Skip to content

fix: validate plugin input early before git operations [ED-25747] - #61

Merged
davseve merged 1 commit into
mainfrom
cursor/validate-plugin-input-early-3838
Oct 11, 2026
Merged

davseve merged 1 commit into
mainfrom
cursor/validate-plugin-input-early-3838

Conversation

@davseve

@davseve davseve commented Oct 8, 2026 •

Copy link
Copy Markdown
Member

Summary

Addresses @Ntnelbaba's code review comment on PR #60: "And if the value is 'koko'?"

This PR makes invalid plugin input values (like "koko") fail fast with a clear error message before any git branch operations occur, preventing wasted work and avoiding branch checkout mutations.

Background

PR #60 added a new plugin input (core or pro) to the release-tag-creation composite action. The validation logic resolvePluginConfig(plugin) in plugin-config.ts already throws plugin must be "core" or "pro", got "<x>" for invalid values, but that validation only ran inside the "Update version files" step (step 5), which is AFTER:

  1. Install dependencies
  2. Handle version input
  3. Switch to release branch (git checkout) ← branch mutated
  4. Config git user

So an invalid plugin value like "koko" would waste work and mutate the working tree before failing.

What Changed

  • Early validation: main.ts now imports and calls resolvePluginConfig(plugin) at the very start of the run() function, before any version format checks or git operations.
  • New helper: Added getPlugin() to read INPUT_PLUGIN env var (defaults to "core").
  • Action YAML: Added INPUT_PLUGIN: ${{ inputs.plugin }} to the "Handle version input" step so the plugin value is available.
  • Tests:
    • Created main.test.ts with unit tests for the plugin validation behavior.
    • Extended plugin-config.test.ts to explicitly include the "koko" test case mentioned in the review.

How It Works

The "Handle version input" step now:

  1. ✅ Validates plugin (resolvePluginConfig(plugin))
  2. ✅ Validates version format
  3. ✅ Checks tag doesn't exist
  4. ✅ Derives channel and branch

Only after all input validations pass does the workflow proceed to git checkout of the release branch.

Testing

  • ✅ vitest passes (49 tests including new plugin validation tests)
  • ✅ tsc type-checking passes
  • ✅ eslint passes

Related

Open in Web Open in Cursor 

Address code review comment from PR #60: validate the plugin input
('core' or 'pro') in the 'Handle version input' step before any git
branch operations occur. This ensures invalid plugin values like 'koko'
fail fast with a clear error message, preventing wasted work and
avoiding branch checkout mutations.

Changes:
- Import and call resolvePluginConfig() at the start of main.ts run()
- Add INPUT_PLUGIN env var to 'Handle version input' step in action.yml
- Add getPlugin() helper to read INPUT_PLUGIN (defaults to 'core')
- Add unit tests for plugin validation behavior
- Extend plugin-config.test.ts to explicitly test 'koko' case

Ref: #60

Co-authored-by: Davids Seveloff <davseve@users.noreply.github.com>
@davseve
davseve requested a review from Ntnelbaba October 11, 2026 06:03
@davseve
davseve marked this pull request as ready for review October 11, 2026 06:03
}

export function getPlugin(): string {
return (process.env['INPUT_PLUGIN'] ?? 'core').trim();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low: getPlugin() trims, but update-version-files.ts reads INPUT_PLUGIN via getEnv() without trimming. A value like " pro " passes this early check and then fails in 'Update version files' (after the release-branch checkout), which is the late failure this PR is meant to prevent. Either drop .trim() here so both steps reject it at step 2, or trim in update-version-files.ts as well.

@@ -0,0 +1,36 @@
import { describe, expect, it } from 'vitest';

import { resolvePluginConfig } from './plugin-config.ts';

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low: this file never imports main.ts; it only re-tests resolvePluginConfig, which plugin-config.test.ts already covers (koko is now in both). getPlugin()'s default/trim and the 'plugin is validated before git ls-remote' order in run() are untested. Because main.ts ends with a bare run();, consider the same split as #60 (run-main.ts entrypoint), then test run() with INPUT_PLUGIN=koko and assert process.exit(1) and that spawnSync was never called.

@davseve
davseve merged commit 74590be into main Oct 11, 2026
17 of 18 checks passed
@davseve
davseve deleted the cursor/validate-plugin-input-early-3838 branch October 11, 2026 08:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants