feat: add enterprise plugin system for ggshield #1167
+9,174
−8
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
agateau-gg
requested changes
Jan 26, 2026
Collaborator
agateau-gg
left a comment
agateau-gg
left a comment
There was a problem hiding this comment.
Started to review but then realized:
- There is no description
- CI is red
Can you fix those first? Putting the PR in draft for now.
clement-tourriere
force-pushed
the
poc_plugins
branch
4 times, most recently
from
9b29a08 to
be0a29f
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1167 +/- ##
==========================================
+ Coverage 92.05% 92.50% +0.45%
==========================================
Files 144 160 +16
Lines 6255 7646 +1391
==========================================
+ Hits 5758 7073 +1315
- Misses 497 573 +76
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
clement-tourriere
force-pushed
the
poc_plugins
branch
3 times, most recently
from
a51d3a7 to
19a5e5c
Compare
clement-tourriere
force-pushed
the
poc_plugins
branch
3 times, most recently
from
6c77613 to
ffeb247
Compare
clement-tourriere
force-pushed
the
poc_plugins
branch
3 times, most recently
from
b757666 to
abaff2c
Compare
Add the foundational plugin system for ggshield: - GGShieldPlugin base class and PluginMetadata - PluginRegistry for tracking loaded plugins - PluginLoader for discovering plugins from entry points and wheels - PluginAPIClient for fetching plugins from GitGuardian API - PluginDownloader for downloading and installing plugin wheels - EnterpriseConfig for plugin configuration - Platform detection utilities for wheel selection
Add ggshield plugin subcommands: - status: Show available plugins for account - install: Download and install a plugin - list: List installed plugins - enable/disable: Toggle plugin state - update: Update installed plugins - uninstall: Remove a plugin Integrate plugin loading into main entry point.
Add developer documentation for the enterprise plugin system and update project configuration.
Add --instance option to the root CLI group so it's available to all subcommands including plugin commands. This allows users to specify a custom GitGuardian instance URL before any subcommand.
Add support for installing plugins from multiple sources: - Local wheel files: `ggshield plugin install ./plugin.whl` - HTTPS URLs with optional SHA256 verification - GitHub release assets with repo tracking - GitHub Actions artifacts (requires GITHUB_TOKEN) Extend update system to track plugin sources in manifest and support auto-updates for GitGuardian API and GitHub release plugins. Non-updatable sources (local files, artifacts) are clearly identified. Includes security warnings for non-GitGuardian sources and HTTPS enforcement.
Plugins with same entry point name from both pip and local wheel were showing up twice in `plugin list`. Now local wheels are discovered first and their entry point names are used for deduplication. Changes: - Discover local wheels first, extract entry point names from wheels - Use entry point name (not package name) as plugin identifier - Skip pip entry points that match local wheel entry point names - Support lookup by entry point name in downloader (is_installed, uninstall)
When trying to uninstall a pip-installed plugin via `ggshield plugin uninstall`, show a helpful error message with the pip uninstall command instead of just saying "not installed".
Python cannot import native extensions (.so/.pyd files) directly from zip archives. Wheels containing native modules are now extracted to a directory before loading. The extracted directory is placed alongside the wheel file and is automatically re-extracted if the wheel is updated.
Add comprehensive tests for: - URL download edge cases (invalid scheme, network errors, invalid wheel) - GitHub artifact success path and error handling - _get_gh_token helper function - Non-updatable plugin handling in update command - GitHub release update checking helper functions - Error handling in all install source types
clement-tourriere
force-pushed
the
poc_plugins
branch
from
abaff2c to
373a19c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
This PR introduces an enterprise plugin system for ggshield, allowing organizations to extend ggshield with additional capabilities through plugins distributed by GitGuardian.
What has been done
New Plugin Commands
Added a new ggshield plugin command group with the following subcommands:
Core Plugin Infrastructure
Validation
PR check list
skip-changeloglabel has been added to the PR.