From 3db0e35e814dbc1c7677a4fc1d087ecfae62895d Mon Sep 17 00:00:00 2001 From: Max Litruv Boonzaayer Date: Fri, 17 Apr 2026 02:53:45 +1000 Subject: [PATCH] Update docs with ownership validation details --- VALIDATION_RULES.md | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/VALIDATION_RULES.md b/VALIDATION_RULES.md index 915fc6e..18ad351 100644 --- a/VALIDATION_RULES.md +++ b/VALIDATION_RULES.md @@ -87,9 +87,23 @@ You can include any additional fields for metadata: - The `author` field must match your Gitea username - This is checked automatically +### Modifying Plugins +- **You can only modify plugins where the ORIGINAL author (on main branch) is you** +- Even if you change the `author` field in your PR, validation checks against the original +- Attempting to modify someone else's plugin will fail validation with: + ``` + ❌ plugins/their-plugin.json: Cannot modify plugin owned by "them" (you are "you") + ``` + ### Removing Plugins -- You can only remove plugins where `author` matches your username -- Attempting to remove someone else's plugin will fail validation +- **You can only remove plugins where the ORIGINAL author (on main branch) is you** +- The validation checks the plugin's author from the main branch, not from your PR +- Attempting to remove someone else's plugin will fail validation with: + ``` + ❌ plugins/their-plugin.json: Cannot remove plugin owned by "them" (you are "you") + ``` + +**Security Note:** All ownership checks use the plugin data from the `main` branch, not from your PR. You cannot bypass ownership by modifying the `author` field. ## Validation Process