[FEATURE] Allow unofficial plugins to be installed

[suda]

There are many Prettier plugins that are not official (yet), like prettier-plugin-svelte. Unfortunately, trying to install it fails with:

Checking plugin: prettier-plugin-svelte
prettier-plugin-svelte does not seem to be a valid @prettier/plugin-x plugin. Exiting.

It would be great if other plugins could be installed as well :)

[creyD]

@stemount @infotexture I think you have a deeper understanding, why we opted for the official plugins only in #22 ? Was this a security issue or could we just open this up?

[infotexture]

@creyD IIRC, in #25 (comment) @stemount was concerned about the security implications of allowing unknown code to be run/installed in addition to the official plug-ins.

I get this restriction and am fine with the limitation, but I understand that others that rely on third-party plug-ins need a way to install them with an action.

Not sure how to best reconcile those concerns, but if nothing else, this may be a case for forking the action and dropping the restriction from the fork.

[suda]

That's what I did for now.

It is indeed tricky to solve. What if you'd have to explicitly pass something like allow_insecure_install: true parameter to clearly indicate that whatever goes in prettier_plugins will be passed straight to npm?

[creyD]

That's what I did for now.

It is indeed tricky to solve. What if you'd have to explicitly pass something like allow_insecure_install: true parameter to clearly indicate that whatever goes in prettier_plugins will be passed straight to npm?

Pretty good idea for the future. The in official plugins option will go live with version 4.0 as soon as the issues with #37 are resolved. Thanks a lot for your help all of you!

[kevmo314]

For anyone else who runs across this issue, there's an injection bug you can use to install your own plugins:

      - name: Prettify code
        uses: creyD/prettier_action@v3.3
        with:
          prettier_version: latest prettier-plugin-organize-imports typescript
          prettier_options: --write **/*.{ts,tsx,js,jsx,md}
          commit_message: "style: format with prettier"

So I suppose this is also a minor bug report for an injection bug on this line: https://github.com/creyD/prettier_action/blob/master/entrypoint.sh#L35