# What Are the Lifecycle Workflows in .github/workflows? Automated Governance for the Claude Plugins Community

> Discover how lifecycle workflows in .github/workflows automate quality, security, and maintenance for the Claude Plugins Community repository. Streamline your GitHub processes today.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: how-to-guide
- Published: 2026-09-11

---

**The lifecycle workflows in `.github/workflows` are GitHub Actions that automate quality enforcement, security policy compliance, and routine maintenance for the anthropics/claude-plugins-community repository.**

The `anthropics/claude-plugins-community` repository maintains a curated marketplace of plugins through continuous integration automation. These **lifecycle workflows** handle validation, ownership verification, security gating, and artifact synchronization without manual intervention, ensuring every plugin meets strict quality standards before reaching users.

## The Four Core Lifecycle Workflows

The repository defines four primary workflows in `.github/workflows` that orchestrate the plugin lifecycle from submission to maintenance.

### Validate Plugins

The [`validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/validate-plugins.yml) workflow acts as the primary quality gate for all plugin changes.

**Triggers:** This workflow runs on every `push` to `main`, every `pull_request` targeting `main`, and via manual `workflow_dispatch`.

**Implementation:** Located at [`.github/workflows/validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/validate-plugins.yml), this job executes a sequential validation suite stored in `.github/actions/validate-plugins/scripts/`:

- [`00-detect-changes.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/00-detect-changes.sh) – Identifies which plugin directories changed
- [`20-validate-cli-marketplace.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/20-validate-cli-marketplace.sh) – Validates CLI marketplace compatibility  
- [`30-validate-cli-external.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/30-validate-cli-external.sh) – Checks external CLI requirements
- [`90-report.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/90-report.sh) – Generates detailed validation reports

The workflow ensures every plugin conforms to the required manifest schema, includes mandatory auxiliary files like `README` and `LICENSE`, and passes CLI-based compatibility checks.

```yaml
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run validation suite
        run: ./.github/actions/validate-plugins/scripts/00-detect-changes.sh

```

### Owner-Liveness Sweep

The [`owner-liveness-sweep.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/owner-liveness-sweep.yml) workflow monitors plugin ownership activity to prevent abandonment.

**Triggers:** A scheduled cron job (`cron: '0 4 * * *'`) runs daily at 04:00 UTC.

**Implementation:** The workflow executes [`.github/actions/owner-liveness-sweep/scripts/sweep.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/owner-liveness-sweep/scripts/sweep.sh), which inspects [`owner-baseline.json`](https://github.com/anthropics/claude-plugins-community/blob/main/owner-baseline.json) to identify owners whose last activity exceeds configurable thresholds. When stale owners are detected, the workflow automatically opens or updates an issue listing them for maintainer review.

```yaml
on:
  schedule:
    - cron: '0 4 * * *'  # Daily at 04:00 UTC

jobs:
  sweep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Sweep stale owners
        run: ./.github/actions/owner-liveness-sweep/scripts/sweep.sh

```

### Close External PRs

The [`close-external-prs.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/close-external-prs.yml) workflow enforces strict access control over plugin manifests.

**Triggers:** Activates on `pull_request_target` events of types `opened`, `edited`, or `reopened`.

**Implementation:** Using scripts in `.github/actions/scan-plugins/` such as [`scan.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/scan.sh) or [`close-external-manifest.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/close-external-manifest.sh), this workflow checks whether a PR originates from a fork outside the official CLA. If the PR attempts to modify plugin manifests without proper authorization, the workflow posts a comment explaining the policy and immediately closes the request.

```yaml
on:
  pull_request_target:
    types: [opened, edited, reopened]

jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Close external PRs
        run: ./.github/actions/scan-plugins/scripts/scan.sh

```

### Bump Plugin SHAs

The [`bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/bump-plugin-shas.yml) workflow maintains cryptographic integrity of published artifacts.

**Triggers:** Runs exclusively via `workflow_dispatch` for manual execution by maintainers.

**Implementation:** The workflow invokes [`.github/actions/bump-plugin-shas/scripts/bump.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/actions/bump-plugin-shas/scripts/bump.sh), which reads [`freeze-shas.txt`](https://github.com/anthropics/claude-plugins-community/blob/main/freeze-shas.txt) and updates each plugin manifest's `sha256` reference to match the latest built artifact. The workflow then commits these updated manifests back to the repository, ensuring users always download verified, up-to-date binaries.

```yaml
on:
  workflow_dispatch:

jobs:
  bump:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Bump SHAs
        run: ./.github/actions/bump-plugin-shas/scripts/bump.sh

```

## Architectural Design Principles

These workflows embody four key design patterns that maintain repository health:

**Fail-Fast Validation:** The validation suite aborts immediately upon detecting any invariant failure, preventing broken plugins from reaching the public marketplace.

**Owner Accountability:** By tracking activity in [`owner-baseline.json`](https://github.com/anthropics/claude-plugins-community/blob/main/owner-baseline.json) and flagging stale owners through automated sweeps, the repository ensures active stewardship of each plugin directory.

**Security-First Policy Enforcement:** The `pull_request_target` trigger on [`close-external-prs.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/close-external-prs.yml) creates a security boundary that prevents untrusted forks from modifying critical manifest files, reducing attack surface.

**Modular Reusability:** Scripts in `.github/actions/validate-plugins/` and `.github/actions/scan-plugins/` serve as reusable libraries. This modular design allows the **Bump Plugin SHAs** workflow to share helper functions with the validation suite, maintaining a single source of truth for plugin metadata handling.

## Summary

The lifecycle workflows in `.github/workflows` create a comprehensive automation pipeline for the Claude Plugins Community:

- **[`.github/workflows/validate-plugins.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/validate-plugins.yml)** ensures all plugins meet schema, CLI compatibility, and documentation standards before merging
- **[`.github/workflows/owner-liveness-sweep.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/owner-liveness-sweep.yml)** runs daily to identify and report inactive plugin owners
- **[`.github/workflows/close-external-prs.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/close-external-prs.yml)** protects manifest integrity by blocking unauthorized external contributions
- **[`.github/workflows/bump-plugin-shas.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/bump-plugin-shas.yml)** synchronizes cryptographic hashes with latest artifact builds via manual dispatch
- All workflows leverage reusable action scripts in `.github/actions/` to maintain consistent logic across automation tasks

## Frequently Asked Questions

### What triggers the plugin validation workflow?

The **Validate Plugins** workflow triggers on every push to the `main` branch, every pull request targeting `main`, and manual workflow dispatch events. This ensures continuous integration testing occurs whenever plugin code changes, preventing regressions from reaching production.

### How does the repository handle inactive plugin owners?

The **Owner-Liveness Sweep** workflow runs daily at 04:00 UTC via cron schedule. It executes [`sweep.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/sweep.sh) to compare current activity against [`owner-baseline.json`](https://github.com/anthropics/claude-plugins-community/blob/main/owner-baseline.json), automatically generating issues that flag owners who exceed inactivity thresholds for maintainer review and potential reassignment.

### Why does the repository automatically close certain pull requests?

The **Close External PRs** workflow protects marketplace integrity by closing pull requests from forks not covered by the official CLA. According to the source code in [`.github/workflows/close-external-prs.yml`](https://github.com/anthropics/claude-plugins-community/blob/main/.github/workflows/close-external-prs.yml), only repository owners or designated maintainers may modify plugin manifests, preventing accidental or malicious changes from untrusted external contributors.

### How are plugin artifact hashes kept synchronized with releases?

The **Bump Plugin SHAs** workflow updates SHA256 references through manual `workflow_dispatch` triggers. The [`bump.sh`](https://github.com/anthropics/claude-plugins-community/blob/main/bump.sh) script processes [`freeze-shas.txt`](https://github.com/anthropics/claude-plugins-community/blob/main/freeze-shas.txt) to align each plugin manifest with its corresponding built artifact, committing the changes to ensure users download cryptographically verified, up-to-date binaries.