Sourcegraph - Update AccessToken schema

[marcleblanc2]

Overview

• Updated the schema, and doc links
• Added support for the new sgp_ v3 token format support
• Updated input validation rules to include capital hex chars A-F
• Endpoint now required

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

• None

How To Test

1. Create an account on https://sourcegraph.com/search
2. Go to your user settings and create an access token
3. Install src-cli
4. Run op plugin init src
5. Locate your Sourcegraph Access Token: Import into 1Password...
6. Enter or paste in the value of the Endpoint: Paste in https://sourcegraph.com
7. Enter or paste in the value of the Token: Paste in the access token created earlier
8. Run src login

$ src login
✔︎ Authenticated as <user> on <endpoint>

Entry created in 1Password desktop app:

Changelog

The Sourcegraph plugin now supports the current sgp_ access token format, and the Endpoint field is required since each token is tied to a specific endpoint.

[scottisloud]

Thanks for updating the Sourcegraph plugin schema and for the detailed manual test steps — the URL updates and making Endpoint required look right for how src authenticates today.

A few things I'd like to see before we merge, non-blocking, but ideally polish up if you deem it worthwhile:

• Token charset: Sourcegraph access tokens are hex-based and often include uppercase A–F (for example sgp_AaD80dc6E02eCAE1_d3cba16CC0F18fA14A2EFB61CbDFceEBf9fAD16b). The token field composition should include Uppercase: true in the charset, similar to plugins/github/personal_access_token.go.
• Token length: Length: 60 doesn't match the current v3 format (sgp_{16hex}_{40hex}, 61 characters total). Legacy tokens (sgp_{40hex}) are shorter. I'd drop the fixed length and rely on Prefix: "sgp_" plus the hex charset, or pick a length that matches the format you're targeting.
• Tests: access_token_test.go still uses a pre-sgp_ fixture. Please update the test token to a realistic sgp_-prefixed value so the tests match the schema.

nit: spacing in AlternativeNames: []string{"Website","URL"} for gofmt.

Could you also confirm make sourcegraph/validate and go test ./plugins/sourcegraph/... pass locally? I only see the signed-commits check on the PR so far.

Happy to take another look after those updates/you indicate no intent to make those optional updates.

(forgot to do this as a proper Review the first time 🤦 )

[marcleblanc2]

@scottisloud the ManagementURL hardcoded in the plugin schema

ManagementURL: sdk.URL("https://sourcegraph.com/settings/tokens"),

is more distracting than useful. Can we set the value based on the user's $SRC_ENDPOINT/settings/tokens?

I've filed issue #661 for this.

[marcleblanc2]

Hey @scottisloud,

Could you also confirm make sourcegraph/validate and go test ./plugins/sourcegraph/... pass locally?

Yes they do.

[2026-08-22 14:34:08] main % make sourcegraph/validate
# BETA NOTICE: The plugin ecosystem is in beta and is subject to change.
# You may have to update or recompile your local builds every now and then to keep them
# compatible with the 1Password CLI updates.

go run cmd/contrib/main.go sourcegraph/validate
# Plugin: sourcegraph

✔ Has plugin name set
✔ Plugin name only using lowercase characters or digits
✔ Plugin name not longer than 20 characters
✔ Has platform name set
✔ Has platform homepage URL set
✔ Has a credential type or executable defined
✔ Has no more than one credential type defined. Plugins with multiple credential types are not supported yet
✔ Credentials referenced in executables are included in the same plugin definition
✔ Credentials are uniquely identifiable inside a plugin

# Credential: Access Token

✔ Has name set
✔ Name is using title case
✔ Has documentation URL set
✔ Has management URL set
✔ Has at least 1 field
✔ All fields have name set
✔ All field names are using title case
✔ All fields have a description set
✔ All specified value compositions are valid
✔ Has at least 1 field that is secret
✔ Has no duplicate field names
✔ Has a provisioner set
✔ Has an importer set

# Executable: Sourcegraph CLI

✔ Has name set
✔ Has documentation URL set
✔ Has specified which commands need authentication
✔ Has executable command set
✔ Has a credential type defined
✔ Credential usage definitions are uniquely identifiable inside an executable

# Executable Sourcegraph CLI: Credential usage access_token

✔ If defined, a credential reference must have at least a `Name`
✔ If defined, a credential selection must have its `ID` and `IncludeAllCredentials` set
✔ Credential usage has either a credential reference or selection defined, but not both

[2026-08-22 14:37:04] main % go test -v ./plugins/sourcegraph/...         
=== RUN   TestAccessTokenProvisioner
=== RUN   TestAccessTokenProvisioner/default
--- PASS: TestAccessTokenProvisioner (0.00s)
    --- PASS: TestAccessTokenProvisioner/default (0.00s)
=== RUN   TestAccessTokenImporter
=== RUN   TestAccessTokenImporter/environment
--- PASS: TestAccessTokenImporter (0.00s)
    --- PASS: TestAccessTokenImporter/environment (0.00s)
PASS
ok      github.com/1Password/shell-plugins/plugins/sourcegraph  0.176s