mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-05-12 06:25:52 -03:00
45896c8f2f
Scan Plugins is meant to gate every change to marketplace.json, but two gaps made that unenforceable: 1. The bump workflow opens PRs with GITHUB_TOKEN, which GitHub exempts from on:pull_request triggers. Weekly bump PRs (e.g. #1809) get no scan check at all. 2. The workflow had a paths filter, so a required-check ruleset for `scan` would block every PR that doesn't touch marketplace.json (no check run = pending forever). Fixes: scan-plugins.yml - Drop the paths filter; replace with a step-level `git diff --quiet` early-exit on the same paths. The check now reports on every PR, which makes it safe to require. - Fail closed when ANTHROPIC_API_KEY is unset and a scan is needed. The shared action no-ops gracefully in that case (right default for community repos), but a required check that silently does nothing is a rubber stamp. bump-plugin-shas.yml - After the action opens the bump PR, `gh workflow run scan-plugins.yml --ref bump/plugin-shas`. workflow_dispatch is exempt from the GITHUB_TOKEN recursion guard, and the resulting check run lands on the branch HEAD (= PR head), so it satisfies the required check. - Add `actions: write` so the dispatch is allowed. Follow-up: add a repo ruleset on main requiring the `scan` check (integration: github-actions) once this merges.
56 lines
2.0 KiB
YAML
56 lines
2.0 KiB
YAML
name: Bump Plugin SHAs
|
|
|
|
# Weekly sweep: for each external entry whose upstream HEAD has moved past
|
|
# its pinned SHA, validate at the new SHA with `claude plugin validate`
|
|
# inline, then open one PR with all passing bumps.
|
|
#
|
|
# Bot-free — uses the default GITHUB_TOKEN. PRs opened with GITHUB_TOKEN don't
|
|
# trigger on:pull_request workflows, so the policy scan (`Scan Plugins`, a
|
|
# required status check on main) would never run and the bump PR could never
|
|
# merge. workflow_dispatch is exempt from that recursion guard, so we dispatch
|
|
# the scan ourselves on the bump branch after the PR is opened. The check run
|
|
# lands on the branch HEAD — the same SHA as the PR head — and satisfies the
|
|
# required check.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '23 7 * * 1' # Monday 07:23 UTC
|
|
workflow_dispatch:
|
|
inputs:
|
|
max_bumps:
|
|
description: Cap on plugins bumped this run
|
|
required: false
|
|
default: '20'
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
actions: write # gh workflow run scan-plugins.yml on the bump branch
|
|
|
|
concurrency:
|
|
group: bump-plugin-shas
|
|
|
|
jobs:
|
|
bump:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# createCommitOnBranch-based bump so commits are signed by GitHub and
|
|
# satisfy the org-level required_signatures ruleset on main.
|
|
- uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@c41c6911de0afffd2bc5cd8b21fb1e06444ee13b
|
|
id: bump
|
|
with:
|
|
marketplace-path: .claude-plugin/marketplace.json
|
|
max-bumps: ${{ inputs.max_bumps || '20' }}
|
|
claude-cli-version: latest
|
|
|
|
# `bump/plugin-shas` is the action's default `pr-branch`. The scan diffs
|
|
# the branch against origin/main (the action's base-ref fallback when
|
|
# there's no pull_request event) and scans only the bumped entries.
|
|
- name: Dispatch policy scan on bump branch
|
|
if: steps.bump.outputs.pr-url != ''
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: gh workflow run scan-plugins.yml --ref bump/plugin-shas
|