- --source clones each registry repository (https only) at the chosen tag,
adds it as a submodule under plugins/<vendor>/<name>, absorbs its git
dir and registers it with the tag as the go.mod require
- git URLs (https, ssh, user@host:path) are cloned with the user's git
setup and never sent to the registry; the newest tag whose plugin.yaml
framework minimum fits is checked out, else the default branch head
- go.work replace overrides for every local replace in workspace modules'
go.mod files (app target, versioned workspace module, or version pin)
- GIT_ALLOW_PROTOCOL=https:ssh, '--' before URLs and paths; non-git apps
are refused before cloning; plugin:add keeps require v0.0.0
- kiosk.Client reads the registry API v1 over fetchguard (trusted mode,
4 MiB, 10 s, no redirects); kiosk.RegistryURL reads plugins.registry_url
(default https://summercms.io, empty disables)
- build.PlanInstall/ApplyInstall pick the newest release the effective
framework satisfies (or a pin), validate registry strings, go get it and
append it to summer.yaml
- summer.yaml edits (plugin:add and plugin:install) keep comments and
blank lines
- TestInstallSmoke/module installs from a file:// GOPROXY and builds
