Skip to content

fix(registry): stop serving empty transactional-email, gate empty plugins (D-1458, D-0515, D-0145) - #474

Merged
acamarata merged 1 commit into
mainfrom
dw1-plugins-8
Oct 25, 2026
Merged

acamarata merged 1 commit into
mainfrom
dw1-plugins-8

Conversation

@acamarata

Copy link
Copy Markdown
Contributor

D-1458 (fixed)

transactional-email has only plugin.json, README.md and SPEC.md in free/, yet registry.json served a signed tarball for it.

  • Removed its row from releases.json (the generator leaves an entry with no release row out of the registry) and regenerated registry.json, catalog.json, counts.json with scripts/plugin-counts.sh. The diff is that one entry plus counts (free entries 131 to 130; advertised stays 168).
  • Added scripts/ci/tests/test_registry_empty_plugins.py (picked up by the hygiene unittest discover). It fails when an entry carries a tarball for a plugin directory holding only manifest and docs. It fails on origin/main (['transactional-email']) and passes here.
  • The same defect exists for 7 more entries (family-familysearch, family-myheritage, family-wikitree, nself-geo, nself-image, nself-pdf, nself-scan). Hiding those is a product-scope call, so they sit in a shrink-only EMPTY_SERVED baseline in the test.
  • Not changed: scripts/verify-published-checksums.sh --write will re-add a row for a planned plugin whose tarball is on a release. The new gate turns that regeneration red instead of silently re-serving it.

D-0515 (already fixed, no change)

No v1.2.7 reference remains in registry.json, catalog.json or releases.json. ci, functions, plugin-dev and traefik point at releases/download/v1.2.13/<name>-1.2.13.tar.gz; those assets exist on release v1.2.13 and each registry checksum equals the published .sha256 asset.

D-0145 (already fixed, no change)

Fixed by #236 (D-0776). No proxy_pass or upstream server in free/*/nginx targets loopback or *.localhost (the .localhost hits are server_name vhosts). test_plugin_nginx_upstreams.py enforces it and passes.

Commands run

  • python3 -m unittest discover -s scripts/ci/tests: 81 tests OK
  • scripts/plugin-counts.sh --check and --check --free-only: current
  • python3 -m unittest ... -p test_registry_empty_plugins.py against origin/main's registry.json: 1 failure; against the regenerated one: OK
  • gh release download v1.2.13 -p <name>-1.2.13.tar.gz.sha256 vs registry checksums for the four plugins: match

…gate empty plugins (D-1458)

Drop the transactional-email row from releases.json and regenerate registry.json, catalog.json and counts.json with scripts/plugin-counts.sh. Add a registry gate that fails when an entry carries a tarball for a plugin whose directory holds only manifest and docs; the seven other planned plugins are listed as a shrink-only baseline.
@acamarata
acamarata merged commit 88d9cf7 into main Oct 25, 2026
25 of 26 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant