GitHub Actions Used in the Claude Plugins Community Repository: Complete CI/CD Guide

The Claude Plugins Community repository uses four primary GitHub Actions workflows and two reusable custom actions to validate plugin manifests, manage repository hygiene, and automate maintenance tasks.

The anthropics/claude-plugins-community repository relies on a tightly integrated suite of GitHub Actions to enforce code quality, manage contributor access, and keep plugin references synchronized. All automation logic resides in the .github/workflows directory, while reusable components live under .github/actions.

Core CI/CD Workflows

The repository defines four distinct workflows that trigger on pushes, pull requests, scheduled intervals, or manual dispatch.

Validate Plugins Workflow

The Validate Plugins workflow serves as the primary quality gate. Defined in .github/workflows/validate-plugins.yml, it executes on every push, pull_request, and workflow_dispatch event. This pipeline orchestrates the validate-plugins custom action (located at .github/actions/validate-plugins/action.yml) to run a series of validation scripts including 00-detect-changes.sh and 11-validate-invariants.sh. These scripts verify plugin manifest integrity, check invariants, and validate external resolution.

Owner Liveness Sweep

Running on a daily cron schedule (47 5 * * *), the Owner Liveness Sweep workflow scans the repository for plugin owners who have become inactive. Unlike the validation workflow, this pipeline uses only standard GitHub actions such as actions/checkout@v3 to identify and tag dormant contributors for administrative review.

Close External PRs

The Close External PRs workflow triggers exclusively on pull_request_target events to automatically close pull requests submitted by non-collaborators. This security-focused automation prevents unwanted external changes by checking contributor status against repository permissions, utilizing standard GitHub actions without custom components.

Bump Plugin SHAs

Scheduled daily at 23 7 * * *, the Bump Plugin SHAs workflow updates SHA references for plugins that have changed upstream. It creates individual pull requests for each detected change while respecting a "freeze" list to suppress unwanted updates. This maintenance workflow relies solely on built-in GitHub actions.

Reusable Custom Actions

Beyond workflow definitions, the repository packages reusable logic into custom actions stored in .github/actions.

Validate Plugins Action

The validate-plugins action (.github/actions/validate-plugins/action.yml) provides a composite step that executes the full validation suite. It sequentially runs shell scripts to detect changes, validate invariants, and verify plugin consistency. This action is consumed by the main Validate Plugins workflow but can be reused by other pipelines requiring manifest verification.

Scan Plugins Action

Located at .github/actions/scan-plugins/README.md, the scan-plugins action supplies a test-pin-check.sh script. This utility verifies that plugin pin-vectors match a predefined golden set, ensuring cryptographic integrity during the validation process.

Standard GitHub Actions Dependencies

All workflows leverage foundational GitHub-hosted actions for environment setup:

• actions/checkout@v3 – Retrieves repository source code across all pipelines
• actions/setup-node@v3 – Prepares Node.js environments for JavaScript-based validation scripts
• actions/setup-python@v4 – Configures Python environments when validation logic requires Python tooling

These dependencies are referenced directly within workflow YAML files using the uses: actions/checkout@v3 syntax.

Running Workflows Locally

You can trigger these GitHub Actions manually using the GitHub CLI for testing or ad-hoc maintenance:

# Trigger the main validation pipeline

gh workflow run "Validate Plugins" --ref main

# Execute the owner liveness check outside its normal schedule

gh workflow run "Owner Liveness Sweep" --ref main

# Manually invoke the external PR closure workflow

gh workflow run "Close External PRs" --ref main

# Force a plugin SHA update ahead of the daily schedule

gh workflow run "Bump Plugin SHAs" --ref main

Summary

• The repository maintains four CI/CD workflows under .github/workflows covering validation, security, and maintenance
• Two reusable custom actions in .github/actions encapsulate validation logic and pin-vector checking
• The Validate Plugins workflow uses the validate-plugins custom action to execute scripts like 00-detect-changes.sh and 11-validate-invariants.sh
• Maintenance workflows run on cron schedules (47 5 * * * and 23 7 * * *) to handle liveness checks and SHA bumps
• All pipelines depend on standard actions including actions/checkout@v3, actions/setup-node@v3, and actions/setup-python@v4

Frequently Asked Questions

What triggers the Validate Plugins workflow in the Claude Plugins Community repository?

The workflow triggers on three events: push to any branch, pull_request creation or updates, and manual invocation via workflow_dispatch. This ensures every code change undergoes manifest validation and invariant checking before integration.

How does the repository handle pull requests from external contributors?

The Close External PRs workflow automatically identifies pull requests from non-collaborators using the pull_request_target trigger and immediately closes them. This prevents unauthorized modifications while maintaining an audit trail of closure attempts.

What is the purpose of the Bump Plugin SHAs workflow?

This scheduled workflow (running daily at 23:07 UTC) monitors upstream plugin repositories for new commits, updates the SHA references in the community repository, and generates pull requests for each detected change. It respects a configurable "freeze" list to prevent updating specific pinned plugins.

Where are the custom validation scripts located in the repository?

Custom validation logic resides in .github/actions/validate-plugins/action.yml and executes scripts named 00-detect-changes.sh, 11-validate-invariants.sh, and others. A separate scan-plugins action in .github/actions/scan-plugins/ provides the test-pin-check.sh utility for pin-vector verification.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}