Drop-in from fai/platform .forgejo/workflow-templates/
sign-bundle-keypair.yml. Triggers on v*.*.* tag push:
builds wasm32-wasip2, fetches the fai CLI from
get.fai.flemming.ai, packs the bundle, ECDSA P-256 signs
it against the org-level Forgejo secret FAI_SIGNING_KEY,
round-trip-verifies against infra/cosign/official.pub on
fai/platform main, and attaches bundle + .sig to the
Forgejo Release via the API.
Hubs configured with require_signatures: true now accept
this module's releases. Without the secret configured the
workflow fails fast with the setup instructions in stderr.
Signed-off-by: flemming-it <sf@flemming.it>
Two prior approaches failed:
1. Sibling-clone of module-sdk into a directory two levels up
from $GITHUB_WORKSPACE failed with a 2-second runner failure
(bisect confirmed: workflow with ONLY the own-repo checkout
succeeded; adding the sibling-clone step reproduced the
failure).
2. Anonymous clone of the now-public module-sdk also failed —
the Forgejo instance has REQUIRE_SIGNIN_VIEW=true, so making
a repo public does not enable anonymous read.
The working approach: switch fai-module-sdk to a git dependency
in Cargo.toml and inject a stored Forgejo PAT into any outgoing
git.flemming.ws URL via 'git config url.X.insteadOf Y'. Cargo's
git fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI=true) then
authenticates transparently.
The Forgejo Actions secret MODULE_SDK_PAT carries the read token.
Locally, the same insteadOf trick works via GIT_CONFIG_COUNT
without polluting the global git config.
Bumps text-extract 0.1.4 -> 0.1.5.
Signed-off-by: flemming-it <sf@flemming.it>
Two prior CI runs (cc72db04 and c411916) failed in 2 seconds
without producing any visible step output. The Forgejo Actions
log API does not expose run logs without a real session, so
isolate by replacing the workflow with a single echo-step.
If this run succeeds, the issue is in one of the original
workflow's steps (likely the second checkout of module-sdk).
If this run also fails in 2 seconds, the issue is structural
to the workflow header or the runner picking up text-extract.
Bumps 0.1.1 -> 0.1.2.
Signed-off-by: flemming-it <sf@flemming.it>
Initial CI run on commit cc72db04 failed in 2 seconds because
the workflow used the repo-scoped GITHUB_TOKEN to clone the
sibling fai/module-sdk repository. That token is scoped to the
current repo (fai-modules/text-extract) and could not read a
private repo in a different org (fai/), so git fetch returned
401 and aborted the run.
fai/module-sdk has been made public — the SDK is the
authoring-surface for module developers and contains nothing
that needs to stay private. With the SDK public, an anonymous
clone is sufficient and avoids the cross-org token-scope
friction entirely.
The text-extract repo itself stays private; only the
authoring-surface SDK is public.
Bumps the module patch version 0.1.0 -> 0.1.1 per the
per-commit policy.
Signed-off-by: flemming-it <sf@flemming.it>
First real F∆I capability module. Ships as alpha in the store
index — installable, but layout-naive PDF extraction. Bumps to
1.0.0 require either the planned service-mode variant
(host-services-backed pdfium/mupdf) or confirmed-good
extraction quality on a representative document set.
Capability surface:
Inputs: document : bytes (PDF or DOCX)
Outputs: extracted : json (ExtractedDocument)
Permissions: none — pure in-WASM, no filesystem, no network
Output schema:
{
"engine": "pdf-extract" | "zip+quick-xml",
"engine_version": "<version>",
"pages": [{ "number": <u32>, "text": <string>,
"confidence?": <f64>, "bbox?": {x,y,w,h} }]
}
The optional confidence and bbox fields are reserved for the
future service-mode variant. The host-services infrastructure
that backs pdfium/mupdf does not exist yet (Phase 0.5+); when
it lands, text-extract v0.2.0 will populate these fields without
an API break.
Engines:
PDF: pdf-extract 0.7 (pure Rust, MIT-licensed). Single-column
documents extract reliably. Multi-column or table-heavy
layouts may produce reordered text — documented in
README as a known limitation of the in-WASM v0.1.0 path.
DOCX: ad-hoc parser using the zip and quick-xml crates. Walks
word/document.xml, concatenates run-level text, inserts a
newline at each paragraph boundary. Tables, footnotes,
and embedded objects are not extracted in v0.1.0.
The module is the first reference user of fai-module-sdk. The
public surface is one #[fai_module] function — no wit_bindgen,
no Guest impl, no allow attributes. Testing surface is the same
function via crate-type = ["cdylib", "rlib"]; the SDK macro
gates its WASM glue on target_arch = "wasm32" so host integration
tests work out of the box.
Tests: 6 unit + 3 integration, all green. The DOCX integration
test builds a minimal valid DOCX in memory and verifies the
JSON output schema. PDF integration coverage will land in a
follow-up once a representative test fixture is bundled.
The Forgejo CI workflow clones fai/module-sdk into a sibling
location to satisfy the path-based dev dependency. The path
will switch to a versioned git tag once SDK releases stabilize.
Signed-off-by: flemming-it <sf@flemming.it>
