From fe8f81309e7b5c983d1e2a23ed476efec458057d Mon Sep 17 00:00:00 2001 From: Tobin South Date: Mon, 11 May 2026 12:45:40 -0700 Subject: [PATCH] Bump bump-plugin-shas action so bump commits are signed (#1814) The pinned version of anthropics/claude-plugins-community's bump-plugin-shas action creates the bump commit with a local git commit, which is unsigned and unmergeable under the required_signatures ruleset on main. The new SHA creates the commit via the GraphQL createCommitOnBranch mutation, which GitHub signs server-side, so weekly bump PRs (e.g. #1809) become mergeable. --- .github/workflows/bump-plugin-shas.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bump-plugin-shas.yml b/.github/workflows/bump-plugin-shas.yml index 867cac8..a2d965f 100644 --- a/.github/workflows/bump-plugin-shas.yml +++ b/.github/workflows/bump-plugin-shas.yml @@ -31,7 +31,9 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@f846a0bcb0e721b1f93d60e8b73e91dafc4a1e87 + # createCommitOnBranch-based bump so commits are signed by GitHub and + # satisfy the org-level required_signatures ruleset on main. + - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@c41c6911de0afffd2bc5cd8b21fb1e06444ee13b with: marketplace-path: .claude-plugin/marketplace.json max-bumps: ${{ inputs.max_bumps || '20' }}