Layer 3b — ldflag/sdk.WithBuildVersion sweep across all plugin repos

[intel352]

Scope

Mass-sweep all GoCodeAlone plugin repos (~80 candidate; audit will narrow) to wire workflow#762's plugin-version contract end-to-end:

• internal.Version = "0.0.0" sentinel
• sdk.ResolveBuildVersion(internal.Version) resolution
• sdk.Serve(plugin, sdk.WithBuildVersion(...)) OR sdk.ServeIaCPlugin(server, sdk.IaCServeOptions{BuildVersion: ...})
• goreleaser ldflag: -X .../internal.Version={{.Version}}
• plugin.json.version = "0.0.0" (sentinel; goreleaser before-hook rewrites at tag time)
• release.yml runs wfctl plugin validate-contract --for-publish pre+post build

Inheritance

• Per workflow#762 close: SDK helpers, registry-sync, validate-contract, type allowlist all SHIPPED in workflow v0.62.0.
• This issue tracks the consumer-side rollout — fanout one PR per plugin repo.

Tasks

• Audit phase: enumerate plugin repos missing each of the 6 contract pieces above
• File per-repo PRs in parallel waves (group: has-release-pipeline vs needs-bootstrap)
• Each PR exercises wfctl plugin validate-contract --for-publish --tag vX.Y.Z
• Re-audit after sweep to confirm zero drift

Related

• workflow#762 (parent contract; SHIPPED)
• workflow#758 (closed; absorbed by Migrate sync-versions.sh → wfctl registry sync subcommand (consolidates Layer 3b + deferred I3 capability gate) #762)

[intel352]

Layer 3b sweep COMPLETE 2026-05-24

70 PRs merged across 64 plugin repos (some repos got 2 PRs — sweep + ldflag follow-up).

Bucket breakdown

Bucket	Count	Pattern	Status
D	5	sentinel "dev"→"0.0.0" only (pilot IaC plugins)	✓
A	41	wire sdk.WithBuildVersion + validate-contract gate + workflow v0.62.0 bump	✓
B	5	A + add goreleaser ldflag	✓
C	10	A + add internal/version.go (was missing)	✓
E	3	A + bootstrap release.yml + .goreleaser.yaml from scratch	✓
F follow-up	6	add internal.Version ldflag to goreleaser (gap caught by re-audit)	✓
Total	70

Exempt repos

• workflow-plugin-agent — built-in library (no plugin contract)
• workflow-plugin-messaging-core — library only

Known deferred follow-up

• workflow-plugin-cloudflare BuildVersion wiring: cloudflare uses custom goplugin.Serve impl in internal/serve.go instead of sdk.ServeIaCPlugin. Wiring BuildVersion through that custom path is a separate refactor — defer or migrate to sdk.ServeIaCPlugin first.

Steady-state observation

49 of 66 repos have plugin.json.version reflecting their last published tag (not the "0.0.0" sentinel). This is expected: scaffold/new repos sit at sentinel; established plugins carry their release version. Goreleaser's before: hook rewrites plugin.json in the tarball at release time; wfctl plugin registry-sync keeps the source-tree plugin.json in sync after release.

Closing #764.