scala-cli-sbt-plugin

POC: an sbt 1.x plugin built with scala-cli, with scripted tests driven by just + a small scala-cli script.

Layout

• plugin/ — the sbt plugin source (Scala 2.12, scala-cli). Publishes to Maven Central as org.polyvariant:scala-cli-sbt-plugin-poc_2.12_1.0.
• plugin/resources/sbt/sbt.autoplugins — required so sbt 1.x discovers the AutoPlugin (this file is normally generated by sbt's compiler plugin).
• sbt-test/<group>/<name>/ — sbt scripted tests.
• build/scripted.scala — minimal driver that calls sbt.scriptedtest.ScriptedRunner from org.scala-sbt::scripted-sbt-redux. All the surrounding plumbing (publishing locally, fetching sbt-launch, writing repo.config) lives in justfile.
• justfile — scripted, scripted-released, publish targets.

Run scripted tests locally

just                           # alias for `just scripted`
just scripted simple/basic
PLUGIN_VERSION=1.2.3 just scripted
just scripted-released         # uses PLUGIN_VERSION; expects artifact on Central

just scripted publishes the plugin via scala-cli publish --ivy2-local-like into a scratch staging dir, then post-processes the result into a scratch ivy home (<work>/ivy/local/<org>/<name>/scala_2.12/sbt_1.0/<rev>/) — the sbt-plugin Ivy layout. ivy.xml gets patched to add the e:scalaVersion/e:sbtVersion cross-attributes (which scala-cli doesn't emit), and checksums are regenerated. The spawned sbt picks the plugin up through its default local resolver against the scratch ivy home — no repo.config involved.

For just scripted-released, sbt-test/.../project/plugins.sbt reads plugin.snapshots=true to register the Central snapshots resolver when verifying a -SNAPSHOT version.

Publish to Maven Central

just publish --signer gpg --gpg-key <KEY_ID>

Versioning

Plugin.scala uses //> using publish.computeVersion git:dynver:

• On a v* tag → the tag (e.g. v0.1.0 → 0.1.0).
• On any other commit → <lastTag>+<n>-<sha>-SNAPSHOT (e.g. 0.1.0+3-abc1234-SNAPSHOT).

scala-cli routes -SNAPSHOT versions to the Central snapshots host automatically. The publish target passes --workspace . so git:dynver finds the repo (the plugin/ subdirectory has no .git).

CI pipeline (.github/workflows/ci.yml)

Three jobs, chained via needs::

1. test — runs on every push and PR. just scripted.
2. publish — runs on main pushes and v* tags, after test passes. Imports the GPG key from PGP_SECRET, configures Sonatype credentials, and runs just publish --signer gpg --gpg-key DB33C5B9DA1A245B. On main this produces a -SNAPSHOT artifact; on a v* tag, a release.
3. verify-release — runs after publish on both main and v* tags. Reads the version from a publish job output (computed via a dummy scala-cli publish --dummy), polls the appropriate Central host (snapshots vs releases) until the artifact is reachable (up to ~15 minutes), then just scripted-released resolves it from Central rather than the scratch repo.

Required secrets: PGP_SECRET, SONATYPE_USERNAME, SONATYPE_PASSWORD.