feat: publish permissions plugin image

[lusu007]

Pull Request

Description

Packages the shaded Velocity permissions plugin JAR as the OCI transport image expected by the existing plugin-velocity-jar Helm chart.

• adds a multi-stage Docker build that places the artifact at /jar/plugin.jar
• publishes ghcr.io/groundsgg/plugin-permissions:edge from main
• publishes semantic image tags from v* release tags through the shared Grounds workflow
• supplies GitHub Packages credentials as a BuildKit secret so they are not persisted in image layers

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 💥 Breaking change
• ♻️ Refactoring
• 📚 Documentation
• 🔧 Chore

Related Issues

• Relates to https://github.com/groundsgg/grounds-forge/issues/470

Testing

• Unit tests pass
• Manual testing completed
• New tests added for new functionality

Validation performed:

• ./gradlew test
• ./gradlew spotlessApply
• ./gradlew build
• local docker build with BuildKit credentials
• container assertion that /jar/plugin.jar exists and is non-empty
• workflow YAML parsing and git diff --check

Checklist

• I have performed a self-review of my own code
• Tests have been added/updated and pass (if needed)
• Documentation has been updated (if needed)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b570afd97

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Propagate the release version into Gradle

This Gradle invocation never receives versionOverride; with gg.grounds.base-conventions 0.6.0, project.version defaults to local-SNAPSHOT unless that property is set, and the Velocity conventions bake project.version into BuildInfo.VERSION. On v* image releases, GHCR will get a semver tag but the JAR's Velocity plugin metadata and permission-catalog source version will still be local-SNAPSHOT, so the tag version needs to be passed into the Docker build and then into this Gradle command.

Useful? React with 👍 / 👎.

[lusu007]

Closing this path as superseded. groundsgg/containers#182 now bakes plugin-permissions-velocity:0.4.0 into the released ghcr.io/groundsgg/velocity:0.12.0 image, and groundsgg/library-platform-bundle#73 provides the required backend wiring. Publishing a second plugin transport image would duplicate the existing distribution path.