_get_ep_compliance_dirs collapsed compliance directories into a dict keyed
by provider, so when two or more dynamically-registered packages shipped
compliance for the same provider, only one survived and the others were
silently dropped from discovery, default output modes and the stdout table.
Accumulate the directories per provider and iterate them all in
get_available_compliance_frameworks, matching the behaviour Compliance.get_bulk
already had. Built-in precedence and filename-stem dedup are preserved.
- Source provider-type choices and creation validation from get_app_providers()
- Hide CLI/SDK-only providers (llm, nhn, scaleway, stackit) from the API
- get_credentials_schema returns schemas keyed by secret type
- validate an external provider's secret against the schema for its
secret_type instead of accepting any declared schema
- reject a secret_type the provider does not declare
- Validate the secret is a JSON object before the no-schema path accepts it,
so a list/string/null cannot be persisted and fail later at {**secret}
- Add parametrized coverage for list/string/null/int payloads
- Move get_provider_type_choices into a leaf module so the provider
serializer field reuses the filters' cached list instead of recomputing
SDK provider discovery on every request
- Backfill provider_str synchronously in 0095 (single UPDATE) so the column
is populated before 0096 sets it NOT NULL, removing the Celery race
- Recreate the unique index inside 0096's transaction with a lock_timeout,
closing the duplicate-provider window left by the concurrent rebuild
- Drop migration 0097 and the now-unused backfill_provider_str task
- Reword get_class docstring: it may populate the _ep_providers cache,
rather than claiming "no global state"
- Assert ImportError specifically in the unknown-provider test to enforce
the public API contract
- Drop the unused provider_class_name left over after get_class delegation
- Compare the module's last dotted segment instead of substring
- Prevent a provider name from capturing overlapping built-ins
- Add parametrized regression test (cloud, git, work, open cases)
- Update get_bulk test mock to the real dotted module name
- Match shadowing entry point by name instead of calling ep.load()
- Prevent plug-in code from executing during a built-in run
- Update regression test to assert ep.load is never called
- Short-circuit on is_builtin_provider before loading entry points
- Prevent same-name plug-ins from flipping a built-in onto the tool-wrapper path
- Avoid executing plug-in code via ep.load() for built-in names
- Add regression test asserting ep.load is never called
- Gate threatscore/ens/nis2/csa reports on the provider's available
compliance frameworks instead of hard-coded provider whitelists
- Reference the ASFF/SecurityHub gate via the provider enum symbol
- Cover external-provider report availability and generic compliance
fallback with tests
- Add get_credentials_schema to the provider contract
- Validate non-built-in secrets against the declared schema; built-ins unchanged
- Accept secrets as-is when no schema is declared (validated at connection)
- Add get_scan_arguments/get_connection_arguments to the provider contract
- Route non-built-in providers through the contract; built-ins unchanged
- Cover the external dynamic path in tests
- Replace the hardcoded provider match with Provider.get_class
- Drop the closed provider-type union and TYPE_CHECKING imports
- Cover built-in and external entry-point resolution in tests
StylusFrost