plugin-scanner 2.0.6__tar.gz → 2.0.8__tar.gz

plugin_scanner-2.0.8/.github/workflows/scorecard.yml

@@ -0,0 +1,39 @@
+name: OpenSSF Scorecard
+on:
+  schedule:
+    - cron: '0 0 * * 0'
+  push:
+    branches: [main]
+permissions: read-all
+
+jobs:
+  scorecard:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      security-events: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+        if: always()
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
+        with:
+          sarif_file: results.sarif
+        if: always()

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.6
+Version: 2.0.8
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/ai-plugin-scanner
 Project-URL: Repository, https://github.com/hashgraph-online/ai-plugin-scanner
@@ -30,6 +30,7 @@ Requires-Dist: build>=1.2.2; extra == 'dev'
 Requires-Dist: jsonschema>=4.23.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
+Requires-Dist: pyyaml>=6.0; extra == 'dev'
 Requires-Dist: ruff>=0.4.0; extra == 'dev'
 Provides-Extra: publish
 Requires-Dist: twine>=6.1.0; extra == 'publish'

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.6"
+version = "2.0.8"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"
@@ -37,6 +37,7 @@ cisco = []
 dev = [
     "build>=1.2.2",
     "jsonschema>=4.23.0",
+    "pyyaml>=6.0",
     "pytest>=7.0",
     "pytest-cov>=4.0",
     "ruff>=0.4.0",

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.6"
+version = "2.0.8"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"
@@ -37,6 +37,7 @@ cisco = []
 dev = [
     "build>=1.2.2",
     "jsonschema>=4.23.0",
+    "pyyaml>=6.0",
     "pytest>=7.0",
     "pytest-cov>=4.0",
     "ruff>=0.4.0",

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/src/codex_plugin_scanner/guard/cli/install_commands.py

@@ -43,6 +43,8 @@ def _resolve_targets(
     context: HarnessContext,
     store: GuardStore,
 ) -> list[str]:
+    if requested_harness is not None and install_all:
+        raise ValueError("Pass either a harness or --all, not both.")
     if requested_harness is not None and not install_all:
         return [requested_harness]
     if not install_all:

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -116,12 +116,18 @@ def sync_receipts(store: GuardStore) -> dict[str, object]:
     policy = payload.get("policy")
     if isinstance(policy, dict):
         store.set_sync_payload("policy", policy, now)
+    else:
+        store.set_sync_payload("policy", {}, now)
     alert_preferences = payload.get("alertPreferences")
     if isinstance(alert_preferences, dict):
         store.set_sync_payload("alert_preferences", alert_preferences, now)
+    else:
+        store.set_sync_payload("alert_preferences", {}, now)
     team_policy_pack = payload.get("teamPolicyPack")
     if isinstance(team_policy_pack, dict):
         store.set_sync_payload("team_policy_pack", team_policy_pack, now)
+    else:
+        store.set_sync_payload("team_policy_pack", {}, now)
     exceptions = payload.get("exceptions")
     remote_decisions = _build_remote_policy_decisions(payload)
     store.replace_remote_policies(remote_decisions, now)

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.6"
+__version__ = "2.0.8"

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/tests/test_action_bundle.py

@@ -2,6 +2,8 @@
 
 from pathlib import Path
 
+import yaml
+
 ROOT = Path(__file__).resolve().parent.parent
 
 
@@ -134,6 +136,32 @@ def test_ci_workflow_covers_cross_platform_runtime() -> None:
     assert "macos-latest" in workflow_text
 
 
+def test_scorecard_workflow_matches_official_install_pattern() -> None:
+    workflow_text = (ROOT / ".github" / "workflows" / "scorecard.yml").read_text(encoding="utf-8")
+    workflow = yaml.safe_load(workflow_text)
+
+    assert "name: OpenSSF Scorecard" in workflow_text
+    assert "permissions: read-all" in workflow_text
+    assert "branches: [main]" in workflow_text
+    assert workflow["jobs"]["scorecard"]["permissions"]["actions"] == "read"
+    assert workflow["jobs"]["scorecard"]["permissions"]["contents"] == "read"
+    assert "id-token: write" in workflow_text
+    assert "security-events: write" in workflow_text
+    assert 'uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' in workflow_text
+    assert 'uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a' in workflow_text
+    assert "results_file: results.sarif" in workflow_text
+    assert "results_format: sarif" in workflow_text
+    assert "publish_results: true" in workflow_text
+    assert 'uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' in workflow_text
+    assert "persist-credentials: false" in workflow_text
+    assert "path: results.sarif" in workflow_text
+    assert "retention-days: 5" in workflow_text
+    assert workflow_text.count("if: always()") == 2
+    assert 'uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13' in workflow_text
+    assert "sarif_file: results.sarif" in workflow_text
+    assert "if: always()" in workflow_text
+
+
 def test_harness_smoke_workflow_covers_nightly_self_hosted_release_gate() -> None:
     workflow_text = (ROOT / ".github" / "workflows" / "harness-smoke.yml").read_text(encoding="utf-8")
 

{plugin_scanner-2.0.6 → plugin_scanner-2.0.8}/tests/test_guard_cli.py

@@ -16,6 +16,7 @@ from codex_plugin_scanner.cli import main
 from codex_plugin_scanner.guard.adapters import cursor as cursor_adapter_module
 from codex_plugin_scanner.guard.cli import commands as guard_commands_module
 from codex_plugin_scanner.guard.cli.render import emit_guard_payload
+from codex_plugin_scanner.guard.store import GuardStore
 
 FIXTURES = Path(__file__).parent / "fixtures"
 
@@ -1270,6 +1271,29 @@ args = ["workspace-skill.js", "--changed"]
         assert rc == 2
         assert "Guard install requires a harness or --all." in stderr
 
+    @pytest.mark.parametrize("command", ["install", "uninstall"])
+    def test_guard_install_commands_reject_harness_with_all(self, tmp_path, capsys, command: str):
+        home_dir = tmp_path / "home"
+        workspace_dir = tmp_path / "workspace"
+        _build_guard_fixture(home_dir, workspace_dir)
+
+        rc = main(
+            [
+                "guard",
+                command,
+                "codex",
+                "--all",
+                "--home",
+                str(home_dir),
+                "--workspace",
+                str(workspace_dir),
+            ]
+        )
+        stderr = capsys.readouterr().err
+
+        assert rc == 2
+        assert "Pass either a harness or --all, not both." in stderr
+
     def test_guard_login_and_sync_posts_receipts(self, tmp_path, capsys):
         home_dir = tmp_path / "home"
         workspace_dir = tmp_path / "workspace"
@@ -1519,6 +1543,79 @@ args = ["workspace-skill.js", "--changed"]
         assert exceptions_rc == 0
         assert exceptions_output["items"][0]["expires_at"] == "2099-01-01T00:00:00+00:00"
 
+    def test_guard_sync_clears_cached_policy_when_server_omits_it(self, tmp_path, capsys):
+        home_dir = tmp_path / "home"
+        _SyncRequestHandler.response_payload = {
+            "syncedAt": "2026-04-09T00:00:00Z",
+            "receiptsStored": 0,
+            "inventoryStored": 0,
+            "inventoryDiff": {"generatedAt": "2026-04-09T00:00:00Z", "items": []},
+            "advisories": [],
+            "policy": {
+                "mode": "enforce",
+                "defaultAction": "warn",
+                "unknownPublisherAction": "review",
+                "changedHashAction": "require-reapproval",
+            },
+            "alertPreferences": {
+                "emailEnabled": True,
+                "digestMode": "daily",
+            },
+            "teamPolicyPack": {
+                "name": "Security team default",
+                "allowedPublishers": ["hashgraph-online"],
+            },
+        }
+
+        server = HTTPServer(("127.0.0.1", 0), _SyncRequestHandler)
+        thread = threading.Thread(target=server.serve_forever, daemon=True)
+        thread.start()
+        try:
+            login_rc = main(
+                [
+                    "guard",
+                    "login",
+                    "--home",
+                    str(home_dir),
+                    "--sync-url",
+                    f"http://127.0.0.1:{server.server_port}/receipts",
+                    "--token",
+                    "demo-token",
+                    "--json",
+                ]
+            )
+            json.loads(capsys.readouterr().out)
+
+            first_sync_rc = main(["guard", "sync", "--home", str(home_dir), "--json"])
+            json.loads(capsys.readouterr().out)
+
+            _SyncRequestHandler.response_payload = {
+                "syncedAt": "2026-04-10T00:00:00Z",
+                "receiptsStored": 0,
+                "inventoryStored": 0,
+                "inventoryDiff": {"generatedAt": "2026-04-10T00:00:00Z", "items": []},
+                "advisories": [],
+            }
+
+            second_sync_rc = main(["guard", "sync", "--home", str(home_dir), "--json"])
+            json.loads(capsys.readouterr().out)
+        finally:
+            server.shutdown()
+            thread.join(timeout=5)
+
+        policy_rc = main(["guard", "policies", "--home", str(home_dir), "--json"])
+        policy_output = json.loads(capsys.readouterr().out)
+        store = GuardStore(home_dir)
+
+        assert login_rc == 0
+        assert first_sync_rc == 0
+        assert second_sync_rc == 0
+        assert policy_rc == 0
+        assert not any(item["source"] == "cloud-sync" for item in policy_output["items"])
+        assert store.get_sync_payload("policy") == {}
+        assert store.get_sync_payload("alert_preferences") == {}
+        assert store.get_sync_payload("team_policy_pack") == {}
+
     def test_guard_run_auto_syncs_cloud_policy_bundle(self, tmp_path, capsys):
         home_dir = tmp_path / "home"
         workspace_dir = tmp_path / "workspace"

plugin_scanner-2.0.6/.github/workflows/scorecard.yml

@@ -1,27 +0,0 @@
-name: OpenSSF Scorecard
-on:
-  schedule:
-    - cron: '0 0 * * 0'
-  push:
-    branches: [main]
-permissions:
-  contents: read
-jobs:
-  scorecard:
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      security-events: write
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-      - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
-        with:
-          sarif_file: results.sarif
-        if: always()