[compscidr]

Closes goblogplatform/GoBlog#648.

A WebAssembly plugin modeled on goblog-plugin-scholar that adds a Projects page (/projects, in the nav):

• GitHub: github_user (user or org) lists public repos via /users/{user}/repos. Forks, archived repos and names in exclude_repos are skipped, repos are sorted most-starred first, and repo_limit caps the list. An optional github_token raises the rate limit. allowed_hosts is api.github.com only.
• Hand-entered: extra_projects textarea, one per line as Name | URL | Description, shown above the repos. It needs no network.
• Caching: works the same way as scholar. The page serves from the plugin store, an hourly job refreshes once the cache is older than cache_hours, and the page fetches by itself only when the store is empty, with a 10-minute backoff after a failure. The cache records the user, so changing github_user refetches. If GitHub is down, the extra projects still render with a notice.
• All output is HTML-escaped, and hrefs are limited to absolute http(s) URLs.

Testing

• go test ./... passes (parsing, filtering, sort, pagination and limit, headers, errors, extra_projects parsing, escaping, cache decisions).
• GOOS=wasip1 GOARCH=wasm go build passes, and goblog validate-plugin plugin.wasm passes.
• I loaded the built wasm through goblog's plugin/wasm host against the live GitHub API with github_user=goblogplatform. It rendered the extra project first, then the repos sorted by stars, with the escaped <b> and the excluded repo hidden. With no settings it shows the "not configured" notice.

After merge: tag v1.0.0 and publish a release (the workflow uploads plugin.wasm), then submit it at goblog.live/plugins/submit.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

It introduces an entirely new network-facing plugin with security-relevant HTML output and a release workflow holding contents: write, warranting final human review despite no blocking issues found.

1 open issue

• Pin actions/setup-go to a commit SHA · New

What changed in this PR

This PR adds a new goblog WebAssembly plugin, goblog-plugin-projects, that renders a Projects page (/projects, shown in the nav). It lists a GitHub user's/organization's public repositories (forks, archived, private, and exclude_repos entries dropped; most-starred first; capped by repo_limit) alongside hand-entered extra_projects. Results are cached in goblog's plugin store, refreshed by an hourly job once older than cache_hours, with synchronous page fetch only when the store is empty and a 10‑minute failure backoff. It is closely modeled on the existing, published goblog-plugin-scholar, reusing its store/cache/host-binding patterns, and all output is HTML-escaped with hrefs restricted to absolute http(s) URLs.

Changes:

• GitHub repo fetching + filtering/sorting/pagination, extra-projects parsing, safe HTML rendering, and cache-decision helpers (natively testable).
• WASM host glue (main.go) exposing identity/settings/pages/jobs/render_page/run_job, with a native stub (main_native.go) so logic is unit-tested off-wasm.
• Project metadata, module files, docs (README/CHANGELOG), and a Release workflow that tests, builds plugin.wasm, and uploads it on release.

File	Description
project.go	Core types, repo/extra-projects parsing, sorting, safe HTML rendering, and cache/limit helpers.
project_test.go	Unit tests for parsing, sorting, escaping, and cache decisions.
fetch.go	Paginated GitHub repo fetch with headers, limit truncation, and status/error handling.
fetch_test.go	Unit tests for pagination, headers, errors, limits, and rune-safe truncation.
main.go	wasip1-only host bindings and plugin exports (settings, pages, jobs, render, job).
main_native.go	Native main() stub so go test runs off-wasm.
goblog-plugin.json	Plugin manifest including allowed_hosts restricted to api.github.com.
go.mod /​ go.sum	Module definition pinning extism/go-pdk v1.1.3.
README.md /​ CHANGELOG.md	Install/settings/how-it-works docs and initial changelog entry.
.github/​workflows/​release.yml	CI to test, build the wasm, and publish it on release.
.gitignore	Ignores build artifacts (plugin.wasm, *.test).

_{Review effort: Balanced}