fix: do not overwrite local plugin manifest if fetched manifest is invalid

pkg/cmd/plugin/upgrade.go

@@ -53,7 +53,10 @@ func (uc *UpgradeCmd) runUpgradeCmd(cmd *cobra.Command, args []string) error {
 	})
 
 	// Refresh the plugin info before proceeding
-	plugins.RefreshPluginManifest(cmd.Context(), uc.cfg, uc.fs, uc.apiBaseURL)
+	if err := plugins.RefreshPluginManifest(cmd.Context(), uc.cfg, uc.fs, uc.apiBaseURL); err != nil {
+		log.Debug(err)
+		fmt.Println("Unable to refresh plugin manifest, continuing with cached manifest...")
+	}
 
 	plugin, err := plugins.LookUpPlugin(cmd.Context(), uc.cfg, uc.fs, args[0])
 

pkg/plugins/utilities.go

@@ -119,6 +119,10 @@ func RefreshPluginManifest(ctx context.Context, config config.IConfig, fs afero.
 		return err
 	}
 
+	if err := validatePluginManifest(body); err != nil {
+		return err
+	}
+
 	configPath := config.GetConfigFolder(os.Getenv("XDG_CONFIG_HOME"))
 	pluginManifestPath := filepath.Join(configPath, "plugins.toml")
 
@@ -131,6 +135,18 @@ func RefreshPluginManifest(ctx context.Context, config config.IConfig, fs afero.
 	return nil
 }
 
+func validatePluginManifest(body []byte) error {
+	var manifestBody PluginList
+
+	if err := toml.Unmarshal(body, &manifestBody); err != nil {
+		return fmt.Errorf("Received an invalid plugin manifest. Error: %s", err)
+	}
+	if len(manifestBody.Plugins) == 0 {
+		return fmt.Errorf("Received an empty plugin manifest")
+	}
+	return nil
+}
+
 // AddEntryToPluginManifest update plugins.toml with a new release version
 func AddEntryToPluginManifest(ctx context.Context, config config.IConfig, fs afero.Fs, entry Plugin) error {
 	color := ansi.Color(os.Stdout)

pkg/plugins/utilities_test.go

@@ -61,6 +61,23 @@ func TestRefreshPluginManifest(t *testing.T) {
 	require.Equal(t, updatedManifestContent, pluginManifestContent)
 }
 
+func TestRefreshPluginManifestFailsInvalidManifest(t *testing.T) {
+	fs := setUpFS()
+	config := &TestConfig{}
+	config.InitConfig()
+	emptyManifestContent := []byte{}
+	testServers := setUpServers(t, emptyManifestContent)
+	defer func() { testServers.CloseAll() }()
+
+	err := RefreshPluginManifest(context.Background(), config, fs, testServers.StripeServer.URL)
+	require.NotNil(t, err)
+	require.ErrorContains(t, err, "Received an empty plugin manifest")
+	// We expect the /plugins.toml file in the test fs has NOT been updated
+	pluginManifestContent, err := afero.ReadFile(fs, "/plugins.toml")
+	require.Nil(t, err)
+	require.NotEqual(t, emptyManifestContent, pluginManifestContent)
+}
+
 func TestIsPluginCommand(t *testing.T) {
 	pluginCmd := &cobra.Command{
 		Annotations: map[string]string{"scope": "plugin"},