Initial commit: plugin repository structure

- GitHub Actions workflows for signing and validation
- Example file-manager plugin
- Scripts for batch signing

.github/workflows/release.yml

@@ -0,0 +1,20 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v1
+        with:
+          files: |
+            plugins/**/*.js
+            plugins/**/*.sig
+            plugins/**/manifest.json

.github/workflows/sign.yml

@@ -0,0 +1,43 @@
+name: Sign Plugins
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'plugins/**/*.js'
+      - 'plugins/**/manifest.json'
+  workflow_dispatch:
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+
+      - name: Build signtool
+        run: |
+          git clone --depth 1 https://github.com/your-org/gotunnel.git /tmp/gotunnel
+          cd /tmp/gotunnel
+          go build -o /usr/local/bin/signtool ./cmd/signtool
+
+      - name: Sign plugins
+        env:
+          SIGNING_KEY: ${{ secrets.PLUGIN_SIGNING_KEY }}
+        run: |
+          echo "$SIGNING_KEY" > /tmp/private.key
+          chmod 600 /tmp/private.key
+          bash scripts/sign-all.sh /tmp/private.key
+          rm -f /tmp/private.key
+
+      - name: Commit signatures
+        run: |
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+          git add -A "plugins/**/*.sig"
+          git diff --staged --quiet || git commit -m "chore: update plugin signatures"
+          git push

.github/workflows/validate.yml

@@ -0,0 +1,16 @@
+name: Validate PR
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'plugins/**'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate manifests
+        run: bash scripts/validate.sh