Skip to content

docs: explain latest stable TLibs pipeline inputs #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanbarlow97 merged 1 commit into from
Sep 22, 2026
Merged

docs: explain latest stable TLibs pipeline inputs #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion PIPELINES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,11 @@ Plugins with file dependencies use `.github/scripts/prepare-release.sh` to downl

`DEPS_TOKEN` is an organisation Actions secret with Contents read access to ServerAssets. Grant the consuming repositories access to this one secret. A separate token for each repository is unnecessary. The workflow passes it only to dependency preparation steps. Fork pull requests do not receive Actions secrets and cannot run builds that require these private inputs.

TLibs consumers declare a checksum-pinned Maven `provided` dependency. Both build workflows run the [shared TLibs installer](https://github.com/TF-Minecraft/TLibs/blob/905a196217471252b96be5ecf8eeb16c9e85e41d/DEPENDENCIES.md), which verifies the selected binary and installs it in Maven's local cache. Local builds run `python3 ../tlibs/tools/install-dependency.py --pom pom.xml` before Maven verification.
TLibs consumers declare a Maven `provided` dependency. Both development and tagged-release workflows run the [shared TLibs installer](https://github.com/TF-Minecraft/TLibs/blob/5da8e77d0e0696bbff7d7064a2644072da9c6428/DEPENDENCIES.md) with `version: latest`. Each job resolves GitHub's latest published stable release once, verifies the versioned JAR's SHA-256, installs its real Maven version, and sets the checked-out POM's `tlibs.version` for that job. The installer logs and outputs the exact version and checksum. The action implementation remains pinned to a full commit SHA.

New TLibs releases become build inputs only after their draft is published as a stable release and marked latest. Prereleases and DEV artifacts are excluded. This does not deploy TLibs to a running server. A missing release, checksum, or failed download fails the build; no older-version fallback occurs in latest mode.

Local builds retain their explicit POM default: run `python3 ../tlibs/tools/install-dependency.py --pom pom.xml` before Maven verification. To opt into latest locally, add `--latest` (which edits the POM). For CI rollback or a reproducible rebuild, select `version: pinned` and set `tlibs.version` to a catalogued version.

ServerAssets' `manifest.json` is authoritative for filenames, hashes, embedded plugin versions, and sources. Keep licensed dependency JARs in that private repository and out of public release assets.

Expand Down
9 changes: 7 additions & 2 deletions projects/TLibs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,12 @@ python3 ../tlibs/tools/install-dependency.py --pom pom.xml
mvn clean verify
```

See the [installer and pinned-version guide](https://github.com/TF-Minecraft/TLibs/blob/v1.1.0/DEPENDENCIES.md)
See the [installer and pinned-version guide](https://github.com/TF-Minecraft/TLibs/blob/5da8e77d0e0696bbff7d7064a2644072da9c6428/DEPENDENCIES.md)
for source access, offline installation, Java requirements, CI and rollback.
All 26 TF-Minecraft consumers now pin **TLibs 1.1.0**, built from the latest source.
All 26 TF-Minecraft consumer pipelines select the **latest published stable TLibs release**
once per build and verify its checksum. Each job uses the resolved exact version
throughout compilation and packaging; drafts, prereleases and DEV artifacts are excluded.
Local POM defaults remain **TLibs 1.1.0**.
Both builds and server runtime require **Java 25**. Download the versioned
[TLibs-1.1.0.jar](https://github.com/TF-Minecraft/TLibs/releases/download/v1.1.0/TLibs-1.1.0.jar).
The installer uses the public release without a private dependency token. Older
Expand All @@ -25,3 +28,5 @@ TLibs remains a separate runtime plugin on the server.
## Builds and releases

See the [shared pipeline guide](../../PIPELINES.md) for development artifacts, release tags, and dependency access.

See [pipeline release selection](../../PIPELINES.md#build-dependencies) for promotion and rollback.