What Are the Lifecycle Workflows in .github/workflows? Automated Governance for the Claude Plugins Community

The lifecycle workflows in .github/workflows are GitHub Actions that automate quality enforcement, security policy compliance, and routine maintenance for the anthropics/claude-plugins-community repository.

The anthropics/claude-plugins-community repository maintains a curated marketplace of plugins through continuous integration automation. These lifecycle workflows handle validation, ownership verification, security gating, and artifact synchronization without manual intervention, ensuring every plugin meets strict quality standards before reaching users.

The Four Core Lifecycle Workflows

The repository defines four primary workflows in .github/workflows that orchestrate the plugin lifecycle from submission to maintenance.

Validate Plugins

The validate-plugins.yml workflow acts as the primary quality gate for all plugin changes.

Triggers: This workflow runs on every push to main, every pull_request targeting main, and via manual workflow_dispatch.

Implementation: Located at .github/workflows/validate-plugins.yml, this job executes a sequential validation suite stored in .github/actions/validate-plugins/scripts/:

• 00-detect-changes.sh – Identifies which plugin directories changed
• 20-validate-cli-marketplace.sh – Validates CLI marketplace compatibility
• 30-validate-cli-external.sh – Checks external CLI requirements
• 90-report.sh – Generates detailed validation reports

The workflow ensures every plugin conforms to the required manifest schema, includes mandatory auxiliary files like README and LICENSE, and passes CLI-based compatibility checks.

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run validation suite
        run: ./.github/actions/validate-plugins/scripts/00-detect-changes.sh

Owner-Liveness Sweep

The owner-liveness-sweep.yml workflow monitors plugin ownership activity to prevent abandonment.

Triggers: A scheduled cron job (cron: '0 4 * * *') runs daily at 04:00 UTC.

Implementation: The workflow executes .github/actions/owner-liveness-sweep/scripts/sweep.sh, which inspects owner-baseline.json to identify owners whose last activity exceeds configurable thresholds. When stale owners are detected, the workflow automatically opens or updates an issue listing them for maintainer review.

on:
  schedule:
    - cron: '0 4 * * *'  # Daily at 04:00 UTC

jobs:
  sweep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Sweep stale owners
        run: ./.github/actions/owner-liveness-sweep/scripts/sweep.sh

Close External PRs

The close-external-prs.yml workflow enforces strict access control over plugin manifests.

Triggers: Activates on pull_request_target events of types opened, edited, or reopened.

Implementation: Using scripts in .github/actions/scan-plugins/ such as scan.sh or close-external-manifest.sh, this workflow checks whether a PR originates from a fork outside the official CLA. If the PR attempts to modify plugin manifests without proper authorization, the workflow posts a comment explaining the policy and immediately closes the request.

on:
  pull_request_target:
    types: [opened, edited, reopened]

jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Close external PRs
        run: ./.github/actions/scan-plugins/scripts/scan.sh

Bump Plugin SHAs

The bump-plugin-shas.yml workflow maintains cryptographic integrity of published artifacts.

Triggers: Runs exclusively via workflow_dispatch for manual execution by maintainers.

Implementation: The workflow invokes .github/actions/bump-plugin-shas/scripts/bump.sh, which reads freeze-shas.txt and updates each plugin manifest's sha256 reference to match the latest built artifact. The workflow then commits these updated manifests back to the repository, ensuring users always download verified, up-to-date binaries.

on:
  workflow_dispatch:

jobs:
  bump:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Bump SHAs
        run: ./.github/actions/bump-plugin-shas/scripts/bump.sh

Architectural Design Principles

These workflows embody four key design patterns that maintain repository health:

Fail-Fast Validation: The validation suite aborts immediately upon detecting any invariant failure, preventing broken plugins from reaching the public marketplace.

Owner Accountability: By tracking activity in owner-baseline.json and flagging stale owners through automated sweeps, the repository ensures active stewardship of each plugin directory.

Security-First Policy Enforcement: The pull_request_target trigger on close-external-prs.yml creates a security boundary that prevents untrusted forks from modifying critical manifest files, reducing attack surface.

Modular Reusability: Scripts in .github/actions/validate-plugins/ and .github/actions/scan-plugins/ serve as reusable libraries. This modular design allows the Bump Plugin SHAs workflow to share helper functions with the validation suite, maintaining a single source of truth for plugin metadata handling.

Summary

The lifecycle workflows in .github/workflows create a comprehensive automation pipeline for the Claude Plugins Community:

• .github/workflows/validate-plugins.yml ensures all plugins meet schema, CLI compatibility, and documentation standards before merging
• .github/workflows/owner-liveness-sweep.yml runs daily to identify and report inactive plugin owners
• .github/workflows/close-external-prs.yml protects manifest integrity by blocking unauthorized external contributions
• .github/workflows/bump-plugin-shas.yml synchronizes cryptographic hashes with latest artifact builds via manual dispatch
• All workflows leverage reusable action scripts in .github/actions/ to maintain consistent logic across automation tasks

Frequently Asked Questions

What triggers the plugin validation workflow?

The Validate Plugins workflow triggers on every push to the main branch, every pull request targeting main, and manual workflow dispatch events. This ensures continuous integration testing occurs whenever plugin code changes, preventing regressions from reaching production.

How does the repository handle inactive plugin owners?

The Owner-Liveness Sweep workflow runs daily at 04:00 UTC via cron schedule. It executes sweep.sh to compare current activity against owner-baseline.json, automatically generating issues that flag owners who exceed inactivity thresholds for maintainer review and potential reassignment.

Why does the repository automatically close certain pull requests?

The Close External PRs workflow protects marketplace integrity by closing pull requests from forks not covered by the official CLA. According to the source code in .github/workflows/close-external-prs.yml, only repository owners or designated maintainers may modify plugin manifests, preventing accidental or malicious changes from untrusted external contributors.

How are plugin artifact hashes kept synchronized with releases?

The Bump Plugin SHAs workflow updates SHA256 references through manual workflow_dispatch triggers. The bump.sh script processes freeze-shas.txt to align each plugin manifest with its corresponding built artifact, committing the changes to ensure users download cryptographically verified, up-to-date binaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}