plugin:install pinned only modules chosen in the same plan, so a second
plugin package in a module the application already required was
installed at the newest release, moving the plugin already there, and
with --source the repository was cloned a second time. PlanInstall now
seeds every module of summer.yaml: a plugin in one installs at the
installed version with no go get or clone (only its summer.yaml entry),
and is refused with a plugin:update hint when that version has no
release of it or is not a release. A git URL whose repository is already
a submodule, or whose module the application has, is refused.
- --source clones each registry repository (https only) at the chosen tag,
adds it as a submodule under plugins/<vendor>/<name>, absorbs its git
dir and registers it with the tag as the go.mod require
- git URLs (https, ssh, user@host:path) are cloned with the user's git
setup and never sent to the registry; the newest tag whose plugin.yaml
framework minimum fits is checked out, else the default branch head
- go.work replace overrides for every local replace in workspace modules'
go.mod files (app target, versioned workspace module, or version pin)
- GIT_ALLOW_PROTOCOL=https:ssh, '--' before URLs and paths; non-git apps
are refused before cloning; plugin:add keeps require v0.0.0
