| 1 | # Publishes g1t's Claude Code and Codex plugin marketplace to flagon-io/g1t-plugins |
| 2 | # on g1t.sh, so people add it without cloning this repository: |
| 3 | # |
| 4 | # claude plugin marketplace add https://g1t.sh/flagon-io/g1t-plugins.git |
| 5 | # claude plugin install g1t@g1t |
| 6 | # |
| 7 | # This repository is the plugin's source: .claude-plugin/marketplace.json |
| 8 | # and plugins/claude-code/. scripts/plugins-release.mjs builds the published |
| 9 | # tree from them (the manifest, the plugin without its tests, a README and |
| 10 | # the license, the plugin's source rewritten to ./plugins/g1t), checks it |
| 11 | # holds nothing else and nothing secret, and commits it to g1t-plugins' |
| 12 | # main only when it changed; each new version is tagged g1t--v<version>, |
| 13 | # as `claude plugin tag` would. A change to the plugin's files without a |
| 14 | # new version stops the run, as Claude Code updates installed plugins only |
| 15 | # when the version changes. |
| 16 | # |
| 17 | # Codex is sourced from plugins/codex/, with its own version guard, and |
| 18 | # published as plugins/g1t-codex/ with .agents/plugins/marketplace.json. |
| 19 | # |
| 20 | # Runs on a push to main that changes the plugin, its manifest or the |
| 21 | # script, and by hand. |
| 22 | # |
| 23 | # Needs the repository secret PLUGINS_PUBLISH_TOKEN: a workspace token of |
| 24 | # flagon-io (g1t.sh/flagon-io/-/tokens, made by an owner; it acts as the |
| 25 | # workspace, not a person), select repositories: g1t-plugins only, with |
| 26 | # Code: read and write (code:write) and nothing else. g1t-plugins must |
| 27 | # exist, public; this never creates it. The published tree has no workflow |
| 28 | # files, so the token needs no workflow_files:write. The job's own token |
| 29 | # reaches this repository only, and only to read it. |
| 30 | name: Plugins release |
| 31 | |
| 32 | on: |
| 33 | push: |
| 34 | branches: [main] |
| 35 | paths: |
| 36 | - .claude-plugin/** |
| 37 | - plugins/claude-code/** |
| 38 | - plugins/codex/** |
| 39 | - scripts/plugins-release.mjs |
| 40 | - LICENSE |
| 41 | workflow_dispatch: |
| 42 | |
| 43 | permissions: |
| 44 | contents: read |
| 45 | |
| 46 | concurrency: |
| 47 | group: plugins-release |
| 48 | cancel-in-progress: false |
| 49 | |
| 50 | jobs: |
| 51 | publish: |
| 52 | name: Publish flagon-io/g1t-plugins |
| 53 | runs-on: ubuntu-latest |
| 54 | timeout-minutes: 10 |
| 55 | steps: |
| 56 | - uses: actions/checkout@v5 |
| 57 | with: |
| 58 | # Without the job's own token in git's config: it would go with |
| 59 | # the push to g1t-plugins beside the publish token, and be refused. |
| 60 | persist-credentials: false |
| 61 | - name: The plugin's tests |
| 62 | run: | |
| 63 | node --test plugins/claude-code/test/hooks.test.mjs |
| 64 | node --test scripts/plugins-release.test.mjs |
| 65 | - name: Publish |
| 66 | env: |
| 67 | PLUGINS_PUBLISH_TOKEN: ${{ secrets.PLUGINS_PUBLISH_TOKEN }} |
| 68 | G1T_PLUGINS_REMOTE: ${{ github.server_url }}/flagon-io/g1t-plugins.git |
| 69 | G1T_SOURCE_COMMIT: ${{ github.sha }} |
| 70 | run: | |
| 71 | if [ -z "${PLUGINS_PUBLISH_TOKEN}" ]; then |
| 72 | echo "::error::Set the repository secret PLUGINS_PUBLISH_TOKEN (this workflow's header says what it needs)." |
| 73 | exit 1 |
| 74 | fi |
| 75 | echo "::add-mask::${PLUGINS_PUBLISH_TOKEN}" |
| 76 | node scripts/plugins-release.mjs publish |