- Source provider-type choices and creation validation from get_app_providers()
- Hide CLI/SDK-only providers (llm, nhn, scaleway, stackit) from the API
- get_credentials_schema returns schemas keyed by secret type
- validate an external provider's secret against the schema for its
secret_type instead of accepting any declared schema
- reject a secret_type the provider does not declare
- Validate the secret is a JSON object before the no-schema path accepts it,
so a list/string/null cannot be persisted and fail later at {**secret}
- Add parametrized coverage for list/string/null/int payloads
- Move get_provider_type_choices into a leaf module so the provider
serializer field reuses the filters' cached list instead of recomputing
SDK provider discovery on every request
- Backfill provider_str synchronously in 0095 (single UPDATE) so the column
is populated before 0096 sets it NOT NULL, removing the Celery race
- Recreate the unique index inside 0096's transaction with a lock_timeout,
closing the duplicate-provider window left by the concurrent rebuild
- Drop migration 0097 and the now-unused backfill_provider_str task
- Gate threatscore/ens/nis2/csa reports on the provider's available
compliance frameworks instead of hard-coded provider whitelists
- Reference the ASFF/SecurityHub gate via the provider enum symbol
- Cover external-provider report availability and generic compliance
fallback with tests
- Add get_credentials_schema to the provider contract
- Validate non-built-in secrets against the declared schema; built-ins unchanged
- Accept secrets as-is when no schema is declared (validated at connection)
- Add get_scan_arguments/get_connection_arguments to the provider contract
- Route non-built-in providers through the contract; built-ins unchanged
- Cover the external dynamic path in tests
- Replace the hardcoded provider match with Provider.get_class
- Drop the closed provider-type union and TYPE_CHECKING imports
- Cover built-in and external entry-point resolution in tests
- Replace the static provider enum in filters with the SDK provider list
- Cache the provider-type choices for hot list endpoints
- Drop the dead provider enum filter override
- Drive provider validity from the SDK instead of a static enum
- Tolerate providers without a uid validator at model clean()
- Accept any SDK-exposed provider in the provider serializer field
- Promote the synced shadow column into provider, dropping the enum
- Rebuild the partial unique index concurrently after the swap
- Keep provider input validation at the serializer layer
- Add batched per-tenant backfill job for the provider_str column
- Register backfill task on the backfill queue
- Dispatch the backfill from a data-only migration
- Add nullable provider_str CharField mirroring the provider enum column
- DB trigger keeps provider_str in sync on INSERT and UPDATE
- First step of the zero-downtime migration of the provider enum to varchar
StylusFrost