feat(#8): declare permissions on all plugins + strict lint#15
Merged
Conversation
Increment 5 of the registry supply-chain RFC (registry side). Add an accurate permissions: block to each plugin (controller/instance root/network/env/commands/ ports/files) and switch the lint workflow to 'spawn plugin validate --strict', which enforces the declared permissions match the plugin's steps. The permissions: block is a declared-interface addition → MINOR bump each: - tailscale v2.0.0→v2.1.0 - rstudio-server v1.0.1→v1.1.0 - spore-sync v1.1.0→v1.2.0 - globus-personal-endpoint v1.1.0→v1.2.0 lint.yml prefers --strict and falls back to plain validate on an older released spawn (the window before spawn with --strict ships).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Increment 5 of the registry supply-chain RFC — the registry side (decision #6).
What
permissions:block to each of the 4 plugins (controller/instance root/network/env/commands/ports/files), authored from each plugin's actual steps.spawn plugin validate --strict, which enforces the declared permissions match the steps (feat(plugin): 'plugin validate --strict' permission/step consistency check spawn#423).Version bumps (MINOR — the
permissions:block is a declared-interface addition)All 4 pass
spawn plugin validate --strictlocally.CI compatibility
lint.ymlprefers--strictbut falls back to plainvalidateon an older released spawn (the window before the spawn release carrying--strictships), so this doesn't red-CI in the meantime.Follow-up (separate, after the next spawn release)
rstudio-serverat v1.1.0 signed by the workflow; the stalerstudio-server-v1.0.1release will be deleted.Refs #8.