feat(sdk): 1.1.2 — @route wires into FastAPI, CycloneDX SBOM in .dryadepkg#6
Merged
Merged
Conversation
…depkg Two author-surface gaps from sdk_proof e2e: Gap #4 — @route was a no-op decorator. The decorator now stamps a canonical _dryade_route_meta dict on the wrapped callable (keeping the legacy `spec` attribute for backwards compatibility), and the SDK ships two new helpers in dryade_plugins_sdk.plugin: - collect_routes(plugin) — walks dir(plugin), returns [(meta, callable), ...] ordered by __qualname__. - build_router(plugin) -> fastapi.APIRouter — produces a FastAPI router from every decorated method; lazy-imports FastAPI so plugins without routes don't pull it in; returns plugin.router unchanged when present so the legacy pattern keeps working. with_tool example now uses @route + build_router as the canonical reference pattern. Gap #6 — dryade plugin package emitted no SBOM. The packager now embeds a CycloneDX 1.5 SBOM as sbom.cdx.json in every .dryadepkg. Full SBOM via cyclonedx-py when available, minimal shim otherwise. The manifest's `sbom` field records the source (minimal-shim | cyclonedx-py) so consumers can read the source without unpacking the SBOM file. Tests: - tests/test_route_decorator.py: 8 cases covering decorator metadata, collect_routes ordering + legacy-spec fallback, build_router output via FastAPI TestClient, plugin.router passthrough, empty-router path. - tests/test_package_sbom.py: asserts every .dryadepkg contains a valid CycloneDX 1.5 SBOM and the manifest carries the sbom-source flag. Co-Authored-By: Dammerzone <dammerzone@users.noreply.github.com>
github-actions
Bot
added
documentation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Welcome to dryade-plugins-sdk! Thanks for your first PR.
Please confirm:
- Tests pass locally (
pytest -x) - Examples still build (
pytest tests/test_examples_build.py) - PR title follows Conventional Commits
A maintainer will review shortly. Want to be added to the All Contributors list? Drop a comment like @all-contributors please add @yourname for code.
DryadeCore
pushed a commit
that referenced
this pull request
May 26, 2026
…depkg (#6) Two author-surface gaps from end-to-end author testing: Gap #4 — @route was a no-op decorator. The decorator now stamps a canonical _dryade_route_meta dict on the wrapped callable (keeping the legacy `spec` attribute for backwards compatibility), and the SDK ships two new helpers in dryade_plugins_sdk.plugin: - collect_routes(plugin) — walks dir(plugin), returns [(meta, callable), ...] ordered by __qualname__. - build_router(plugin) -> fastapi.APIRouter — produces a FastAPI router from every decorated method; lazy-imports FastAPI so plugins without routes don't pull it in; returns plugin.router unchanged when present so the legacy pattern keeps working. with_tool example now uses @route + build_router as the canonical reference pattern. Gap #6 — dryade plugin package emitted no SBOM. The packager now embeds a CycloneDX 1.5 SBOM as sbom.cdx.json in every .dryadepkg. Full SBOM via cyclonedx-py when available, minimal shim otherwise. The manifest's `sbom` field records the source (minimal-shim | cyclonedx-py) so consumers can read the source without unpacking the SBOM file. Tests: - tests/test_route_decorator.py: 8 cases covering decorator metadata, collect_routes ordering + legacy-spec fallback, build_router output via FastAPI TestClient, plugin.router passthrough, empty-router path. - tests/test_package_sbom.py: asserts every .dryadepkg contains a valid CycloneDX 1.5 SBOM and the manifest carries the sbom-source flag. Co-authored-by: Dryade <contact@dryade.ai> Co-authored-by: Dammerzone <dammerzone@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Lands the final two author-surface gaps from the `sdk_proof` end-to-end run.
Gap #4 — `@route` was a no-op. The decorator now stamps `_dryade_route_meta` (keeping the legacy `spec` attribute for backwards compatibility), and the SDK ships two new helpers:
Gap #6 — no SBOM in `.dryadepkg`. `dryade plugin package` now embeds a CycloneDX 1.5 SBOM as `sbom.cdx.json` next to `dryade.json`. Full SBOM via `cyclonedx-py` (added to `[cli]` extras) when available, minimal shim otherwise. The manifest carries an `sbom: cyclonedx-py | minimal-shim` field so consumers can read the source without unpacking the SBOM.
Tests
Companion host fix in DryadeAI/Dryade#962 unblocks the load gate so SDK-authored plugins satisfy `isinstance(plugin, Plugin)` (structural Protocol) without inheriting from `core.ee.*`.
🤖 Generated with Claude Code