mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-06-14 22:56:15 -03:00
267c4e6f06
The nvidia-skills entry was added in PR #2088 with: "source": { "source": "git-subdir", "url": "https://github.com/NVIDIA/skills.git", "path": "plugins/nvidia-skills", "ref": "main" } It's missing the required `sha` field. The marketplace validator enforces invariant I5 ("source.sha is missing or not a 40-char hex SHA") on every git-subdir source — without it, the action fails: ##[error]invariant I5: nvidia-skills: source.sha is missing or not a 40-char hex SHA This has been silently failing the "Validate Plugins" CI on every PR that touches marketplace.json since #2088 merged on 2026-05-03. Confirmed by checking the last 5 completed validate runs on main — all 5 ❌, including PR #2114 (security-guidance bump that you merged earlier today). The validator failure was getting swallowed because all the other PR-level checks (Check MCP URLs, Scan Plugins, Validate Plugin Licenses) were passing, and humans were `gh pr merge --admin`-ing through it. Fix: add the sha field pinned to the current upstream HEAD of github.com/NVIDIA/skills.git on the `main` branch. Resolved via: git ls-remote https://github.com/NVIDIA/skills.git refs/heads/main SHA: 62b685a20ac45285cafd1e22782abbed33172c17 This mirrors the shape of other git-subdir entries with both `ref` and `sha` (e.g. 42crunch-api-security-testing pins ref="v1.5.5", sha="b404d99a...", adobe-for-creativity pins ref="main", sha="8d74ee6b..."). Unblocks every in-flight PR that touches marketplace.json — including PR #2154 (security-guidance venv-deepdive) which is currently red-blocked on this. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>