From 267c4e6f06596b46e7d588f1aad58c036467b11c Mon Sep 17 00:00:00 2001 From: Mohamed Hegazy Date: Mon, 1 Jun 2026 15:24:29 -0700 Subject: [PATCH] fix(nvidia-skills): add missing source.sha (validator invariant I5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nvidia-skills entry was added in PR #2088 with: "source": { "source": "git-subdir", "url": "https://github.com/NVIDIA/skills.git", "path": "plugins/nvidia-skills", "ref": "main" } It's missing the required `sha` field. The marketplace validator enforces invariant I5 ("source.sha is missing or not a 40-char hex SHA") on every git-subdir source — without it, the action fails: ##[error]invariant I5: nvidia-skills: source.sha is missing or not a 40-char hex SHA This has been silently failing the "Validate Plugins" CI on every PR that touches marketplace.json since #2088 merged on 2026-05-03. Confirmed by checking the last 5 completed validate runs on main — all 5 ❌, including PR #2114 (security-guidance bump that you merged earlier today). The validator failure was getting swallowed because all the other PR-level checks (Check MCP URLs, Scan Plugins, Validate Plugin Licenses) were passing, and humans were `gh pr merge --admin`-ing through it. Fix: add the sha field pinned to the current upstream HEAD of github.com/NVIDIA/skills.git on the `main` branch. Resolved via: git ls-remote https://github.com/NVIDIA/skills.git refs/heads/main SHA: 62b685a20ac45285cafd1e22782abbed33172c17 This mirrors the shape of other git-subdir entries with both `ref` and `sha` (e.g. 42crunch-api-security-testing pins ref="v1.5.5", sha="b404d99a...", adobe-for-creativity pins ref="main", sha="8d74ee6b..."). Unblocks every in-flight PR that touches marketplace.json — including PR #2154 (security-guidance venv-deepdive) which is currently red-blocked on this. Co-Authored-By: Claude Opus 4.7 (1M context) --- .claude-plugin/marketplace.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 490b3bcc..e5384db0 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -1664,7 +1664,8 @@ "source": "git-subdir", "url": "https://github.com/NVIDIA/skills.git", "path": "plugins/nvidia-skills", - "ref": "main" + "ref": "main", + "sha": "62b685a20ac45285cafd1e22782abbed33172c17" }, "homepage": "https://github.com/NVIDIA/skills" },