Publish and activate remaining official plugin registry releases #188

New issue

Closed

opened 2026-06-01 07:29:08 +00:00 by steve · 0 comments

steve commented

2026-06-01 07:29:08 +00:00

Owner

Problem

The app-side registry contract and plugin IDs are ready for the remaining
first-party official plugins, but the registry entries are still pending because
the immutable release assets do not exist as Forgejo release downloads.
Without a local and CI-backed asset publication path, maintainers have to build,
sign, upload, and audit release files manually before registry metadata can be
promoted to active.

Goal

Provide a repeatable app-repo path to build, sign, stage, and publish official
plugin release assets to Forgejo releases, then use those assets to activate
the remaining official registry entries.

Scope

Publish assets for:
- lapis-docs
- lapis-pdf
- lapis-slides
- lapis-canvas
- lapis-graph
- lapis-notebook
- lapis-telemetry
- lapis-markdown-lint
Add a local pnpm registry-assets:publish script that builds plugin packages,
stages normalized release inputs, packages and signs release.json, verifies
release.signed.json, and creates a Forgejo-release-ready flat asset set.
Read each selected plugin release version from its package-local
package.json instead of stamping one batch version across all official
plugins.
Fail publishing when a selected plugin's package-local package.json version
and manifest.json version differ.
Add pnpm registry-assets:version so maintainers can bump specific official
publishable plugins or the default publishable plugin set to CalVer before
publishing. Default version is the current local date (YYYY.M.D, for example
2026.6.1) and --patch/--patch-suffix adds a semver-compatible patch
suffix.
Add a Forgejo availability verification mode that validates package versions,
detects already-published plugin/version assets, skips those versions for the
default publish-all selection, and fails for explicit --plugins selections
that already exist.
Add a Forgejo workflow in the app repo to run the same script and optionally
publish the staged assets to an immutable release tag.
Add a local key generation script that stores the default plugin release
signing key set under ~/.lapis/ for local publishing.
Keep registry metadata ownership in /Users/stevejuma/code/lapis-plugin-registry.
Keep lapis-bases pending, hidden, or otherwise non-installable.

Non-goals

Removing migrated plugins from workspaceCorePlugins; that belongs to #189.
Moving Bases out of the bundle.
Publishing registry metadata from the app repo.
Adding third-party registry sources.

Acceptance Criteria

pnpm registry-assets:publish -- --dry-run stages release assets locally
without requiring production secrets and uses each plugin package version.
pnpm registry-assets:publish rejects mismatched package.json and
manifest.json versions before building or uploading plugin release assets.
pnpm registry-assets:version updates package-local package.json and
manifest.json versions for the same official publishable plugin set as
registry-assets:publish by default, supports --plugins <ids>, supports
explicit --version, supports dry runs, and writes patch builds as
YYYY.M.D-patch.N.
Non-dry-run publication requires LAPIS_PLUGIN_RELEASE_KEY_ID and an official
release private key from LAPIS_PLUGIN_RELEASE_PRIVATE_KEY_PEM or
--private-key-file, unless a local key set generated by
pnpm plugin-release:keygen exists under ~/.lapis/.
pnpm plugin-release:keygen writes a private PEM, public PEM, raw base64
public key, and metadata file under ~/.lapis/, refuses to overwrite those
files by default, and prints the public key material needed for trust-list
updates.
--verify requires FORGEJO_TOKEN and checks Forgejo release assets for
already-published plugin/version prefixes.
--publish requires FORGEJO_TOKEN, performs the same Forgejo availability
check before building, and uploads to a Forgejo release tag such as
official-plugin-assets-2026-06-01.
The publisher refuses to replace an already staged asset in the local
forgejo-assets/ output tree.
Forgejo workflow publish-official-plugin-assets.yml can stage assets as a
dry run or verify and publish them to the app repo Forgejo release.
After assets are published, registry entries can be updated with real hashes
and sizes and validated with pnpm registry:validate:remote in the registry
repo.
App dry-install coverage passes before #189 removes plugins from bootstrap.

Implementation Notes

The app repo owns plugin source builds and official release asset signing.
The registry repo owns entry review, generated metadata, registry metadata
signatures, and final registry publication.
Registry entries should reference the Forgejo release download URLs for the
signed release manifests and release files.
Use Docs release packaging as the shape reference.
2026-06-01: Added lapis-docs to the default
pnpm registry-assets:publish official asset set so default publish-all runs
keep docs coverage consistent with other official plugins.
2026-06-01: Fixed empty-string option fallback handling so --verify without
explicit --release-tag/--out now uses default values and emitted
releaseManifestUrl values no longer include /releases/download//....
2026-06-01: Updated publish uploads to run in small resumable batches
(--upload-batch-size, default 20) and updated scripts/forgejo-release.mjs
with per-asset progress output, --resume skip behavior for already uploaded
assets, and retry-with-exponential-backoff for transient HTTP/network failures
(including 504 timeouts).
2026-06-01: pnpm registry-assets:publish now exposes a top-level
--resume flag, stages local release work under the single ignored root
release-artifacts/official-plugin-assets/, clears stale staged assets before
each run so old versions do not leak into later publishes, and deletes the
per-run tmp/ packaging subtree in finally cleanup.

Suggested Files or Specs To Inspect

scripts/publish-official-plugin-assets.mjs
scripts/update-core-plugin-versions.mjs
scripts/generate-plugin-release-key.mjs
.forgejo/workflows/publish-official-plugin-assets.yml
scripts/plugin-release.mjs
spec/src/30-cross-package-contracts/plugin-registry.md
/Users/stevejuma/code/lapis-plugin-registry/docs/publishing-official-plugins.md

Validation Commands

pnpm registry-assets:publish -- --dry-run
pnpm registry-assets:version -- --dry-run
pnpm registry-assets:publish -- --verify
pnpm plugin-release:keygen -- --dir /tmp/lapis-release-key-test
node --test scripts/plugin-release.test.mjs scripts/generate-plugin-release-key.test.mjs scripts/publish-official-plugin-assets.test.mjs scripts/update-core-plugin-versions.test.mjs
pnpm test:scripts
pnpm check:all
make spec-lint
mdbook build spec

Follow-up to #185 — Migrate remaining installable first-party plugins to the official registry

Follow-up Tasks

Implementation Summary

Added top-level publish resume support, consolidated local release work under release-artifacts/official-plugin-assets, cleaned stale/legacy temp assets, and documented the new behavior.

## Problem The app-side registry contract and plugin IDs are ready for the remaining first-party official plugins, but the registry entries are still pending because the immutable release assets do not exist as Forgejo release downloads. Without a local and CI-backed asset publication path, maintainers have to build, sign, upload, and audit release files manually before registry metadata can be promoted to active. ## Goal Provide a repeatable app-repo path to build, sign, stage, and publish official plugin release assets to Forgejo releases, then use those assets to activate the remaining official registry entries. ## Scope - Publish assets for: - `lapis-docs` - `lapis-pdf` - `lapis-slides` - `lapis-canvas` - `lapis-graph` - `lapis-notebook` - `lapis-telemetry` - `lapis-markdown-lint` - Add a local `pnpm registry-assets:publish` script that builds plugin packages, stages normalized release inputs, packages and signs `release.json`, verifies `release.signed.json`, and creates a Forgejo-release-ready flat asset set. - Read each selected plugin release version from its package-local `package.json` instead of stamping one batch version across all official plugins. - Fail publishing when a selected plugin's package-local `package.json` version and `manifest.json` version differ. - Add `pnpm registry-assets:version` so maintainers can bump specific official publishable plugins or the default publishable plugin set to CalVer before publishing. Default version is the current local date (`YYYY.M.D`, for example `2026.6.1`) and `--patch`/`--patch-suffix` adds a semver-compatible patch suffix. - Add a Forgejo availability verification mode that validates package versions, detects already-published plugin/version assets, skips those versions for the default publish-all selection, and fails for explicit `--plugins` selections that already exist. - Add a Forgejo workflow in the app repo to run the same script and optionally publish the staged assets to an immutable release tag. - Add a local key generation script that stores the default plugin release signing key set under `~/.lapis/` for local publishing. - Keep registry metadata ownership in `/Users/stevejuma/code/lapis-plugin-registry`. - Keep `lapis-bases` pending, hidden, or otherwise non-installable. ## Non-goals - Removing migrated plugins from `workspaceCorePlugins`; that belongs to #189. - Moving Bases out of the bundle. - Publishing registry metadata from the app repo. - Adding third-party registry sources. ## Acceptance Criteria - `pnpm registry-assets:publish -- --dry-run` stages release assets locally without requiring production secrets and uses each plugin package version. - `pnpm registry-assets:publish` rejects mismatched `package.json` and `manifest.json` versions before building or uploading plugin release assets. - `pnpm registry-assets:version` updates package-local `package.json` and `manifest.json` versions for the same official publishable plugin set as `registry-assets:publish` by default, supports `--plugins <ids>`, supports explicit `--version`, supports dry runs, and writes patch builds as `YYYY.M.D-patch.N`. - Non-dry-run publication requires `LAPIS_PLUGIN_RELEASE_KEY_ID` and an official release private key from `LAPIS_PLUGIN_RELEASE_PRIVATE_KEY_PEM` or `--private-key-file`, unless a local key set generated by `pnpm plugin-release:keygen` exists under `~/.lapis/`. - `pnpm plugin-release:keygen` writes a private PEM, public PEM, raw base64 public key, and metadata file under `~/.lapis/`, refuses to overwrite those files by default, and prints the public key material needed for trust-list updates. - `--verify` requires `FORGEJO_TOKEN` and checks Forgejo release assets for already-published plugin/version prefixes. - `--publish` requires `FORGEJO_TOKEN`, performs the same Forgejo availability check before building, and uploads to a Forgejo release tag such as `official-plugin-assets-2026-06-01`. - The publisher refuses to replace an already staged asset in the local `forgejo-assets/` output tree. - Forgejo workflow `publish-official-plugin-assets.yml` can stage assets as a dry run or verify and publish them to the app repo Forgejo release. - After assets are published, registry entries can be updated with real hashes and sizes and validated with `pnpm registry:validate:remote` in the registry repo. - App dry-install coverage passes before #189 removes plugins from bootstrap. ## Implementation Notes - The app repo owns plugin source builds and official release asset signing. - The registry repo owns entry review, generated metadata, registry metadata signatures, and final registry publication. - Registry entries should reference the Forgejo release download URLs for the signed release manifests and release files. - Use Docs release packaging as the shape reference. - 2026-06-01: Added `lapis-docs` to the default `pnpm registry-assets:publish` official asset set so default publish-all runs keep docs coverage consistent with other official plugins. - 2026-06-01: Fixed empty-string option fallback handling so `--verify` without explicit `--release-tag`/`--out` now uses default values and emitted `releaseManifestUrl` values no longer include `/releases/download//...`. - 2026-06-01: Updated publish uploads to run in small resumable batches (`--upload-batch-size`, default `20`) and updated `scripts/forgejo-release.mjs` with per-asset progress output, `--resume` skip behavior for already uploaded assets, and retry-with-exponential-backoff for transient HTTP/network failures (including 504 timeouts). - 2026-06-01: `pnpm registry-assets:publish` now exposes a top-level `--resume` flag, stages local release work under the single ignored root `release-artifacts/official-plugin-assets/`, clears stale staged assets before each run so old versions do not leak into later publishes, and deletes the per-run `tmp/` packaging subtree in `finally` cleanup. ## Suggested Files or Specs To Inspect - `scripts/publish-official-plugin-assets.mjs` - `scripts/update-core-plugin-versions.mjs` - `scripts/generate-plugin-release-key.mjs` - `.forgejo/workflows/publish-official-plugin-assets.yml` - `scripts/plugin-release.mjs` - `spec/src/30-cross-package-contracts/plugin-registry.md` - `/Users/stevejuma/code/lapis-plugin-registry/docs/publishing-official-plugins.md` ## Validation Commands - `pnpm registry-assets:publish -- --dry-run` - `pnpm registry-assets:version -- --dry-run` - `pnpm registry-assets:publish -- --verify` - `pnpm plugin-release:keygen -- --dir /tmp/lapis-release-key-test` - `node --test scripts/plugin-release.test.mjs scripts/generate-plugin-release-key.test.mjs scripts/publish-official-plugin-assets.test.mjs scripts/update-core-plugin-versions.test.mjs` - `pnpm test:scripts` - `pnpm check:all` - `make spec-lint` - `mdbook build spec` ## Related Issues - Follow-up to #185 — [Migrate remaining installable first-party plugins to the official registry](../open/185-migrate-remaining-installable-first-party-plugins-to-the-official-registry.md) ## Follow-up Tasks ## Implementation Summary Added top-level publish resume support, consolidated local release work under release-artifacts/official-plugin-assets, cleaned stale/legacy temp assets, and documented the new behavior.

steve added this to the Full Registry V1 milestone

2026-06-01 07:29:08 +00:00

steve added the

labels

2026-06-01 07:29:08 +00:00