feat(plugin): enforce certified archive admission (#2553)

* feat(plugin): add certified admission policy

* feat(plugin): enforce certified archive admission

* chore(plugin): pin certified SDK beta

* fix(plugin): consume SDK beta 5

* style(plugin): format certification admission
This commit is contained in:
RockChinQ
2026-09-20 18:54:45 +08:00
committed by GitHub
parent 8f8356fe97
commit 20a04a77bf
14 changed files with 871 additions and 71 deletions
@@ -272,6 +272,12 @@ async def test_local_install_persists_verified_package_before_runtime_apply():
connector._inspect_plugin_package = Mock(return_value=('author', 'plugin'))
connector._store_artifact_package = AsyncMock()
connector._persist_installation_package = AsyncMock(return_value=(binding, None, False))
connector._admit_plugin_archive = Mock(
return_value=(
{'_certification': {'normalized_digest': digest}},
SimpleNamespace(for_installation=lambda _installation_uuid: SimpleNamespace(artifact_digest=digest)),
)
)
connector._wait_for_installed_plugin_ready = AsyncMock()
await connector.install_plugin(