build: resolve shared plugin APIs from verified releases

.github/workflows/build.yml

@@ -21,10 +21,10 @@ jobs:
         with:
           distribution: temurin
           java-version: '25'
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
 
       - name: Prepare pinned dependencies
         env:
@@ -48,7 +48,10 @@ jobs:
       - uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.dev.outputs.name }}-${{ github.run_id }}-${{ github.run_attempt }}
-          path: ${{ steps.dev.outputs.jar }}
+          path: |
+            ${{ steps.dev.outputs.jar }}
+            .build/plugin-dependencies.json
+          include-hidden-files: true
           if-no-files-found: error
 
       - name: Upload unit test reports

.github/workflows/maven-release.yml

@@ -50,10 +50,10 @@ jobs:
           }
           [[ "${TAG^^}" != *SNAPSHOT* ]] || exit 1
 
-      - name: Install latest stable TLibs in Maven
-        uses: TF-Minecraft/TLibs/.github/actions/setup@5da8e77d0e0696bbff7d7064a2644072da9c6428
+      - name: Install shared plugin dependencies
+        uses: TF-Minecraft/TLibs/.github/actions/setup-plugins@7afa185bee605908a99ac55288ed27a3babbad62
         with:
-          version: latest
+          mode: latest
 
       - name: Prepare pinned dependencies
         env:
@@ -102,6 +102,7 @@ jobs:
               'commit': os.environ['GITHUB_SHA'],
               'tag': os.environ['TAG'],
               'run': f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ['GITHUB_RUN_ID']}",
+              'plugin_dependencies': json.loads(pathlib.Path('.build/plugin-dependencies.json').read_text()),
               'artifact': source.name,
               'sha256': digest,
           }, indent=2) + '\n')

.gitignore

@@ -34,3 +34,6 @@ Thumbs.db
 
 # Downloaded build dependencies
 /libs/*.jar
+
+# Resolved build dependency metadata
+.build/

README.md

@@ -20,3 +20,22 @@ Other declared build dependencies still need their usual preparation.
 Use JDK 25 for this TLibs binary; the server must also run Java 25.
 
 Builds and server runtime require Java 25. Local builds default to [TLibs 1.1.0](https://github.com/TF-Minecraft/TLibs/releases/tag/v1.1.0); CI resolves the latest published stable TLibs release for each build, verifies its checksum, and uses its exact version throughout that job.
+
+## Shared plugin dependencies
+
+Build and release workflows install checksum-verified plugin releases through
+[TLibs' shared installer](https://github.com/TF-Minecraft/TLibs/blob/main/DEPENDENCIES.md).
+CI selects the latest published versions; local builds use the explicit Maven
+version properties. Shared plugins use `provided` scope and remain separate
+server plugins. Each build records exact versions and checksums in
+`.build/plugin-dependencies.json` alongside its JAR.
+
+From this checkout, with the TLibs repository next to it:
+
+```sh
+python3 ../tlibs/tools/install-plugins.py --pom pom.xml
+```
+
+Prepare any remaining third-party inputs with `.github/scripts/prepare-release.sh`
+before running Maven. Any source-unavailable inputs remain private and checksum-pinned wherever declared; see the installer
+documentation for authentication and reproducible rebuilds.