Click Publish on the project page. SourceTrust checks your publishing access before the inventory review, signature and countdown. If payment is required, that step opens first. Access is checked again when the publication is saved. SourceTrust freezes the current Live packages into an immutable, numbered revision. The public page always shows the last thing you deliberately published, never work in progress.
First publish on a draft project
The first publish activates the project. On a free organization that uses the lifetime Community publish or a public-GitHub OSS activation (SourceTrust stays on the page). On a paid organization it uses one billing project slot and pages have no SourceTrust promotion. Exporting a draft in Public page mode does not activate it. In In-app only / export or Public page and in-app export mode, the first export requires owner or admin activation and available free or paid project capacity. Only owners and admins can activate. Editors can re-publish an already-active project but cannot activate a new one.
Publish states
- Unpublished changes: You edited Live packages since the last publish. The project header, out-of-date banner, and Publication status summarize added, updated, and removed packages, plus how many are not yet on the public attestation page. The Changes tab lists both the live-vs-published diff and those pending packages.
- Blocked: An approved package is missing text or an obligation. Fix it (or un-approve it) before publishing.
- Incomplete inventory: Packages still needing review stay off the page. Publish warns by default; Require full inventory review hard-blocks. Publish when merged never auto-publishes while gaps remain.
- Signature: Your org may require a signature on every publish. Your profile name is recorded as the signer. See Help center → QR codes and signatures.