|
| 1 | +name: Plugin sanity |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + pull_request: |
| 6 | + workflow_dispatch: |
| 7 | + |
| 8 | +permissions: |
| 9 | + contents: read |
| 10 | + |
| 11 | +jobs: |
| 12 | + sanity: |
| 13 | + runs-on: ubuntu-latest |
| 14 | + steps: |
| 15 | + - uses: actions/checkout@v4 |
| 16 | + |
| 17 | + - uses: actions/setup-python@v5 |
| 18 | + with: |
| 19 | + python-version: "3.12" |
| 20 | + |
| 21 | + - name: Validate Codex plugin package |
| 22 | + run: | |
| 23 | + python - <<'PY' |
| 24 | + import json |
| 25 | + import re |
| 26 | + from pathlib import Path |
| 27 | +
|
| 28 | + root = Path.cwd() |
| 29 | +
|
| 30 | + def fail(message: str) -> None: |
| 31 | + raise SystemExit(message) |
| 32 | +
|
| 33 | + def load_json(path: Path) -> dict: |
| 34 | + try: |
| 35 | + return json.loads(path.read_text(encoding="utf-8")) |
| 36 | + except Exception as exc: |
| 37 | + fail(f"{path} is not valid JSON: {exc}") |
| 38 | +
|
| 39 | + marketplace = load_json(root / ".agents" / "plugins" / "marketplace.json") |
| 40 | + entries = marketplace.get("plugins") |
| 41 | + if not isinstance(entries, list): |
| 42 | + fail("marketplace plugins must be a list") |
| 43 | +
|
| 44 | + docent_entries = [entry for entry in entries if entry.get("name") == "docent"] |
| 45 | + if len(docent_entries) != 1: |
| 46 | + fail("marketplace must contain exactly one docent plugin entry") |
| 47 | +
|
| 48 | + source = docent_entries[0].get("source") |
| 49 | + if not isinstance(source, dict) or source.get("source") != "local": |
| 50 | + fail("docent marketplace source must be local") |
| 51 | + plugin_dir = root / source.get("path", "") |
| 52 | + if not plugin_dir.is_dir(): |
| 53 | + fail(f"marketplace source path does not exist: {plugin_dir}") |
| 54 | +
|
| 55 | + manifest = load_json(plugin_dir / ".codex-plugin" / "plugin.json") |
| 56 | + if manifest.get("name") != "docent": |
| 57 | + fail("plugin manifest name must be docent") |
| 58 | +
|
| 59 | + version = manifest.get("version") |
| 60 | + if not isinstance(version, str) or not re.fullmatch(r"\d+\.\d+\.\d+", version): |
| 61 | + fail("plugin manifest version must be plain major.minor.patch") |
| 62 | + if manifest.get("skills") != "./skills/": |
| 63 | + fail("plugin manifest skills must point to ./skills/") |
| 64 | + if manifest.get("mcpServers") != "./.mcp.json": |
| 65 | + fail("plugin manifest mcpServers must point to ./.mcp.json") |
| 66 | +
|
| 67 | + required_files = [ |
| 68 | + ".codex-plugin/plugin.json", |
| 69 | + ".mcp.json", |
| 70 | + "skills/docent/SKILL.md", |
| 71 | + "skills/docent/analysis.md", |
| 72 | + "skills/docent/dql-reference.md", |
| 73 | + "skills/docent/ingestion-reference.md", |
| 74 | + "skills/docent/ingestion.md", |
| 75 | + "skills/docent/readings-reference.md", |
| 76 | + "skills/docent/report.md", |
| 77 | + ] |
| 78 | + for rel_path in required_files: |
| 79 | + path = plugin_dir / rel_path |
| 80 | + if not path.is_file(): |
| 81 | + fail(f"required plugin file is missing: {rel_path}") |
| 82 | + if path.suffix == ".md" and not path.read_text(encoding="utf-8").strip(): |
| 83 | + fail(f"markdown file is empty: {rel_path}") |
| 84 | +
|
| 85 | + mcp = load_json(plugin_dir / ".mcp.json") |
| 86 | + server = mcp.get("mcpServers", {}).get("docent") |
| 87 | + if not isinstance(server, dict): |
| 88 | + fail(".mcp.json must define mcpServers.docent") |
| 89 | + if server.get("type") != "stdio" or server.get("command") != "uv": |
| 90 | + fail("docent MCP server must run as uv stdio") |
| 91 | + args = server.get("args") |
| 92 | + if not isinstance(args, list) or "--from" not in args: |
| 93 | + fail("docent MCP server args must include --from") |
| 94 | + package = args[args.index("--from") + 1] |
| 95 | + if package != "docent-python>=0.1.73": |
| 96 | + fail("docent MCP server must require docent-python>=0.1.73") |
| 97 | +
|
| 98 | + forbidden_names = {".mcp.local.json", "docent.env"} |
| 99 | + for path in plugin_dir.rglob("*"): |
| 100 | + if path.name in forbidden_names or path.name.startswith("docent.env."): |
| 101 | + fail(f"local credential/config file must not be published: {path}") |
| 102 | +
|
| 103 | + print("Codex plugin sanity checks passed") |
| 104 | + PY |
0 commit comments