Publishing your plugin

Plugins for VanillaMine and PocketMine-MP 5 are published on the VanillaMine plugin repository, the replacement for Poggit.

Coming soon

The plugin repository is not online yet. This page describes how it works.

Two ways to publish

• Upload a .phar you built yourself.
• Give a Git repository and a tag: any host (GitLab, GitHub, Codeberg…), public https:// URL. The repository builds the phar. If you have a .poggit.yml, its project path and libs (virions) are used, and virions published on the repository are injected and shaded like on Poggit.

The plugin name and version come from plugin.yml (or virion.yml for a virion). Upload a new version by bumping version.

Review

1. Automatic checks run in seconds, without running your code: valid plugin.yml, main class present, a 5.x api, PHP syntax, and code that needs a closer look (eval, running programs, obfuscation, bundled executables). Errors block the upload and tell you what to fix.
2. A moderator reviews each release.
3. Authors the moderators trust publish straight away, as long as the checks find no warning and nothing new compared with the last approved version (network access, decoding data, dynamic calls, writing files…). Otherwise a moderator looks first.

Obfuscated code is not accepted. Virions listed in .poggit.yml must use the form owner/repository/project (GitHub) or host/owner/repository/project, and a version constraint such as ^1.2.0: only virions built on the repository from that same Git repository are used.

From CI

Create an API token in your dashboard, store it as a masked variable (HUB_TOKEN) and send one request per tag. The build happens on the repository's server, so it costs no CI minutes.

# .gitlab-ci.yml
publish:
  image: alpine:3.20
  rules:
    - if: $CI_COMMIT_TAG
  script:
    - apk add --no-cache curl
    - >
      curl --fail-with-body -H "Authorization: Bearer $HUB_TOKEN"
      -F git_url=$CI_PROJECT_URL.git -F git_ref=$CI_COMMIT_TAG
      https://plugins.example.com/api/v1/releases

For tool authors

The repository serves the same releases.json as Poggit (same fields and state numbers), plus /get/{name} and virion downloads. Tools that read Poggit work by changing the host.