[sj26]

🤖

Why

Testing an alternate runtime currently makes the plugin resolve Git refs, install mise and Go, and compile three platform binaries. Even released runtimes require managing mise before launching buildkite-gha.

What

Make the plugin a downloader and launcher. Keep version: latest or an exact GitHub release; replace source builds with a raw executable URL or platform-to-URL map:

# Before: install a toolchain and build from source.
source-ref: main

# After: run an already-built executable.
binary: https://example.com/buildkite-gha-linux-amd64

URLs optionally accept #sha256=<64 hex digits>: missing checksums are allowed for custom URLs, supplied checksums are enforced before execution. Official releases require GitHub API asset digests. Prefer raw executables, but preserve historical version pins by reading verified archives when that release has no raw asset. Invalid raw metadata or bytes never fall back to an archive.

Cache release metadata for one hour and verified downloads by platform and digest. Warm acquisition makes no requests; clean checkout refreshes metadata without downloading unchanged bytes again. Pass selected release metadata to compatible CLIs so counterpart selection doesn't repeat the lookup. Cached bytes are verified in a private temporary directory before execution; unpinned custom URLs remain uncached.

Remove importer mise management, compilation, minimum-release-age, and their test/CI machinery. Keep developer mise and generated-job runtime tools. Add jq for the existing JSON configuration, leave workflow validation to the CLI, shorten the duplicated runtime documentation, and run the candidate plugin in native macOS smokes.

Rollout: additive CLI support #644 and example producer migration #645 are merged. Keep this draft until the raw CLI release #666 is published and both old-plugin/new-CLI and new-plugin/new-CLI paths are checked. Retain the existing historical smoke pins as compatibility controls. The CLI retains legacy consumption; this plugin rejects source-ref and minimum-release-age, so users of those options must migrate before moving latest.

The plugin remains draft. Publication and promotion are separate from this PR update.

[buildsworth-bk-app]

One blocking issue in the live smoke setup. Retiring acquisition fields also changes the public plugin configuration contract, so human approval is required.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 48111, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-6.1-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. The same approval policy applies in every repository:

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). buildsworth may approve without per-PR permission.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical pipeline paths). Human approval required; buildsworth never approves.

[buildsworth-bk-app]

The smoke-test key collision is fixed, and I found no new issues. Retiring source-ref and minimum-release-age changes the public plugin configuration contract, so human approval is still required.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 48114, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Superseded by a newer Buildsworth review.