docs(plugins): plugin supply chain security — pinned refs required, SHA-256 integrity - #17
Merged
Merged
Conversation
…integrity (PR #775) - Two-Axis Model sources table: replace mutable `github://owner/repo` row with pinned-tag and pinned-SHA rows; clarify these are now the only valid forms - Installing a Plugin: update GitHub example to use `#v1.0.0`; add Callout warning that bare refs return HTTP 422 with link to Supply Chain Security section - Install Safeguards: add `PLUGIN_ALLOW_UNPINNED` env var row (dev escape hatch) - New "Supply Chain Security" section: explains pinned-ref enforcement (SAFE-T1102), shows valid vs invalid ref forms, SHA-256 content integrity option with hash computation recipe, and PLUGIN_ALLOW_UNPINNED escape hatch Pairs with monorepo PR #775 (fix(security): plugin supply chain hardening). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Documents the breaking plugin supply chain hardening shipped in monorepo PR #775.
Breaking change for plugin users
github://owner/repoinstalls without a#tagor#sharef now return HTTP 422. This is a breaking API change — any automation callingPOST /workspaces/:id/pluginswith a bare GitHub source must be updated.Changes to
content/docs/plugins.mdxTwo-Axis Model sources table — replaced the mutable
github://owner/reporow withgithub://(pinned tag) andgithub://(SHA) rows, clarifying that pinned refs are the only valid form.Installing a Plugin — updated the GitHub install example from the old unpinned form to
#v1.0.0; added a<Callout type="warn">immediately after explaining the 422 behavior and linking to the new security section.Install Safeguards table — added
PLUGIN_ALLOW_UNPINNEDenv var row with explicit "development use only" warning.New
## Supply Chain Securitysection (SAFE-T1102) covering:#v1.2.3,#abc1234) vs invalid (bare repo) with HTTP 422sha256field, verification behavior, mismatch → 422 + cleanupPLUGIN_ALLOW_UNPINNED=trueescape hatch for local developmentPairs with
fix(security): plugin supply chain hardening — SAFE-T1102 (issue #768)PLUGIN_ALLOW_UNPINNEDenv var also reflected in monorepo PR #785 (.env.exampleaudit)Test plan
#v1.0.0pinned refPLUGIN_ALLOW_UNPINNEDrow appears in Install Safeguards tablegithub://owner/repoexamples remain in the file🤖 Generated with Claude Code