Support installing plugins from private URLs or registries

[mikkelhegn]

The two options available to install plugins today is a public URL or accessible file location. For scenarios where you only want to share a plugin with a defined group of people, if would be great to be able to be bale to use either a private registry or URL to share plugins.

[karthik2804]

Support from installing from private URLs was added recently via #2896. One can now do spin plugins install --url <url> --auth-header-value <authentication header value> to install plugins from secured endpoints. Is that sufficient for this?

[mikkelhegn]

Can you help describe the procedure to install a plug-in from a private GitHub repo? I think that's the most likely scenario which would be great to support.

[karthik2804]

GIthub repo is currently slightly complicated as for private repositories you cannot directly curl the releases. You will have to go through the github API, which spin does not have any understanding of. The solution to this would be to have a proxy app that takes a github token which it uses to fetch the appropriate asset.

An alternate but not suggested way is to check in the files into the repo. If this is done then you can install by using

spin plugins install --url <https://raw.githubusercontent.com/<github account>/<repo name>/refs/heads/<branch>/<path to plugin manifest> --auth-header-value "token: <gh token>"

[itowlson]

Is anything more required on this e.g.

• Do we need to do any more work on private URLs?
  • If so, what?
• Do we also need private plugin registries?
  • If so, can we elaborate on the requirements and UX (e.g. GH collaborators or roles, PATs, etc.)

Or can we close it as "done enough for now"?

[mikkelhegn]

I think documenting the private install option, which @karthik2804 described above here: https://spinframework.dev/v3/managing-plugins#installing-a-plugin-from-a-url would be good.

I don't think more work is needed.