build: resolve shared plugin APIs from verified releases

.github/dependencies.sha256

@@ -1,6 +1,3 @@
 b7156eab567772f9fdac0bf696b209111790c3f69149ab9a742e3dd030ec4b10  libs/spigot-api.jar
 ee2e7ab9b5386f2d103081c4d108e61b1035df2ca692b53d6e2409fb1f5caccf  libs/ProtocolLib.jar
 0116d714822b6f0cfebfe833a5df2e4754797b637d0fe709afb762c56da463a3  libs/ItemsAdder_3.5.0-r2.jar
-22dd8755e769823585340354c567cd6c3d07ddb6410747ce8f27bb97d3475b04  libs/denareconomy-0.1.8.jar
-0fedc530aaa9cd9e0a452d0bde95fb9fa0ecc31564ec625e3a0e2cef57c0aec8  libs/rpcharacters-1.1.7.jar
-5185b9e0ea8653ab61da07304f1573c6a9a5af97cf55a5d970c5a25f16bc743d  libs/simplefactions-2.8.7.jar

.github/scripts/prepare-release.sh

@@ -6,7 +6,4 @@ mkdir -p libs
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/b7156eab5677/spigot-api.jar?ref=$ref" > "libs/spigot-api.jar"
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/runtime/plugins/ProtocolLib.jar?ref=$ref" > "libs/ProtocolLib.jar"
 curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0116d714822b/ItemsAdder_3.5.0-r2.jar?ref=$ref" > "libs/ItemsAdder_3.5.0-r2.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/22dd8755e769/denareconomy-0.1.8.jar?ref=$ref" > "libs/denareconomy-0.1.8.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0fedc530aaa9/rpcharacters-1.1.7.jar?ref=$ref" > "libs/rpcharacters-1.1.7.jar"
-curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/5185b9e0ea86/simplefactions-2.8.7.jar?ref=$ref" > "libs/simplefactions-2.8.7.jar"
 sha256sum --check .github/dependencies.sha256

.github/workflows/build.yml

@@ -21,10 +21,10 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
 
       - name: Prepare pinned dependencies
         env:
@@ -48,7 +48,10 @@ jobs:
       - uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.dev.outputs.name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ steps.dev.outputs.jar }}
+          path: |
+            ${{ steps.dev.outputs.jar }}
+            .build/plugin-dependencies.json
+          include-hidden-files: true
           if-no-files-found: error
 
       - name: Upload unit test reports

.github/workflows/maven-release.yml

@@ -50,10 +50,10 @@ jobs:
           }
           [[ "${TAG^^}" != *SNAPSHOT* ]] || exit 1
 
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
 
       - name: Prepare pinned dependencies
         env:
@@ -102,6 +102,7 @@ jobs:
               'commit': os.environ['GITHUB_SHA'],
               'tag': os.environ['TAG'],
               'run': f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}",
+              'plugin_dependencies': json.loads(pathlib.Path('.build/plugin-dependencies.json').read_text()),
               'artifact': source.name,
               'sha256': digest,
           }, indent=2) + '\n')

.gitignore

@@ -34,3 +34,6 @@ Thumbs.db
 
 # Downloaded build dependencies
 /libs/*.jar
+
+# Resolved build dependency metadata
+.build/

README.md

@@ -20,3 +20,22 @@ Other declared build dependencies still need their usual preparation.
 Use JDK 25 for this TLibs binary; the server must also run Java 25.
 
 Builds and server runtime require Java 25. Local builds default to [TLibs 1.1.0](https://github.com/TF-Minecraft/TLibs/releases/tag/v1.1.0); CI resolves the latest published stable TLibs release for each build, verifies its checksum, and uses its exact version throughout that job.
+
+## Shared plugin dependencies
+
+Build and release workflows install checksum-verified plugin releases through
+[TLibs' shared installer](https://github.com/TF-Minecraft/TLibs/blob/main/DEPENDENCIES.md).
+CI selects the latest published versions; local builds use the explicit Maven
+version properties. Shared plugins use `provided` scope and remain separate
+server plugins. Each build records exact versions and checksums in
+`.build/plugin-dependencies.json` alongside its JAR.
+
+From this checkout, with the TLibs repository next to it:
+
+```sh
+python3 ../tlibs/tools/install-plugins.py --pom pom.xml
+```
+
+Prepare any remaining third-party inputs with `.github/scripts/prepare-release.sh`
+before running Maven. Any source-unavailable inputs remain private and checksum-pinned wherever declared; see the installer
+documentation for authentication and reproducible rebuilds.

pom.xml

@@ -9,6 +9,9 @@
     <version>0.1.1</version>
 
     <properties>
+        <simplefactions.version>2.8.7</simplefactions.version>
+        <rpcharacters.version>1.1.7</rpcharacters.version>
+        <denareconomy.version>0.1.9</denareconomy.version>
         <tlibs.version>1.1.0</tlibs.version>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
@@ -48,25 +51,31 @@
             <systemPath>${project.basedir}/libs/ItemsAdder_3.5.0-r2.jar</systemPath>
         </dependency>
         <dependency>
-            <groupId>local</groupId>
-            <artifactId>DenarEconomy</artifactId>
-            <version>0.1.8</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/denareconomy-0.1.8.jar</systemPath>
+            <groupId>net.tfminecraft</groupId>
+            <artifactId>denareconomy</artifactId>
+            <version>${denareconomy.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
         <dependency>
-            <groupId>local</groupId>
-            <artifactId>RPCharacters</artifactId>
-            <version>1.1.7</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/rpcharacters-1.1.7.jar</systemPath>
+            <groupId>net.tfminecraft</groupId>
+            <artifactId>rpcharacters</artifactId>
+            <version>${rpcharacters.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
         <dependency>
-            <groupId>local</groupId>
+            <groupId>net.tfminecraft</groupId>
             <artifactId>simplefactions</artifactId>
-            <version>2.8.7</version>
-            <scope>system</scope>
-            <systemPath>${project.basedir}/libs/simplefactions-2.8.7.jar</systemPath>
+            <version>${simplefactions.version}</version>
+            <scope>provided</scope>
+            <exclusions>
+                <exclusion><groupId>*</groupId><artifactId>*</artifactId></exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.google.code.gson</groupId>