test(marketplace): add integration-tier coverage for marketplace --ref end-to-end flow

[danielmeppiel]

Context

Follow-up deferred from the apm-review-panel on #1880 (test-coverage-expert lens).

#1880 fixes registered marketplace --ref propagation to string/dict plugin sources and GitLab slash-ref proxy filenames, with thorough unit coverage (TestMarketplaceRegisteredRefPropagation, TestBuildArtifactoryArchiveUrl). What is not yet covered is an integration-tier test that exercises the full resolve_marketplace_plugin -> downstream resolution -> downloader chain with a real ref value end to end.

Why deferred (not folded into #1880)

New integration-test infrastructure is out of scope for a surgical bug fix. It is tracked here so the panel verdict on #1880 carries no loose follow-up.

Suggested scope

• One integration test that registers a marketplace with a non-default --ref and asserts the resolved/downloaded artifact reflects that ref across both GitHub-family and GitLab hosts.
• Assert URLs via urllib.parse (per tests/instructions), not substring.

Source: panel recommendation on #1880

[github-actions]

Triage Verdict

Classification: type/test (existing) | theme/portability | area/marketplace | area/testing
Priority: priority/low
Milestone: v0.23.0

Panel assessments

DevX UX Expert: Valuable follow-up from #1880. Unit tests cover the ref-propagation logic in isolation, but an integration-tier test exercises the full resolve -> download chain that unit tests cannot catch. This improves developer confidence when modifying the marketplace resolution path and provides an early-warning signal for regressions.

Python Architect: Scope is clear and bounded: one integration test exercising resolve_marketplace_plugin -> downstream resolution -> downloader with a real ref value for both GitHub-family and GitLab hosts. Per tests/instructions, URL assertions must use urllib.parse -- never substring matching. The test should live in the integration test tier, not the unit tier. Can be implemented independently of #1917 or sequentially after it.

Supply Chain Security Expert: An integration test asserting the full resolve+download chain for --ref is a good regression harness for future supply-chain changes that touch ref handling. The urllib.parse URL assertion requirement also prevents fragile substring matching that could silently pass on host or path changes.

APM CEO (arbiter): Accept. Low-priority but high-value test investment. The right moment to implement is either after #1917 (so the extracted helper can be tested end-to-end as well) or as a standalone PR if #1917 stalls.

Suggested next action

Implement one integration test covering the full --ref chain for GitHub-family and GitLab hosts. Use urllib.parse for all URL assertions. Can pair with #1917 or land independently.

Labels applied

theme/portability area/marketplace area/testing priority/low status/triaged
(Note: type/test was already present. type/test is not in the current label taxonomy allow-list -- a maintainer may wish to add it to the allow-list or replace it with an in-taxonomy label if taxonomy consistency is preferred.)

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel · 124.8 AIC · ⌖ 11.5 AIC · ⊞ 9.2K · ◷