Publish plugin package hashes in registry

[SeoFood]

Summary

• calculate the SHA-256 digest for each published plugin ZIP
• write the digest to new and existing plugins.json registry entries
• serve registry downloads from the same GitHub Pages origin as the registry
• add regression coverage for the plugin release workflow

Root cause

Microsoft Store builds require each downloadable plugin package to have a trusted SHA-256 digest. The Store package added that verification, but the plugin publishing workflow never populated the sha256 registry field, so Store installs always failed after downloading the package. Plugin URLs also redirected from the reachable registry origin to release-assets.githubusercontent.com, adding a second network boundary during certification.

Validation

• dotnet test tests/TypeWhisper.PluginSystem.Tests/TypeWhisper.PluginSystem.Tests.csproj --no-restore --filter FullyQualifiedName~PluginPackagingWorkflowTests
• live registry backfill verified separately for all 34 current plugin packages
• all 34 Pages ZIP archives opened successfully and matched their published SHA-256 digest

Summary by CodeRabbit

• New Features

  • Plugin downloads now use a dedicated hosting URL.
  • Published plugins include a SHA-256 integrity hash in the plugin registry.

• Tests

  • Added coverage to verify plugin packages publish correctly with download URLs and integrity hashes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ee68f9a-b881-4eb8-a666-63c5a3e3633c

📥 Commits

Reviewing files that changed from the base of the PR and between 01dac66 and d7e5528.

📒 Files selected for processing (2)

• .github/workflows/publish-plugins.yml
• tests/TypeWhisper.PluginSystem.Tests/PluginPackagingWorkflowTests.cs

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/publish-plugins.yml
• tests/TypeWhisper.PluginSystem.Tests/PluginPackagingWorkflowTests.cs

---

📝 Walkthrough

Walkthrough

The plugin publishing workflow now computes a SHA-256 hash for each ZIP, records it in plugins.json for existing and new entries, uses a hosted plugin URL, and validates these declarations with a workflow test.

Changes

Plugin hash registry

Layer / File(s)	Summary
Compute and persist plugin package hash .github/workflows/publish-plugins.yml, tests/TypeWhisper.PluginSystem.Tests/PluginPackagingWorkflowTests.cs	The workflow hashes the generated ZIP, exports PLUGIN_SHA256, writes sha256 to registry entries, changes the plugin download URL, and tests the resulting workflow expressions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit with a hash in my hat,
ZIP bytes checked—imagine that!
Registry fields now shine bright,
Hosted URLs hop just right,
Tests nibble the workflow clean.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: publishing plugin package hashes in the registry.
Description check	✅ Passed	The description is mostly complete and includes summary, root cause, and validation, though Related Issue and Notes sections are missing.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch seofood/fix-store-plugin-registry-hashes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[SeoFood]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.