Prepare for on-demand cartridges. (#171)

On-demand cartridge fetching of boj-server-cartridges + bundle deletion prep.

- release.yml / Containerfile: fetch cartridge tree from the canonical
  registry (scripts/fetch-cartridges.sh, landed in #169) instead of a
  bundled cartridges/ dir.
- Elixir tests + test config: honour BOJ_CARTRIDGES_PATH override; widen
  the known auth-method allowlist.

Author: JoshuaJewell

.github/workflows/release.yml

@@ -30,14 +30,21 @@ jobs:
         with:
           version: 0.15.2
 
+      - name: Fetch cartridges
+        # Cartridge source lives in the canonical registry, not this repo. Fetch
+        # it into a flat <name>/ cache and point the build loops below at it.
+        run: |
+          BOJ_CARTRIDGES_PATH="$RUNNER_TEMP/cartridges" bash scripts/fetch-cartridges.sh
+          echo "CARTS_ROOT=$RUNNER_TEMP/cartridges" >> "$GITHUB_ENV"
+
       - name: Build core FFI libraries
         run: cd ffi/zig && zig build -Doptimize=ReleaseSafe
 
       - name: Build cartridge shared libraries
         run: |
           for cart in database-mcp fleet-mcp nesy-mcp agent-mcp cloud-mcp container-mcp k8s-mcp git-mcp secrets-mcp queues-mcp iac-mcp observe-mcp ssg-mcp proof-mcp lsp-mcp dap-mcp bsp-mcp feedback-mcp; do
             echo "Building $cart .so..."
-            cd "cartridges/$cart/ffi" && zig build -Doptimize=ReleaseSafe
+            cd "$CARTS_ROOT/$cart/ffi" && zig build -Doptimize=ReleaseSafe
             cd "$GITHUB_WORKSPACE"
           done
 
@@ -47,9 +54,9 @@ jobs:
           # Core static libraries and benchmark binary
           cp ffi/zig/zig-out/lib/*.a release-artifacts/core/
           cp ffi/zig/zig-out/bin/boj_bench release-artifacts/core/ 2>/dev/null || true
-          # Cartridge shared libraries
+          # Cartridge shared libraries (built from the fetched cache)
           for cart in database-mcp fleet-mcp nesy-mcp agent-mcp cloud-mcp container-mcp k8s-mcp git-mcp secrets-mcp queues-mcp iac-mcp observe-mcp ssg-mcp proof-mcp lsp-mcp dap-mcp bsp-mcp feedback-mcp; do
-            cp "cartridges/$cart/ffi/zig-out/lib/"*.so "release-artifacts/cartridges/" 2>/dev/null || true
+            cp "$CARTS_ROOT/$cart/ffi/zig-out/lib/"*.so "release-artifacts/cartridges/" 2>/dev/null || true
           done
 
       - name: Create release tarball

container/Containerfile

@@ -16,15 +16,30 @@
 # Stage 1: Zig FFI Builder
 # ============================================================================
 
+# Cartridge source is fetched on demand from the canonical registry rather than
+# bundled in this repo. Override the ref/repo at build time if needed:
+#   podman build --build-arg BOJ_CARTRIDGES_REF=v1.2.3 ...
+ARG BOJ_CARTRIDGES_REF=main
+ARG BOJ_CARTRIDGES_REPO=https://github.com/hyperpolymath/boj-server-cartridges.git
+
 FROM cgr.dev/chainguard/wolfi-base:latest AS zig-builder
 
-RUN apk add --no-cache zig build-base
+RUN apk add --no-cache zig build-base git bash
 
 WORKDIR /build
 
-# Copy Zig source and cartridge FFI sources
+# Copy Zig source
 COPY ffi/zig/ ffi/zig/
-COPY cartridges/ cartridges/
+
+# Fetch the cartridge tree from the registry into /build/cartridges, flattened to
+# <name>/ (the layout the build loops below and the runtime Catalog both expect).
+ARG BOJ_CARTRIDGES_REF
+ARG BOJ_CARTRIDGES_REPO
+COPY scripts/fetch-cartridges.sh /tmp/fetch-cartridges.sh
+RUN BOJ_CARTRIDGES_REF="$BOJ_CARTRIDGES_REF" \
+    BOJ_CARTRIDGES_REPO="$BOJ_CARTRIDGES_REPO" \
+    BOJ_CARTRIDGES_PATH=/build/cartridges \
+    bash /tmp/fetch-cartridges.sh
 
 # Build boj-invoke CLI (x86_64-linux-gnu target so it uses DlDynLib/real dlopen)
 RUN cd ffi/zig && zig build invoke -Doptimize=ReleaseFast
@@ -104,9 +119,11 @@ RUN for cart_dir in /tmp/cartridges-src/*/; do \
     done && \
     rm -rf /tmp/cartridges-src
 
-# Copy cartridge metadata (cartridge.json files — loaded by Catalog GenServer)
+# Copy cartridge metadata (cartridge.json files — loaded by Catalog GenServer).
+# Sourced from the fetched tree in the zig-builder stage, not the build context,
+# so the image build no longer depends on a bundled cartridges/ directory.
 RUN mkdir -p /app-cartridges-meta
-COPY cartridges/ /tmp/carts-meta/
+COPY --from=zig-builder /build/cartridges/ /tmp/carts-meta/
 RUN for cart_dir in /tmp/carts-meta/*/; do \
       cart="$(basename "$cart_dir")" && \
       if [ -f "${cart_dir}cartridge.json" ]; then \

elixir/config/test.exs

@@ -7,4 +7,5 @@ import Config
 config :boj_rest, start_server: false
 
 config :boj_rest,
-  cartridges_root: Path.expand("../../cartridges", __DIR__)
+  cartridges_root:
+    System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)

elixir/test/aspect_test.exs

@@ -8,7 +8,7 @@ defmodule BojRest.AspectTest do
   import Plug.Test
   import Plug.Conn
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
   @opts BojRest.Router.init([])
 
   setup_all do

elixir/test/catalog_properties_test.exs

@@ -4,7 +4,7 @@ defmodule BojRest.CatalogPropertiesTest do
   use ExUnit.Case, async: false
   use ExUnitProperties
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
 
   setup_all do
     case Process.whereis(BojRest.Catalog) do
@@ -66,7 +66,7 @@ defmodule BojRest.CatalogPropertiesTest do
   end
 
   property "auth method is always a known value for all cartridges" do
-    known = ~w[none api-key api_key_header bearer bearer_token oauth oauth2 session-token basic]
+    known = ~w[none api-key api_key api_key_header api_token bearer bearer_token oauth oauth2 session-token basic mtls custom optional_bearer optional_api_key]
     carts = BojRest.Catalog.list()
     check all cart <- StreamData.member_of(carts) do
       method = get_in(cart, ["auth", "method"])

elixir/test/catalog_test.exs

@@ -3,7 +3,7 @@
 defmodule BojRest.CatalogTest do
   use ExUnit.Case, async: false
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
 
   setup_all do
     case Process.whereis(BojRest.Catalog) do
@@ -83,8 +83,9 @@ defmodule BojRest.CatalogTest do
   end
 
   test "auth method is always a known value" do
-    known = ["none", "api-key", "api_key_header", "bearer", "bearer_token",
-             "oauth", "oauth2", "session-token", "basic"]
+    known = ["none", "api-key", "api_key", "api_key_header", "api_token",
+             "bearer", "bearer_token", "oauth", "oauth2", "session-token",
+             "basic", "mtls", "custom", "optional_bearer", "optional_api_key"]
     BojRest.Catalog.list()
     |> Enum.each(fn cart ->
       method = get_in(cart, ["auth", "method"])

elixir/test/contract_test.exs

@@ -8,7 +8,7 @@ defmodule BojRest.ContractTest do
   import Plug.Test
   import Plug.Conn
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
   @opts BojRest.Router.init([])
 
   setup_all do

elixir/test/js_invoker_test.exs

@@ -3,7 +3,7 @@
 defmodule BojRest.JsInvokerTest do
   use ExUnit.Case, async: false
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
 
   # ── deno discovery ──────────────────────────────────────────────────────────
 

elixir/test/router_test.exs

@@ -5,7 +5,7 @@ defmodule BojRest.RouterTest do
   import Plug.Test
   import Plug.Conn
 
-  @cartridges_root Path.expand("../../cartridges", __DIR__)
+  @cartridges_root System.get_env("BOJ_CARTRIDGES_PATH") || Path.expand("../../cartridges", __DIR__)
   @opts BojRest.Router.init([])
 
   setup_all do