Document extension upload and import

[IlyaasK]

Summary

• add a runnable kernel_extension example
• require Terraform 1.11+, matching the resource's write-only archive path
• track exact archive changes with filesha256
• publish the same usage and both import forms in generated Registry docs
• update the examples index without adding a binary fixture

Why this is v1 work

The durable extension lifecycle is implemented and acceptance-covered in the preceding stack. This small PR makes that surface usable and documents the required content-addressed workflow before v1 release.

Resource scope

Documentation and examples for kernel_extension only. Provider behavior is unchanged.

API contract notes

The example uploads a caller-supplied extension ZIP. It does not download Chrome Web Store archives or invoke any browser/session operation.

Terraform state semantics

• source_path is write-only and requires Terraform 1.11+
• source_sha256 = filesha256(source_path) is the durable signal for archive replacement
• the archive path is a variable, so static validation needs no committed binary ZIP

Sensitive fields

No secret values are introduced. The archive path is write-only; the checksum is non-sensitive durable state.

Import behavior

Generated docs show both supported forms:

• <extension-id> for provider/API-key project resolution
• <project-id>/<extension-id> for explicit project scope

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-examples.sh (all six examples validated)
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• non-live terraform plan for the extension example
• git diff --check

Acceptance status

No live API operation is needed for this docs-only PR. The preceding acceptance PR contains the guarded real upload, import, replacement, and delete lifecycle test; it remains a required pre-tag run with credentials.

Deferred concerns

• no binary extension fixture is committed
• no live API apply runs in this PR
• profile resource work remains blocked on a tagged SDK with update support
• no proxy, deployment, API key, app invocation, session, log, screenshot, live-view, force-destroy, or runtime-state functionality is added

GitHub issues

This PR does not resolve an issue. #24 and #25 remain handled by the existing v1 architecture decisions.

---

Note

Low Risk
Documentation and example Terraform only; no runtime or provider logic changes.

Overview
Documents the kernel_extension content-addressed upload workflow for v1 without changing provider behavior.

Registry docs (docs/resources/extension.md) now include a full example usage block (Terraform >= 1.11.0, variable for the ZIP path, source_path + source_sha256 = filesha256(...)) and an Import section for <extension-id> and <project-id>/<extension-id>.

Adds a runnable extension example and matching examples/resources/kernel_extension snippets (resource.tf, import.sh). The examples index lists the new example and clarifies that examples do not download extensions (wording tweak from “upload”).

^{Reviewed by Cursor Bugbot for commit 0e38db9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bf17fc0. Configure here.}

[cursor]

Chrome brand in example text

Low Severity

The new extension_zip_path variable description names Chrome and Manifest V3. Public examples in this repo are expected to use generic wording instead of product or brand names, matching other examples that avoid company-specific references.

Additional Locations (2)

• examples/resources/kernel_extension/resource.tf#L6-L7
• docs/resources/extension.md#L21-L22

 

^{Triggered by learned rule: Examples must use generic names and URLs — no company-specific references}

^{Reviewed by Cursor Bugbot for commit bf17fc0. Configure here.}