Skip to main content
An Entire plugin is your service, acting on the repositories a customer chose to share with it. A customer installs your plugin on one of their Entire projects and picks the repositories it may reach. Entire then sends the customer back to you with a signed install receipt. From that point your service holds an installation ID and nothing else: no customer passwords, no long-lived tokens. Whenever you need to act, you sign a short JWT with your own key and exchange it for an access token that lasts about 45 minutes. A plugin registered for it can also create repositories in the customer’s project. Each new repository joins the installation, so you act on it like any repository the customer selected. Build on the Go SDK if you can. It implements every step in this guide. The rest of the guide explains the flow so you know what the SDK does, and so you can implement it in another language.
Plugins are currently available to selected partners only. If you want to build one, talk to your Entire contact first.The plugin system and the SDK package are in early access. Install, receipts, repository lists, access tokens and check runs work in production today. Webhooks, trail comments, deployments and repository creation are rolling out, and their contracts may change. Field names in this guide are stable unless marked otherwise.

​
Steps

  1. Register your plugin with Entire.
  2. Send customers through the install flow and verify the receipt.
  3. Act for an installation: list its repositories, mint access tokens and, if you need to, create repositories.
  4. Sign users in with OAuth, if you need to know which installations and repositories a user can use.
  5. Build it with the Go SDK, and receive webhooks when installations or refs change, and trail events when trails change.
  6. Comment on trails to report your results where people review the change.

​
Concepts

​
Security checklist

  • Keep the private key in a secret store or KMS, never in source control or images.
  • Tie every install state to the browser session that started it, and verify every receipt fully before you store anything.
  • Request the narrowest token that does the job: one repository, fewest permissions.
  • Never log tokens, JWTs or receipts.
  • Treat a 404 for an installation or repository as revoked access, and stop.
  • Keep tokens out of URLs, command lines and files a build can read.