[FEATURE] Allow unofficial plugins to be installed about prettier_action HOT 5 CLOSED

For anyone else who runs across this issue, there's an injection bug you can use to install your own plugins:

      - name: Prettify code
        uses: creyD/[email protected]
        with:
          prettier_version: latest prettier-plugin-organize-imports typescript
          prettier_options: --write **/*.{ts,tsx,js,jsx,md}
          commit_message: "style: format with prettier"

So I suppose this is also a minor bug report for an injection bug on this line: https://github.com/creyD/prettier_action/blob/master/entrypoint.sh#L35

from prettier_action.

@stemount @infotexture I think you have a deeper understanding, why we opted for the official plugins only in #22 ? Was this a security issue or could we just open this up?

from prettier_action.

@creyD IIRC, in #25 (comment) @stemount was concerned about the security implications of allowing unknown code to be run/installed in addition to the official plug-ins.

I get this restriction and am fine with the limitation, but I understand that others that rely on third-party plug-ins need a way to install them with an action.

Not sure how to best reconcile those concerns, but if nothing else, this may be a case for forking the action and dropping the restriction from the fork.

from prettier_action.

That's what I did for now.

It is indeed tricky to solve. What if you'd have to explicitly pass something like allow_insecure_install: true parameter to clearly indicate that whatever goes in prettier_plugins will be passed straight to npm?

from prettier_action.

That's what I did for now.

It is indeed tricky to solve. What if you'd have to explicitly pass something like allow_insecure_install: true parameter to clearly indicate that whatever goes in prettier_plugins will be passed straight to npm?

Pretty good idea for the future. The in official plugins option will go live with version 4.0 as soon as the issues with #37 are resolved. Thanks a lot for your help all of you!

from prettier_action.