ReviewOS

also looking at this

stacks/buddy

fix(setup): make custom plugins able to run at all

#1416
Merged glennmichael123 wants to merge fix/json-plugins into main
5 files +401 -31
README.mdmodified+16-10
renamed throughout · 11 hidden lines
Changes to README.md
@@ -438,9 +438,9 @@ export JIRA_PROJECT_KEY="BUDDY" # Optional, defaults to BUDDY renamed throughout
438438Create custom integrations by defining plugins in `.buddy/plugins/`:
439439
440440```jsonc
441// .buddy/plugins/custom-integration.json
441// .buddy/plugins/custom-notify.json
442442{
443 "name": "custom-integration",
443 "name": "custom-notify",
444444 "version": "1.0.0",
445445 "enabled": true,
446446 "triggers": [
Changes to README.md
@@ -449,19 +449,25 @@ Create custom integrations by defining plugins in `.buddy/plugins/`:
449449 ],
450450 "hooks": [
451451 {
452 "name": "custom-notification",
452 "name": "notify",
453453 "priority": 10,
454 "async": true,
455 "handler": "// Custom JavaScript function"
454 "action": {
455 "type": "webhook",
456 "url": "https://your-webhook.com/notify",
457 "body": { "channel": "#builds" }
458 }
456459 }
457 ],
458 "configuration": {
459 "webhook_url": "https://your-custom-webhook.com/notify",
460 "api_key": "your-api-key"
461 }
460 ]
462461}
463462```
464463
464A hook declares an `action` rather than a function. JSON has no way to carry
465one, and reading a string out of a config file to run as code would turn any
466`.buddy/plugins/*.json` in a repository into arbitrary code execution on
467whoever runs `buddy setup`. The payload names the event and the repository
468and nothing else, plus whatever `body` adds — setup holds a token by the time
469hooks run, and the plugin file chooses the URL.
470
465471### Plugin Events
466472
467473| Event | Description | Context |