From 8187863086045e8fa0792fd1de83e5bc154fa886 Mon Sep 17 00:00:00 2001 From: caterryan Date: Tue, 14 Jul 2026 14:12:13 -0500 Subject: [PATCH] ci: validate registry plugins Run the influxdb3-plugin CLI against every packageable plugin directory on pull requests and pushes to main. - Split into changes/validate/result jobs so a single stable registry-plugin-validate check can be required in branch protection without blocking unrelated PRs. - Fail when plugin discovery finds no directories so a broken glob cannot pass silently (also applied to publish-registry). - Read the SDK version from .github/plugin-sdk-version, shared with publish-registry, so validate and publish cannot drift; bump the SDK to v0.6.0 for manifest schema 1.3 support. - Install the CLI into $RUNNER_TEMP/bin instead of /usr/local/bin and pin actions/checkout to a commit SHA. Co-Authored-By: Claude Fable 5 --- .github/plugin-sdk-version | 1 + .github/workflows/publish-registry.yml | 19 +- .../workflows/validate-registry-plugins.yml | 179 ++++++++++++++++++ 3 files changed, 194 insertions(+), 5 deletions(-) create mode 100644 .github/plugin-sdk-version create mode 100644 .github/workflows/validate-registry-plugins.yml diff --git a/.github/plugin-sdk-version b/.github/plugin-sdk-version new file mode 100644 index 0000000..60f6343 --- /dev/null +++ b/.github/plugin-sdk-version @@ -0,0 +1 @@ +v0.6.0 diff --git a/.github/workflows/publish-registry.yml b/.github/workflows/publish-registry.yml index 2117dbc..f837bca 100644 --- a/.github/workflows/publish-registry.yml +++ b/.github/workflows/publish-registry.yml @@ -17,7 +17,6 @@ env: PLUGIN_ROOT: influxdata REGISTRY_RELEASE: registry SDK_REPO: influxdata/influxdb3-plugin-sdk - SDK_VERSION: v0.6.0 EXCLUDE_DIRS: "library" GH_TOKEN: ${{ github.token }} @@ -26,7 +25,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 + + - name: Resolve SDK version + shell: bash + run: echo "SDK_VERSION=$(cat .github/plugin-sdk-version)" >> "$GITHUB_ENV" - name: Install influxdb3-plugin CLI shell: bash @@ -39,8 +42,11 @@ jobs: --pattern "SHA256SUMS" \ --dir /tmp/sdk --clobber (cd /tmp/sdk && grep " ${asset}\$" SHA256SUMS | sha256sum -c -) - tar xzf "/tmp/sdk/${asset}" -C /usr/local/bin/ influxdb3-plugin - influxdb3-plugin --version + install_dir="${RUNNER_TEMP}/bin" + mkdir -p "$install_dir" + tar xzf "/tmp/sdk/${asset}" -C "$install_dir" influxdb3-plugin + echo "$install_dir" >> "$GITHUB_PATH" + "${install_dir}/influxdb3-plugin" --version - name: Fetch registry index shell: bash @@ -88,7 +94,10 @@ jobs: echo "Plugin directories to publish:" cat /tmp/plugin-directories.txt else - echo "No plugin directories found under ${PLUGIN_ROOT}." + # An empty list means the discovery glob is broken, not that there + # is nothing to publish; fail rather than silently publish nothing. + echo "No plugin directories found under ${PLUGIN_ROOT}." >&2 + exit 1 fi - name: Package plugins diff --git a/.github/workflows/validate-registry-plugins.yml b/.github/workflows/validate-registry-plugins.yml new file mode 100644 index 0000000..65b86e7 --- /dev/null +++ b/.github/workflows/validate-registry-plugins.yml @@ -0,0 +1,179 @@ +name: Validate Registry Plugins + +on: + pull_request: + push: + branches: + - main + paths: + - 'influxdata/**' + - '.github/workflows/publish-registry.yml' + - '.github/workflows/validate-registry-plugins.yml' + - '.github/plugin-sdk-version' + workflow_dispatch: + +permissions: + contents: read + +env: + PLUGIN_ROOT: influxdata + SDK_REPO: influxdata/influxdb3-plugin-sdk + EXCLUDE_DIRS: "library" + GH_TOKEN: ${{ github.token }} + +jobs: + changes: + # Runs on every pull request so the `result` job below always reports a + # status and can be marked required without blocking unrelated PRs. + name: Detect registry plugin changes + runs-on: ubuntu-latest + outputs: + validate: ${{ steps.filter.outputs.validate }} + steps: + - name: Checkout + if: github.event_name == 'pull_request' + uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 + with: + persist-credentials: false + fetch-depth: 0 + + - name: Filter changed paths + id: filter + shell: bash + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + if [ "${GITHUB_EVENT_NAME}" != "pull_request" ]; then + echo "validate=true" >> "$GITHUB_OUTPUT" + exit 0 + fi + + # Diff merge-base(base, head)..head so files changed on the base + # branch after the PR branched don't trigger validation. + changed=$(git diff --name-only "${BASE_SHA}...${HEAD_SHA}") + + # Changes limited to excluded (non-plugin) directories don't need + # validation. + for ex in ${EXCLUDE_DIRS:-}; do + changed=$(printf '%s\n' "${changed}" | grep -v "^${PLUGIN_ROOT}/${ex}/" || true) + done + + echo "Changed files considered:" + echo "${changed}" + + if echo "${changed}" | grep -qE '^(influxdata/|\.github/(workflows/(publish-registry|validate-registry-plugins)\.yml|plugin-sdk-version)$)'; then + echo "validate=true" >> "$GITHUB_OUTPUT" + else + echo "validate=false" >> "$GITHUB_OUTPUT" + fi + + validate: + name: Validate packageable plugins + needs: changes + if: needs.changes.outputs.validate == 'true' + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3 + with: + persist-credentials: false + + - name: Resolve SDK version + shell: bash + run: echo "SDK_VERSION=$(cat .github/plugin-sdk-version)" >> "$GITHUB_ENV" + + - name: Install influxdb3-plugin CLI + shell: bash + run: | + set -euo pipefail + asset="influxdb3-plugin-x86_64-unknown-linux-gnu.tar.gz" + gh release download "$SDK_VERSION" \ + --repo "$SDK_REPO" \ + --pattern "$asset" \ + --pattern "SHA256SUMS" \ + --dir /tmp/sdk --clobber + (cd /tmp/sdk && grep " ${asset}\$" SHA256SUMS | sha256sum -c -) + install_dir="${RUNNER_TEMP}/bin" + mkdir -p "$install_dir" + tar xzf "/tmp/sdk/${asset}" -C "$install_dir" influxdb3-plugin + echo "$install_dir" >> "$GITHUB_PATH" + "${install_dir}/influxdb3-plugin" --version + + - name: Find packageable plugins + shell: bash + run: | + set -euo pipefail + shopt -s nullglob + + if [ ! -d "$PLUGIN_ROOT" ]; then + echo "Plugin root does not exist: ${PLUGIN_ROOT}" >&2 + exit 1 + fi + + read -ra excluded <<< "${EXCLUDE_DIRS:-}" + + plugin_list="${RUNNER_TEMP}/plugin-directories.txt" + : > "$plugin_list" + for dir in "${PLUGIN_ROOT}"/*/; do + name="$(basename "$dir")" + skip=false + for ex in "${excluded[@]:-}"; do + if [ "$name" = "$ex" ]; then skip=true; break; fi + done + if [ "$skip" = true ]; then + echo "Excluding non-plugin directory: ${name}" + continue + fi + printf '%s\n' "$dir" >> "$plugin_list" + done + + if [ -s "$plugin_list" ]; then + echo "Packageable plugin directories:" + cat "$plugin_list" + else + # An empty list means the discovery glob is broken, not that there + # is nothing to validate; fail rather than pass without validating. + echo "No packageable plugin directories found under ${PLUGIN_ROOT}." >&2 + exit 1 + fi + + - name: Validate plugins + shell: bash + run: | + set -euo pipefail + + plugin_list="${RUNNER_TEMP}/plugin-directories.txt" + while IFS= read -r dir; do + [ -n "$dir" ] || continue + name="$(basename "$dir")" + log="${RUNNER_TEMP}/validate-${name}.log" + + echo "Validating ${name}..." + if influxdb3-plugin validate "$dir" --output json >"$log" 2>&1; then + cat "$log" + else + echo "Validation failed for ${name}:" >&2 + cat "$log" >&2 + exit 1 + fi + done < "$plugin_list" + + result: + # Single stable check name for branch protection. Passes when registry + # plugin validation was skipped because no packageable plugin inputs changed. + name: registry-plugin-validate + needs: [changes, validate] + if: always() + runs-on: ubuntu-latest + steps: + - name: Check job results + run: | + results="${{ join(needs.*.result, ' ') }}" + echo "Job results: ${results}" + for r in ${results}; do + if [ "${r}" = "failure" ] || [ "${r}" = "cancelled" ]; then + exit 1 + fi + done