feat: Run the catalog on the shared workflows

.github/workflows/catalog-health.yaml

@@ -0,0 +1,16 @@
+name: Catalog health
+
+on:
+  schedule:
+    - cron: "0 12 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  health:
+    uses: datum-cloud/actions/.github/workflows/plugin-catalog-health.yaml@v1.27.1
+    permissions:
+      contents: read
+      issues: write

.github/workflows/ci.yaml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   ci:
-    uses: datum-cloud/actions/.github/workflows/ci-basic.yaml@v1.27.1
+    uses: datum-cloud/actions/.github/workflows/plugin-catalog-validate.yaml@v1.27.1
     with:
-      run: scripts/ci-check
+      # The branch rules require the "ci / Build and test" check.
+      check-name: Build and test

.github/workflows/rebuild-index.yaml

@@ -0,0 +1,18 @@
+name: Rebuild index
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "plugins/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  rebuild:
+    uses: datum-cloud/actions/.github/workflows/plugin-catalog-index.yaml@v1.27.1
+    secrets:
+      app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
+      app-private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}

.github/workflows/scan-releases.yaml

@@ -1,50 +1,28 @@
-# Notices when a plugin's upstream repo has published a newer release than this
-# catalog offers, and opens the PR to catch up.
-#
-# A plugin's own repo is supposed to push its release here. When that push
-# breaks the catalog goes quietly stale and people install an old client. This
-# runs regardless of why the push did not happen.
-#
-# The work is in scripts/scan-upstream-releases.py so it can be read, reviewed
-# and run by hand.
-name: Scan upstream releases
+name: Scan releases
 
 on:
   schedule:
-    # Daily, early UTC. Nothing here is urgent enough to run more often.
     - cron: "17 6 * * *"
   workflow_dispatch:
     inputs:
-      dry_run:
-        description: "Report what is behind without opening PRs"
+      dry-run:
+        description: Report which plugins are behind without opening pull requests
         type: boolean
         default: false
       plugin:
-        description: "Only this plugin (leave empty for all)"
+        description: Scan only this plugin, by name
         type: string
-        required: false
+        default: ""
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.x"
-
-      - name: Install PyYAML
-        run: pip install --quiet pyyaml
-
-      - name: Scan for newer releases
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          scripts/scan-upstream-releases.py \
-            ${{ inputs.dry_run && '--dry-run' || '' }} \
-            ${{ inputs.plugin && format('--plugin {0}', inputs.plugin) || '' }}
+    uses: datum-cloud/actions/.github/workflows/plugin-catalog-scan.yaml@v1.27.1
+    with:
+      dry-run: ${{ inputs.dry-run || false }}
+      plugin: ${{ inputs.plugin || '' }}
+    secrets:
+      app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
+      app-private-key: ${{ secrets.RELEASE_BOT_APP_PRIVATE_KEY }}

README.md

@@ -1,6 +1,6 @@
-# datumctl-plugins
+# Datum Cloud plugins
 
-The official plugin index for [datumctl](https://github.com/datum-cloud/datumctl), the CLI for [Datum Cloud](https://datum.net).
+The official plugin catalog for [datumctl](https://github.com/datum-cloud/datumctl), the CLI for [Datum Cloud](https://datum.net). `datumctl` reads this catalog by default, so every plugin listed here installs by name with no setup.
 
 ## Available plugins
 
@@ -16,19 +16,33 @@ The official plugin index for [datumctl](https://github.com/datum-cloud/datumctl
 | [search](plugins/search.yaml) | Search for resources across the platform by kind, name, and project scope |
 | [telemetry](plugins/telemetry.yaml) | Query logs for your Datum Cloud projects |
 
-## Installing a plugin
+## Using this catalog
 
 ```sh
+# Search and install
+datumctl plugin search compute
 datumctl plugin install compute
-datumctl plugin install ipam
+
+# Or browse interactively
+datumctl plugin browse
+```
+
+Once installed, a plugin runs as a `datumctl` subcommand:
+
+```sh
+datumctl compute --help
 ```
 
+Plugins for the Milo platform live in the [Milo catalog](https://github.com/milo-os/cli-plugins), which you add with `datumctl plugin index add milo-os milo-os/cli-plugins`.
+
 ## Submitting a plugin
 
-1. Add the `datumctl-plugin` topic to your GitHub repository.
-2. Open a PR adding `plugins/<your-plugin-name>.yaml` following the [schema](schema/plugin-v1alpha1.json).
-3. CI will validate your manifest: schema, URI resolution, and SHA256 verification.
-4. Once merged, `index.yaml` is regenerated automatically.
+1. Add the `datumctl-plugin` topic to your plugin's GitHub repository.
+2. Open a pull request adding `plugins/<your-plugin-name>.yaml`, following the [schema](https://github.com/datum-cloud/actions/blob/v1.27.1/scripts/plugin-catalog/schema/plugin-v1alpha1.json). That's the only file you edit.
+3. CI validates every manifest against the schema and `datumctl plugin index validate`, and checks that each changed download URL resolves and matches its SHA256. A weekly health check re-verifies the whole catalog.
+4. On merge, [`index.yaml`](index.yaml), the file `datumctl` actually reads, is rebuilt from `plugins/*.yaml` through a pull request. You never edit it by hand.
+
+New releases reach this catalog through the [`update-plugin-index`](https://github.com/datum-cloud/actions/blob/main/docs/update-plugin-index/README.md) action in your release workflow, and a daily scan opens an update for any release that action missed.
 
 ## Plugin manifest format
 
@@ -50,6 +64,8 @@ spec:
       sha256: <lowercase hex sha256 of the archive>
 ```
 
+### Binary naming
+
 The binary inside each archive must be named `datumctl-<name>` or `milo-<name>` (add `.exe` on Windows).
 datumctl recognizes both prefixes, so a plugin built for the milo-os platform installs from this catalog without a second, datumctl-branded build.
 
@@ -59,3 +75,7 @@ To explicitly select the binary to install, set `files` for each platform, as in
       files:
         - from: milo-ipam  # milo-ipam.exe on Windows
 ```
+
+## How this catalog runs
+
+Validation, the index rebuild, the daily release scan, and the weekly health check all come from the shared [plugin catalog workflows](https://github.com/datum-cloud/actions/blob/main/docs/plugin-catalog/README.md) in `datum-cloud/actions`.