[low] Check all plugins before installing any in plugin install

[elhoim]

BLUF

• Problem: sigma plugin install A B checks and installs one plugin at a time. If B is incompatible, the command fails after A is already installed, and the pySigma re-check (--check-pysigma, default on) is skipped.
• Impact: sigma plugin install splunk some-incompatible-plugin exits with an error, but leaves splunk installed. The pySigma version check that install would normally run never happens, so the user ends up with a half-applied install they didn't expect.
• Fix: resolve and compatibility-check every requested plugin first. If any is incompatible, fail with a list of all incompatible plugins and install nothing. --force-install still installs everything.
• Tests: three new offline CliRunner tests: incompatible second plugin, all compatible, and --force-install. The first fails on main and passes with the fix.

Priority: low

Details

Root cause: sigma/cli/plugin.py:138-149

for plugin_identifier in plugin_identifiers:
    plugin = get_plugin(uuid, plugin_identifier)
    if not compatibility_check or plugin.is_compatible():
        plugin.install()            # A is installed here ...
        ...
    else:
        raise click.exceptions.ClickException(...)   # ... before B is found incompatible
if check_pysigma:
    check_pysigma_command()         # skipped by the exception

After the fix the command works in two phases:

1. Look up all plugins. With the compatibility check on, collect every incompatible identifier. If there are any, raise a single error that names them all, for example Plugin not compatible with installed pySigma version: 'b'! No plugin was installed.
2. Install the plugins in order, then run the pySigma check as before.

Unknown identifiers already failed before any install, because get_plugin() raises. They now fail before any install in all cases.

Testing

• New tests in tests/test_plugin.py. They are offline: get_plugin and check_pysigma_command are stubbed.
  • test_plugin_install_incompatible_installs_nothing (fails on main: a was installed)
  • test_plugin_install_multiple_compatible
  • test_plugin_install_force_incompatible
• Full suite, run the way CI runs it (Python 3.12, dependencies pinned to poetry.lock: pySigma 1.4.0, click 8.4.2, pyparsing 3.3.2): pytest --cov=sigma → 121 passed, 1 skipped.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The change achieves the intended all-or-nothing install behavior with targeted tests, with only a minor whitespace nit noted.

Review effort: Lite
Findings: 1

Open (1)

• Remove trailing whitespace on the separator blank line · New

What changed in this PR

This PR updates sigma plugin install to avoid partial installs by resolving and (optionally) compatibility-checking all requested plugins before installing any of them, ensuring the install is all-or-nothing unless --force-install is used.

Changes:

• Refactor plugin installation into a two-phase flow: resolve/check first, then install.
• Improve the incompatibility error to include all incompatible plugin identifiers and explicitly state that nothing was installed.
• Add offline tests covering incompatible multi-install behavior, all-compatible installs, and --force-install bypass.

File	Description
sigma/​cli/​plugin.py	Pre-resolves all plugins, aggregates incompatibilities, and only installs if the compatibility gate passes (or is forced).
tests/​test_plugin.py	Adds stubbed offline tests to verify multi-plugin install behavior and force-install semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.