feat(deployment-pulse): add TypeScript reference plugin

.github/workflows/ci.yml

@@ -10,20 +10,20 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build:
-    name: Build & test
+  rust:
+    name: Rust build & test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
 
       - name: Install Bun (for plugin UIs)
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
 
       - name: cargo fmt
         run: cargo fmt --all -- --check
@@ -33,3 +33,25 @@ jobs:
 
       - name: cargo test
         run: cargo test --workspace
+
+  typescript:
+    name: TypeScript build & test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install locked dependencies
+        working-directory: deployment-pulse-plugin
+        run: bun install --frozen-lockfile
+
+      - name: Test and build Deployment Pulse
+        working-directory: deployment-pulse-plugin
+        run: |
+          bun run test
+          bun run build
+          bunx tsc --noEmit

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -23,27 +23,37 @@ jobs:
           - target: x86_64-unknown-linux-gnu
             os: ubuntu-latest
             suffix: x86_64-linux
+            bun_target: bun-linux-x64
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
             suffix: aarch64-linux
             linker: aarch64-linux-gnu-gcc
+            bun_target: bun-linux-arm64
           - target: x86_64-apple-darwin
             os: macos-latest
             suffix: x86_64-darwin
+            bun_target: bun-darwin-x64
           - target: aarch64-apple-darwin
             os: macos-latest
             suffix: aarch64-darwin
+            bun_target: bun-darwin-arm64
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify release commit is on main
+        shell: bash
+        run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           targets: ${{ matrix.target }}
 
       - name: Install Bun
-        uses: oven-sh/setup-bun@v2
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
 
       - name: Install cross-compilation tools (Linux aarch64)
         if: matrix.target == 'aarch64-unknown-linux-gnu'
@@ -52,7 +62,7 @@ jobs:
           sudo apt-get install -y gcc-aarch64-linux-gnu
 
       - name: Cache cargo
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           key: ${{ matrix.target }}
 
@@ -61,6 +71,16 @@ jobs:
           CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
         run: cargo build --release --workspace --target ${{ matrix.target }}
 
+      - name: Install Deployment Pulse dependencies
+        working-directory: deployment-pulse-plugin
+        run: bun install --frozen-lockfile
+
+      - name: Build Deployment Pulse
+        working-directory: deployment-pulse-plugin
+        run: |
+          bun run embed
+          bun build src/index.ts --compile --target=${{ matrix.bun_target }} --outfile=dist/temps-deployment-pulse-plugin
+
       - name: Stage release artifacts
         shell: bash
         run: |
@@ -75,10 +95,13 @@ jobs:
             dst="dist/${binary}-${{ matrix.suffix }}"
             cp "${src}" "${dst}"
           done
+          cp \
+            deployment-pulse-plugin/dist/temps-deployment-pulse-plugin \
+            "dist/temps-deployment-pulse-plugin-${{ matrix.suffix }}"
           ls -la dist
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: plugins-${{ matrix.suffix }}
           path: dist/*
@@ -88,8 +111,11 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    environment: release
+    permissions:
+      contents: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: dist
           merge-multiple: true
@@ -98,7 +124,7 @@ jobs:
         run: ls -la dist
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: dist/*
           generate_release_notes: true

README.md

@@ -2,7 +2,7 @@
 
 Official external plugins for [Temps](https://temps.sh) — drop-in binaries that extend the platform without forking or rebuilding it.
 
-All plugins in this repo are written in Rust using [`temps-plugin-sdk`](https://github.com/gotempsh/temps/tree/main/crates/temps-plugin-sdk) and communicate with the Temps server over stdin/stdout.
+Plugins in this repo use either the Rust [`temps-plugin-sdk`](https://github.com/gotempsh/temps/tree/main/crates/temps-plugin-sdk) or the TypeScript [`@temps-sdk/plugin`](https://github.com/gotempsh/temps/tree/main/sdks/node/packages/plugin-sdk). Both communicate with the Temps server over stdin/stdout and compile to standalone binaries.
 
 ## Plugins
 
@@ -12,6 +12,7 @@ All plugins in this repo are written in Rust using [`temps-plugin-sdk`](https://
 | [`lighthouse-plugin`](./lighthouse-plugin) | Runs Google Lighthouse audits after every deployment and tracks Core Web Vitals over time. |
 | [`indexnow-plugin`](./indexnow-plugin) | Automatically submits deployed URLs to IndexNow-supporting search engines (Bing, Yandex, Seznam). |
 | [`google-indexing-plugin`](./google-indexing-plugin) | Notifies the Google Indexing API when pages are published or removed. |
+| [`deployment-pulse-plugin`](./deployment-pulse-plugin) | TypeScript reference plugin with a searchable, cross-project deployment health dashboard. |
 
 ## Install a prebuilt binary
 
@@ -47,9 +48,20 @@ chmod +x ~/.temps/plugins/temps-lighthouse-plugin
 
 Open **Settings → Plugins** in the Temps dashboard and click **Reload Plugins**.
 
+For the TypeScript example, use Bun:
+
+```bash
+cd deployment-pulse-plugin
+bun install --frozen-lockfile
+bun run test
+bun run build
+cp dist/temps-deployment-pulse-plugin ~/.temps/plugins/
+chmod +x ~/.temps/plugins/temps-deployment-pulse-plugin
+```
+
 ## Plugin structure
 
-Each plugin is a standalone Cargo crate with the same layout:
+Rust plugins are standalone Cargo crates:
 
 ```
 lighthouse-plugin/
@@ -61,13 +73,31 @@ lighthouse-plugin/
 
 The `build.rs` runs `bun install && bun run build` in `web/` when the `web/` directory exists, then the Rust code embeds the built assets with `include_dir!`.
 
+TypeScript plugins follow the same single-binary model:
+
+```
+deployment-pulse-plugin/
+├── package.json    # SDK dependency and Bun scripts
+├── scripts/        # embeds the compiled UI
+├── src/            # plugin process and tests
+└── web/            # Vite + React UI
+```
+
+`bun run build` builds the UI, embeds it into TypeScript, and compiles the
+plugin into one executable. Temps does not need Bun or Node.js at runtime.
+
 ## Write your own plugin
 
-The easiest starting point is to copy `example-plugin`, rename it, and edit from there. See the [plugin system docs](https://temps.sh/docs/plugins) for the full SDK reference, protocol details, and service registration patterns.
+For Rust, copy `example-plugin`. For TypeScript, copy
+`deployment-pulse-plugin`. See the [plugin system docs](https://temps.sh/docs/plugins)
+for the full SDK reference, protocol details, and service registration patterns.
 
 ## Versioning
 
-This repo pins to a specific Temps SDK version via `temps-plugin-sdk = { git = "...", tag = "vX.Y.Z" }` in the workspace `Cargo.toml`. Bump the tag in a single PR when you want to pick up new SDK features — every plugin in the workspace upgrades together.
+Rust plugins pin `temps-plugin-sdk = { git = "...", tag = "vX.Y.Z" }`.
+The TypeScript SDK and individual plugins use their own semantic versions
+because they can release independently from Temps. Compatibility is defined by
+the external-plugin protocol version.
 
 ## License
 

deployment-pulse-plugin/.gitignore

@@ -0,0 +1,6 @@
+node_modules/
+dist/
+web/node_modules/
+web/dist/
+src/_embedded_ui.ts
+*.tgz

deployment-pulse-plugin/README.md

@@ -0,0 +1,47 @@
+# Deployment Pulse TypeScript Plugin
+
+A useful, read-only Temps plugin built with `@temps-sdk/plugin`. It gives an
+operator one compact view of deployment health across every project:
+
+- latest deployment state, branch, commit, and age;
+- projects needing attention sorted first;
+- recent deployment success rate per project;
+- search and health filters;
+- automatic refresh every 30 seconds; and
+- partial results when one project's history cannot be read.
+
+The Bun build embeds the React UI and SDK into a single executable. The Temps
+host does not need Bun or Node.js installed.
+
+## Build and test
+
+Install the exact SDK version recorded in `bun.lock`, then build and test:
+
+```bash
+bun install --frozen-lockfile
+bun run test
+bun run build
+```
+
+The executable is written to `dist/temps-deployment-pulse-plugin`.
+
+## Install locally
+
+```bash
+mkdir -p ~/.temps/plugins
+cp dist/temps-deployment-pulse-plugin ~/.temps/plugins/
+chmod +x ~/.temps/plugins/temps-deployment-pulse-plugin
+```
+
+Open **Settings → Plugins** and select **Reload Plugins**, or restart Temps.
+The plugin contributes one **Deployment Pulse** navigation item and mounts its
+read-only API at `/api/x/deployment-pulse/overview`.
+
+## Permissions and data
+
+Deployment Pulse declares no raw API capability, database access, or host-data
+access. It reads only the caller-scoped `list_projects` and `list_deployments`
+methods exposed by the signed protocol-v2 SDK channel.
+
+Project links use the public `/projects/<project_slug>` route. Internal project
+IDs are never exposed in dashboard URLs.

deployment-pulse-plugin/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "typescript-deployment-pulse-plugin",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "bun run src/index.ts",
+    "embed": "bun run scripts/embed-assets.ts",
+    "compile": "bun run embed && bun build src/index.ts --compile --outfile dist/temps-deployment-pulse-plugin",
+    "build": "bun run compile",
+    "test": "bun test src web/src"
+  },
+  "dependencies": {
+    "@temps-sdk/plugin": "0.1.0-beta.1"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.0.0",
+    "@types/node": "^22.0.0",
+    "typescript": "^5.5.4"
+  }
+}