Add version parity checks to external plugin quality gates#2307
Merged
aaronpowell merged 3 commits intoJul 16, 2026
Conversation
Enforce external.json version matching against remote plugin.json for source ref and/or sha in shared quality gates, and surface the new gate status/output in intake and PR workflows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8aa3e98d-1873-4cab-8866-1b2efd0f24ad
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new “version match” quality gate for external plugins so plugins/external.json’s declared version is validated against the remote plugin.json at the submitted immutable locators, and propagates the new gate’s status/output through intake and PR reporting workflows.
Changes:
- Extend
eng/external-plugin-quality-gates.mjsto fetch/readplugin.jsonatsource.refand/orsource.shaand fail on version mismatch (with a newversion_match_status+ output field). - Surface the new gate in PR summaries and intake comments (tables + detailed output sections).
- Align workflow fallback payload keys to use
vally_lint_statusand includeversion_match_status.
Show a summary per file
| File | Description |
|---|---|
| eng/external-plugin-quality-gates.mjs | Implements the version match gate and includes its status in overall quality results. |
| eng/external-plugin-pr-quality-gates.mjs | Includes the version match status in PR gate summary output. |
| eng/external-plugin-intake.mjs | Adds version match status/output to intake comment rendering. |
| .github/workflows/external-plugin-pr-quality-gates.yml | Updates PR workflow reporting tables/details to include version match and fallback payloads. |
| .github/workflows/external-plugin-intake.yml | Updates intake workflow fallback payloads to the correct status fields and adds version match. |
| .github/workflows/external-plugin-command-router.yml | Updates command-router workflow fallback payloads to the correct status fields and adds version match. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Low
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
aaronpowell
deleted the
aaronpowell-external-plugin-version-match-validation
branch
July 16, 2026 02:39
| ); | ||
|
|
||
| for (const manifestPath of manifestCandidates) { | ||
| const showResult = runCommand("git", ["show", `${locator}:${manifestPath}`], { cwd: repoDir }); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
npm startand verified thatREADME.mdis up to date.mainbranch for this pull request.Description
This closes a validation gap where an external plugin entry could declare a version in
plugins/external.jsonthat does not match the remoteplugin.jsonat the submittedsource.refand/orsource.sha.The shared external plugin quality gate now includes a new
version matchgate that fetches and readsplugin.jsonfrom each provided locator, compares versions, and fails with submitter-fix output on mismatch, missing manifests, or invalid manifest JSON. The new gate is wired through issue intake and PR quality summaries, including status columns and detailed gate output sections.I also aligned workflow fallback payloads to use
vally_lint_status(instead of the staleskill_validator_status) and addedversion_match_statuswhen quality jobs fail unexpectedly.Type of Contribution
Additional Notes
N/A
By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.