Add strict-contracts CI job, strengthen contract tests, add engine manifest validation

Agent-Logs-Url: https://github.com/GoCodeAlone/workflow-plugin-github/sessions/f07d93ad-41a2-4378-bba2-410c8ca11dc9

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -14,3 +14,35 @@ jobs:
           go-version-file: go.mod
       - run: go build ./...
       - run: go test ./... -v -race -count=1
+        env:
+          GOPRIVATE: github.com/GoCodeAlone/*
+          GONOSUMCHECK: github.com/GoCodeAlone/*
+
+  strict-contracts:
+    name: Validate strict plugin contracts
+    runs-on: [self-hosted, Linux, X64]
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - name: Verify plugin.json exists
+        run: |
+          test -f plugin.json || { echo "ERROR: plugin.json is missing — every release must include a strict contract manifest"; exit 1; }
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Run strict contract tests
+        run: |
+          go test ./internal/... -run "TestPluginStepSchemasJSON|TestPluginManifestEngineValidation|TestModuleSchemas" -v -count=1
+        env:
+          GOPRIVATE: github.com/GoCodeAlone/*
+          GONOSUMCHECK: github.com/GoCodeAlone/*
+      - name: Validate plugin.json with wfctl
+        run: |
+          # wfctl validates registry-format manifests; strict contract schema coverage is enforced
+          # by the Go tests above. This step runs informational validation and logs the result.
+          go run github.com/GoCodeAlone/workflow/cmd/wfctl@v0.3.56 plugin validate --file plugin.json 2>&1; wfctl_exit=$?
+          echo "wfctl validation exit code: ${wfctl_exit}"
+        env:
+          GOPRIVATE: github.com/GoCodeAlone/*
+          GONOSUMCHECK: github.com/GoCodeAlone/*

internal/schemas_test.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"os"
 	"testing"
+
+	"github.com/GoCodeAlone/workflow/plugin"
 )
 
 // TestModuleSchemas verifies that the plugin's SchemaProvider returns schema
@@ -77,7 +79,7 @@ func TestPluginStepSchemasJSON(t *testing.T) {
 	// Locate plugin.json relative to the repository root (one level up from internal/).
 	data, err := os.ReadFile("../plugin.json")
 	if err != nil {
-		t.Skipf("plugin.json not found (skipping in isolated test environments): %v", err)
+		t.Fatalf("plugin.json not found — every build must ship a contract manifest: %v", err)
 	}
 
 	var manifest struct {
@@ -110,3 +112,35 @@ func TestPluginStepSchemasJSON(t *testing.T) {
 			len(manifest.StepSchemas), len(manifest.StepTypes))
 	}
 }
+
+// TestPluginManifestEngineValidation verifies that plugin.json is parseable as a
+// workflow engine PluginManifest and that Validate() passes required-field checks.
+func TestPluginManifestEngineValidation(t *testing.T) {
+	m, err := plugin.LoadManifest("../plugin.json")
+	if err != nil {
+		t.Fatalf("plugin.LoadManifest: %v", err)
+	}
+	if err := m.Validate(); err != nil {
+		t.Fatalf("plugin.json fails engine manifest validation: %v", err)
+	}
+	// Strict contract requirements: must declare at least one module or step type.
+	if len(m.ModuleTypes) == 0 && len(m.StepTypes) == 0 {
+		t.Error("plugin.json: must advertise at least one moduleType or stepType for strict contracts")
+	}
+	// StepSchemas must be present when step types are declared.
+	if len(m.StepTypes) > 0 && len(m.StepSchemas) == 0 {
+		t.Error("plugin.json: stepSchemas is required when stepTypes are declared (missing_step_contract_descriptor)")
+	}
+	// Every step type must have a schema entry.
+	schemaSet := make(map[string]bool, len(m.StepSchemas))
+	for _, s := range m.StepSchemas {
+		if s != nil {
+			schemaSet[s.Type] = true
+		}
+	}
+	for _, st := range m.StepTypes {
+		if !schemaSet[st] {
+			t.Errorf("plugin.json: stepType %q has no stepSchema (missing_step_contract_descriptor)", st)
+		}
+	}
+}