golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(34): release ledger and validation map

Browse Source 
- 34-release-log.md: v0.6.0 contents, plugin tag table (current -> new),
  release order with the three rebases, 32 pointer bumps, app
  regenerations, summercms.io deploy, v0.6.0 tag message draft, rules
- 34-VALIDATION.md: per-task map for 34-01..34-06, Wave 0 ticked
This commit is contained in:
Jakub Zych
2026-10-29 21:39:21 +01:00
parent dfc6127009
commit 74c8146c46
2 changed files with 372 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
.planning/phases/34-plugin-marketplace/34-VALIDATION.md
View File

@@ -5,7 +5,7 @@ slug: "plugin-marketplace"
# audit-milestone §5.5 distinguishes NOT-VALIDATED (draft) from PARTIAL (validated + nyquist_compliant: false) (#2117)
status: draft
nyquist_compliant: false
wave_0_complete: false
wave_0_complete: true
created: "2026-10-29"
---
@@ -40,7 +40,32 @@ created: "2026-10-29"
| Task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
| _filled by the planner/executor per task; see 34-RESEARCH.md § Validation Architecture for the SC-1..SC-4 test map_ | | | | | | | | | ⬜ pending |
| 34-01-T1 | 34-01 | 1 | SC-1, D-16 | - | Format, API shape, names and v0.6.0 confirmed before code | decision | n/a (answered as-planned) | n/a | ✅ green |
| 34-01-T2 | 34-01 | 1 | D-01, D-04 | T-34-01 | plugin.yaml generated from sources, never run | unit | `go test -short ./modules/kiosk -run 'TestManifestSmoke\|TestManifestFormat\|TestCheck'` | ✅ | ✅ green |
| 34-01-T3 | 34-01 | 1 | D-02, D-03, D-05 | T-34-02 | Const IDs read statically; non-const refused naming ID()/Requires() | unit | `go test -short ./modules/kiosk -run 'TestReadIdentity\|TestDerive\|TestPluginManifest'`; `./internal/build -run TestAddPluginConstID` | ✅ | ✅ green |
| 34-01-T4 | 34-01 | 1 | D-16 | T-34-04 | Strict vX.Y.Z rules; unknown JSON fields ignored | unit | `go test -short ./modules/kiosk -run 'TestVersions\|TestManifestSmoke/registry'` | ✅ | ✅ green |
| 34-01-T5 | 34-01 | 1 | SC-4, D-06, D-07 | T-34-03, T-34-05, T-34-06 | No filesystem path in PluginInfo; metadata failure never breaks a build | unit | `go test -short ./internal/build -run 'TestPluginInfoSmoke\|TestPluginDirs\|TestEffectiveFramework'`; `./modules/party -run TestDescribe` | ✅ | ✅ green |
| 34-02-T1 | 34-02 | 4 | SC-1, D-01, D-04 | T-34-07 | Drift guard fails go test on a stale plugin.yaml | integration | `bash scripts/check-phase34.sh --plugins` (sm-journal-plugin TestPluginManifest) | ✅ | ✅ green |
| 34-02-T2 | 34-02 | 4 | SC-1, D-01..D-05 | T-34-07, T-34-08 | 13 tagged repos: generated manifest, CheckT guard | integration | `bash scripts/check-phase34.sh --plugins` | ✅ | ✅ green |
| 34-02-T3 | 34-02 | 4 | SC-1, D-05 | T-34-08 | 6 untagged repos; no v0.0.0 plugin requirement | integration | `bash scripts/check-phase34.sh --plugins` | ✅ | ✅ green |
| 34-02-T4 | 34-02 | 4 | - | T-34-10 | Push/bump decision (answered defer) | decision | n/a (deferred to 34-release-log.md) | n/a | ✅ green |
| 34-02-T5 | 34-02 | 4 | - | T-34-09 | No pointer references an unpushed commit | manual | n/a (ledger: 34-release-log.md step 5) | n/a | ✅ green |
| 34-03-T1 | 34-03 | 2 | SC-2, D-13 | T-34-11, T-34-12, T-34-13 | Hardened anonymous https git, capped reads, sanitized README | integration | `go -C ../sm-summercmsio-app/plugins/golem15/summercms test ./... -run 'TestRegistrySmoke\|TestIngestTags\|TestIngestManifests\|TestGitRunner'` | ✅ | ✅ green |
| 34-03-T2 | 34-03 | 2 | D-14, D-15, D-16 | T-34-16, T-34-17, T-34-18 | Escaped search, capped query, ETag/304, digest skip | integration | `bash scripts/check-phase34.sh --site` and `--docker` (TestRegistryAPIShapes, TestQueryRules) | ✅ | ✅ green |
| 34-03-T3 | 34-03 | 2 | D-04, D-13 | T-34-14, T-34-15, T-34-19, T-34-20 | Ingest-now needs scope + permission, never creates a listing; release script refuses dirty/stale trees | integration | `go -C …/summercms test -run TestRegistryIngestEndpoint`; `python3 -B scripts/test_changelog_post.py` | ✅ | ✅ green |
| 34-03-T4 | 34-03 | 2 | SC-2 | T-34-21 | /marketplace renders registry text as text | automated_ui | `pnpm test && pnpm test:marketplace` (vue-summercmsio-app); `scripts/check-deploy.sh` | ✅ | ✅ green |
| 34-04-T1 | 34-04 | 2 | SC-3, D-08 | T-34-22 | Install picks newest compatible release; no go mod tidy | integration | `go test ./internal/build -run TestInstallSmoke/module` (`--docker` stage) | ✅ | ✅ green |
| 34-04-T2 | 34-04 | 2 | D-09, D-18 | T-34-23, T-34-24, T-34-25 | Registry strings validated before exec; --yes off a terminal; offline makes no call | unit | `go test -short ./internal/build -run 'TestResolveInstall\|TestAskToProceed'`; `./cmd/summer -run TestPluginCommands` | ✅ | ✅ green |
| 34-04-T3 | 34-04 | 2 | D-11, D-12 | T-34-26, T-34-27 | Git URLs validated, no credentials in .gitmodules, protocol allow-list | integration | `go test ./internal/build -run 'TestInstallSmoke/(source\|giturl\|urls\|nogit)'` | ✅ | ✅ green |
| 34-04-T4 | 34-04 | 2 | D-10 | T-34-28 | Update never moves the framework; comments in summer.yaml kept | integration | `go test ./internal/build -run 'TestInstallSmoke/update\|TestAppendManifestPlugins'` | ✅ | ✅ green |
| 34-05-T1 | 34-05 | 3 | D-19, D-06 | T-34-29, T-34-30 | 401/403 without backend.view_plugins; entry only for allowed principals | unit | `go test -short ./modules/cabana -run 'TestPluginsScreenSmoke\|TestPluginsEndpoints'` | ✅ | ✅ green |
| 34-05-T2 | 34-05 | 3 | SC-4, D-07, D-17, D-18 | T-34-31, T-34-32 | Cached, bounded registry calls; IDs and icons sanitized; degraded 200 | unit | `go test -short ./modules/cabana -run TestPluginsEndpoints`; `npm --prefix admin run test -- PluginsView useSettings` | ✅ | ✅ green |
| 34-05-T3 | 34-05 | 3 | D-17 | T-34-33 | Committed dist matches a fresh build | other | `bash scripts/check-phase34.sh --admin` (check-admin-openapi --check, check-admin-dist) | ✅ | ✅ green |
| 34-06-T1 | 34-06 | 5 | SC-5 | T-34-35 | Gate fails on a skipped, missing or failing test and on a missing repository | other | `bash scripts/check-phase34.sh --self-test` | ✅ | ✅ green |
| 34-06-T2 | 34-06 | 5 | SC-5, D-02..D-05, D-07..D-10, D-12, D-18 | T-34-34 | Fixtures in t.TempDir(), no writes to sibling repos | unit | `bash scripts/check-phase34.sh --go` | ✅ | ✅ green |
| 34-06-T3 | 34-06 | 5 | SC-5, D-17, D-19 | - | Unexported seams only (additive) | unit | `bash scripts/check-phase34.sh --admin --additive` | ✅ | ✅ green |
| 34-06-T4 | 34-06 | 5 | SC-5, D-13..D-16 | T-34-34 | Release script and registry tests never touch the network | unit | `bash scripts/check-phase34.sh --site` | ✅ | ✅ green |
| 34-06-T5 | 34-06 | 5 | - | T-34-36 | Ledger names repos, SHAs and steps only; no secrets | manual | `grep -n 'v0.6.0\|Release order\|Executed steps\|never move' 34-release-log.md` | ✅ | ✅ green |
*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
@@ -48,11 +73,11 @@ created: "2026-10-29"
## Wave 0 Requirements
- [ ] manifest module tests: derive / README / check / validate
- [ ] `internal/build` fixture helpers: git repo with tags, `file://` GOPROXY tree (stdlib only)
- [ ] site plugin `TestMain` with testcontainers (`flag.Parse()` + `testing.Short()`)
- [ ] admin PluginsView vitest spec
- [ ] `scripts/check-phase34.sh`
- [x] manifest module tests: derive / README / check / validate (`modules/kiosk/*_test.go`)
- [x] `internal/build` fixture helpers: git repo with tags, `file://` GOPROXY tree (stdlib only) (`internal/build/fixtures_test.go`, 34-04)
- [x] site plugin `TestMain` with testcontainers (`flag.Parse()` + `testing.Short()`) (`testmain_test.go`, 34-03)
- [x] admin PluginsView vitest spec (`admin/tests/views/PluginsView.test.ts`)
- [x] `scripts/check-phase34.sh`
*If none: "Existing infrastructure covers all phase requirements."*

340
.planning/phases/34-plugin-marketplace/34-release-log.md Normal file
View File

@@ -0,0 +1,340 @@
# Phase 34 release log
The user-gated release of the plugin marketplace: framework `v0.6.0`, a new tag in every public plugin repository, the summercms.io site plugin and pages, the application pointer bumps and the summercms.io deploy. Nothing in this file has been pushed, tagged or deployed; plan 34-06 only wrote it. Jakub runs the steps in order and records each one under "Executed steps".
Decisions this ledger follows:
- **Plugin tags (Jakub, 2026-10-29):** every plugin that got a `plugin.yaml` commit in this phase (the 20 `sm-*-plugin` repositories) and `sm-summercmsio-plugin` get a new release tag: the next patch after the newest existing tag, `v0.1.0` for a repository without one.
- **Changelog (Jakub, 2026-10-29):** only the framework `v0.6.0` tag gets a post on https://summercms.io/changelog. The plugin tags get **no** `/changelog/plugins` posts; the framework post and the tag message list the plugin bumps instead.
- **App pointer bumps:** deferred in 34-02 ("defer"); they move here and target the tagged plugin commits.
- Memory rules: tag only at phase completion after full verification, tags only on the default branch, every tag contains the earlier tags.
## Planned contents
### Framework `v0.6.0` (summercms.go, master)
Newest tag before the phase: `v0.5.3`. master is 32 commits ahead of origin/master at the time of writing (planning docs of other sessions included). Code commits of the phase:
| Plan | Commit | Subject |
|------|--------|---------|
| 34-01 | ec6a195 | feat(kiosk): plugin.yaml manifest and summer plugin:manifest |
| 34-01 | 51ec2f9 | feat(kiosk): resolve constant plugin IDs, overrides and the CheckT helper |
| 34-01 | 4916ee3 | feat(kiosk): registry v1 wire types and version rules |
| 34-01 | e8d3d72 | feat(build): bake plugin metadata and the framework version into plugins.gen.go |
| 34-04 | 9b23e87 | feat(build): summer plugin:install for registry plugins as Go modules |
| 34-04 | a462bf1 | feat(build): plugin:install resolves requirements, pins and prompts |
| 34-04 | 8093587 | feat(build): plugin:install --source and git URLs as submodules |
| 34-04 | d024ab4 | feat(build): summer plugin:update |
| 34-05 | c4b1ac4 | feat(cabana): read-only Plugins screen with installed plugins |
| 34-05 | 7e8a193 | feat(cabana): plugin updates and marketplace search on the Plugins screen |
| 34-05 | 678eac4 | build(admin): rebuild the embedded admin for the Plugins screen |
| 34-06 | b93a6de | test: phase 34 gate script |
| 34-06 | 9109e5b | test(kiosk): manifest, identity, version and client unit tests |
| 34-06 | 7de774b | test(build): plugin dirs, install resolution and summer.yaml edits (two fixes) |
| 34-06 | a231309 | test(summer): plugin command prompts |
| 34-06 | df2ba57 | test(cabana): Plugins screen endpoints (one fix) |
| 34-06 | bad273b | test(admin): PluginsView and settings paths |
| 34-06 | dfc6127 | test: phase 34 gate requires the summercms.io unit tests |
The admin dist was rebuilt in 678eac4 and 34-06 changed no `admin/src` file (only `admin/tests`), so no rebuild is needed before the tag; `scripts/check-admin-dist.sh` passes.
### Plugin repositories: current tag -> new tag
Each repository's new commit is the 34-02 manifest commit (`feat: plugin.yaml manifest for the SummerCMS marketplace`); every `plugin.yaml` says `framework: v0.6.0` and every `go.mod` requires `git.golem15.com/golem15/summercms v0.6.0` (with the development `replace => ../summercms.go`, which consumers ignore). Patch bumps throughout: the change is a manifest file, a test and the framework minimum.
| # | Repository | Branch | Commit to tag | Commits since the last tag | Current tag | New tag | Push blocker |
|---|------------|--------|---------------|----------------------------|-------------|---------|--------------|
| 1 | sm-translate-plugin | main | 7e64224 | 1 | v0.1.2 | **v0.1.3** | - |
| 2 | sm-user-plugin | master | 97f83cc | 1 | v0.1.18 | **v0.1.19** | - |
| 3 | sm-chat-plugin | main | rebased b952128 (new SHA) | 1 (+12 on origin) | v0.1.3 | **v0.1.4** | 1 ahead, 12 behind: rebase first |
| 4 | sm-faq-plugin | main | 3bf54cd | 1 | v0.1.1 | **v0.1.2** | - |
| 5 | sm-menu-plugin | main | 98df4c7 | 1 | v0.1.1 | **v0.1.2** | - |
| 6 | sm-seo-plugin | main | 55f5e5d | 22 (21 review fixes + manifest) | v0.1.0 | **v0.1.1** | - |
| 7 | sm-sitemap-plugin | main | 049f3ee | 1 | v0.1.1 | **v0.1.2** | - |
| 8 | sm-mfa-plugin | master | 544017c | 1 | v0.1.2 | **v0.1.3** | - |
| 9 | sm-oauthserver-plugin | master | d600e2c | 1 | v0.1.5 | **v0.1.6** | - (an uncommitted go.work edit of another session stays unstaged) |
| 10 | sm-sociallogin-plugin | master | 47b3bb2 | 1 | v0.1.5 | **v0.1.6** | - |
| 11 | sm-paymentgateway-plugin | main | 300bc09 | 1 | v0.1.1 | **v0.1.2** | - |
| 12 | sm-paymentgatewaysubscriptions-plugin | main | c81e385 | 1 | v0.1.2 | **v0.1.3** | - |
| 13 | sm-pgstripe-plugin (root and `subscriptions/`) | main | d61508f | 1 | v0.1.3 | **v0.1.4** | - |
| 14 | sm-journal-plugin | main | 5b38a3b | 4 (3 API fixes + manifest) | v0.2.5 | **v0.2.6** | - |
| 15 | sm-chatvideo-plugin | main | 33ff4f5 | 8 | none | **v0.1.0** | - |
| 16 | sm-forum-plugin | main | 36bd875 | 7 | none | **v0.1.0** | - |
| 17 | sm-herald-plugin | main | db8a1bb | 7 | none | **v0.1.0** | - |
| 18 | sm-userfriends-plugin | main | 2f29b26 | 6 | none | **v0.1.0** | - |
| 19 | sm-chatchannels-plugin | main | rebased 322629b (new SHA) | 10 | none | **v0.1.0** | 1 ahead, 1 behind (origin a30f04a touches go.mod): rebase first |
| 20 | sm-chatbots-plugin | main | rebased 0cd78f2 (new SHA) | 7 | none | **v0.1.0** | 1 ahead, 1 behind (origin d0b9fb1 drops sibling replaces): rebase first; builds only once v0.6.0 is on the remote |
Requirements inside the set (from the manifests): journal and faq need translate; chat, mfa, oauthserver, sociallogin, paymentgateway, forum and userfriends need user; chatvideo needs chat; chatchannels and chatbots need chat and user; paymentgatewaysubscriptions needs paymentgateway and user; pgstripe needs paymentgateway, and its `subscriptions/` plugin needs paymentgatewaysubscriptions.
### summercms.io repositories
| Repository | Branch | Commits | Tag | Push |
|------------|--------|---------|-----|------|
| sm-summercmsio-plugin (`sm-summercmsio-app/plugins/golem15/summercms`) | master | 34-03: 242d641, f6a5949, 08e04de, 5853cf5; 34-06: c52e721 `test: registry ingest, queries and API` (5 ahead of origin) | none -> **v0.1.0** on c52e721 | yes |
| vue-summercmsio-app | master | 34-03: 05f1cea `feat: marketplace pages`; 34-06: 8267c55 `test: marketplace utilities` (2 ahead) | none (consumed as a submodule) | yes |
| sm-summercmsio-app | master | 34-03: 458a4f1, 06593c3, 0707fdc, fd8fe3b, 97c0c08; 34-06: 352314a `test: changelog-post manifest and ingest helpers` (6 ahead) | none | yes, after its gitlink commits |
## Release order
Run every step only after the previous one is pushed and verified. No `--force` anywhere; never move a tag.
### 1. Gate
```sh
cd summercms.go
bash scripts/check-phase34.sh --all # Docker host (sudo -u golem when the socket is denied)
```
Expected: `Phase 34 gate passed`. The `--plugins` stage skips sm-user-plugin's pre-existing `TestRegisterCORSPath` (it needs an application around it) and prints that skip.
### 2. Framework v0.6.0
```sh
cd summercms.go
git fetch origin && git status # master fast-forwards over origin/master
go vet ./... && go test -short ./...
git tag -a v0.6.0 -F <tag message below>
git push origin master
git push origin v0.6.0
git ls-remote --tags origin v0.6.0
```
Then the changelog post (the only post of this release), from `../sm-summercmsio-app`:
```sh
scripts/changelog-post.py source v0.6.0 # material for the notes
scripts/changelog-post.py publish v0.6.0 notes.md --excerpt "Plugin marketplace: plugin.yaml manifests, summer plugin:install and plugin:update, and a Plugins screen in the admin."
```
The notes reuse the tag message below (`## Highlights` / `## Added` / `## Changed`, no H1, no planning IDs), including the "Plugins released alongside" section.
### 3. Plugins, in dependency order
For each repository in the table order (translate, user, chat, faq, menu, seo, sitemap, mfa, oauthserver, sociallogin, paymentgateway, paymentgatewaysubscriptions, pgstripe, journal, chatvideo, forum, herald, userfriends, then chatchannels and chatbots):
```sh
cd ../sm-<name>-plugin
git fetch origin && git status # ahead only, except chat/chatchannels/chatbots
GOWORK=off go build ./... && go vet ./... && go test -short ./... # TestPluginManifest included
summer plugin:manifest --check . # and `--check subscriptions` in sm-pgstripe-plugin
git tag -a <new tag> -m "<new tag>: plugin.yaml for the SummerCMS marketplace; requires SummerCMS v0.6.0"
git push origin <branch>
git push origin <new tag>
```
No `changelog-post.py publish --repo` for the plugins (no plugin posts this release). That script normally runs the manifest check and asks the registry to ingest; here the manifest check is the explicit command above, and the ingest happens in step 6.
The three rebases (34-02 push blockers), each before its tag:
- **sm-chat-plugin:** `git rebase origin/main`; resolve go.mod/go.sum (keep origin's 12 commits, require summercms v0.6.0); `summer plugin:manifest .` to regenerate plugin.yaml against the rebased sources and amend it into the manifest commit; build, vet, test; tag `v0.1.4` on the rebased commit.
- **sm-chatchannels-plugin** (after chat is tagged): `git rebase origin/main` over a30f04a (optional HTTP API switch, touches go.mod); require sm-chat-plugin `v0.1.4` if the rebased code needs it, else keep v0.1.3; regenerate plugin.yaml; build, vet, test; tag `v0.1.0`.
- **sm-chatbots-plugin** (after chat is tagged): `git rebase origin/main` over d0b9fb1 (drops sibling replaces); with no `../summercms.go` replace the build and `TestPluginManifest` resolve framework v0.6.0 from the remote, so step 2 must be done; regenerate plugin.yaml; build, vet, test; tag `v0.1.0`.
Their new SHAs replace b952128, 322629b and 0cd78f2 in the pointer bumps below.
### 4. summercms.io site plugin and pages
```sh
cd ../sm-summercmsio-app/plugins/golem15/summercms
go vet ./... && go test ./... # Docker: TestRegistrySmoke, TestRegistryAPIShapes, TestRegistryIngestEndpoint
git tag -a v0.1.0 -m "v0.1.0: plugin registry and marketplace API"
git push origin master && git push origin v0.1.0
cd ../../../vue-summercmsio-app
pnpm test && pnpm build:changelog && pnpm test:changelog && pnpm test:marketplace
git push origin master
```
### 5. Applications
Per application, in separate commits (research F10: the regenerated `main.go` and `plugins.gen.go` never ride in a pointer-bump commit):
1. `go get git.golem15.com/golem15/summercms@v0.6.0` (where go.mod pins a framework version; apps that `replace` it with `../summercms.go` still get the require raised) -> commit `chore: require SummerCMS v0.6.0`.
2. Plugin pointer bumps to the tagged commits below, `git -C plugins/golem15/<name> checkout <tag>` then stage only the gitlinks -> commit `chore: bump plugin pointers for plugin.yaml`.
3. `summer build` (regenerates `main.go` and `plugins.gen.go` with `PluginInfo` and `FrameworkVersion v0.6.0`) -> commit `chore: regenerate main.go and plugins.gen.go for SummerCMS v0.6.0`.
4. Release build per the application's DEPLOY.md, then push.
Pending gitlinks (from 34-02 and 34-03; "tag" is the tagged commit):
| Application | Path | Current | Target |
|-------------|------|---------|--------|
| sm-demo-app | plugins/golem15/faq | b3cc978 | v0.1.2 (3bf54cd) |
| sm-demo-app | plugins/golem15/journal | f5a0394 | v0.2.6 (5b38a3b) |
| sm-demo-app | plugins/golem15/menu | 8656474 | v0.1.2 (98df4c7) |
| sm-demo-app | plugins/golem15/mfa | 463c750 | v0.1.3 (544017c) |
| sm-demo-app | plugins/golem15/oauthserver | 8bbec72 | v0.1.6 (d600e2c) |
| sm-demo-app | plugins/golem15/paymentgateway | e0badb5 | v0.1.2 (300bc09) |
| sm-demo-app | plugins/golem15/paymentgatewaysubscriptions | 1ec96df | v0.1.3 (c81e385) |
| sm-demo-app | plugins/golem15/pgstripe | 6d07d98 | v0.1.4 (d61508f) |
| sm-demo-app | plugins/golem15/seo | b19cd06 | v0.1.1 (55f5e5d) |
| sm-demo-app | plugins/golem15/sitemap | 96c790d | v0.1.2 (049f3ee) |
| sm-demo-app | plugins/golem15/sociallogin | ecfb8a7 | v0.1.6 (47b3bb2) |
| sm-demo-app | plugins/golem15/translate | 54cf93b | v0.1.3 (7e64224) |
| sm-demo-app | plugins/golem15/user | 07196a4 | v0.1.19 (97f83cc) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/faq | b3cc978 | v0.1.2 (3bf54cd) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/journal | ffa2c8f | v0.2.6 (5b38a3b) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/menu | 8656474 | v0.1.2 (98df4c7) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/sitemap | 96c790d | v0.1.2 (049f3ee) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/translate | 54cf93b | v0.1.3 (7e64224) |
| sm-grzybyfunkcjonalne-app | plugins/golem15/user | bfcfea4 | v0.1.19 (97f83cc) |
| sm-bm-app | plugins/golem15/chat | 51c9e17 (= origin/main) | v0.1.4 (rebased chat) |
| sm-bm-app | plugins/golem15/chatbots | d0b9fb1 (= origin/main) | v0.1.0 (rebased chatbots) |
| sm-bm-app | plugins/golem15/chatchannels | a30f04a (= origin/main) | v0.1.0 (rebased chatchannels) |
| sm-bm-app | plugins/golem15/mfa | 463c750 | v0.1.3 (544017c) |
| sm-bm-app | plugins/golem15/oauthserver | df2eddd | v0.1.6 (d600e2c) |
| sm-bm-app | plugins/golem15/sociallogin | ecfb8a7 | v0.1.6 (47b3bb2) |
| sm-bm-app | plugins/golem15/user | 66fc107 | v0.1.19 (97f83cc) |
| sm-summercmsio-app | plugins/golem15/journal | ffa2c8f | v0.2.6 (5b38a3b) |
| sm-summercmsio-app | plugins/golem15/translate | 1134dd1 | v0.1.3 (7e64224) |
| sm-summercmsio-app | plugins/golem15/user | 50da92c | v0.1.19 (97f83cc) |
| sm-summercmsio-app | plugins/golem15/summercms | ca59415 | v0.1.0 (c52e721) |
| sm-summercmsio-app | vue-summercmsio-app | b3bfc5d | 8267c55 (pushed master) |
| fonoteka.go | plugins/golem15/user | a1b78b8 | v0.1.19 (97f83cc) |
32 plugin gitlinks plus the vue app link. Every non-chat bump is a fast-forward (checked in 34-02). No application mounts chatvideo, forum, herald or userfriends: those need only their tag. sm-grzybyfunkcjonalne-app (1) and fonoteka.go (39) already carry unpushed commits of their own; sm-summercmsio-app's working tree already shows its two gitlinks modified (left uncommitted by 34-03 and 34-06 on purpose).
For sm-summercmsio-app the framework bump is already committed (97c0c08 `chore: require summercms v0.6.0`); `scripts/build.sh dev` regenerates `main.go` and `plugins.gen.go`, which 34-03 restored to the committed versions: commit the regeneration in step 3.
## summercms.io deploy
From `../sm-summercmsio-app/DEPLOY.md`, "Plugin marketplace (the release that brings it)", after step 5 for sm-summercmsio-app:
1. `scripts/check-deploy.sh` (nginx and supervisor configs).
2. git on rome: `ssh rome 'command -v git && git --version'`; install git if empty (the ingester clones over https).
3. Release build and deploy per DEPLOY.md "Release": `migrate` creates the registry tables and the River queue tables; `config/queue.yaml` sets `work_in_serve: true`, so `serve` runs the hourly `summercms:registry-ingest` and the ingest-now jobs (`sudo supervisorctl tail summercms-io` shows the worker).
4. Reinstall the nginx site file (`/marketplace` to Node, POST only on `= /api/registry/v1/ingest`, `client_max_body_size 8k` there) and the changelog supervisor program (`NUXT_REGISTRY_API_BASE`), as under "Cutover", step 3; `nginx -t` and reload.
5. Mint the registry token on rome (Jakub only; never by an agent): `sudo -u summercms ./bin/summercms-io admin:token:create <you> --name registry --scope registry --expires 365d`, stored in a password manager and `~/.config/summercms/registry-token` (mode 600). With no plugin posts this release it is not needed yet; it serves later `changelog-post.py` plugin posts.
6. Curate the fourteen launch repositories once their new tags are pushed:
```
https://git.golem15.com/golem15/sm-chat-plugin.git
https://git.golem15.com/golem15/sm-faq-plugin.git
https://git.golem15.com/golem15/sm-journal-plugin.git
https://git.golem15.com/golem15/sm-menu-plugin.git
https://git.golem15.com/golem15/sm-mfa-plugin.git
https://git.golem15.com/golem15/sm-oauthserver-plugin.git
https://git.golem15.com/golem15/sm-paymentgateway-plugin.git
https://git.golem15.com/golem15/sm-paymentgatewaysubscriptions-plugin.git
https://git.golem15.com/golem15/sm-pgstripe-plugin.git
https://git.golem15.com/golem15/sm-seo-plugin.git
https://git.golem15.com/golem15/sm-sitemap-plugin.git
https://git.golem15.com/golem15/sm-sociallogin-plugin.git
https://git.golem15.com/golem15/sm-translate-plugin.git
https://git.golem15.com/golem15/sm-user-plugin.git
```
`sudo -u summercms ./bin/summercms-io summercms:registry-add <the fourteen URLs>` then `summercms:registry-ingest` (first ingest, one line per repository). Only tags carrying a `plugin.yaml` are listed, so each repository publishes from its new tag; older tags are noted and skipped. The six repositories tagged for the first time here (chatchannels, chatvideo, forum, herald, userfriends, chatbots) can be added the same way when Jakub wants them listed.
7. Curl the API:
```sh
curl -s https://summercms.io/api/registry/v1/plugins | head -c 300
curl -sI -H 'Origin: https://example.com' https://summercms.io/api/registry/v1/plugins
curl -sI https://summercms.io/marketplace
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://summercms.io/api/registry/v1/ingest # 401
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://summercms.io/api/registry/v1/plugins # 403
```
8. Visual check of `/marketplace` (list, search, a category, a detail page) and of an application's Settings -> System -> Plugins screen against the live registry; then a real `summer plugin:install golem15.faq` on a scratch application (34-04's open manual item).
## Framework v0.6.0: tag message (draft)
The annotated tag message; the changelog notes reuse it without the first line.
```
SummerCMS v0.6.0: plugin marketplace
Plugins now describe themselves in a generated plugin.yaml, applications
install and update them with one summer command, and the admin shows what
an application was built with. summercms.io lists the plugins in its new
marketplace.
## Highlights
- plugin.yaml: every plugin carries a manifest generated from its own
sources (ID and required plugins from plugin.go, module and version
minimums from go.mod, name and description from the README). It is
committed next to plugin.go and never edited by hand.
- summer plugin:install <vendor.name> adds a plugin from the registry: the
newest release your framework version allows, with the plugins it
requires, after printing the plan and asking (or --yes). --source and git
URLs install it as a git submodule instead.
- summer plugin:update moves one or all installed plugins to their newest
compatible release.
- The admin has a Plugins screen (Settings -> System -> Plugins): installed
plugins with versions and sources, update badges and a marketplace search,
each with the summer command to copy.
## Added
- New module kiosk: the plugin.yaml format (Manifest, Marshal, Parse,
Validate), Derive/Generate/Write/Check, CheckT for a one-line go test
guard in plugin repositories, the registry API v1 wire types, version
rules (ValidVersion, CompareVersions, BaseVersion, Satisfies,
NewestCompatible) and the registry client (kiosk.Client, NewClient,
RegistryURL).
- summer plugin:manifest [dir] with --check, --pretend, --name and
--description. Plugin IDs and requirements may be literals or constants
of the same package, another package or another module; nothing is run.
- summer plugin:install and summer plugin:update, with --yes and
--offline; plugin:install also takes vendor.name@vX.Y.Z and --source.
- summer build bakes PluginInfo (name, description, module, package,
version and source of each plugin) and FrameworkVersion into
plugins.gen.go; the generated main publishes them with party.Describe,
and party.Installed exposes them to plugins.
- Config key plugins.registry_url (default https://summercms.io;
SUMMER_PLUGINS__REGISTRY_URL overrides it; an empty value disables every
registry call).
- Permission backend.view_plugins (cabana.PermissionViewPlugins) for the
Plugins screen; superusers always have it. Admin API GET /plugins and
GET /plugins/marketplace; settings entries may open an admin route
(SettingsEntry.Path).
## Changed
- summer plugin:add reads constant plugin IDs, and plugin:add and
plugin:install append to summer.yaml in place: comments, blank lines and
the item layout stay as they were.
- Every application's main.go and plugins.gen.go change on the first
summer build with v0.6.0; commit the regeneration with the upgrade.
## Plugins released alongside
Every public plugin now ships a plugin.yaml and requires SummerCMS v0.6.0:
- sm-translate-plugin v0.1.3
- sm-user-plugin v0.1.19
- sm-chat-plugin v0.1.4
- sm-faq-plugin v0.1.2
- sm-menu-plugin v0.1.2
- sm-seo-plugin v0.1.1
- sm-sitemap-plugin v0.1.2
- sm-mfa-plugin v0.1.3
- sm-oauthserver-plugin v0.1.6
- sm-sociallogin-plugin v0.1.6
- sm-paymentgateway-plugin v0.1.2
- sm-paymentgatewaysubscriptions-plugin v0.1.3
- sm-pgstripe-plugin v0.1.4
- sm-journal-plugin v0.2.6
- sm-chatvideo-plugin v0.1.0 (first release)
- sm-forum-plugin v0.1.0 (first release)
- sm-herald-plugin v0.1.0 (first release)
- sm-userfriends-plugin v0.1.0 (first release)
- sm-chatchannels-plugin v0.1.0 (first release)
- sm-chatbots-plugin v0.1.0 (first release)
```
If a rebase or a check changes a plugin's version before tagging, update this list and the table above together.
## Rules
- **Never move a tag.** The Go module proxy and the checksum database cache a tagged version forever (research Pitfall 7); a wrong tag is fixed with the next patch, never by deleting and re-pushing.
- Tags only on the default branch (master or main of each repository); each tag must contain the earlier tags of that repository.
- The framework tag and its changelog post happen the same day. The plugin tags of this release get no posts (Jakub's decision); later plugin releases follow the normal rule (a `/changelog/plugins` post through `changelog-post.py publish --repo`).
- Push before bump: an application pointer moves only to a commit that is pushed and tagged.
- No `--force`, no `--no-verify`; tokens are minted and handled only by Jakub and never written into this file.
## Executed steps
| Step | Date | What was done | Result (SHA, tag object, URL) |
|------|------|---------------|-------------------------------|
| | | | |