Add the registry tool, contributor contract and CI - #1
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- DockerValidator now has a Timeout (default 120s) and generates a named container per run so it can be docker-killed; cmd.Cancel and WaitDelay ensure a cancelled/timed-out context actually stops the container instead of leaking it. Adds --memory 512m --pids-limit 256. - ValidateEntry filters the release history in Validated.Releases to tags matching vX.Y.Z, so a pre-convention tag like release-2024 never shows up in a plugin's history (the latest-release check still runs against the unfiltered list first). - writeJSON no longer HTML-escapes JSON output, so readme_html contains literal <h1> rather than <h1>. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
cmd/registry is the tool CI runs: `validate` on pull requests and `build` on merge and every six hours, wired to the real GitHub source and Docker validator with a testable run() core. docs/CONTRACT.md is what a plugin author reads before opening a PR; README.md is the registry's own front door. renovate.json keeps the pinned goblog image current in workflows, cmd/registry/main.go and docs/CONTRACT.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- cmd/registry: run() now takes a Validator factory (func(image string) registry.Validator) built from the parsed --image flag instead of main pre-scanning os.Args for "--image VALUE" only; --image=VALUE and -image VALUE now reach the real DockerValidator too. Drop the "flags parsed twice" doc comment, now stale. - validator.go: run `docker kill` with its own 5s timeout context so a hung daemon can't block forever; only report "plugin timed out" when ctx.Err() is context.DeadlineExceeded specifically, so a plain caller cancellation surfaces as the underlying error instead. Note in a comment why a failed `docker kill` is still safe (--rm plus a random per-run name). - TestDockerValidator_Timeout now proves the kill path ran, not just that the error message says "timed out": the fake docker touches a marker file named after the container it was asked to kill, and the test asserts that marker exists. - docs/CONTRACT.md, README.md: note CI's timeout/memory/process limits on the validate-plugin check, and move/expand the TMPDIR note to sit with the Docker mention plus a note on rootless Docker and cgroups. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The new GitHub Actions workflows reference non-existent major action tags (e.g., actions/checkout@v7, actions/setup-go@v7, actions/deploy-pages@v5), which will break CI/deploys.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR introduces a Go-based plugin registry tool (cmd/registry validate|build) plus documentation and CI to validate listed plugin repositories and publish a GitHub Pages–hosted index for consumption by goblog clients.
Changes:
- Add registry validation/build pipeline with a Docker-sandboxed
goblog validate-pluginrunner and an index/details JSON generator. - Add contributor contract + README explaining the submission and validation rules.
- Add Renovate configuration and GitHub Actions workflows for PR validation and scheduled/main-branch publishing to Pages.
File summaries
| File | Description |
|---|---|
| renovate.json | Renovate config to keep the pinned goblog Docker image tag updated across workflows/code/docs. |
| README.md | Repository overview and local usage instructions for validate/build. |
| docs/CONTRACT.md | Contributor contract specifying required repo files, tag/version rules, and local pre-check command. |
| cmd/registry/main.go | CLI entrypoint wiring GitHub source + validator and implementing validate/build commands and exit codes. |
| cmd/registry/main_test.go | CLI behavior tests for validation, build exit codes, and flag wiring. |
| internal/registry/validator.go | Docker-based validator that runs goblog validate-plugin in a network-disabled container with timeouts/limits. |
| internal/registry/validator_test.go | Validator tests including a real-image opt-in and a timeout/kill-path harness with a fake docker shim. |
| internal/registry/validate.go | End-to-end validation for a registry entry (release selection, manifest/README presence, plugin identity checks). |
| internal/registry/validate_test.go | Validation behavior tests (tag filtering, latest-by-date selection, and error cases). |
| internal/registry/build.go | Index + per-plugin detail document builder, with skip-on-failure behavior and Pages output layout. |
| internal/registry/build_test.go | Build output tests (index sorting, detail fields, changelog behavior, .nojekyll, skip rules). |
| .github/workflows/validate.yml | PR workflow to run unit tests and validate all registry entries. |
| .github/workflows/publish.yml | Main/scheduled workflow to build and deploy the published index to GitHub Pages and fail if entries were skipped. |
Review details
- Files reviewed: 13/13 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+7
to
+8
| // GITHUB_TOKEN is used when set. Exit codes: 0 ok; 1 a validation failed or | ||
| // a fatal error; 2 (build only) output was written but some entries were skipped. |
Contributor
Author
There was a problem hiding this comment.
Fixed in e7c8a9b — the comment now says 2 is either a usage error or, for build, output written with skipped entries.
… tighten entry validation - go run collapsed registry build's exit code 2; build a binary first so skipped-entry builds (exit 2) still trigger the skipped-output path instead of failing the job outright - move pages/id-token permissions off the workflow-wide block and onto the deploy job only, since build runs untrusted plugin code - tighten manifest.go's entry check to a regex so odd characters (query, space) are rejected, not just missing .go/slash - add internal/registry/validator_test.go to renovate's regex manager so its hard-coded image tag gets bumped too - clarify CONTRACT.md wording and source.go's RenderMarkdown doc comment - reject --out/--base-url on validate and --repo on build in registry main.go, with tests Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Re the review summary: the action majors do exist — actions/checkout@v7, actions/setup-go@v7, actions/upload-pages-artifact@v5 and actions/deploy-pages@v5 all resolve via the tags API (latest releases: checkout v7.0.1, setup-go v7.0.0, upload-pages-artifact v5.0.0, deploy-pages v5.0.1), and the Validate workflow on this PR already ran green with checkout@v7 + setup-go@v7. The Pages actions get exercised by Publish index after merge. |
…Name() Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Registry tool (
cmd/registry validate|build) with the Docker-sandboxed plugin validator, the contributor contract, README, Renovate config, and the two workflows:Validateon PRs andPublish index(main + every 6h + dispatch → GitHub Pages). First entry: goblogplatform/goblog-plugin-hello v1.0.0.After merge,
Publish indexdeploys https://goblogplatform.github.io/plugins/index.json.🤖 Generated with Claude Code