- --source clones each registry repository (https only) at the chosen tag, adds it as a submodule under plugins/<vendor>/<name>, absorbs its git dir and registers it with the tag as the go.mod require - git URLs (https, ssh, user@host:path) are cloned with the user's git setup and never sent to the registry; the newest tag whose plugin.yaml framework minimum fits is checked out, else the default branch head - go.work replace overrides for every local replace in workspace modules' go.mod files (app target, versioned workspace module, or version pin) - GIT_ALLOW_PROTOCOL=https:ssh, '--' before URLs and paths; non-git apps are refused before cloning; plugin:add keeps require v0.0.0
12 KiB
12 KiB