feat(addons): native add-on manifest schema + validator + build-hygiene gates (#3425) #3463

Merged

mfreeman451 merged 2 commits from feat/native-addon-build-signing into staging 2026-05-31 05:19:01 +00:00

Conversation 1 Commits 2 Files changed 16 +1801 -4

mfreeman451 commented 2026-05-31 04:45:09 +00:00

Owner

Copy link

What

The validation & build-hygiene gates slice of add-native-addon-build-signing (#3425) — a single additive commit (37be0ebd1, +1796).

• Manifest JSON-Schema + Go validator (go/tools/addon-manifest-validator/): a from-scratch draft-2020-12 subset interpreter (type/required/enum/pattern/min-max/uniqueItems/additionalProperties/nested), driven by the embedded canonical schema (addons/native-addon-manifest.schema.json). CLI globs addons/*/addon.yaml and fails closed.
• Build-hygiene gates (scripts/check-addon-*.sh): no-stdlib-plugin, dependency-isolation (go list -deps over the agent), and a binary-size check; aggregated as make addon_build_gates.
• In-bundle manifest validation in build/native_addons/assemble_addon_bundle.py (deterministic zip + sha256 + per-arch metadata.json).

Verification

• go build + go test ./go/tools/addon-manifest-validator/... pass (5 test funcs incl. 7 targeted-violation subtests); go vet clean.

Scope / merge notes

• This is ~⅓ of the full add-native-addon-build-signing proposal (4/13 tasks): the validation/hygiene half. The publish/ingest half — Cosign signing, ed25519 upload-signature, discovery index, verify-before-release CI, and the Elixir control-plane importer — is not in this PR and remains to be built (it needs the Cosign + ed25519 CI secrets).
• The binary-size gate is a scaffold until a build/native_addons/binary-size-baseline.json is committed.
• Bottom of a stack: #3460 (feat/native-addon-rust-sdk) contains this commit. Merge this PR first; #3460's diff will then reduce to just its Rust-SDK commits.

🤖 Generated with Claude Code

## What The **validation & build-hygiene gates** slice of `add-native-addon-build-signing` (#3425) — a single additive commit (`37be0ebd1`, +1796). - **Manifest JSON-Schema + Go validator** (`go/tools/addon-manifest-validator/`): a from-scratch draft-2020-12 subset interpreter (type/required/enum/pattern/min-max/uniqueItems/additionalProperties/nested), driven by the embedded canonical schema (`addons/native-addon-manifest.schema.json`). CLI globs `addons/*/addon.yaml` and fails closed. - **Build-hygiene gates** (`scripts/check-addon-*.sh`): no-stdlib-plugin, dependency-isolation (`go list -deps` over the agent), and a binary-size check; aggregated as `make addon_build_gates`. - **In-bundle manifest validation** in `build/native_addons/assemble_addon_bundle.py` (deterministic zip + sha256 + per-arch `metadata.json`). ## Verification - `go build` + `go test ./go/tools/addon-manifest-validator/...` pass (5 test funcs incl. 7 targeted-violation subtests); `go vet` clean. ## Scope / merge notes - This is **~⅓ of the full `add-native-addon-build-signing` proposal** (4/13 tasks): the validation/hygiene half. The publish/ingest half — Cosign signing, ed25519 upload-signature, discovery index, verify-before-release CI, and the Elixir control-plane importer — is **not** in this PR and remains to be built (it needs the Cosign + ed25519 CI secrets). - The binary-size gate is a scaffold until a `build/native_addons/binary-size-baseline.json` is committed. - **Bottom of a stack:** #3460 (`feat/native-addon-rust-sdk`) contains this commit. **Merge this PR first**; #3460's diff will then reduce to just its Rust-SDK commits. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

mfreeman451 added 1 commit 2026-05-31 04:45:09 +00:00

feat(addons): native add-on manifest schema + validator and build-hygiene gates (#3425) ... 37be0ebd13

Implements the unblocked, secret-free slice of the add-native-addon-build-signing
OpenSpec change: manifest validation (tasks 1.1/1.2), the dependency-isolation gate
(3.2), and the forbid-stdlib-plugin + binary-size portions of the build-hygiene
gates (3.1). The Cosign/ed25519 signing, discovery-index, verify-before-release,
and control-plane importer tasks remain blocked on a keyed signing environment and
registry/object-store access and are intentionally NOT touched.

- addons/native-addon-manifest.schema.json: JSON-Schema 2020-12 for addon.yaml
  (id, name, version, kind, delivery, supervision, capabilities, requires,
  artifacts, exec, state_dirs, config_schema), formalized from the de-facto sample
  and fingerprintd manifests.
- go/tools/addon-manifest-validator: dependency-light Go validator (command +
  internal/manifestschema library, embedded schema) that fails closed on a manifest
  missing required fields or with an unknown kind/delivery/supervision value.
  Unit tests with valid + invalid fixtures and a schema-drift guard.
- build/native_addons/assemble_addon_bundle.py: validates the manifest before
  writing any bundle output, so raw `bazel build` also fails closed before bundling.
- scripts/check-addon-dependency-isolation.sh: go list -deps gate asserting the base
  serviceradar-agent's transitive package set excludes add-on implementation
  packages (go/pkg/addon/sdk, go/cmd/serviceradar-*-addon); allows the agent-side
  contract/manager packages. Fails with the offending import path.
- scripts/check-addon-no-stdlib-plugin.sh: forbids the Go stdlib `plugin` package in
  the agent + add-on builds (go list -deps + direct-import scan).
- scripts/check-addon-binary-size.sh: per-artifact size regression gate; go-size-
  analyzer/gsa is a CI-image prerequisite (REQUIRE_GSA=1 to fail closed if missing).
- Makefile: validate_addon_manifests, check_addon_dependency_isolation,
  check_addon_no_stdlib_plugin, check_addon_binary_size, addon_build_gates,
  build_native_addons targets.

Verified: validator passes the shipped manifests and fails closed on an invalid
fixture; both isolation gates pass on the clean tree and fail (with the offending
path) on an injected violating import; openspec validate --strict passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mfreeman451 referenced this pull request 2026-05-31 04:47:31 +00:00

feat(addon): Rust native add-on SDK + rust-sample reference (#3425) #3460

mfreeman451 reviewed 2026-05-31 05:01:26 +00:00

mfreeman451 left a comment

Copy link

lgtm

lgtm

mfreeman451 added 1 commit 2026-05-31 05:06:05 +00:00

fix(addons): satisfy lint-go gates in addon-manifest-validator (#3425) ... cf4b8ec33d

CI lint-go (golangci-lint) flagged the validator slice:
- err113: wrap a static sentinel (errNonStringMappingKey) instead of a dynamic
  fmt.Errorf for the non-string YAML mapping-key case.
- goprintffuncname: rename the printf-like Result.add -> Result.addf (+ call sites).
- errcheck: explicitly ignore fmt.Fprintf/Fprintln returns in main.go.

`golangci-lint run ./go/tools/addon-manifest-validator/...` -> 0 issues; package
tests pass; the validator still validates addons/*/addon.yaml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mfreeman451 merged commit 52799e98e9 into staging 2026-05-31 05:19:01 +00:00

mfreeman451 referenced this pull request from a commit 2026-05-31 05:19:02 +00:00

Merge pull request 'feat(addons): native add-on manifest schema + validator + build-hygiene gates (#3425)' (#3463) from feat/native-addon-build-signing into staging

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

1week

  

2weeks

  

Failed compliance check

  

IP cameras

  

NATS

NATS JetStream

  

Possible security concern

  

Review effort 1/5

  

Review effort 2/5

  

Review effort 3/5

  

Review effort 4/5

  

Review effort 5/5

  

UI

  

aardvark

  

accessibility

  

amd64

  

api

  

arm64

  

auth

  

back-end

  

bgp

  

blog

  

bug

Something isn't working

  

build

  

checkers

  

ci-cd

continuous integration-continuous deployments

  

cleanup

  

cnpg

cloud-native postgres

  

codex

  

core

core service

  

dependencies

Pull requests that update a dependency file

  

device-management

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

dusk

  

ebpf

  

enhancement

New feature or request

  

eta 1d

  

eta 1hr

  

eta 3d

  

eta 3hr

  

feature

  

fieldsurvey

  

github_actions

Pull requests that update GitHub Actions code

  

go

Pull requests that update Go code

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

javascript

Pull requests that update Javascript code

  

k8s

  

log-collector

  

mapper

  

mtr

multi traceroute

  

needs-triage

  

netflow

  

network-sweep

  

observability

  

oracle

Oracle Linux related issues

  

otel

opentelemetry logs, traces, metrics

  

plug-in

  

proton

timeplus proton streaming database

  

python

  

question

Further information is requested

  

reddit

  

redhat

  

research

  

rperf

  

rperf-checker

  

rust

Pull requests that update rust code

  

sdk

  

security

  

serviceradar-agent

  

serviceradar-agent-gateway

  

serviceradar-web

  

serviceradar-web-ng

  

siem

  

snmp

  

sysmon

  

topology

  

ubiquiti

  

wasm

  

wontfix

This will not be worked on

  

zen-engine

No labels

1week

2weeks

Failed compliance check

IP cameras

NATS

Possible security concern

Review effort 1/5

Review effort 2/5

Review effort 3/5

Review effort 4/5

Review effort 5/5

UI

aardvark

accessibility

amd64

api

arm64

auth

back-end

bgp

blog

bug

build

checkers

ci-cd

cleanup

cnpg

codex

core

dependencies

device-management

documentation

duplicate

dusk

ebpf

enhancement

eta 1d

eta 1hr

eta 3d

eta 3hr

feature

fieldsurvey

github_actions

go

good first issue

help wanted

invalid

javascript

k8s

log-collector

mapper

mtr

needs-triage

netflow

network-sweep

observability

oracle

otel

plug-in

proton

python

question

reddit

redhat

research

rperf

rperf-checker

rust

sdk

security

serviceradar-agent

serviceradar-agent-gateway

serviceradar-web

serviceradar-web-ng

siem

snmp

sysmon

topology

ubiquiti

wasm

wontfix

zen-engine

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

carverauto/serviceradar!3463

No description provided.