Skip to content

Test: a repo without a manifest must fail validation - #2

Closed
compscidr wants to merge 7 commits into
mainfrom
test/validate-workflow
Closed

compscidr wants to merge 7 commits into
mainfrom
test/validate-workflow

Conversation

@compscidr

Copy link
Copy Markdown
Contributor

Throwaway: proves the Validate workflow rejects a bad entry. Will be closed.

compscidr and others added 7 commits September 14, 2026 18:27
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- DockerValidator now has a Timeout (default 120s) and generates a
  named container per run so it can be docker-killed; cmd.Cancel and
  WaitDelay ensure a cancelled/timed-out context actually stops the
  container instead of leaking it. Adds --memory 512m --pids-limit 256.
- ValidateEntry filters the release history in Validated.Releases to
  tags matching vX.Y.Z, so a pre-convention tag like release-2024 never
  shows up in a plugin's history (the latest-release check still runs
  against the unfiltered list first).
- writeJSON no longer HTML-escapes JSON output, so readme_html contains
  literal <h1> rather than <h1>.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
cmd/registry is the tool CI runs: `validate` on pull requests and
`build` on merge and every six hours, wired to the real GitHub source
and Docker validator with a testable run() core. docs/CONTRACT.md is
what a plugin author reads before opening a PR; README.md is the
registry's own front door. renovate.json keeps the pinned goblog image
current in workflows, cmd/registry/main.go and docs/CONTRACT.md.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- cmd/registry: run() now takes a Validator factory
  (func(image string) registry.Validator) built from the parsed --image
  flag instead of main pre-scanning os.Args for "--image VALUE" only;
  --image=VALUE and -image VALUE now reach the real DockerValidator
  too. Drop the "flags parsed twice" doc comment, now stale.
- validator.go: run `docker kill` with its own 5s timeout context so a
  hung daemon can't block forever; only report "plugin timed out" when
  ctx.Err() is context.DeadlineExceeded specifically, so a plain caller
  cancellation surfaces as the underlying error instead. Note in a
  comment why a failed `docker kill` is still safe (--rm plus a random
  per-run name).
- TestDockerValidator_Timeout now proves the kill path ran, not just
  that the error message says "timed out": the fake docker touches a
  marker file named after the container it was asked to kill, and the
  test asserts that marker exists.
- docs/CONTRACT.md, README.md: note CI's timeout/memory/process limits
  on the validate-plugin check, and move/expand the TMPDIR note to sit
  with the Docker mention plus a note on rootless Docker and cgroups.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@compscidr

Copy link
Copy Markdown
Contributor Author

Confirmed: Validate fails on a repo without a manifest (goblogplatform/goblog-plugin.json not found) while the hello entry still passes. Closing throwaway PR.

@compscidr compscidr closed this Sep 15, 2026
@compscidr
compscidr deleted the test/validate-workflow branch September 15, 2026 01:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant