Purpose of .github/owner-baseline.json in the Claude Plugins Community Repository

The .github/owner-baseline.json file serves as an immutable metadata registry that maps plugin owner logins to their permanent GitHub account IDs, enabling automated detection of account takeovers or login reassignments before any plugin updates are approved.

In the anthropics/claude-plugins-community repository, the .github/owner-baseline.json file functions as a critical security mechanism within the plugin submission pipeline. This JSON registry maintains a persistent record of every marketplace plugin source-repo owner who has ever contributed, ensuring that ownership changes are flagged for manual review before new versions can be published.

Core Functionality of the Owner Baseline Registry

The .github/owner-baseline.json file operates as a single source of truth for owner identity verification across the Claude plugin ecosystem.

Immutable Owner Mapping

The file stores a mapping of each lower-cased owner login to the stable GitHub account ID recorded at the time of first contribution. Because GitHub account IDs remain constant even when usernames change, this mapping prevents identity confusion when login names are recycled or transferred to different entities.

Reassignment Detection

When the owner-liveness-sweep action runs, it compares the current GitHub ID associated with an owner's login against the baseline record. If the resolved ID differs from the stored value, the system flags all plugins associated with that login, blocking automated version bumps until a maintainer manually reviews the ownership change.

How the Owner-Liveness-Sweep Action Validates Identities

The owner-liveness-sweep GitHub Action relies on the baseline file to perform security sweeps across all plugin submissions.

Validation Logic Implementation

The validation script located at .github/actions/owner-liveness-sweep/scripts/sweep.sh reads the JSON registry and cross-references each owner's current GitHub ID using the GitHub API. The workflow executes the following comparison logic:

# Pseudocode from .github/actions/owner-liveness-sweep/scripts/sweep.sh

owner=$(jq -r '.owner' "$PLUGIN_MANIFEST")                # e.g. "anthropic-plugin"

current_id=$(gh api "/users/$owner" --jq .id)              # Resolve current GitHub ID

recorded_id=$(jq -r ".owners[\"$owner\"].id" \
                "$GITHUB_WORKSPACE/.github/owner-baseline.json")

if [[ "$current_id" != "$recorded_id" ]]; then
  echo "::error ::Owner $owner has changed ID (was $recorded_id, now $current_id). Review required."
  exit 1
fi

If the IDs mismatch, the action fails and requires manual intervention before any plugins from that owner can be updated.

Automation Modes and Maintenance Guidelines

The baseline file maintains itself through automated processes, reducing manual overhead while preserving security integrity.

Seed and Refresh Operations

The owner-liveness-sweep action operates in two distinct modes: seed mode for initial population of the registry, and refresh mode for updating records when new owners submit their first plugin. Both modes write to .github/owner-baseline.json automatically without requiring human intervention.

Manual Editing Restrictions

Developers and maintainers should never edit existing entries by hand without thoroughly reviewing the security implications. Manual modifications risk bypassing the very takeover detection mechanisms the file is designed to enforce.

Integration with Repository Security Workflows

Several files work in concert to protect the plugin marketplace using the baseline registry:

• .github/owner-baseline.json — Stores the persistent mapping of owner logins to GitHub account IDs.
• .github/actions/owner-liveness-sweep/action.yml — Defines the GitHub Action interface that consumes the baseline data.
• .github/actions/owner-liveness-sweep/scripts/sweep.sh — Implements the core comparison logic between current and recorded IDs.
• .github/workflows/owner-liveness-sweep.yml — Schedules the automated sweep on a recurring basis (typically daily) to catch ownership changes early.

This architecture ensures the community plugin ecosystem remains protected against accidental or malicious ownership transfers.

Summary

• The .github/owner-baseline.json file maps lower-cased owner logins to immutable GitHub account IDs to establish identity baselines.
• The owner-liveness-sweep action compares current IDs against the baseline to detect login reassignments or account takeovers.
• Mismatches trigger manual review workflows, blocking automated version bumps for affected plugins.
• The system operates in seed or refresh modes automatically; manual edits to existing entries are strongly discouraged.
• Key implementation files include .github/actions/owner-liveness-sweep/scripts/sweep.sh and .github/workflows/owner-liveness-sweep.yml.

Frequently Asked Questions

What happens if an owner's GitHub ID changes in the baseline file?

If the owner-liveness-sweep action detects that a login now resolves to a different GitHub ID than recorded in .github/owner-baseline.json, it immediately flags all plugins from that owner for manual review. The workflow fails and prevents automated version bumps until a maintainer verifies the ownership change is legitimate.

Can I manually update entries in the owner-baseline.json file?

You should never edit existing entries manually without careful review. The file is maintained automatically by the owner-liveness-sweep action in seed or refresh mode. Manual modifications could inadvertently bypass security checks designed to detect account takeovers.

How often does the owner-liveness-sweep action run?

According to the repository configuration in .github/workflows/owner-liveness-sweep.yml, the sweep action runs on a scheduled basis—typically daily—to ensure any ownership changes are detected before new plugin versions are processed.

Why use GitHub account IDs instead of just usernames?

GitHub account IDs are immutable, whereas usernames (logins) can be changed or reassigned to different users. By recording the permanent account ID in .github/owner-baseline.json, the system can detect when a username has been transferred to a new entity, preventing potential supply chain attacks through username recycling.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}