Scripted publishing

Interactive setup, approved scope

Use Headless Publish only after one-time interactive owner or approved managed test-account setup outside CI. Never store Obsidian account credentials in CI or pass credential-bearing login options in automation.

Prerequisites

• Node.js 22+ runner and obsidian-headless installed.
• Approved account alias and active Publish entitlement read back without secrets.
• Approved site, local path, include set, schedule, cost scope, evidence owner, and rollback owner.
• Interactive ob login completed with credential options omitted.
• Publish mapping configured under separate exact approval.

Review before publication

cd ~/vaults/approved-publish-source
ob publish --dry-run

Preserve the dry-run, immutable source commit/hash, exact include set, and public target. Dry-run is preview evidence only; it does not publish and it is not public readback.

Publication gate

Stop for a release approval naming the exact account alias, site, source hash, include set, public scope, cost, and rollback owner. Broad all-file behavior and confirmation suppression remain blocked unless separately named.

After an authorized publish, read back the exact public URL and expected content/hashes. A successful command alone is not publication proof.

Failure and rollback

On scope, content, identity, entitlement, or public-readback drift: stop further publication, preserve the release receipt, restore the prior approved source state, run a fresh reviewed dry-run, and republish or remove content only under exact approval.

See Scheduled automation, Headless Publish, and Recovery.

Source: Headless Publish, retrieved 2026-08-29 EDT.