v1.18.0

update-plugin-index is now a composite action

The plugin-catalog updater from v1.17.0 shipped as a reusable workflow, but that form can't actually authenticate cross-repo: a GitHub App token minted in one job and handed to a reusable-workflow job arrives empty, because masked secret values don't survive the job-to-job hop. This release re-delivers it as a composite action so the token is minted and used in the same job.

Same job — same purpose: when a service publishes a release, open a PR against your datumctl plugin catalog that bumps the plugin's manifest to the new version, refreshing every per-platform download URL and checksum straight from the release's checksums.txt. Nothing about a specific plugin is hardcoded, and the manifest's formatting and comments are preserved.

Using it

Mint the catalog token and call the action in the same job:

- name: Mint catalog token
  id: app-token
  uses: actions/create-github-app-token@v2
  with:
    app-id: ${{ secrets.PLUGIN_INDEX_APP_ID }}
    private-key: ${{ secrets.PLUGIN_INDEX_APP_PRIVATE_KEY }}
    owner: your-org
    repositories: your-catalog

- name: Open the catalog PR
  uses: datum-cloud/actions/update-plugin-index@v1.18.0
  with:
    index-repo: your-org/your-catalog
    plugin-name: your-plugin
    version: ${{ github.event.release.tag_name }}
    token: ${{ steps.app-token.outputs.token }}

Migrating from v1.17.0

• Reference the action path datum-cloud/actions/update-plugin-index@v1.18.0, not the .github/workflows/... reusable-workflow path.
• The credential is now the token input (mint it in the same job) instead of the PLUGIN_INDEX_TOKEN secret.
• The generated PR now links back to the source release so reviewers can see what shipped.

The reusable-workflow form from v1.17.0 is superseded and should not be used.

Full Changelog: v1.17.0...v1.18.0

v1.17.0

Keep plugin catalogs in sync with releases — automatically

Adds the update-plugin-index reusable workflow. When a service publishes a release, it opens a PR against your datumctl plugin catalog that bumps the plugin's manifest to the new version — refreshing every per-platform download URL and checksum straight from the release's checksums.txt. No more hand-editing a catalog manifest after each release.

• Generic across plugins — it derives what to update from the manifest's existing platform list, so nothing about a specific plugin is hardcoded.
• Safe cross-repo — authenticates to the catalog repo with a token you supply, and preserves the manifest's formatting and comments (only version, URLs, and checksums change).
• Drop-in — leaves the rest of your release pipeline untouched; the catalog's own CI still validates the resulting PR.

Using it

uses: datum-cloud/actions/.github/workflows/update-plugin-index.yaml@v1.17.0
with:
  index-repo: your-org/your-catalog
  plugin-name: your-plugin
  version: ${{ github.event.release.tag_name }}
secrets:
  PLUGIN_INDEX_TOKEN: ${{ steps.app-token.outputs.token }}

Introduced in #84.

Full Changelog: v1.16.0...v1.17.0

v1.16.0

What's Changed

• chore(deps): update docker/login-action action to v4.2.0 by @renovate[bot] in #74
• feat(nix): add nix-update-hash reusable workflow by @drewr in #75
• chore(deps): update peter-evans/create-pull-request action to v8 by @renovate[bot] in #76
• fix(nix): push hash update directly to triggering branch by @drewr in #77
• feat(validate-kustomize): build with LoadRestrictionsNone by default by @scotwells in #80

Full Changelog: v1.15.0...v1.16.0

v1.15.0

What's Changed

• chore(deps): update pnpm/action-setup action to v6 by @renovate[bot] in #68
• feat: add reusable generate-doc-toc workflow by @drewr in #69
• fix(generate-doc-toc): open PR instead of pushing to main by @drewr in #70
• fix(bump-npm-version): land bump commit on main, not detached HEAD by @kevwilliams in #72

Full Changelog: v1.14.0...v1.15.0

v1.14.0

What's Changed

• Delete _JOS7378.jpg by @bmertens-datum in #55
• chore: add CODEOWNERS by @scotwells in #65
• feat: add configurable registry-organization input to publish-docker workflow by @scotwells in #64
• chore(deps): update docker/login-action action to v3.7.0 by @renovate[bot] in #36
• chore(deps): update docker/build-push-action action to v6.19.2 by @renovate[bot] in #37
• chore(deps): update actions/checkout action to v6 by @renovate[bot] in #40
• chore(deps): update actions/setup-node action to v6 by @renovate[bot] in #41
• chore(deps): update actions/upload-artifact action to v7 by @renovate[bot] in #43
• chore(deps): update docker/login-action action to v4 by @renovate[bot] in #45
• chore(deps): update docker/setup-buildx-action action to v4 by @renovate[bot] in #46
• chore(deps): update docker/metadata-action action to v6 by @renovate[bot] in #48
• chore(deps): update dorny/paths-filter action to v4 by @renovate[bot] in #67
• chore(deps): update actions/create-github-app-token action to v3 by @renovate[bot] in #66
• chore(deps): update docker/build-push-action action to v7 by @renovate[bot] in #47
• chore: configure Claude Code datum plugins by @scotwells in #38

New Contributors

• @bmertens-datum made their first contribution in #55

Full Changelog: v1.13.3...v1.14.0

v1.13.3

Remove manual kustomize install steps — kustomize is already pre-installed on GitHub-hosted runners.

v1.13.2

What's Changed

• feat: add set-project-month reusable workflow by @kevwilliams in #61
• feat: switch set-project-month to GitHub App token by @kevwilliams in #62

Full Changelog: v1.13.1...v1.13.2

v1.12.1

What's Changed

• fix: checkout main branch in publish-release to fix detached HEAD push failure by @scotwells in #57

Full Changelog: v0.12.0...v1.12.1

v1.12.0

What's Changed

• feat: add dev build mode to npm publish workflow by @scotwells in #56

Full Changelog: v1.11.0...v0.12.0

What's Changed

• feat: add dev build mode to npm publish workflow by @scotwells in #56

Full Changelog: v1.11.0...v1.12.0

v1.11.0

What's Changed

• fix: support packages in subdirectories for npm publishing — The publish-npm-package workflow now correctly handles packages that live in subdirectories (e.g. ui/) by reading packageManager from the package's own package.json and running install/build in the correct working directory.