LabHit Docs

Extension Marketplace

The LabHit Extension Marketplace is a registry where developers publish, discover, and install pipeline extensions.

Overview

Extensions are sandboxed WASM modules that add capabilities to your pipelines. Each extension declares its category, required permissions, and interface through a manifest file.

Extension Categories

Category Purpose Examples
source Code checkout and repository management Git clone, SVN, Mercurial
build Compilation and artifact generation Container build, Cargo, npm
test Test execution and reporting Unit tests, integration tests, fuzzing
scan Security scanning and code analysis SAST, dependency audit, license check
deploy Deployment to target environments Kubernetes, cloud functions, CDN
notify Notifications and alerting Slack, email, webhook
report Reporting and metrics Coverage, performance, changelog
utility General-purpose tools Cache management, file manipulation

Searching Extensions

CLI

# Search by keyword
labhit extension search "kubernetes"

# Search by category
labhit extension search --category deploy

# List all extensions
labhit extension search ""

GraphQL API

query {
  extensions(query: "kubernetes", category: "deploy", limit: 10) {
    id
    name
    description
    category
    downloadCount
  }
}

Dashboard

Visit the Marketplace page in the dashboard to browse extensions with category filters and search.

Installing Extensions

# Install latest version
labhit extension install deploy/kubernetes

# Install a specific version
labhit extension install deploy/kubernetes --version 1.2.0

Extensions are downloaded as .lhx packages (tar.gz containing the WASM module, manifest, and documentation). Package integrity is verified via SHA-256 hash.

Packaging Extensions for Distribution

Build and pack your extension into a portable .lhx package today. Hosted publishing to the marketplace registry is rolling out — until it lands, share the .lhx file directly or install it locally with labhit extension install.

Prerequisites

  • A LabHit account
  • The extension WASM module compiled for wasm32-wasip1 or wasm32-wasip2
  • An extension.yaml manifest

Extension Manifest

id: deploy/my-deployer
name: My Deployer
description: Deploy to my cloud provider
version: 1.0.0
category: deploy
capabilities:
  - network
  - env:MY_CLOUD_TOKEN

Build and Pack

# Initialize a new extension project
labhit extension init my-deployer

# Build the WASM module
labhit extension build

# Test locally
labhit extension test

# Pack into a distributable .lhx package
labhit extension pack

pack produces a <name>-<version>.lhx file and prints its size and SHA-256 hash.

Package Format (.lhx)

A .lhx file is a gzip-compressed tar archive containing:

File Required Description
extension.yaml Yes Extension manifest
*.wasm Yes Compiled WASM module
README.md No Documentation shown on the marketplace page
LICENSE No License file

Maximum package size: 50 MB.

Using Extensions in Pipelines

Reference installed extensions with the use: directive:

engine: "1"
pipeline:
  name: deploy-pipeline
stages:
  checkout:
    use: source/git
    with:
      repository: https://github.com/my-org/my-app
      branch: main

  build:
    after: [checkout]
    use: build/container
    with:
      dockerfile: ./Dockerfile
      tag: my-app:latest

  deploy:
    after: [build]
    use: deploy/kubernetes
    with:
      cluster: production
      manifest: ./k8s/deployment.yaml

An extension's required permissions (network, filesystem, secrets) are declared in its own extension.yaml manifest, not in the pipeline's sandbox: block.

Extension Permissions

Extensions run in sandboxed environments with deny-by-default permissions. Each extension must declare the capabilities it needs in its manifest.

Capability What It Grants
filesystem Read/write access to the pipeline workspace
network Outbound network access
env:VAR_NAME Access to a specific environment variable

Capabilities are enforced at runtime. An extension that attempts to access a resource it hasn't declared will receive a permission denied error.

LabHit supports paid extensions with revenue sharing for publishers. See labhit.dev for current marketplace terms.

Version Management

Extensions follow semantic versioning. Publishers can:

  • Publish new versions at any time
  • Yank a version to hide it from search and install (metadata preserved)
  • View download counts and version history

Yanked versions remain accessible to pipelines that already reference them by exact version number.