plugin.yml

# Execution stays disabled until the operator records Blacksmith qualification.
# See https://github.com/spitzli/cloud/blob/main/tools/plugin-ci/BLACKSMITH.md; runner labels alone do not select a region.
# Copy to .github/workflows/plugin.yml in each independent native plugin repository.
name: Native plugin
on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: native-plugin-${{ github.ref }}
  cancel-in-progress: false

jobs:
  check:
    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && vars.SPITZLI_BLACKSMITH_BUILDER_READY == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 20
    env:
      SPITZLI_OCI_BACKEND: blacksmith-buildx
      SPITZLI_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
    steps:
      - name: Require reviewed Blacksmith execution
        shell: bash
        env:
          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
        run: |
          set -euo pipefail
          case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
          test "$BLACKSMITH_REGION" = "$QUALIFIED_BLACKSMITH_REGION"
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.3
      - name: Install native manifest validator prerequisites
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends protobuf-compiler pkg-config libssl-dev
      - name: Reject unexpected existing BuildKit before provider setup
        shell: bash
        run: |
          set -euo pipefail
          test ! -e buildkitd.toml
          python3 scripts/plugin-release/build_oci.py --before-blacksmith-setup
      - name: Set up the managed Blacksmith builder
        uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184 # reviewed v2
        with:
          cache-key: Dockerfile
          nofallback: true
          buildx-version: v0.23.0
          platforms: linux/amd64
      - name: Verify provider builder and keep generated configuration outside source
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/plugin-release/build_oci.py --assert-blacksmith-builder
          mv -- buildkitd.toml "$RUNNER_TEMP/blacksmith-buildkitd.toml"
      - name: Require preinstalled qualified runner tools
        shell: bash
        run: |
          set -euo pipefail
          test "$(id -u)" -ne 0
          test "$(bun --version)" = 1.4.3
          command -v cargo
          command -v protoc
          command -v docker
      - name: Resolve this repository's GHCR image
        shell: bash
        run: printf 'IMAGE_REPOSITORY=ghcr.io/%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
      - run: bun scripts/plugin-release/release.mjs validate
      - name: Check and test the independent container target without publishing
        run: python3 scripts/plugin-release/build_oci.py --check < /dev/null

  release:
    needs: check
    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && vars.SPITZLI_BLACKSMITH_BUILDER_READY == 'true' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    # Restrict this environment to release tags using the repository's tag policy.
    environment: plugin-release
    permissions:
      contents: write
      packages: write
    env:
      SPITZLI_OCI_BACKEND: blacksmith-buildx
      SPITZLI_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
    steps:
      - name: Require reviewed Blacksmith execution
        shell: bash
        env:
          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
        run: |
          set -euo pipefail
          case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
          test "$BLACKSMITH_REGION" = "$QUALIFIED_BLACKSMITH_REGION"
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.3
      - name: Install native manifest validator prerequisites
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends protobuf-compiler pkg-config libssl-dev
      - name: Reject unexpected existing BuildKit before provider setup
        shell: bash
        run: |
          set -euo pipefail
          test ! -e buildkitd.toml
          python3 scripts/plugin-release/build_oci.py --before-blacksmith-setup
      - name: Set up the managed Blacksmith builder
        uses: useblacksmith/setup-docker-builder@19215110ab936351210feebdfa5b440b4493e184 # reviewed v2
        with:
          cache-key: Dockerfile
          nofallback: true
          buildx-version: v0.23.0
          platforms: linux/amd64
      - name: Verify provider builder and keep generated configuration outside source
        shell: bash
        run: |
          set -euo pipefail
          python3 scripts/plugin-release/build_oci.py --assert-blacksmith-builder
          mv -- buildkitd.toml "$RUNNER_TEMP/blacksmith-buildkitd.toml"
      - name: Require preinstalled Bun
        run: test "$(bun --version)" = 1.4.3
      - name: Require native contract, immutable bases, exact tag and configured signing trust
        env:
          PLUGIN_REGISTRY_URL: ${{ vars.PLUGIN_REGISTRY_URL }}
          PLUGIN_REGISTRY_PUBLIC_JWK: ${{ vars.PLUGIN_REGISTRY_PUBLIC_JWK }}
        run: bun scripts/plugin-release/release.mjs preflight
      - name: Resolve this repository's GHCR image
        shell: bash
        run: |
          set -euo pipefail
          printf 'IMAGE_REPOSITORY=ghcr.io/%s\n' "${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
      - name: Build and push through managed Blacksmith BuildKit
        id: image
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          printf '%s' "$GH_TOKEN" | python3 scripts/plugin-release/build_oci.py
      - name: Write final native manifest and identical descriptor with pushed image digest
        env:
          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
        run: bun scripts/plugin-release/release.mjs finalize release
      - name: Publish exact assets on the existing source tag
        shell: bash
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          command -v gh >/dev/null
          if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
            echo 'Release already exists; refusing to overwrite immutable assets.' >&2
            exit 1
          fi
          prerelease=()
          if [[ "$GITHUB_REF_NAME" == *-* ]]; then prerelease=(--prerelease); fi
          gh release create "$GITHUB_REF_NAME" release/tabularium.json release/*-universal.json release/release-lock.json \
            --verify-tag --title "$GITHUB_REF_NAME" --generate-notes "${prerelease[@]}"
  registry:
    needs: release
    if: vars.SPITZLI_BLACKSMITH_READY == 'true' && vars.SPITZLI_BLACKSMITH_REGION != '' && (startsWith(github.ref, 'refs/tags/v') && github.event_name == 'push')
    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    environment: plugin-release
    permissions:
      contents: read
    steps:
      - name: Require reviewed Blacksmith execution
        shell: bash
        env:
          QUALIFIED_BLACKSMITH_REGION: ${{ vars.SPITZLI_BLACKSMITH_REGION }}
        run: |
          set -euo pipefail
          case "${BLACKSMITH_REGION:-}" in us-east|us-west|eu-central|eu-west) ;; *) echo 'Recorded Blacksmith region required' >&2; exit 1 ;; esac
          test "$BLACKSMITH_REGION" = "$QUALIFIED_BLACKSMITH_REGION"
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          persist-credentials: false
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.4.3
      - name: Install native manifest validator prerequisites
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y --no-install-recommends protobuf-compiler pkg-config libssl-dev
      - name: Download the exact immutable assets from this release tag
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir release
          gh release download "$GITHUB_REF_NAME" --dir release --pattern tabularium.json --pattern '*-universal.json' --pattern release-lock.json
      - name: Publish with a scoped token when configured; require the exact signed receipt in either case
        env:
          PLUGIN_REGISTRY_URL: ${{ vars.PLUGIN_REGISTRY_URL }}
          PLUGIN_REGISTRY_PUBLIC_JWK: ${{ vars.PLUGIN_REGISTRY_PUBLIC_JWK }}
          TABULARIUM_TOKEN: ${{ secrets.TABULARIUM_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -n "$TABULARIUM_TOKEN" ]]; then
            bun scripts/plugin-release/release.mjs publish release
          else
            bun scripts/plugin-release/release.mjs verify release
          fi
      - name: Retain public signed receipt
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: signed-native-release-${{ github.sha }}
          path: release/signed-receipt.json
          if-no-files-found: error
          retention-days: 30