-
Notifications
You must be signed in to change notification settings - Fork 0
feat: GitHub-based Plugin Marketplace System #98
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
3b8c5d5
c6fa9cd
b1fbcf5
0de8d7f
169d999
c48ef98
0376e29
4f22573
98cdf16
b5f582a
a402571
760e53c
12e1469
c2b113b
b40b7b2
389674e
e7c8ba8
3b9bd3c
7f5c109
2e64749
e2f1c8e
54ba497
a628a02
d5cab3d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,130 @@ | ||
| name: Publish Plugins to PyPI | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - 'plugin-git-v*' | ||
| - 'plugin-github-v*' | ||
| - 'plugin-jira-v*' | ||
| - 'plugin-*-v*' # Support new plugins | ||
| workflow_dispatch: | ||
| inputs: | ||
| plugin: | ||
| description: 'Plugin name (e.g., git, github, jira)' | ||
| required: true | ||
| version: | ||
| description: 'Version to release (e.g., 1.0.0)' | ||
| required: true | ||
|
|
||
| jobs: | ||
| determine-plugin: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| plugin-name: ${{ steps.extract.outputs.plugin-name }} | ||
| plugin-version: ${{ steps.extract.outputs.version }} | ||
| steps: | ||
| - name: Extract plugin from tag | ||
| id: extract | ||
| run: | | ||
| # Handle both manual dispatch and tag-triggered workflow | ||
| if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then | ||
| PLUGIN="${{ github.event.inputs.plugin }}" | ||
| VERSION="${{ github.event.inputs.version }}" | ||
| else | ||
| TAG="${{ github.ref }}" | ||
| # Extract from tag: plugin-git-v1.0.0 -> git, 1.0.0 | ||
| PLUGIN=$(echo "$TAG" | sed 's|refs/tags/plugin-||;s|-v.*||') | ||
| VERSION=$(echo "$TAG" | sed 's|refs/tags/.*-v||') | ||
| fi | ||
|
|
||
| echo "plugin-name=$PLUGIN" >> $GITHUB_OUTPUT | ||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||
| echo "Plugin: $PLUGIN, Version: $VERSION" | ||
|
|
||
| publish: | ||
| needs: determine-plugin | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # Full history for git operations | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install Poetry | ||
| uses: snok/install-poetry@v1 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Workflow should not use version pinning for third-party actions More DetailsThis rule checks that GitHub workflow does not use version pinning on third-party actions. This rule fails when the workflow contains steps that use third-party actions referenced by version tags (like @v1, @v2.3, @v4) instead of specific commits. Using version-tagged actions creates a supply chain security risk, as the version tag could be modified by the action's maintainer to point to malicious code after the calling workflow is created. Even when using specific version tags, the tag could be moved to point to malicious code. To prevent this risk, always pin third-party actions to specific commit SHAs to ensure the exact code being executed is locked and immutable. Expected Found Security Frameworks: wf-id-1, wf-id-175
To ignore this finding as an exception, reply to this conversation with If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more). To get more details on how to remediate this issue using AI, reply to this conversation with |
||
| with: | ||
| version: latest | ||
|
|
||
| - name: Update plugin version in pyproject.toml | ||
| working-directory: plugins/titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} | ||
| run: | | ||
| poetry version ${{ needs.determine-plugin.outputs.plugin-version }} | ||
|
|
||
| - name: Build plugin package | ||
| working-directory: plugins/titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} | ||
| run: poetry build | ||
|
|
||
| - name: Publish to PyPI | ||
| working-directory: plugins/titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} | ||
| run: poetry publish | ||
| env: | ||
| POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_TOKEN }} | ||
|
|
||
| update-registry: | ||
| needs: [determine-plugin, publish] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Update registry.json | ||
| run: | | ||
| python scripts/update_registry.py \ | ||
| --plugin titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} \ | ||
| --version ${{ needs.determine-plugin.outputs.plugin-version }} | ||
|
|
||
| - name: Commit registry update | ||
| run: | | ||
| git config user.email "titan-bot@masmovil.es" | ||
| git config user.name "Titan Bot" | ||
| git add registry.json | ||
| git diff --cached --exit-code || { | ||
| git commit -m "chore(registry): update titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} to v${{ needs.determine-plugin.outputs.plugin-version }}" | ||
| git push | ||
| } | ||
|
|
||
| - name: Create Release Notes | ||
| uses: actions/create-release@v1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| tag_name: plugin-${{ needs.determine-plugin.outputs.plugin-name }}-v${{ needs.determine-plugin.outputs.plugin-version }} | ||
| release_name: Plugin ${{ needs.determine-plugin.outputs.plugin-name }} v${{ needs.determine-plugin.outputs.plugin-version }} | ||
| body: | | ||
| ## Plugin Release | ||
|
|
||
| **Plugin**: `titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }}` | ||
| **Version**: `${{ needs.determine-plugin.outputs.plugin-version }}` | ||
| **Status**: ✅ Published to PyPI | ||
|
|
||
| ### Installation | ||
|
|
||
| ```bash | ||
| pipx inject titan-cli titan-plugin-${{ needs.determine-plugin.outputs.plugin-name }} | ||
| ``` | ||
|
|
||
| ### Registry | ||
|
|
||
| The marketplace registry has been automatically updated. | ||
| draft: false | ||
| prerelease: false | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| name: Test Plugins | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Workflow should have permissions limitations More DetailsThis rule checks that GitHub workflow has an empty permissions block to enforce least privilege. This rule fails when the workflow doesn't have a permissions block or has a non-empty permissions block with `write-all` scope, which can grant excessive permissions to workflow actions. Excessive permissions in GitHub workflows increase the risk surface in case of a compromise, potentially allowing attackers to access sensitive resources or perform unauthorized actions. To prevent this risk, always implement least privilege by explicitly defining an empty permissions block for all workflows. Expected Found Security Frameworks: wf-id-1, wf-id-175
To ignore this finding as an exception, reply to this conversation with If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more). To get more details on how to remediate this issue using AI, reply to this conversation with |
||
|
|
||
| on: | ||
| pull_request: | ||
| paths: | ||
| - 'plugins/**' | ||
| - '.github/workflows/test-plugins.yml' | ||
| push: | ||
| branches: | ||
| - develop | ||
| - feat/** | ||
| paths: | ||
| - 'plugins/**' | ||
|
|
||
| jobs: | ||
| detect-plugins: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| matrix: ${{ steps.set-matrix.outputs.matrix }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Detect changed plugins | ||
| id: set-matrix | ||
| run: | | ||
| # Get list of changed files | ||
| if [ "${{ github.event_name }}" == "pull_request" ]; then | ||
| CHANGED_FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }}...HEAD) | ||
| else | ||
| CHANGED_FILES=$(git diff --name-only HEAD~1..HEAD) | ||
| fi | ||
|
|
||
| # Extract unique plugin directories | ||
| PLUGINS=() | ||
| for file in $CHANGED_FILES; do | ||
| if [[ $file == plugins/titan-plugin-*/* ]]; then | ||
| PLUGIN=$(echo $file | cut -d'/' -f2) | ||
| if [[ ! " ${PLUGINS[@]} " =~ " ${PLUGIN} " ]]; then | ||
| PLUGINS+=("$PLUGIN") | ||
| fi | ||
| fi | ||
| done | ||
|
|
||
| # If no plugins detected, test all | ||
| if [ ${#PLUGINS[@]} -eq 0 ]; then | ||
| PLUGINS=("titan-plugin-git" "titan-plugin-github" "titan-plugin-jira") | ||
| fi | ||
|
|
||
| # Format as JSON array | ||
| MATRIX=$(printf '"%s",' "${PLUGINS[@]}" | sed 's/,$//') | ||
| MATRIX="{\"plugin\":[$MATRIX]}" | ||
| echo "matrix=$MATRIX" >> $GITHUB_OUTPUT | ||
|
|
||
| test: | ||
| needs: detect-plugins | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: ${{ fromJson(needs.detect-plugins.outputs.matrix) }} | ||
| fail-fast: false | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v4 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install Poetry | ||
| uses: snok/install-poetry@v1 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Workflow should not use version pinning for third-party actions More DetailsThis rule checks that GitHub workflow does not use version pinning on third-party actions. This rule fails when the workflow contains steps that use third-party actions referenced by version tags (like @v1, @v2.3, @v4) instead of specific commits. Using version-tagged actions creates a supply chain security risk, as the version tag could be modified by the action's maintainer to point to malicious code after the calling workflow is created. Even when using specific version tags, the tag could be moved to point to malicious code. To prevent this risk, always pin third-party actions to specific commit SHAs to ensure the exact code being executed is locked and immutable. Expected Found Security Frameworks: wf-id-1, wf-id-175
To ignore this finding as an exception, reply to this conversation with If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more). To get more details on how to remediate this issue using AI, reply to this conversation with |
||
| with: | ||
| version: latest | ||
| virtualenvs-in-project: true | ||
|
|
||
| - name: Load cached venv | ||
| id: cached-poetry-dependencies | ||
| uses: actions/cache@v3 | ||
| with: | ||
| path: plugins/${{ matrix.plugin }}/.venv | ||
| key: venv-${{ matrix.plugin }}-${{ hashFiles(format('plugins/{0}/poetry.lock', matrix.plugin)) }} | ||
|
|
||
| - name: Install dependencies | ||
| working-directory: plugins/${{ matrix.plugin }} | ||
| run: poetry install | ||
|
|
||
| - name: Run linting (ruff) | ||
| working-directory: plugins/${{ matrix.plugin }} | ||
| run: poetry run ruff check . --output-format=short | ||
|
|
||
| - name: Run tests | ||
| working-directory: plugins/${{ matrix.plugin }} | ||
| run: poetry run pytest -v | ||
|
|
||
| - name: Upload coverage | ||
| uses: codecov/codecov-action@v3 | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Workflow should not use version pinning for third-party actions More DetailsThis rule checks that GitHub workflow does not use version pinning on third-party actions. This rule fails when the workflow contains steps that use third-party actions referenced by version tags (like @v1, @v2.3, @v4) instead of specific commits. Using version-tagged actions creates a supply chain security risk, as the version tag could be modified by the action's maintainer to point to malicious code after the calling workflow is created. Even when using specific version tags, the tag could be moved to point to malicious code. To prevent this risk, always pin third-party actions to specific commit SHAs to ensure the exact code being executed is locked and immutable. Expected Found Security Frameworks: wf-id-1, wf-id-175
To ignore this finding as an exception, reply to this conversation with If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more). To get more details on how to remediate this issue using AI, reply to this conversation with |
||
| with: | ||
| files: ./plugins/${{ matrix.plugin }}/coverage.xml | ||
| flags: plugins | ||
| fail_ci_if_error: false | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -140,3 +140,6 @@ venv.bak/ | |
| # OS-specific | ||
| .DS_Store | ||
| Thumbs.db | ||
|
|
||
| # Titan CLI - Downloaded plugins (project-level) | ||
| .titan/plugins/ | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Workflow should have permissions limitations
on resource
nameMore Details
This rule checks that GitHub workflow has an empty permissions block to enforce least privilege. This rule fails when the workflow doesn't have a permissions block or has a non-empty permissions block with `write-all` scope, which can grant excessive permissions to workflow actions. Excessive permissions in GitHub workflows increase the risk surface in case of a compromise, potentially allowing attackers to access sensitive resources or perform unauthorized actions. To prevent this risk, always implement least privilege by explicitly defining an empty permissions block for all workflows.
Expected
Found
Security Frameworks: wf-id-1, wf-id-175
To ignore this finding as an exception, reply to this conversation with
#wiz_ignore reasonIf you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with
#wiz remediate