-hashes would fail with an integrity error. Update those files with their native package manager (npm install --save-exact <url>, pip install --require-hashes) so the URL and integrity change together.