Migrate workflow-plugin-cicd to strict gRPC proto contracts

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Configure Go private modules
+        run: git config --global url."https://x-access-token:${{ github.token }}@github.com/GoCodeAlone/".insteadOf "https://github.com/GoCodeAlone/"
+
+      - name: Run tests
+        run: go test ./...
+        env:
+          GOWORK: "off"
+          GOPRIVATE: github.com/GoCodeAlone/*
+          GONOSUMCHECK: github.com/GoCodeAlone/*
+
+  wfctl-strict-contracts:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Configure Go private modules
+        run: git config --global url."https://x-access-token:${{ github.token }}@github.com/GoCodeAlone/".insteadOf "https://github.com/GoCodeAlone/"
+
+      - name: Validate strict plugin contracts
+        run: |
+          if [ ! -f plugin.json ]; then
+            echo "plugin.json not found — strict contract validation cannot run" >&2
+            exit 1
+          fi
+          go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.20.1 plugin validate --file plugin.json --strict-contracts
+        env:
+          GOWORK: "off"
+          GOPRIVATE: github.com/GoCodeAlone/*
+          GONOSUMCHECK: github.com/GoCodeAlone/*

internal/plugin.go

@@ -1,5 +1,9 @@
 // Package internal implements the workflow-plugin-cicd external plugin,
 // providing CI/CD pipeline step types and the aws.codebuild module type.
+// Module schemas are exposed via the SchemaProvider interface (gRPC) so the
+// host engine can validate module configuration at startup. Step schemas are
+// declared as stepSchemas entries in plugin.json so that tooling such as
+// wfctl can validate payloads at audit time without running the plugin binary.
 package internal
 
 import (
@@ -35,6 +39,26 @@ func (p *cicdPlugin) Manifest() sdk.PluginManifest {
 	}
 }
 
+// ModuleSchemas returns typed schema descriptors for each module type
+// this plugin provides. This implements sdk.SchemaProvider so that the
+// host engine can validate module config at startup and expose field
+// documentation via the editor / MCP server without running the plugin.
+func (p *cicdPlugin) ModuleSchemas() []sdk.ModuleSchemaData {
+	return []sdk.ModuleSchemaData{
+		{
+			Type:        "aws.codebuild",
+			Label:       "AWS CodeBuild",
+			Category:    "CI/CD",
+			Description: "AWS CodeBuild integration: manage projects, trigger builds, and poll build status using the AWS SDK.",
+			ConfigFields: []sdk.ConfigField{
+				{Name: "region", Type: "string", Description: "AWS region (e.g. us-east-1)", Required: false},
+				{Name: "role_arn", Type: "string", Description: "IAM role ARN to assume for CodeBuild API calls", Required: false},
+				{Name: "env_vars", Type: "map", Description: "Default environment variables injected into every build started by this module", Required: false},
+			},
+		},
+	}
+}
+
 // ModuleTypes returns the module type names this plugin provides.
 func (p *cicdPlugin) ModuleTypes() []string {
 	return []string{"aws.codebuild"}