| 1 | #!/usr/bin/env python3 |
| 2 | """Generate the built-in catalog from the first-party marketplace checkout. |
| 3 | |
| 4 | No install, trust, enablement, network fetch, or plugin execution occurs here. |
| 5 | Run with --check in CI; without it, review the generated snapshot diff. |
| 6 | """ |
| 7 | import argparse |
| 8 | import json |
| 9 | from pathlib import Path |
| 10 | import subprocess |
| 11 | |
| 12 | ROOT = Path(__file__).resolve().parents[1] |
| 13 | REPOSITORY = "https://github.com/Hmbown/codewhale-plugin-marketplace" |
| 14 | parser = argparse.ArgumentParser(description=__doc__) |
| 15 | parser.add_argument("--marketplace", type=Path, default=ROOT.parent / "codewhale-plugin-marketplace") |
| 16 | parser.add_argument("--check", action="store_true") |
| 17 | args = parser.parse_args() |
| 18 | source = args.marketplace.resolve() |
| 19 | raw = subprocess.check_output(["git", "show", "HEAD:marketplace.json"], cwd=source) |
| 20 | revision = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=source, text=True).strip() |
| 21 | catalog = json.loads(raw) |
| 22 | for candidate in catalog["plugins"]: |
| 23 | spec = candidate["source"] |
| 24 | if not spec.startswith("path:"): |
| 25 | raise SystemExit(f"unexpected first-party source: {spec}") |
| 26 | relative = spec[5:] |
| 27 | if any(part in ("", ".", "..") or not all(c.isascii() and (c.isalnum() or c in "-_.") for c in part) for part in relative.split("/")): |
| 28 | raise SystemExit(f"unsafe bundle path: {relative}") |
| 29 | # Pin every install source to the reviewed marketplace revision so the |
| 30 | # bytes a user installs are the bytes this snapshot describes. Freshness |
| 31 | # comes from bumping the pin (the marketplace-sync workflow reports drift |
| 32 | # against `main` weekly); `/plugin update` re-downloads the same archive |
| 33 | # and reports no change until the pin moves. |
| 34 | candidate["source"] = f"https://codeload.github.com/Hmbown/codewhale-plugin-marketplace/tar.gz/{revision}#path={relative}" |
| 35 | snapshot = {"repository": REPOSITORY, "revision": revision, "catalog": catalog} |
| 36 | rendered = json.dumps(snapshot, indent=2, ensure_ascii=False) + "\n" |
| 37 | output = ROOT / "crates/tui/assets/first-party-marketplace.json" |
| 38 | if args.check: |
| 39 | if not output.exists() or output.read_text() != rendered: |
| 40 | raise SystemExit("First-party catalog drift: run python3 scripts/sync-marketplace.py, review, and rebuild.") |
| 41 | print(f"First-party catalog matches marketplace {revision}") |
| 42 | else: |
| 43 | output.write_text(rendered) |
| 44 | print(f"Updated {output} from marketplace {revision}") |
| 45 |