Improve UX for trusting additional composer plugins

I am not convinced this should be UI.

I think you're saying that requiring manual modification to the configuration is sufficient?

If so: fair enough. I can see arguments either way. But what should still happen IMHO is improving the message: right now ComposerPluginsValidator just tells the user a composer plugin is not supported:

      $unsupported_plugins_messages = array_map(
        fn (string $raw_allowed_plugin_name) => new FormattableMarkup(
          "<code>@package_name

",
[
'@package_name' => $raw_allowed_plugin_name,
]
),
$unsupported_plugins
);
$summary = $this->formatPlural(
count($unsupported_plugins),
'An unsupported Composer plugin was detected.',
'Unsupported Composer plugins were detected.',
);
$event->addError($unsupported_plugins_messages, $summary);

→ this just generates a list, without providing the user a course of action.

Stupidly, I went 99% of the way in 📌 Limit trusted Composer plugins to a known list, allow user to add more Fixed because I provided a hook_help() entry:

      $output .= '<h4 id="package-manager-faq-unsupported-composer-plugin">' . t('What if it says I have unsupported composer plugins in my codebase?') . '</h4>';
      $output .= '<p>' . t('A fresh Drupal installation only uses supported composer plugins, but some modules or themes may depend on additional composer plugins. Please <a href=":new-issue">create a new issue</a> when you encounter this.', [
        ':new-issue' => 'https://www.drupal.org/node/add/project-issue/automatic_updates',
      ]) . '</p>';
      $output .= '<p>' . t('It is possible to <em>trust</em> additional composer plugins, but this requires significant expertise: understanding the code of that composer plugin, what the effects on the file system are and how it affects the Package Manager module. Some composer plugins could result in a broken site!') . '</p>';

but failed to link to it from the validation message 🙈🙈🙈

Maybe that's the only remaining thing to do here? 😊

d.o rendering fail 🤷‍♀️

Note that in 📌 Tighten ComposerPluginsValidator: support only specified version constraint Fixed , ComposerPluginsValidator is becoming stricter. But this same UX can be used to trust unsupported versions of supported Composer plugins 👍

It's great to see all the efforts going into getting Automatic Updates ready, so thanks for that.

If you have https://www.drupal.org/project/openai → installed, you get this message on /admin/reports/updates/update:

An unsupported Composer plugin was detected.
    php-http/discovery

Does this mean that Automatic Updates will not work, or might it work, but not guaranteed to work?

Should I create a separate issue for Automatic Update support for this Composer plugin?