1.8 KiB
IntelliJ plugin native standard
The plugin is a real resource-only product, not a no-CI exemption. Its native
profile is intellij-plugin, with an orb-owned reusable worker and canonical
auxiliary bridge at .github/workflows/build.yml. Generate using
generate_auxiliary_workflow.py intellij-plugin --ref IMMUTABLE_ORB_SHA.
PRs and main/develop/tag pushes use Linux/JDK17 and the committed Gradle wrapper
(Gradle8.6 in audited source) to run check buildPlugin. Distribution ZIPs and
reports are retained. There are no authored source tests in the audited product;
this validates its actual Gradle packaging lifecycle without inventing app code.
No consumer build.gradle.kts semantics are changed.
Publication remains opt-in manual: select vVERSION, set publish=true and the
exact source version, then approve the intellij-marketplace environment. The
worker requires successful same-source build, exact source version/tag/HEAD and
remote tag identity, serializes publication, requires all four existing secret
interfaces, then executes signPlugin publishPlugin. Secrets CERTIFICATE_CHAIN,
PRIVATE_KEY, PRIVATE_KEY_PASSWORD and PUBLISH_TOKEN are passed only into that
step. Ordinary builds and PRs never publish. The caller and worker need only
contents:read; Marketplace authorization remains the existing token contract.
Root must configure/verify environment protection and existing secret availability, run the hosted build canary, and verify signed Marketplace release separately. No credentials, consumer migration or publication have been performed here. Version1.1.0 is already documented historically: do not republish it merely to test automation. The vVERSION convention is the explicit new guarded CI release contract, not a claim about historical tags. No GitHub release is synthesized.