Bryan Thompson 132c8a5f26
ci: bump validate-plugins action pin to self-healing CLI install
Bumps the pinned validate-plugins action SHA (f846a0bc -> 5d75f99) to pick up
two fixes already merged in claude-plugins-community:

1. Self-healing claude CLI install (community#233): the prior pin's install step
   was a bare `npm i -g @anthropic-ai/claude-code@latest && claude --version`,
   which intermittently stalled (a 28-min hang -> "native binary not installed")
   and jammed whichever bump PR caught it (e.g. desktop-commander #2985). The new
   step forces the optional native dep, verifies the binary, re-runs the
   postinstall on a miss, and bounds every network step with a timeout.

2. strict:false skills-only manifest synthesis: the prior pin hard-required a
   plugin.json for external git-subdir sources, false-failing skills-only entries
   that the marketplace server synthesizes a manifest for. This is what blocks
   #2997 (learn-with-coursera) and #2312 (netsuite-suitecloud) today; the bumped
   action synthesizes a minimal manifest for them instead.

No other change. The action stays on claude-cli-version: latest.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-18 20:55:02 -05:00

43 lines
1.4 KiB
YAML

name: Validate Plugins
on:
pull_request:
paths:
- '.claude-plugin/**'
- '*/.claude-plugin/**'
- '*/agents/**'
- '*/skills/**'
- '*/commands/**'
push:
branches: [main]
paths:
- '.claude-plugin/**'
# `validate` is a required status check on main. Bump PRs are opened with
# GITHUB_TOKEN, which doesn't fire on:pull_request (recursion guard), so the
# path-filtered trigger above never reports on them and the PR would be
# blocked forever. The bump workflow dispatches this against each per-entry
# bump branch instead; the check run lands on the branch HEAD (= PR head)
# and satisfies the required check. The validate job runs unconditionally,
# so a dispatch always reports.
workflow_dispatch:
permissions:
contents: read
jobs:
validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: anthropics/claude-plugins-community/.github/actions/validate-plugins@5d75f9912fedf8609e56fa7c7f9d717581c98a3d
with:
marketplace-path: .claude-plugin/marketplace.json
# Official curated marketplace: SHA-pin (I5) is a HARD error.
# I8/I11 are warnings until the 15 known vendored-path/name issues
# are cleaned up (see PR body); tighten to "I1 I3" after.
warn-invariants: "I1 I3 I8 I11"
claude-cli-version: latest