ci(publish): route production through Platform

.github/workflows/publish-cindy-plugins-global.yml

@@ -146,6 +146,7 @@ jobs:
       id-token: write
     strategy:
       fail-fast: false
+      max-parallel: 2
       matrix:
         plugin: ${{ fromJSON(needs.detect.outputs.plugins) }}
     steps:
@@ -162,10 +163,10 @@ jobs:
 
       - name: Publish plugin
         env:
-          CINDY_PLUGIN_SERVER_URL_GLOBAL: ${{ secrets.CINDY_PLUGIN_SERVER_URL_GLOBAL }}
+          CINDY_PLUGIN_PLATFORM_URL_GLOBAL: ${{ secrets.CINDY_PLUGIN_PLATFORM_URL_GLOBAL }}
         run: |
           set -euo pipefail
-          : "${CINDY_PLUGIN_SERVER_URL_GLOBAL:?CINDY_PLUGIN_SERVER_URL_GLOBAL is not configured}"
+          : "${CINDY_PLUGIN_PLATFORM_URL_GLOBAL:?CINDY_PLUGIN_PLATFORM_URL_GLOBAL is not configured}"
 
           oidc_response="$(curl \
             --fail-with-body \
@@ -188,5 +189,5 @@ jobs:
             --header "Authorization: Bearer ${oidc_token}" \
             --header "Content-Type: application/octet-stream" \
             --data-binary "@$RUNNER_TEMP/plugin.cindy" \
-            "${CINDY_PLUGIN_SERVER_URL_GLOBAL%/}"
+            "${CINDY_PLUGIN_PLATFORM_URL_GLOBAL%/}"
           echo

.github/workflows/publish-cindy-plugins.yml

@@ -146,6 +146,7 @@ jobs:
       id-token: write
     strategy:
       fail-fast: false
+      max-parallel: 2
       matrix:
         plugin: ${{ fromJSON(needs.detect.outputs.plugins) }}
     steps:
@@ -162,10 +163,10 @@ jobs:
 
       - name: Publish plugin
         env:
-          CINDY_PLUGIN_SERVER_URL_CN: ${{ secrets.CINDY_PLUGIN_SERVER_URL_CN }}
+          CINDY_PLUGIN_PLATFORM_URL_CN: ${{ secrets.CINDY_PLUGIN_PLATFORM_URL_CN }}
         run: |
           set -euo pipefail
-          : "${CINDY_PLUGIN_SERVER_URL_CN:?CINDY_PLUGIN_SERVER_URL_CN is not configured}"
+          : "${CINDY_PLUGIN_PLATFORM_URL_CN:?CINDY_PLUGIN_PLATFORM_URL_CN is not configured}"
 
           oidc_response="$(curl \
             --fail-with-body \
@@ -188,5 +189,5 @@ jobs:
             --header "Authorization: Bearer ${oidc_token}" \
             --header "Content-Type: application/octet-stream" \
             --data-binary "@$RUNNER_TEMP/plugin.cindy" \
-            "${CINDY_PLUGIN_SERVER_URL_CN%/}"
+            "${CINDY_PLUGIN_PLATFORM_URL_CN%/}"
           echo

.tests/publish-workflows.test.mjs

@@ -18,10 +18,18 @@ test('CN and Global plugin publishers are operationally independent', () => {
   assert.match(cnWorkflow, /group: cindy-plugin-publish-cn-prod-/);
   assert.match(globalWorkflow, /group: cindy-plugin-publish-global-prod-/);
 
-  assert.match(cnWorkflow, /CINDY_PLUGIN_SERVER_URL_CN/);
-  assert.doesNotMatch(cnWorkflow, /CINDY_PLUGIN_SERVER_URL_GLOBAL/);
-  assert.match(globalWorkflow, /CINDY_PLUGIN_SERVER_URL_GLOBAL/);
-  assert.doesNotMatch(globalWorkflow, /CINDY_PLUGIN_SERVER_URL_CN/);
+  assert.match(cnWorkflow, /secrets\.CINDY_PLUGIN_PLATFORM_URL_CN/);
+  assert.doesNotMatch(cnWorkflow, /CINDY_PLUGIN_PLATFORM_URL_GLOBAL/);
+  assert.match(globalWorkflow, /secrets\.CINDY_PLUGIN_PLATFORM_URL_GLOBAL/);
+  assert.doesNotMatch(globalWorkflow, /CINDY_PLUGIN_PLATFORM_URL_CN/);
+});
+
+test('both production publishers route through protected Platform endpoints', () => {
+  for (const workflow of [cnWorkflow, globalWorkflow]) {
+    assert.doesNotMatch(workflow, /CINDY_PLUGIN_SERVER_URL_/);
+    assert.doesNotMatch(workflow, /api\/publisher\/releases/);
+    assert.doesNotMatch(workflow, /https:\/\/(?:plugin|platform)\./);
+  }
 });
 
 test('both regional publishers support main pushes and full manual republish', () => {
@@ -33,6 +41,7 @@ test('both regional publishers support main pushes and full manual republish', (
     assert.match(workflow, /Publishing all Cindy plugins:/);
     assert.match(workflow, /id-token: write/);
     assert.match(workflow, /audience=cindy-plugin/);
+    assert.match(workflow, /max-parallel: 2/);
   }
 });
 

README.md

@@ -194,9 +194,12 @@ Both are active and behave identically:
   plugins in full — for initial setup after a repository migration or an
   explicit re-release.
 - Each publishes via GitHub Actions OIDC (audience `cindy-plugin`) to its own
-  endpoint, supplied by a repository secret. The two runs package, execute, and
-  report independently; a failure on one side does not affect the other's
-  workflow status. There is no development publishing workflow.
+  production Cindy Platform endpoint, supplied by the repository secrets
+  `CINDY_PLUGIN_PLATFORM_URL_CN` and `CINDY_PLUGIN_PLATFORM_URL_GLOBAL`.
+  Platform orchestrates the release and forwards the OIDC token and package to
+  Plugin Server; the workflows never call Plugin Server directly. The two runs
+  package, execute, and report independently; a failure on one side does not
+  affect the other's workflow status. There is no development publishing workflow.
 
 Because both fire on the same push, one merge that changes a plugin produces two
 releases of it — one per region.

README.zh-CN.md

@@ -161,9 +161,11 @@ cindy-art/
 - `main` 的普通 push 只发布本次发生变化的插件目录；没有触及任何插件目录的 push 不会
   发布任何东西。
 - Actions 页面手动运行会全量发布当前全部插件，供仓库迁移后首次建档或显式重发使用。
-- 各自通过 GitHub Actions OIDC（audience `cindy-plugin`）发布到由仓库 Secret 提供的
-  端点。两次运行独立打包、独立执行、独立汇报，一边失败不影响另一边的 Workflow 状态。
-  仓库不提供 Dev 发布 Workflow。
+- 各自通过 GitHub Actions OIDC（audience `cindy-plugin`）发布到由仓库 Secret
+  `CINDY_PLUGIN_PLATFORM_URL_CN` 与 `CINDY_PLUGIN_PLATFORM_URL_GLOBAL` 提供的对应生产
+  Cindy Platform 入口。Platform 负责发布编排并把 OIDC Token 与包体转发给 Plugin
+  Server，Workflow 不再直连 Plugin Server。两次运行独立打包、独立执行、独立汇报，
+  一边失败不影响另一边的 Workflow 状态。仓库不提供 Dev 发布 Workflow。
 
 由于两者由同一次 push 触发，一次改动插件的合并会产生两个 Release —— 每个区域一个。