feat: publish this plugin to grc.store - #456
Open
eddie-knight wants to merge 2 commits into
Open
Conversation
Declare the publication metadata `pvtr publish` reads out of the built binary: Publisher ossf (coordinate ossf/github-repo), the Apache-2.0 license grc.store requires on every publication, and the namespace that owns each embedded catalog. The vendored OSPS Baseline YAML carries no metadata.author.id and pvtr will not guess an owner, so the mapping is declared here. None of it is reachable at run time, so the orchestrator setup moves into newOrchestrator and a test asserts the resulting publish manifest — otherwise a wrong coordinate or a newly embedded, unmapped catalog would first surface as a failed release. Add the publish workflow itself. It stays workflow_dispatch-only: the first successful publish TOFU-pins the signer identity to this file's path, so it must be deliberate and every later publish must run from here. PVTR_VERSION is a placeholder until the pvtr release carrying `pvtr publish` is cut. Signed-off-by: Eddie Knight <knight@linux.com>
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Trim the added comments to the one-line style used elsewhere in main.go, and drop the sentences that restate either the SDK's own field docs or the code on the next line. Tighten the publish step: it ran under GitHub's default `bash -e`, with no pipefail, so a failed token mint left PVTR_TOKEN empty (or the literal "null", which pvtr's TrimSpace accepts) and the step still reached `privateer publish`. Set -euo pipefail and guard the token the same way the audience above it was already guarded. `--dist` is the flag default, so drop it. Assert the exact catalog count in the publish manifest test — `== 0` only caught losing every catalog, not one dropping out of the embed glob — and use strings.HasPrefix over the hand-rolled slice compare. While here, fix the NewPluginCommands arguments: they were shifted a slot, so VersionPostfix landed in buildGitCommitHash and GitCommitHash in buildTime, and BuiltAt — set by both goreleaser and the Makefile — was passed nowhere. Version already carries the postfix. Signed-off-by: Eddie Knight <eknight@revanite.io>
eddie-knight
marked this pull request as ready for review
August 18, 2026 23:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Declare the publication metadata
pvtr publishreads out of the built binary: Publisher ossf (coordinate ossf/github-repo), the Apache-2.0 license grc.store requires on every publication, and the namespace that owns each embedded catalog. The vendored OSPS Baseline YAML carries no metadata.author.id and pvtr will not guess an owner, so the mapping is declared here.None of it is reachable at run time, so the orchestrator setup moves into newOrchestrator and a test asserts the resulting publish manifest — otherwise a wrong coordinate or a newly embedded, unmapped catalog would first surface as a failed release.
Add the publish workflow itself. It stays workflow_dispatch-only: the first successful publish TOFU-pins the signer identity to this file's path, so it must be deliberate and every later publish must run from here. PVTR_VERSION is a placeholder until the pvtr release carrying
pvtr publishis cut.Also carries one unrelated bugfix, kept here because it lives in the lines this PR was already moving: the
NewPluginCommandsarguments were shifted a slot, soVersionPostfixlanded inbuildGitCommitHashandGitCommitHashinbuildTime, andBuiltAt— set by both.goreleaser.yamland theMakefile— was passed nowhere.Versionalready carries the postfix, so the fix drops it and passesGitCommitHashandBuiltAtinto their own slots. This changes what the plugin reports for its commit and build time.