Installing a plugin with commit sha as ref fails

[sophio-japharidze-sonarsource]

Hello!

When trying to install plugin that has a commit sha fixed in external.json fails with an error.

Steps to reproduce:

• Run /plugin install sonarqube@awesome-copilot command
• Observe the error

✗ Failed to install plugin: Failed to fetch GitHub plugin SonarSource/sonarqube-agent-plugins: Error: Command failed: git clone --depth 1 --progress --branch 
  b1492121b8591fba7dc477392ae0ea6be924fb31 https://github.com/SonarSource/sonarqube-agent-plugins.git 
  /Users/sophio.japharidze/Library/Caches/copilot/marketplaces/SonarSource--sonarqube-agent-plugins
  Cloning into '/Users/sophio.japharidze/Library/Caches/copilot/marketplaces/SonarSource--sonarqube-agent-plugins'...
  fatal: Remote branch b1492121b8591fba7dc477392ae0ea6be924fb31 not found in upstream origin

I think the clone command is wrong, it should not be trying to fix the --branch when commit sha is provided. the ai-ready plugin has the same problem.

Would it be possible to update ref of sonarqube plugin to master please? I am one of the maintaners and have asked for it also in the original issue.

We appreciate your help on this 🙇‍♀️

[aaronpowell]

Ah damn. This is going to be a bug in CLI that I'll have to follow up with the team on fixing.

We don't want to use branches, they are mutable which means that we can't be certain that what was submitted is going to be consistent at install time.

Can you create a tag and send a PR with that as the ref while I work with the team to support SHA-based ref's. Tags aren't immutable either, but they are slightly more immutable than branches.

[aaronpowell]

Actually, maybe it shouldn't be ref it should be sha (which is then a bug in my automations).

Let me do some testing, if that's the case, I'll fix it for you.
Scratch that, I don't think we support sha.

[sophio-japharidze-sonarsource]

Thanks a lot for the info, I have opened a PR - #1791