feat: adopt strict-contracts typed proto (closes #10) (#11)

* chore: bump workflow v0.3.56 → v0.51.7

Update minEngineVersion in plugin.json to 0.51.7.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat: adopt strict-contracts proto + ContractRegistry (closes #10)

- proto/github/v1/github.proto: typed messages for 3 module types (git.webhook, github.app, github.runner_provider) and 17 step types
- gen/github.pb.go: protoc-gen-go v1.36.11 generated bindings
- internal/contracts.go: ContractRegistry() on githubPlugin; 20 STRICT_PROTO contract descriptors (3 modules + 17 steps)
- internal/contracts_test.go: 4 passing tests (NonNil, AllModuleTypes, AllStepTypes, ContractCount)
- plugin.contracts.json: 20 strict_proto contract entries
- plugin.json: add contracts array with full workflow.plugin.github.v1.* type names
- go.mod: promote google.golang.org/protobuf v1.36.11 to direct dependency
- Makefile: add proto-gen target
- .goreleaser.yaml: include plugin.contracts.json and LICENSE in release archives
- .github/workflows/wfctl-validate.yml: strict-contracts CI gate

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: pass RELEASES_TOKEN to setup-wfctl for private module access

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: simplify ci.yml — remove stale strict-contracts job (superseded by wfctl-validate.yml)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: use latest wfctl instead of go.mod version (v0.51.7 has no binary asset)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: add downloads array to plugin.json (required by wfctl external plugin validation)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: assert against sdk.ContractProvider interface directly

Replace anonymous interface assertion with typed sdk.ContractProvider so any
future SDK interface additions are caught at compile time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: intel352

.github/workflows/ci.yml

@@ -10,44 +10,17 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+      - name: Configure git for private modules
+        run: git config --global url."https://${{ secrets.RELEASES_TOKEN }}@github.com/".insteadOf "https://github.com/"
       - run: go build ./...
-      - run: go test ./... -v -race -count=1
         env:
           GOPRIVATE: github.com/GoCodeAlone/*
           GONOSUMCHECK: github.com/GoCodeAlone/*
-
-  strict-contracts:
-    name: Validate strict plugin contracts
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-      - name: Verify plugin.json exists
-        run: |
-          test -f plugin.json || { echo "ERROR: plugin.json is missing — every release must include a strict contract manifest"; exit 1; }
-      - uses: actions/setup-go@v6
-        with:
-          go-version-file: go.mod
-      - name: Run strict contract tests
-        run: |
-          go test ./internal/... -run "TestPluginStepSchemasJSON|TestPluginManifestEngineValidation|TestModuleSchemas" -v -count=1
-        env:
-          GOPRIVATE: github.com/GoCodeAlone/*
-          GONOSUMCHECK: github.com/GoCodeAlone/*
-      - name: Validate plugin.json with wfctl
-        run: |
-          # wfctl validates registry-format manifests; strict contract schema coverage is enforced
-          # by the Go tests above. This step runs informational validation and logs the result.
-          set +e
-          go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.3.56 plugin validate --file plugin.json 2>&1
-          wfctl_exit=$?
-          set -e
-          echo "wfctl validation exit code: ${wfctl_exit}"
+      - run: go test ./... -v -race -count=1
         env:
           GOPRIVATE: github.com/GoCodeAlone/*
           GONOSUMCHECK: github.com/GoCodeAlone/*

.github/workflows/wfctl-validate.yml

@@ -0,0 +1,34 @@
+# .github/workflows/wfctl-validate.yml
+name: wfctl strict contracts
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+jobs:
+  wfctl-strict-contracts:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check plugin.json and plugin.contracts.json exist
+        run: |
+          if [ ! -f plugin.json ]; then
+            echo "::error::plugin.json is missing — add a plugin manifest to enable strict contract validation"
+            exit 1
+          fi
+          if [ ! -f plugin.contracts.json ]; then
+            echo "::error::plugin.contracts.json is missing — add a contracts file to pass strict contract validation"
+            exit 1
+          fi
+
+      - uses: GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956
+        with:
+          version: latest
+          token: ${{ secrets.RELEASES_TOKEN }}
+
+      - name: Validate strict plugin contracts
+        run: wfctl plugin validate --file plugin.json --strict-contracts

.goreleaser.yaml

@@ -45,6 +45,8 @@ archives:
     name_template: "{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}"
     files:
       - plugin.json
+      - plugin.contracts.json
+      - LICENSE
 
 checksum:
   name_template: "checksums.txt"

Makefile

@@ -1,4 +1,15 @@
-.PHONY: build test install clean
+.PHONY: build test install clean proto-gen
+
+# Regenerate Go bindings from proto/github/v1/github.proto.
+# Requires: protoc + protoc-gen-go
+#   brew install protobuf
+#   go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+proto-gen:
+	protoc \
+		--proto_path=proto/github/v1 \
+		--go_out=gen \
+		--go_opt=paths=source_relative \
+		proto/github/v1/github.proto
 
 BINARY_NAME = workflow-plugin-github
 PROVIDER_BINARY_NAME = github-runner-provider