From cbc50e012d2a68b1834ed5b83b0fba1935c740d2 Mon Sep 17 00:00:00 2001
From: Hendrik Brombeer <hendrikbrombeer@gmail.com>
Date: Sun, 12 Jul 2026 18:28:08 +0200
Subject: [PATCH] feat(ci): publish the plugin image to ghcr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

plugin-proxy has never shipped an artifact: no image, no maven release.
plugin-chat declares a hard Velocity dependency on it (and resolves
ProxyServiceRegistry from its classes at runtime), so neither can be
deployed until this one is pullable.

Add the standard docker-gradle-build-push workflow (edge on main, semver
on tag) and a Dockerfile carrying the shaded JAR at /jar/plugin.jar — the
shape the plugin-velocity-jar chart expects.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E92vTegZqXd2HqjE7jnDJz
---
 .../workflows/docker-gradle-build-push.yml    | 22 +++++++++
 Dockerfile                                    | 49 +++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 .github/workflows/docker-gradle-build-push.yml
 create mode 100644 Dockerfile

diff --git a/.github/workflows/docker-gradle-build-push.yml b/.github/workflows/docker-gradle-build-push.yml
new file mode 100644
index 0000000..98b9bb0
--- /dev/null
+++ b/.github/workflows/docker-gradle-build-push.yml
@@ -0,0 +1,22 @@
+name: Docker Build
+
+# Publishes ghcr.io/groundsgg/plugin-proxy (edge on main, semver on tag).
+# The image carries the shaded JAR at /jar/plugin.jar so the platform bundle
+# can pull the plugin into the velocity proxy via the plugin-velocity-jar chart.
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  pull_request:
+
+permissions:
+  packages: write
+  contents: write
+  actions: write
+
+jobs:
+  reusable:
+    uses: groundsgg/.github/.github/workflows/docker-gradle-build-push.yml@main
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..1a23bd6
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,49 @@
+# syntax=docker/dockerfile:1
+#
+# Builds the plugin-proxy Velocity-plugin JAR and packages it for the
+# platform-test environment. The output image carries the JAR at
+# /jar/plugin.jar — the shape the `plugin-velocity-jar` Helm chart expects
+# (oci://ghcr.io/groundsgg/charts/plugin-velocity-jar). Velocity proxy pods
+# in a per-engineer vCluster fetch this image's JAR via the chart's
+# init-container + httpd indirection.
+#
+# Pushed as `ghcr.io/groundsgg/plugin-proxy:edge` (main) / `:<semver>` (tag)
+# by .github/workflows/docker-gradle-build-push.yml.
+
+FROM eclipse-temurin:25-jdk AS build
+WORKDIR /src
+
+# GitHub Packages credentials for the gg.grounds.velocity convention plugin.
+# The token comes from the `github_token` build secret (never a build-arg —
+# that would leak it into the layer history).
+ARG GITHUB_USER
+
+# Copy gradle wrapper + root config first so dependency caches stay warm
+# across source-only changes.
+COPY gradle/ gradle/
+COPY gradlew settings.gradle.kts build.gradle.kts gradle.properties ./
+
+COPY api/ api/
+COPY velocity/ velocity/
+
+# `:velocity:build` produces the shaded plugin JAR (the api module and the
+# NATS client are bundled into it — the proxy plugin owns the
+# ProxyServiceRegistry that plugin-chat resolves at runtime).
+RUN --mount=type=secret,id=github_token,required=true \
+    /bin/sh -euc '\
+      : "${GITHUB_USER:?GITHUB_USER build arg is required}"; \
+      token="$(cat /run/secrets/github_token)"; \
+      ./gradlew --no-daemon :velocity:build \
+        -Pgithub.user="${GITHUB_USER}" \
+        -Pgithub.token="${token}" \
+    '
+
+RUN mkdir -p /out && \
+    cp "$(ls -S /src/velocity/build/libs/*.jar | head -n1)" /out/plugin.jar
+
+FROM alpine:3
+RUN mkdir -p /jar
+COPY --from=build /out/plugin.jar /jar/plugin.jar
+# No ENTRYPOINT — the plugin-velocity-jar chart's init-container `cp`s
+# /jar/plugin.jar out, then the chart's main container (busybox httpd)
+# serves the JAR. This image only carries data.