# How the Nightly Sync Process for marketplace.json Works in Claude Plugins Community

> Understand the nightly sync process for marketplace.json in the Claude Plugins community. Learn how this automated workflow updates plugin metadata daily.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: internals
- Published: 2026-08-26

---

**The nightly sync process is an automated GitHub Actions workflow that runs at 07:23 UTC daily to pull the latest plugin metadata from Anthropic's internal review pipeline and update the public [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) file.**

The `anthropics/claude-plugins-community` repository serves as a read‑only mirror of Anthropic’s internal plugin marketplace. According to the source code analysis, the nightly synchronization ensures that the community has access to the latest validated plugin references without direct access to internal systems.

## Architecture of the Nightly Sync Workflow

The synchronization is orchestrated through a scheduled GitHub Actions workflow defined in [`.github/workflows/bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/bump-plugin-shas.yml). This automation acts as the public entry point that reflects changes from Anthropic’s internal review pipeline, maintaining the [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) file as an accurate mirror of the upstream source.

### Schedule and Trigger Configuration

The workflow operates on a strict cron schedule to guarantee daily updates. According to the workflow definition in [`.github/workflows/bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/bump-plugin-shas.yml), the process triggers automatically at 07:23 UTC every day, with an optional manual dispatch for targeted updates.

```yaml
on:
  schedule:
    - cron: '23 7 * * *'   # Daily 07:23 UTC

  workflow_dispatch:
    inputs:
      max_bumps:
        description: Cap on plugins bumped this run
        required: false
        default: '30'
      plugin:
        description: Bump ONLY this plugin name (empty = all stale)
        required: false
        default: ''

```

### The bump-plugin-shas Action

At the core of the nightly sync is the custom GitHub Action located at `.github/actions/bump-plugin-shas`. This action encapsulates the logic for reading the current marketplace manifest, detecting outdated plugin SHAs, validating new versions, and regenerating the [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) file.

## The 4-Step Synchronization Process

The nightly sync process for the [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) file follows a strict sequence to ensure data integrity and prevent broken plugins from entering the mirror:

1. **Load the freeze‑shas list** – The workflow first retrieves a curated list of plugins known to be broken or temporarily frozen, ensuring these entries are excluded from the update cycle.

2. **Execute the bump-plugin-shas action** – The action reads the current [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), identifies external entries with upstream commits that have moved past their pinned SHAs, validates each new SHA using `claude plugin validate`, and writes the updated entries back to the manifest.

3. **Commit changes and open pull requests** – For each bumped plugin, the workflow commits the updated [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) and opens an individual pull request (one PR per plugin entry), enabling isolated review and rollback capabilities.

4. **Dispatch validation workflows** – The workflow triggers the [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow for each generated pull request, ensuring the updated manifest passes the repository’s full validation suite before merging.

## Configuration and Implementation Details

The implementation relies on specific input parameters passed to the bump action to control behavior and maintain repository stability.

### Action Input Parameters

When the nightly sync executes, the workflow invokes the bump action with the following configuration, as defined in the workflow source:

```yaml
- uses: ./.github/actions/bump-plugin-shas
  id: bump
  with:
    marketplace-path: .claude-plugin/marketplace.json
    max-bumps: ${{ inputs.max_bumps || '30' }}
    freeze-shas: ${{ steps.freeze.outputs.list }}
    only: ${{ inputs.plugin }}
    pr-mode: per-entry
    claude-cli-version: latest

```

- **marketplace-path**: Points to [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), the target file for all updates.
- **max-bumps**: Limits the number of plugins updated per run to prevent overwhelming the review queue (defaults to 30).
- **freeze-shas**: References the exclusion list generated in the first step.
- **pr-mode**: Configured as `per-entry` to create individual pull requests for each plugin update.
- **claude-cli-version**: Specifies the validation tool version to use during SHA verification.

## Safety Mechanisms and Validation

The nightly sync process incorporates multiple safeguards to prevent corrupted or incompatible plugins from reaching the public mirror. The **freeze-shas** mechanism allows maintainers to temporarily exclude problematic plugins from the automatic update cycle, while the `claude plugin validate` command ensures each new SHA meets Anthropic’s validation standards before being written to [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json).

After the bump action generates updates, the [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow executes comprehensive checks on the modified manifest. This two-stage validation—first during SHA bumping and again via the dispatched workflow—ensures that the [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) file remains functional and accurate.

## Summary

- The nightly sync process for [`marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/marketplace.json) is driven by the [`bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/bump-plugin-shas.yml) workflow, scheduled to run at 07:23 UTC daily.
- The repository acts as a read‑only mirror, with the [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) file assembled from Anthropic’s internal review pipeline.
- The custom action at `.github/actions/bump-plugin-shas` handles SHA detection, validation via `claude plugin validate`, and manifest regeneration.
- Safety features include the freeze‑shas exclusion list and per‑entry pull request creation to isolate changes.
- The [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow provides secondary validation after each bump to ensure manifest integrity.

## Frequently Asked Questions

### What time does the marketplace.json nightly sync run?

The workflow triggers at **07:23 UTC every day** according to the cron expression `'23 7 * * *'` defined in [`.github/workflows/bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/bump-plugin-shas.yml). The repository also supports manual execution via `workflow_dispatch` for urgent updates or targeted plugin bumps.

### Why does the sync create individual pull requests for each plugin?

The **per-entry PR mode** isolates each plugin update into its own pull request. This approach prevents a single broken plugin from blocking updates to other entries and allows maintainers to review, approve, or reject specific SHA bumps independently. The configuration parameter `pr-mode: per-entry` in the bump action enforces this behavior.

### How does the sync prevent broken plugins from being published?

The process implements a **freeze-shas** exclusion list that filters out known broken plugins before the bump action executes. Additionally, each candidate SHA undergoes validation through the `claude plugin validate` command. Finally, the [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow runs comprehensive checks on every generated pull request before merging changes to the main branch.

### Can I manually trigger the marketplace.json sync for a specific plugin?

Yes. The workflow supports manual triggering through **workflow_dispatch** inputs. You can specify a single plugin name using the `plugin` input parameter, or adjust the `max_bumps` limit to control how many plugins update in a single run. This flexibility allows targeted updates without waiting for the scheduled 07:23 UTC execution.