build: resolve shared plugin APIs from verified releases

.github/dependencies.sha256

@@ -1,16 +1,4 @@
 27e9906f137702e681af9a9cb913f65fb267e8d84aa14141546a7c97a2ce234d  libs/VotingPlugin-7.0.jar
-aaf20bbeba7963cec543ba1206ca0b1c6304efaa4607f3cb85e6602caa4d2319  libs/musicalinstruments-2.5.jar
-ff96d058ed6d6aa6c147d8c16c0364581806ac5acee36873658a189a88242e96  libs/geiger_counter-1.1.3.jar
 14850d7454374d7312305d3e84a391be720301e5964963f869b27ae97f6264eb  libs/MMOCore-1.13.1.jar
 8ff714bd3f486de26e9869462d4696eece5958287ce75a013cb30eb6bebd5e88  libs/MMOItems-6.10.1.jar
 a3f86a50d38296dd0a91d375f0a9433192e6e8d3e9dcae2751c801e67d24d9cd  libs/MythicLib-dist-1.7.1.jar
-499239027c78b337d1da48dd1f0f07786164b8d59dcaa506602114bc9cbaca88  libs/vfbuilders-1.0.0.jar
-791bc29301b4250a0f7ef3053a1999ace7e2ff0ddae8e79ff52bef0fee8034ed  libs/vehicleframework-1.1.12.jar
-0fedc530aaa9cd9e0a452d0bde95fb9fa0ecc31564ec625e3a0e2cef57c0aec8  libs/rpcharacters-1.1.7.jar
-0b077b2d56e918cc6a8b4662a0b6ad8dc5c3cc11f6a2fe93acb7a25bdf3cb524  libs/interactiblefurniture-0.1.3-BETA.jar
-5185b9e0ea8653ab61da07304f1573c6a9a5af97cf55a5d970c5a25f16bc743d  libs/simplefactions-2.8.7.jar
-64ea06ea92bf22785e6d541dd1b5f550edcdc4610d7a9748a91d715876ac079d  libs/advancedcrafting-1.2.1.jar
-e805d125cc6da3e76999f4658ad520c738715173f3d6a2d61ff638c5887dc338  libs/archeology-plugin-1.0.1.jar
-f04892ad7d077634d57a0115526cff11664ff04b251ceb9cfd0355cdd04fce7a  libs/marketblock-0.0.2.jar
-8b862b768e5c0be1a07fd31edf6d746af353af820720cea35552485cb4688e54  libs/games-0.1.1.jar
-c2b208566fb67db465caaaefdab09a2bbdcbb1261307c1c9d701c3f8a9eda2cc  libs/cooking-0.1.5-ALPHA.jar

.github/scripts/prepare-release.sh

@@ -4,19 +4,7 @@ set -euo pipefail
 ref=6a368f76c89e856fa73299d17e2a40c5a1e2f20a
 mkdir -p libs
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/27e9906f1377/VotingPlugin-7.0.jar?ref=$ref" > "libs/VotingPlugin-7.0.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/aaf20bbeba79/musicalinstruments-2.5.jar?ref=$ref" > "libs/musicalinstruments-2.5.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/ff96d058ed6d/geiger_counter-1.1.3.jar?ref=$ref" > "libs/geiger_counter-1.1.3.jar"
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/14850d745437/MMOCore-1.13.1.jar?ref=$ref" > "libs/MMOCore-1.13.1.jar"
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/8ff714bd3f48/MMOItems-6.10.1-20250521.175300-22.jar?ref=$ref" > "libs/MMOItems-6.10.1.jar"
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/a3f86a50d382/MythicLib-dist-1.7.1.jar?ref=$ref" > "libs/MythicLib-dist-1.7.1.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/499239027c78/vfbuilders-1.0.0.jar?ref=$ref" > "libs/vfbuilders-1.0.0.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/791bc29301b4/vehicleframework-1.1.12.jar?ref=$ref" > "libs/vehicleframework-1.1.12.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0fedc530aaa9/rpcharacters-1.1.7.jar?ref=$ref" > "libs/rpcharacters-1.1.7.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0b077b2d56e9/interactiblefurniture-0.1.3-BETA.jar?ref=$ref" > "libs/interactiblefurniture-0.1.3-BETA.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/5185b9e0ea86/simplefactions-2.8.7.jar?ref=$ref" > "libs/simplefactions-2.8.7.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/64ea06ea92bf/advancedcrafting-1.2.1.jar?ref=$ref" > "libs/advancedcrafting-1.2.1.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/e805d125cc6d/archeology-plugin-1.0.1.jar?ref=$ref" > "libs/archeology-plugin-1.0.1.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/f04892ad7d07/marketblock-0.0.2.jar?ref=$ref" > "libs/marketblock-0.0.2.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/8b862b768e5c/games-0.1.1.jar?ref=$ref" > "libs/games-0.1.1.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/c2b208566fb6/cooking-0.1.5-ALPHA.jar?ref=$ref" > "libs/cooking-0.1.5-ALPHA.jar"
 sha256sum --check .github/dependencies.sha256

.github/workflows/build.yml

@@ -21,10 +21,11 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
+          private-token: ${{ secrets.DEPS_TOKEN }}
 
       - name: Prepare pinned dependencies
         env:
@@ -48,7 +49,10 @@ jobs:
       - uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.dev.outputs.name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ steps.dev.outputs.jar }}
+          path: |
+            ${{ steps.dev.outputs.jar }}
+            .build/plugin-dependencies.json
+          include-hidden-files: true
           if-no-files-found: error
 
       - name: Upload unit test reports

.github/workflows/maven-release.yml

@@ -50,10 +50,11 @@ jobs:
           }
           [[ "${TAG^^}" != *SNAPSHOT* ]] || exit 1
 
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
+          private-token: ${{ secrets.DEPS_TOKEN }}
 
       - name: Prepare pinned dependencies
         env:
@@ -102,6 +103,7 @@ jobs:
               'commit': os.environ['GITHUB_SHA'],
               'tag': os.environ['TAG'],
               'run': f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}",
+              'plugin_dependencies': json.loads(pathlib.Path('.build/plugin-dependencies.json').read_text()),
               'artifact': source.name,
               'sha256': digest,
           }, indent=2) + '\n')

.gitignore

@@ -8,3 +8,6 @@ CLAUDE.md
 
 # Downloaded build dependencies
 /libs/*.jar
+
+# Resolved build dependency metadata
+.build/

README.md

@@ -29,3 +29,22 @@ Other compile-time plugin APIs are fetched from a pinned private ServerAssets co
 upgrade, including VehicleFramework 1.1.12, AdvancedCrafting 1.2.1 and full
 Cooking/Games JARs for their compile-time APIs. TLibs still downloads separately
 from its public versioned release.
+
+## Shared plugin dependencies
+
+Build and release workflows install checksum-verified plugin releases through
+[TLibs' shared installer](https://github.com/TF-Minecraft/TLibs/blob/main/DEPENDENCIES.md).
+CI selects the latest published versions; local builds use the explicit Maven
+version properties. Shared plugins use `provided` scope and remain separate
+server plugins. Each build records exact versions and checksums in
+`.build/plugin-dependencies.json` alongside its JAR.
+
+From this checkout, with the TLibs repository next to it:
+
+```sh
+python3 ../tlibs/tools/install-plugins.py --pom pom.xml
+```
+
+Prepare any remaining third-party inputs with `.github/scripts/prepare-release.sh`
+before running Maven. Any source-unavailable inputs remain private and checksum-pinned wherever declared; see the installer
+documentation for authentication and reproducible rebuilds.

pom.xml

@@ -12,6 +12,18 @@
     <url>tfminecraft.net</url>
 
     <properties>
+        <cooking.version>0.1.5-ALPHA</cooking.version>
+        <games.version>0.1.1</games.version>
+        <marketblock.version>0.0.2</marketblock.version>
+        <archeology-plugin.version>1.0.1</archeology-plugin.version>
+        <advancedcrafting.version>1.2.2</advancedcrafting.version>
+        <simplefactions.version>2.8.7</simplefactions.version>
+        <interactiblefurniture.version>0.1.3-BETA</interactiblefurniture.version>
+        <rpcharacters.version>1.1.7</rpcharacters.version>
+        <vehicleframework.version>1.1.12</vehicleframework.version>
+        <vfbuilders.version>1.0.0</vfbuilders.version>
+        <geiger_counter.version>1.1.3</geiger_counter.version>
+        <musicalinstruments.version>2.5</musicalinstruments.version>
         <tlibs.version>1.1.0</tlibs.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.source>21</maven.compiler.source>
@@ -55,22 +67,26 @@
             <systemPath>${project.basedir}/libs/VotingPlugin-7.0.jar</systemPath>
         </dependency>
 
-        <!-- MusicalInstruments: jar-only release, compiled against for InstrumentPlayEvent -->
+        <!-- MusicalInstruments: provided plugin API, compiled against for InstrumentPlayEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>tfmc.justin</groupId>
             <artifactId>musicalinstruments</artifactId>
-            <version>2.5</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/musicalinstruments-2.5.jar</systemPath>
+            <version>${musicalinstruments.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
-        <!-- geiger_counter: jar-only release, compiled against for GeigerSourceCollectEvent -->
+        <!-- geiger_counter: provided plugin API, compiled against for GeigerSourceCollectEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>geiger_counter</artifactId>
-            <version>1.1.3</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/geiger_counter-1.1.3.jar</systemPath>
+            <version>${geiger_counter.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- MMOCore: jar-only release, compiled against for PlayerExperienceGainEvent -->
@@ -103,23 +119,27 @@
             <systemPath>${project.basedir}/libs/MythicLib-dist-1.7.1.jar</systemPath>
         </dependency>
 
-        <!-- VFBuilders: jar-only release, compiled against for VehicleConstructEvent -->
+        <!-- VFBuilders: provided plugin API, compiled against for VehicleConstructEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>vfbuilders</artifactId>
-            <version>1.0.0</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/vfbuilders-1.0.0.jar</systemPath>
+            <version>${vfbuilders.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- VehicleFramework: VFBuilders' own hard dependency, on the classpath
              so javac can resolve VehicleConstructEvent's ActiveVehicle field -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>vehicleframework</artifactId>
-            <version>1.1.12</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/vehicleframework-1.1.12.jar</systemPath>
+            <version>${vehicleframework.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- TLibs: shared by every tfminecraft plugin below, needed on the
@@ -135,77 +155,93 @@
             </exclusions>
         </dependency>
 
-        <!-- RPCharacters: jar-only release, compiled against for CharacterChatEvent -->
+        <!-- RPCharacters: provided plugin API, compiled against for CharacterChatEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>rpcharacters</artifactId>
-            <version>1.1.7</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/rpcharacters-1.1.7.jar</systemPath>
+            <version>${rpcharacters.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
-        <!-- InteractibleFurniture: jar-only release, compiled against for FurniturePlaceEvent -->
+        <!-- InteractibleFurniture: provided plugin API, compiled against for FurniturePlaceEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>interactiblefurniture</artifactId>
-            <version>0.1.3-BETA</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/interactiblefurniture-0.1.3-BETA.jar</systemPath>
+            <version>${interactiblefurniture.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
-        <!-- SimpleFactions: jar-only release, compiled against for BattleEndedEvent -->
+        <!-- SimpleFactions: provided plugin API, compiled against for BattleEndedEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>simplefactions</artifactId>
-            <version>2.8.7</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/simplefactions-2.8.7.jar</systemPath>
+            <version>${simplefactions.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
-        <!-- AdvancedCrafting: jar-only release, compiled against for
+        <!-- AdvancedCrafting: provided plugin API, compiled against for
              ItemCraftedEvent and AlloyCraftedEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>advancedcrafting</artifactId>
-            <version>1.2.1</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/advancedcrafting-1.2.1.jar</systemPath>
+            <version>${advancedcrafting.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- Archaeo: jar-only release, compiled against for FindRecoveredEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>com.nowko</groupId>
             <artifactId>archeology-plugin</artifactId>
-            <version>1.0.1</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/archeology-plugin-1.0.1.jar</systemPath>
+            <version>${archeology-plugin.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
-        <!-- MarketBlock: jar-only release, compiled against for MarketSaleEvent -->
+        <!-- MarketBlock: provided plugin API, compiled against for MarketSaleEvent -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>marketblock</artifactId>
-            <version>0.0.2</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/marketblock-0.0.2.jar</systemPath>
+            <version>${marketblock.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- Games: compile-time API from the verified full plugin JAR -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>games</artifactId>
-            <version>0.1.1</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/games-0.1.1.jar</systemPath>
+            <version>${games.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- Cooking: compile-time API from the verified full plugin JAR -->
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>cooking</artifactId>
-            <version>0.1.5-ALPHA</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/cooking-0.1.5-ALPHA.jar</systemPath>
+            <version>${cooking.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
 
         <!-- Tests -->