ci: expand plugin validation with toolkit checks and run the uploader as a package - #2835
Open
lin-snow wants to merge 2 commits into
Open
ci: expand plugin validation with toolkit checks and run the uploader as a package#2835lin-snow wants to merge 2 commits into
lin-snow wants to merge 2 commits into
Conversation
- add blocking and warning checks to plugin PR pre-checks - generate a detailed validation summary before final failure - revalidate merged packages before marketplace upload - add a sandbox workflow for testing pre-check changes
The toolkit's uploader is now an importable package; the canonical
invocation is the package directory itself:
python3 .scripts/uploader
Merge after langgenius/dify-marketplace-toolkit#4 — workflows clone the
toolkit at HEAD, and the package form only exists on that branch. The
toolkit keeps upload-package.py as a deprecated alias until both plugin
repositories run the package form, then removes it.
Contributor
|
Please select exactly one risk level in the PR template: Low risk, Medium risk, or High risk. This helps Marketplace reviewers route the submission correctly. |
github-actions
Bot
added
the
risk: missing
Contributor
There was a problem hiding this comment.
Pull request overview
This PR strengthens the plugin CI workflows by expanding validation to include multiple dify-marketplace-toolkit validator checks, consolidating results into a summary, and updating the uploader invocation to run via the uploader package entry point.
Changes:
- Expanded PR pre-check to run a broader set of toolkit validators and collect results into a single end-of-job summary before failing on blocking errors.
- Added a sandbox-only copy of the pre-check workflow (triggered only for PRs targeting
precheck-sandbox) to test CI changes without affecting real submissions. - Updated upload/publish workflows to invoke the uploader via
python3 .scripts/uploaderand added final package revalidation on merge before upload.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/upload-merged-plugin.yaml | Adds final merged-package validation steps and switches uploader invocation to package entry point. |
| .github/workflows/pre-check-plugin.yaml | Expands PR validation using toolkit validators, improves summary reporting, and adds a final “fail on blocking errors” gate. |
| .github/workflows/pre-check-plugin-sandbox.yaml | Introduces a sandbox-scoped duplicate of the pre-check workflow for safely exercising workflow changes. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+702
to
+706
| - name: Fail on Blocking Errors | ||
| if: always() | ||
| run: | | ||
| BLOCKING_ERROR_FILES=( | ||
| /tmp/manifest_errors.txt |
Comment on lines
+114
to
+121
| - name: Check Package Contents | ||
| continue-on-error: true | ||
| run: | | ||
| python3 .scripts/validator/check-package-contents.py \ | ||
| -d "$PLUGIN_PATH" \ | ||
| --package-file "$SUBMITTED_PLUGIN_PATH.zip" \ | ||
| --error-file /tmp/package_contents_errors.txt \ | ||
| --warning-file /tmp/package_contents_warnings.txt |
Comment on lines
+113
to
+120
| - name: Check Package Contents | ||
| continue-on-error: true | ||
| run: | | ||
| python3 .scripts/validator/check-package-contents.py \ | ||
| -d "$PLUGIN_PATH" \ | ||
| --package-file "$SUBMITTED_PLUGIN_PATH.zip" \ | ||
| --error-file /tmp/package_contents_errors.txt \ | ||
| --warning-file /tmp/package_contents_warnings.txt |
Comment on lines
+701
to
+705
| - name: Fail on Blocking Errors | ||
| if: always() | ||
| run: | | ||
| BLOCKING_ERROR_FILES=( | ||
| /tmp/manifest_errors.txt |
Comment on lines
+75
to
+79
| - name: Unpack Plugin for Final Validation | ||
| run: | | ||
| mkdir -p unpacked_plugin | ||
| unzip "$PLUGIN_PATH" -d unpacked_plugin | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expands the PR pre-check with the marketplace toolkit's validators and switches the uploader to its package invocation.
flowchart LR PR["Plugin PR"] --> PC["pre-check:<br/>a dozen toolkit validators<br/>+ install test + packaging check"] PC --> S["one validation summary,<br/>fail at the end"] MG["merge to main"] --> UM["upload-merged:<br/>revalidate package"] UM --> UP["python3 .scripts/uploader"] UP --> M1["POST /plugins/inner-upload"] UP --> M2["PUT /plugin-artifacts/{checksum}/scan-report"]validator/check-*.pyCLI from dify-marketplace-toolkit. Blocking findings and review warnings are collected into a single summary instead of dying on the first error.pre-check-plugin-sandbox.yamlis a copy of the pre-check triggered only by PRs targeting aprecheck-sandboxbranch, so check changes can be exercised without touching real submissions.python3 .scripts/uploader. It uploads and then submits the security scan report against the returned artifact checksum on its own — workflows carry no scan logic, and a report failure warns without failing a publish.Merge after langgenius/dify-marketplace-toolkit#4, which ships the package entry point (the old
upload-package.pypath keeps working there as an alias until both plugin repositories migrate).