Bump bump-plugin-shas action so bump commits are signed (#1814)

The pinned version of anthropics/claude-plugins-community's
bump-plugin-shas action creates the bump commit with a local git commit,
which is unsigned and unmergeable under the required_signatures ruleset
on main. The new SHA creates the commit via the GraphQL
createCommitOnBranch mutation, which GitHub signs server-side, so weekly
bump PRs (e.g. #1809) become mergeable.
This commit is contained in:
Tobin South 2026-05-11 12:45:40 -07:00 committed by GitHub
parent 6196a61bde
commit fe8f81309e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -31,7 +31,9 @@ jobs:
steps:
- uses: actions/checkout@v4
- uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@f846a0bcb0e721b1f93d60e8b73e91dafc4a1e87
# createCommitOnBranch-based bump so commits are signed by GitHub and
# satisfy the org-level required_signatures ruleset on main.
- uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@c41c6911de0afffd2bc5cd8b21fb1e06444ee13b
with:
marketplace-path: .claude-plugin/marketplace.json
max-bumps: ${{ inputs.max_bumps || '20' }}