feat: add provider-neutral source-control recipe

[zeval]

Plugin authors need a provider-neutral reference for Kandev source-control hooks. This adds an opt-in recipe while keeping generated plugins provider-free.

Important Changes

• Covers repository discovery, task links, reviews, composer references, cancellation, and lifecycle ownership.
• Pins SDK contract validation and verifies recipe code stays outside default packages.

Validation

• npm ci --ignore-scripts
• make test
• go test -race ./server/... ./recipes/source-control/server/...
• make vet
• gofmt -l . and module-tidy diff checks
• make audit-recipes
• make verify-package-host
• make verify-package

Checklist

• I have performed a self-review of my code.
• I have manually tested my changes and they work as expected.
• My changes have tests that cover the new functionality and edge cases.
• If my change touches UI files (apps/web/), I have added or updated Playwright e2e tests in apps/web/e2e/ and verified them with make test-e2e.
• I checked whether this affects public docs in docs/public/** and updated them or noted why no docs change is needed.

[greptile-apps]

Greptile Summary

The PR adds an opt-in, provider-neutral source-control recipe while keeping the generated plugin package provider-free.

• Adds backend action, repository, review-association, and entity-reference contracts.
• Adds frontend repository, task-link, review, lifecycle, and stale-refresh handling.
• Adds pinned Go and TypeScript SDK contract validation to CI and release workflows.
• Adds package-content verification to prevent recipe and development files from entering release archives.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure established by the reviewed contracts and reachable scenarios.

The recipe keeps privileged selectors in verified host context, validates provider identities and action responses, handles partial remote-creation success without encouraging duplicates, fences stale frontend updates, and remains excluded from default release packages.

Important Files Changed

Filename	Overview
recipes/source-control/server/recipe.go	Adds the provider-neutral backend action boundary, verified-context handling, repository paging, immutable identities, and partial-success semantics.
recipes/source-control/server/references.go	Adds bounded entity-reference search and submission-time authorization delegation.
recipes/source-control/ui/register.ts	Registers repository, task-link, and review providers while normalizing untrusted action responses and forwarding cancellation.
recipes/source-control/ui/review-store.ts	Adds versioned snapshot storage that rejects stale refreshes and fences updates after teardown.
recipes/source-control/manifest.fragment.yaml	Documents the opt-in action scopes, capabilities, provider ownership, and reference-source declarations.
Makefile	Extends testing to recipe contracts and verifies package contents, binaries, and checksums.
.github/workflows/ci.yml	Pins the SDK source contract and adds Node-based recipe tests alongside minimum-version backend validation.
.github/workflows/release.yml	Applies the pinned contract tests and package verification before publishing releases.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  HostUI[Host source-control UI] -->|authenticated actions| Frontend[Recipe frontend registrations]
  Frontend -->|invokeAction| Host[Verified Kandev action context]
  Host --> Backend[Recipe backend extension]
  Backend --> Repositories[Provider repository adapters]
  Backend --> Reviews[Review and association adapters]
  Backend --> References[Reference search and authorization]
  Frontend --> Stores[Review and association snapshot stores]
  Stores --> HostUI
  Package[Default plugin package] -. excludes .-> Recipe[Opt-in recipe files]

Loading

_{Reviews (1): Last reviewed commit: "feat: add provider-neutral source-contro..." | Re-trigger Greptile}