fix: register pull plugin via separate entry point for the plugin loader

Author: dcoric

SUPPLY-CHAIN.md

@@ -155,7 +155,10 @@ In `proxy.config.json`:
 1. Add the plugin to the `plugins` array:
 
    ```json
-   "plugins": ["./plugins/git-proxy-plugin-supply-chain/index.js"]
+   "plugins": [
+     "./plugins/git-proxy-plugin-supply-chain/index.js",
+     "./plugins/git-proxy-plugin-supply-chain/pull.js"
+   ]
    ```
 
 2. Authorise your test repo (so GitProxy will proxy it) by adding it to `authorisedList`:

plugins/git-proxy-plugin-supply-chain/README.md

@@ -92,19 +92,27 @@ are a follow-up - today, warnings are logged and only _blocks_ reach the termina
 
 ## Enable it
 
-Add the plugin to the `plugins` array in your `proxy.config.json`:
+Add the plugin to the `plugins` array in your `proxy.config.json`. GitProxy's plugin loader
+takes only the **default export** of each configured module, so the push scanner (`index.js`)
+and the pull/clone scanner (`pull.js`) are registered as two entries:
 
 ```json
 {
-  "plugins": ["@finos/git-proxy-plugin-supply-chain"]
+  "plugins": [
+    "@finos/git-proxy-plugin-supply-chain",
+    "@finos/git-proxy-plugin-supply-chain/pull.js"
+  ]
 }
 ```
 
 or, from a checkout of this repo:
 
 ```json
 {
-  "plugins": ["./plugins/git-proxy-plugin-supply-chain/index.js"]
+  "plugins": [
+    "./plugins/git-proxy-plugin-supply-chain/index.js",
+    "./plugins/git-proxy-plugin-supply-chain/pull.js"
+  ]
 }
 ```
 

plugins/git-proxy-plugin-supply-chain/pull.js

@@ -0,0 +1,30 @@
+/**
+ * Copyright 2026 GitProxy Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Loader entry point for the pull/clone scanner. GitProxy's PluginLoader takes only the
+ * default export of each configured module (load-plugin's `key` defaults to 'default'),
+ * so the push and pull plugins ship as separate entry files. Register both:
+ *
+ *   "plugins": [
+ *     "./plugins/git-proxy-plugin-supply-chain/index.js",
+ *     "./plugins/git-proxy-plugin-supply-chain/pull.js"
+ *   ]
+ */
+
+import { pullPlugin } from './index.js';
+
+export default pullPlugin;