Add plugin lock-file upgrade - #6317
Merged
Merged
Conversation
samuv
requested review from
ChrisJBurns,
JAORMX,
amirejaz,
aponcedeleonch,
jhrozek,
rdimitrov and
reyortiz3
as code owners
August 13, 2026 16:43
26 tasks
github-actions
Bot
added
size/XL
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #6317 +/- ##
==========================================
- Coverage 77.72% 77.68% -0.05%
==========================================
Files 748 749 +1
Lines 71826 72126 +300
==========================================
+ Hits 55827 56029 +202
- Misses 15994 16092 +98
Partials 5 5 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
JAORMX
requested changes
Aug 13, 2026
JAORMX
left a comment
JAORMX
left a comment
Collaborator
There was a problem hiding this comment.
Panel review found inconsistent plain-name resolution, ambiguous preview API status, and missing required CLI coverage/completion. Please address the inline findings before merge. The transaction fixes requested on the earlier stack PRs also apply to this upgrade path.
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 14, 2026 08:16
9459007 to
eb5e5b4
Compare
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 14, 2026 08:46
eb5e5b4 to
d071d5a
Compare
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 14, 2026 08:57
d071d5a to
f51bf78
Compare
github-actions
Bot
added
size/XL
JAORMX
requested changes
Aug 14, 2026
JAORMX
left a comment
JAORMX
left a comment
Collaborator
There was a problem hiding this comment.
Local-store resolution, E2E coverage, and completion were addressed. The local apply path still drops the artifact/reference needed by persisted state and later sync.
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 14, 2026 12:52
f51bf78 to
f5b5f83
Compare
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 19, 2026 15:20
796523b to
4868efd
Compare
JAORMX
previously approved these changes
Aug 19, 2026
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 19, 2026 15:46
4868efd to
a18127f
Compare
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 19, 2026 17:40
a18127f to
e46c13e
Compare
github-actions
Bot
added
size/XL
samuv
force-pushed
the
plugins-lock/05-upgrade
branch
from
August 20, 2026 08:09
e46c13e to
e3dd9ba
Compare
Re-resolve plugins: lock entries and install newer content via thv ai-plugin upgrade and POST /plugins/upgrade. Signed-off-by: Samuele Verzi <samu@stacklok.com>
Plain-name lock entries now resolve the same way Install does, so a local rebuild is visible to upgrade. Also complete upgrade args from lock entries and cover fail-on-changes in the plugin CLI e2e. Signed-off-by: Samuele Verzi <samu@stacklok.com>
A bare local-store tag must not be rewritten as a Docker Hub digest reference; apply the resolved layer bytes instead. Signed-off-by: Samuele Verzi <samu@stacklok.com>
The DB should keep the local tag while the lock file keeps the previous restorable pin instead of a Docker Hub rewrite. Signed-off-by: Samuele Verzi <samu@stacklok.com>
A stale plan must not resurrect an uninstall or overwrite a newer install of the same plugin. Signed-off-by: Samuele Verzi <samu@stacklok.com>
Sync loads plain-source empty-reference pins by digest, and local upgrades no longer keep a stale remote resolved reference. Signed-off-by: Samuele Verzi <samu@stacklok.com>
jhrozek
approved these changes
Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
thv ai-plugin upgradeandPOST /plugins/upgradere-resolve eachplugins:lock entry'ssourceand install newer content when the digest moved (--preview/--allow-ref-change/--fail-on-changes).Sourceis never rewritten.--allow-ref-changeis passed. Signer-change guarding is Stack 2 / PR9 —--allow-signer-changeis not exposed yet.--fail-on-changesstill fetch OCI artifacts to compare digests (RFC: preview is not side-effect-free) but do not write the lock or install.TOOLHIVE_PLUGINS_LOCK_ENABLED(403 when off).Part of #6300. Stack 5/5 — schema → lock-service → install-hooks → sync → upgrade.
Type of change
Test plan
./pkg/plugins/pluginsvcupgrade tests and./pkg/api/v1upgrade endpoint tests, with the Taskfile race/ldflagsflags)task lint-fix)Does this introduce a user-facing change?
No by default — the feature is inert unless
TOOLHIVE_PLUGINS_LOCK_ENABLED=true. With the gate on,thv ai-plugin upgradere-resolvesplugins:lock entries.Special notes for reviewers
AllowSignerChangefrom skills; this PR does not enforce it and does not add the CLI flag.resolveLatestStatemirrors Install's dispatch (git → OCI → registry name) but stops short of extraction / DB / lock writes.