mirror of
https://github.com/anthropics/knowledge-work-plugins.git
synced 2026-09-14 20:16:30 +08:00
tobin
df21fbd390
Adds the shared composite actions (validate / bump / scan) and pins the 2 external entries that were missing a SHA (figma, adobe-for-creativity). Workflows: - validate-plugins.yml: invariants I1-I11 + claude plugin validate + diff-gated clone-at-SHA validation. SHA-pin (I5) is a hard error. I1 stays warn (entries are intentionally category-grouped). - bump-plugin-shas.yml: bot-free weekly refresh. - scan-plugins.yml: Claude policy scan with the tightened hook-scope/telemetry/disclosure rubric. Blocking. Policy prompt at .github/policy/ uses the same tightened rubric as the official marketplace (hook scope, undisclosed telemetry, description-vs-behavior).
36 lines
962 B
YAML
36 lines
962 B
YAML
name: Scan Plugins
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.claude-plugin/marketplace.json'
|
|
- '.github/policy/**'
|
|
workflow_dispatch:
|
|
inputs:
|
|
scan_all:
|
|
description: Scan every external entry (full re-review). Slow.
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 120
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# Blocking. Uses the tightened hook-scope/telemetry/disclosure policy.
|
|
- uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@706952a0caebac4024b4be25137ff2faa64e153b
|
|
with:
|
|
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
policy-prompt: .github/policy/prompt.md
|
|
fail-on-findings: "true"
|
|
scan-all-external: ${{ inputs.scan_all || 'false' }}
|
|
scan-timeout-secs: "900"
|
|
claude-cli-version: latest
|