- Source provider-type choices and creation validation from get_app_providers()
- Hide CLI/SDK-only providers (llm, nhn, scaleway, stackit) from the API
- get_credentials_schema returns schemas keyed by secret type
- validate an external provider's secret against the schema for its
secret_type instead of accepting any declared schema
- reject a secret_type the provider does not declare
- Validate the secret is a JSON object before the no-schema path accepts it,
so a list/string/null cannot be persisted and fail later at {**secret}
- Add parametrized coverage for list/string/null/int payloads
- Move get_provider_type_choices into a leaf module so the provider
serializer field reuses the filters' cached list instead of recomputing
SDK provider discovery on every request
- Backfill provider_str synchronously in 0095 (single UPDATE) so the column
is populated before 0096 sets it NOT NULL, removing the Celery race
- Recreate the unique index inside 0096's transaction with a lock_timeout,
closing the duplicate-provider window left by the concurrent rebuild
- Drop migration 0097 and the now-unused backfill_provider_str task
- Reword get_class docstring: it may populate the _ep_providers cache,
rather than claiming "no global state"
- Assert ImportError specifically in the unknown-provider test to enforce
the public API contract
- Drop the unused provider_class_name left over after get_class delegation
- Compare the module's last dotted segment instead of substring
- Prevent a provider name from capturing overlapping built-ins
- Add parametrized regression test (cloud, git, work, open cases)
- Update get_bulk test mock to the real dotted module name
- Match shadowing entry point by name instead of calling ep.load()
- Prevent plug-in code from executing during a built-in run
- Update regression test to assert ep.load is never called
- Short-circuit on is_builtin_provider before loading entry points
- Prevent same-name plug-ins from flipping a built-in onto the tool-wrapper path
- Avoid executing plug-in code via ep.load() for built-in names
- Add regression test asserting ep.load is never called
- Gate threatscore/ens/nis2/csa reports on the provider's available
compliance frameworks instead of hard-coded provider whitelists
- Reference the ASFF/SecurityHub gate via the provider enum symbol
- Cover external-provider report availability and generic compliance
fallback with tests
- Add get_credentials_schema to the provider contract
- Validate non-built-in secrets against the declared schema; built-ins unchanged
- Accept secrets as-is when no schema is declared (validated at connection)
- Add get_scan_arguments/get_connection_arguments to the provider contract
- Route non-built-in providers through the contract; built-ins unchanged
- Cover the external dynamic path in tests
- Replace the hardcoded provider match with Provider.get_class
- Drop the closed provider-type union and TYPE_CHECKING imports
- Cover built-in and external entry-point resolution in tests
- Replace the static provider enum in filters with the SDK provider list
- Cache the provider-type choices for hot list endpoints
- Drop the dead provider enum filter override
- Drive provider validity from the SDK instead of a static enum
- Tolerate providers without a uid validator at model clean()
- Accept any SDK-exposed provider in the provider serializer field
StylusFrost