feat(plugins): automate plugin release publishing on Cloudflare

.github/workflows/README.md

@@ -12,6 +12,7 @@ This directory contains all GitHub Actions workflows for the starter-gradle proj
 | **Security**    | `codeql-analysis.yml`                | Security scanning with CodeQL               | Push to main/minor, daily schedule      |
 | **Publishing**  | `publish-release.yml`                | Publish release (Maven, Cargo, npm, Docker) | Tag push `v*.*.*`                       |
 | **Publishing**  | `publish-snapshot.yml`               | Publish snapshot versions                   | Manual, daily schedule                  |
+| **Publishing**  | `publish-plugins.yml`                | Build/sign/deploy runtime plugins catalog   | Plugin tag push, manual dispatch        |
 | **Publishing**  | `_publish.yml`                       | Reusable publish workflow                   | Called by other workflows               |
 | **Automation**  | `auto-fix-lockfile.yml`              | Auto-update lockfiles                       | Daily schedule, manual                  |
 | **Automation**  | `fix-renovate.yml`                   | Fix lockfiles for Renovate PRs              | Comment `/fix-lock` on PR               |
@@ -189,6 +190,34 @@ Calls the reusable `_publish.yml` workflow with:
 
 ---
 
+### `publish-plugins.yml` - Plugin Artifact Publishing
+
+**Purpose**: Builds, signs, verifies, and deploys runtime plugin artifacts and catalog metadata.
+
+**Triggers**:
+
+- Push tag matching `plugin/<plugin-id>/v<semver>`
+- Manual trigger (`workflow_dispatch`)
+
+**What it does**:
+
+1. Resolves target plugin from `package.metadata.corvus.plugin_id`
+2. Builds WASM artifact (`wasm32-wasip1`)
+3. Generates immutable artifact paths under `artifacts/<plugin-id>/<version>/`
+4. Upserts plugin entry into `catalog.json` and preserves existing entries
+5. Signs artifact with cosign (key-based or keyless)
+6. Verifies signature in CI
+7. Builds plugins catalog site
+8. Deploys to Cloudflare Pages (configurable)
+
+**Required secrets/vars for deployment**:
+
+- `CLOUDFLARE_API_TOKEN`
+- `CLOUDFLARE_ACCOUNT_ID`
+- `CLOUDFLARE_PAGES_PROJECT_NAME` (repository variable recommended)
+
+---
+
 ### `_publish.yml` - Reusable Publishing Workflow
 
 **Purpose**: Internal reusable workflow for publishing release/snapshot artifacts.

.lycheeignore

@@ -9,6 +9,9 @@
 # Mend.io returns 403 Forbidden to bots
 ^https://www\.mend\.io/.*
 
+# GNU Make website is intermittently timing out from CI/hook network
+^https://www\.gnu\.org/software/make/?$
+
 # Checkstyle header file contains regex patterns that look like URLs
 gradle/configs/checkstyle/checkstyle-header-file\.txt
 

clients/agent-runtime/plugins/memory-surreal-graphs/Cargo.toml

@@ -5,6 +5,19 @@ edition = "2021"
 license = "Apache-2.0"
 description = "Pilot WASM plugin artifact for Corvus surreal graph memory backend"
 
+[package.metadata.corvus]
+plugin_id = "memory.surreal.graphs"
+publisher = "corvus-official"
+runtime_api = "corvus-plugin/v1"
+capabilities = ["memory"]
+memory_entrypoint = "memory_v1"
+health_entrypoint = "health_v1"
+tools_entrypoints = []
+memory_mb = 256
+fuel = 1000000
+timeout_ms = 10000
+max_output_bytes = 262144
+
 [lib]
 crate-type = ["cdylib"]
 

clients/agent-runtime/src/onboard/wizard.rs

@@ -2769,10 +2769,15 @@ fn setup_memory() -> Result<MemoryConfig> {
             style("ℹ").cyan()
         );
         let mut bootstrap = plugin_bootstrap_config(backend)?;
-        install_and_handle_surreal_graphs(&mut bootstrap, false)?;
+        install_and_handle_surreal_graphs(&mut bootstrap, true)?;
+        if bootstrap.memory.backend != backend {
+            let original_auto_save = config.auto_save;
+            config = bootstrap.memory;
+            config.auto_save = original_auto_save;
+        }
     }
 
-    if requires_surreal_memory_setup(backend) {
+    if requires_surreal_memory_setup(&config.backend) {
         setup_surreal_memory_options(&mut config)?;
     }
 

clients/web/apps/docs/src/content/docs/en/404.mdx

@@ -1,19 +1,19 @@
 ---
-title: '404'
+title: "404"
 template: splash
 editUrl: false
 hero:
-title: '404'
-tagline: Page not found. The content may have moved during Corvus customization.
-actions:
-- text: Back to Home
-link: /
-icon: right-arrow
-variant: primary
-- text: View Documentation
-link: ../guides/getting-started/
-icon: open-book
-variant: minimal
+  title: "404"
+  tagline: Page not found. The content may have moved during Corvus customization.
+  actions:
+    - text: Back to Home
+      link: /
+      icon: right-arrow
+      variant: primary
+    - text: View Documentation
+      link: ../guides/getting-started/
+      icon: open-book
+      variant: minimal
 ---
 
 ## Looking for something?

clients/web/apps/docs/src/content/docs/en/guides/plugins.md

@@ -114,22 +114,45 @@ Workflow file:
 
 Current workflow behavior:
 
-1. Build WASM plugin artifact.
-2. Assemble bundle metadata:
-  - `plugin-manifest.json`
-  - `catalog.json`
-  - `revocations.json`
-3. Optionally sign with cosign key (if secret is present).
-4. Optionally push to OCI (if `oci_repository` input is provided).
-5. Upload bundle artifacts.
+1. Trigger automatically on plugin release tags: `plugin/<plugin-id>/v<semver>`.
+2. Resolve plugin directory dynamically from `package.metadata.corvus.plugin_id` in each
+   plugin `Cargo.toml`.
+3. Build WASM plugin artifact for `wasm32-wasip1`.
+4. Assemble immutable bundle metadata and artifacts:
+   - `artifacts/<plugin-id>/<version>/<plugin-id>.wasm`
+   - `artifacts/<plugin-id>/<version>/plugin-manifest.json`
+   - root `catalog.json` (upsert plugin entry, keep others)
+   - root `revocations.json` (preserve list, refresh `updated_at`)
+5. Sign artifact with cosign (key-based when `COSIGN_PRIVATE_KEY` is set, otherwise keyless
+   OIDC).
+6. Verify signature in CI.
+7. Optionally push artifact bundle to OCI (`oci_repository`).
+8. Build plugins catalog app and deploy to Cloudflare Pages (enabled by default for release tags).
+9. Upload build + bundle artifacts as workflow artifacts for traceability.
 
 :::important
-This workflow is currently configured for `memory.surreal.graphs` in job env defaults. For a new
-plugin, either:
+To onboard a new plugin into automated releases:
 
-1. Adapt env values for the new plugin, or
-2. Generalize workflow inputs/matrix so plugin ID/folder/artifact name are parameters.
-   :::
+1. Create it under `clients/agent-runtime/plugins/<plugin-folder>/`.
+2. Add `package.metadata.corvus.plugin_id` to its `Cargo.toml`.
+3. Set plugin limits/capabilities in `package.metadata.corvus`.
+4. Create a release tag: `plugin/<plugin-id>/v<version>`.
+
+No workflow code changes are required for new plugins when metadata is present.
+:::
+
+Release example:
+
+```bash
+git tag plugin/memory.surreal.graphs/v0.1.0
+git push origin plugin/memory.surreal.graphs/v0.1.0
+```
+
+Cloudflare deployment configuration expected by the workflow:
+
+- Secret: `CLOUDFLARE_API_TOKEN`
+- Secret: `CLOUDFLARE_ACCOUNT_ID`
+- Repository variable: `CLOUDFLARE_PAGES_PROJECT_NAME`
 
 ## 6. Operator Commands (Runtime)
 

clients/web/apps/docs/src/content/docs/en/index.mdx

@@ -3,15 +3,15 @@ title: Corvus
 description: Reactive agent platform for always-on orchestration on the JVM.
 template: splash
 hero:
-tagline: Build long-running, proactive agents with Kotlin, Spring Boot, Neo4j, Rust sidecars, and a transparent control panel.
-actions:
-- text: Get Started
-link: guides/getting-started/
-icon: right-arrow
-- text: View on GitHub
-link: https://github.com/dallay/corvus
-icon: external
-variant: minimal
+  tagline: Build long-running, proactive agents with Kotlin, Spring Boot, Neo4j, Rust sidecars, and a transparent control panel.
+  actions:
+    - text: Get Started
+      link: guides/getting-started/
+      icon: right-arrow
+    - text: View on GitHub
+      link: https://github.com/dallay/corvus
+      icon: external
+      variant: minimal
 ---
 
 

clients/web/apps/docs/src/content/docs/es/404.mdx

@@ -1,19 +1,19 @@
 ---
-title: '404'
+title: "404"
 template: splash
 editUrl: false
 hero:
-title: '404'
-tagline: Página no encontrada. El contenido pudo moverse durante la personalización de Corvus.
-actions:
-- text: Volver al Inicio
-link: /
-icon: right-arrow
-variant: primary
-- text: Ver Documentación
-link: ../guides/getting-started/
-icon: open-book
-variant: minimal
+  title: "404"
+  tagline: Página no encontrada. El contenido pudo moverse durante la personalización de Corvus.
+  actions:
+    - text: Volver al Inicio
+      link: /
+      icon: right-arrow
+      variant: primary
+    - text: Ver Documentación
+      link: ../guides/getting-started/
+      icon: open-book
+      variant: minimal
 ---
 
 ## ¿Buscas algo?

clients/web/apps/docs/src/content/docs/es/guides/plugins.md

@@ -115,23 +115,46 @@ Archivo de workflow:
 
 Comportamiento actual del workflow:
 
-1. Build del artefacto WASM del plugin.
-2. Ensamblar metadatos del bundle:
-  - `plugin-manifest.json`
-  - `catalog.json`
-  - `revocations.json`
-3. Opcionalmente firmar con clave cosign (si el secret está presente).
-4. Opcionalmente push a OCI (si el input `oci_repository` es proporcionado).
-5. Upload de artefactos del bundle.
+1. Se dispara automáticamente con tags de release: `plugin/<plugin-id>/v<semver>`.
+2. Resuelve dinámicamente la carpeta del plugin usando `package.metadata.corvus.plugin_id` en
+   cada `Cargo.toml`.
+3. Hace build del artefacto WASM para `wasm32-wasip1`.
+4. Ensambla bundle inmutable con artefactos/metadatos:
+   - `artifacts/<plugin-id>/<version>/<plugin-id>.wasm`
+   - `artifacts/<plugin-id>/<version>/plugin-manifest.json`
+   - `catalog.json` raíz (upsert del plugin, preservando los demás)
+   - `revocations.json` raíz (preserva la lista, actualiza `updated_at`)
+5. Firma el artefacto con cosign (con clave cuando existe `COSIGN_PRIVATE_KEY`, o bien keyless
+   OIDC si no existe).
+6. Verifica la firma en CI.
+7. Push opcional del bundle a OCI (`oci_repository`).
+8. Hace build de la app de catálogo y deploy a Cloudflare Pages (habilitado por defecto para tags de
+   release).
+9. Sube artefactos del build y del bundle para trazabilidad.
 
 :::important
-Este workflow está actualmente configurado para `memory.surreal.graphs` en los defaults de env del
-job. Para un nuevo plugin, ya sea:
+Para integrar un nuevo plugin al release automático:
 
-1. Adaptar los valores de env para el nuevo plugin, o
-2. Generalizar los inputs/matrix del workflow para que plugin ID/folder/nombre de artefacto sean
-   parámetros.
-   :::
+1. Créalo en `clients/agent-runtime/plugins/<carpeta-plugin>/`.
+2. Agrega `package.metadata.corvus.plugin_id` en su `Cargo.toml`.
+3. Define límites/capacidades en `package.metadata.corvus`.
+4. Crea un tag de release: `plugin/<plugin-id>/v<version>`.
+
+Con metadata correcta, no hace falta cambiar el workflow para plugins nuevos.
+:::
+
+Ejemplo de release:
+
+```bash
+git tag plugin/memory.surreal.graphs/v0.1.0
+git push origin plugin/memory.surreal.graphs/v0.1.0
+```
+
+Configuración de Cloudflare esperada por el workflow:
+
+- Secret: `CLOUDFLARE_API_TOKEN`
+- Secret: `CLOUDFLARE_ACCOUNT_ID`
+- Variable de repositorio: `CLOUDFLARE_PAGES_PROJECT_NAME`
 
 ## 6. Comandos de Operador (Runtime)
 

clients/web/apps/docs/src/content/docs/es/index.mdx

@@ -3,15 +3,15 @@ title: Corvus
 description: Plataforma reactiva de agentes siempre activos sobre JVM.
 template: splash
 hero:
-tagline: Construye agentes proactivos y de larga duración con Kotlin, Spring Boot, Neo4j, sidecars en Rust y un panel transparente.
-actions:
-- text: Primeros Pasos
-link: guides/getting-started/
-icon: right-arrow
-- text: Ver en GitHub
-link: https://github.com/dallay/corvus
-icon: external
-variant: minimal
+  tagline: Construye agentes proactivos y de larga duración con Kotlin, Spring Boot, Neo4j, sidecars en Rust y un panel transparente.
+  actions:
+    - text: Primeros Pasos
+      link: guides/getting-started/
+      icon: right-arrow
+    - text: Ver en GitHub
+      link: https://github.com/dallay/corvus
+      icon: external
+      variant: minimal
 ---