From 633fdfa4026c60fc5c890cf57b8c42817fe6b620 Mon Sep 17 00:00:00 2001
From: Bryan Thompson <238056179+bryan-anthropic@users.noreply.github.com>
Date: Tue, 4 Aug 2026 17:07:48 -0500
Subject: [PATCH] bump tracking: pin action to community 9247660a +
 releases-only for CrowdStrike entries (#4879)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pin the bump action to community 9247660a (anthropics/claude-plugins-community#1715:
releases-only tracking via the new optional tracking-config input) and enroll the two
CrowdStrike entries — their pins now follow published release tags, not main HEAD.
All other entries HEAD-track exactly as before.
---
 .github/bump-tracking.json             | 6 ++++++
 .github/workflows/bump-plugin-shas.yml | 7 ++++++-
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 .github/bump-tracking.json

diff --git a/.github/bump-tracking.json b/.github/bump-tracking.json
new file mode 100644
index 00000000..4624fa9a
--- /dev/null
+++ b/.github/bump-tracking.json
@@ -0,0 +1,6 @@
+{
+  "releases-only": [
+    "crowdstrike-falcon-foundry",
+    "crowdstrike-falcon-fusion"
+  ]
+}
diff --git a/.github/workflows/bump-plugin-shas.yml b/.github/workflows/bump-plugin-shas.yml
index 371a4f17..37e96e0e 100644
--- a/.github/workflows/bump-plugin-shas.yml
+++ b/.github/workflows/bump-plugin-shas.yml
@@ -57,13 +57,18 @@ jobs:
 
       # createCommitOnBranch-based bump so commits are signed by GitHub and
       # satisfy the org-level required_signatures ruleset on main.
-      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@426e469f322952061102b286b378c0c9733a0934
+      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@9247660a88cf3f49456a2f6464d66fe4ea4f4a77
         id: bump
         with:
           marketplace-path: .claude-plugin/marketplace.json
           max-bumps: ${{ inputs.max_bumps || '30' }}
           only: ${{ inputs.plugin }}
           pr-mode: per-entry
+          # Entries listed in .github/bump-tracking.json {"releases-only": [...]}
+          # bump to the latest published release tag's commit instead of HEAD
+          # (no release / not-ahead / lookup failure -> pin held; see the action
+          # README). All other entries HEAD-track exactly as before.
+          tracking-config: .github/bump-tracking.json
           claude-cli-version: latest
 
       # Per-entry fan-out: dispatch the three required checks against each bump