Merge commit from fork

Adopt Go's os.Root for plugin file operations so that all path access
derived from a plugin name stays within the plugin root (~/.trivy/plugins).
Add pkg/x/os.Root, a small wrapper over os.Root with a Join helper, and
route install, uninstall, and plugin loading through it instead of joining
names onto the root path directly.

NewManager opens the plugin root eagerly and returns an error, and exposes
Close; the package-level Run/Start helpers wrap it for callers outside the
plugin subcommands.

Author: knqyf263

integration/plugin_test.go

@@ -44,8 +44,8 @@ func TestPlugin(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// We can overwrite stdout for `_default_Manager` only once.
-			// So we need to clear the temporary stdout file before each test case.
+			// The output plugin appends to os.Stdout (redirected to tempStdOut),
+			// so clear it before each test case.
 			clearFile(t, tempStdOut)
 
 			t.Setenv("XDG_DATA_HOME", t.TempDir())

pkg/commands/app.go

@@ -120,7 +120,17 @@ func loadPluginCommands() []*cobra.Command {
 	ctx := context.Background()
 
 	var commands []*cobra.Command
-	plugins, err := plugin.NewManager().LoadAll(ctx)
+	// Avoid creating the plugin directory on every run; nothing to load if it is absent.
+	if !plugin.DirExists() {
+		return nil
+	}
+	manager, err := plugin.NewManager()
+	if err != nil {
+		log.WarnContext(ctx, "Failed to initialize the plugin manager", log.Err(err))
+		return nil
+	}
+	defer manager.Close()
+	plugins, err := manager.LoadAll(ctx)
 	if err != nil {
 		log.DebugContext(ctx, "No plugins loaded")
 		return nil
@@ -751,6 +761,7 @@ func NewConfigCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 
 func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 	var pluginOptions flag.Options
+	var manager *plugin.Manager
 	pluginFlags := &flag.Flags{
 		globalFlags,
 	}
@@ -767,6 +778,16 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			if err != nil {
 				return err
 			}
+			manager, err = plugin.NewManager()
+			if err != nil {
+				return xerrors.Errorf("plugin manager error: %w", err)
+			}
+			return nil
+		},
+		PersistentPostRunE: func(_ *cobra.Command, _ []string) error {
+			if manager != nil {
+				return manager.Close()
+			}
 			return nil
 		},
 	}
@@ -788,7 +809,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			DisableFlagsInUseLine: true,
 			Args:                  cobra.ExactArgs(1),
 			RunE: func(cmd *cobra.Command, args []string) error {
-				if _, err := plugin.Install(cmd.Context(), args[0], plugin.Options{Insecure: pluginOptions.Insecure}); err != nil {
+				if _, err := manager.Install(cmd.Context(), args[0], plugin.Options{Insecure: pluginOptions.Insecure}); err != nil {
 					return xerrors.Errorf("plugin install error: %w", err)
 				}
 				return nil
@@ -803,7 +824,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			SilenceUsage:          true,
 			Args:                  cobra.ExactArgs(1),
 			RunE: func(cmd *cobra.Command, args []string) error {
-				if err := plugin.Uninstall(cmd.Context(), args[0]); err != nil {
+				if err := manager.Uninstall(cmd.Context(), args[0]); err != nil {
 					return xerrors.Errorf("plugin uninstall error: %w", err)
 				}
 				return nil
@@ -818,7 +839,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			Short:                 "List installed plugin",
 			Args:                  cobra.NoArgs,
 			RunE: func(cmd *cobra.Command, _ []string) error {
-				if err := plugin.List(cmd.Context()); err != nil {
+				if err := manager.List(cmd.Context()); err != nil {
 					return xerrors.Errorf("plugin list display error: %w", err)
 				}
 				return nil
@@ -832,7 +853,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			SilenceUsage:          true,
 			Args:                  cobra.ExactArgs(1),
 			RunE: func(_ *cobra.Command, args []string) error {
-				if err := plugin.Information(args[0]); err != nil {
+				if err := manager.Information(args[0]); err != nil {
 					return xerrors.Errorf("plugin information display error: %w", err)
 				}
 				return nil
@@ -847,7 +868,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			Short:                 "Run a plugin on the fly",
 			Args:                  cobra.MinimumNArgs(1),
 			RunE: func(cmd *cobra.Command, args []string) error {
-				return plugin.Run(cmd.Context(), args[0], plugin.Options{
+				return manager.Run(cmd.Context(), args[0], plugin.Options{
 					Args:     args[1:],
 					Insecure: pluginOptions.Insecure,
 				})
@@ -861,7 +882,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			SilenceUsage:          true,
 			Args:                  cobra.NoArgs,
 			RunE: func(cmd *cobra.Command, _ []string) error {
-				if err := plugin.Update(cmd.Context(), plugin.Options{Insecure: pluginOptions.Insecure}); err != nil {
+				if err := manager.Update(cmd.Context(), plugin.Options{Insecure: pluginOptions.Insecure}); err != nil {
 					return xerrors.Errorf("plugin update error: %w", err)
 				}
 				return nil
@@ -879,7 +900,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 				if len(args) == 1 {
 					keyword = args[0]
 				}
-				return plugin.Search(cmd.Context(), keyword)
+				return manager.Search(cmd.Context(), keyword)
 			},
 		},
 		&cobra.Command{
@@ -889,7 +910,7 @@ func NewPluginCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
 			SilenceErrors:         true,
 			SilenceUsage:          true,
 			RunE: func(cmd *cobra.Command, args []string) error {
-				if err := plugin.Upgrade(cmd.Context(), args); err != nil {
+				if err := manager.Upgrade(cmd.Context(), args); err != nil {
 					return xerrors.Errorf("plugin upgrade error: %w", err)
 				}
 				return nil

pkg/plugin/index_test.go

@@ -24,8 +24,9 @@ func TestManager_Update(t *testing.T) {
 	}))
 	t.Cleanup(ts.Close)
 
-	manager := plugin.NewManager(plugin.WithIndexURL(ts.URL + "/index.yaml"))
-	err := manager.Update(t.Context(), plugin.Options{})
+	manager, err := plugin.NewManager(plugin.WithIndexURL(ts.URL + "/index.yaml"))
+	require.NoError(t, err)
+	err = manager.Update(t.Context(), plugin.Options{})
 	require.NoError(t, err)
 
 	indexPath := filepath.Join(tempDir, ".trivy", "plugins", "index.yaml")
@@ -65,7 +66,7 @@ bar                  A bar plugin
 		{
 			name:    "no index",
 			keyword: "",
-			dir:     "unknown",
+			dir:     t.TempDir(), // a fresh dir without index.yaml
 			wantErr: "plugin index not found",
 		},
 	}
@@ -74,8 +75,9 @@ bar                  A bar plugin
 			t.Setenv("XDG_DATA_HOME", tt.dir)
 
 			var got bytes.Buffer
-			m := plugin.NewManager(plugin.WithWriter(&got))
-			err := m.Search(t.Context(), tt.keyword)
+			m, err := plugin.NewManager(plugin.WithWriter(&got))
+			require.NoError(t, err)
+			err = m.Search(t.Context(), tt.keyword)
 			if tt.wantErr != "" {
 				require.ErrorContains(t, err, tt.wantErr)
 				return