Distribute skills as a Claude Code plugin and via npx skills#17
Conversation
|
Warning Review limit reached
Your plan currently allows 2 reviews/hour. Refill in 7 minutes and 31 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis PR integrates codelens as a Claude Code plugin by adding plugin manifests, creating automated version synchronization between ChangesClaude Code Plugin Integration
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yaml:
- Around line 69-73: Update the sync-version job to harden the checkout and push
steps: replace the unpinned actions/checkout@v6 reference with a pinned commit
SHA for actions/checkout, add with: persist-credentials: false to the Checkout
main step to avoid leaking the default GITHUB_TOKEN, and change the push command
that does git push origin HEAD:main to use an explicit tokenized remote URL
(e.g. git push https://x-access-token:${{ secrets.GITHUB_TOKEN }}`@github.com/`${{
github.repository }} HEAD:main) so the push uses an explicit token rather than
persisted credentials.
In `@README.md`:
- Around line 55-57: Add the language identifier "bash" to the fenced code
blocks that contain the shell commands so markdown lint passes and formatting is
consistent; specifically update the fence around the block containing "npx
skills add charliek/codelens" and the block containing "/plugin marketplace add
charliek/codelens" and "/plugin install codelens@codelens" to start with ```bash
instead of ``` .
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4e7efcb9-5cc4-4bd8-9928-8c2a4cf74896
📒 Files selected for processing (7)
.claude-plugin/marketplace.json.claude-plugin/plugin.json.github/workflows/release.yamlCLAUDE.mdREADME.mddocs/development/setup.mdscripts/set-version.sh
| - name: Checkout main | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: main | ||
| # Default persist-credentials keeps the GITHUB_TOKEN so we can push back. |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the current immutable commit SHA for actions/checkout v6, and does GitHub recommend pinning workflow actions by full commit SHA for supply-chain security?
💡 Result:
The immutable commit SHA for the initial release of actions/checkout v6.0.0 is 11bd71f01bbe51f23071765d1e4e75185345670c. GitHub strongly recommends pinning workflow actions by their full-length commit SHA to ensure supply-chain security [1]. Because tags (like v6) and branches are mutable, they can be repointed by repository owners or compromised accounts to different commits, potentially introducing malicious code into your workflows without warning [2][3][4][1]. Pinning to a full-length commit SHA provides an immutable reference that cannot be altered, effectively mitigating the risk of such supply-chain attacks [5][6][1]. To maintain the security benefits of pinning while still managing updates, it is common practice to use automated dependency management tools like Dependabot or Renovate, which can automatically open pull requests to update your pinned SHAs when new versions are released [5][2][7]. Additionally, GitHub provides organizational and repository-level policies that can be configured to require that all actions be pinned to a full-length commit SHA [1].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://www.aikido.dev/blog/checklist-github-actions
- 3: https://gbhackers.com/compromised-github-action/
- 4: https://undercodenews.com/github-actions-nightmare-malicious-tag-hijack-sparks-massive-supply-chain-breach-shock/
- 5: https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash
- 6: https://stackoverflow.com/questions/78903499/how-do-i-pin-an-action-to-a-specific-sha
- 7: Pin all GitHub Actions to immutable SHA commits for supply chain security github/gh-aw#5691
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the referenced portions of the workflow
sed -n '1,140p' .github/workflows/release.yaml | cat -nRepository: charliek/codelens
Length of output: 3705
Harden the sync-version write-back job (pin actions/checkout + avoid persisted GITHUB_TOKEN credentials).
sync-versionuses unpinnedactions/checkout@v6(supply-chain hardening: pin to a full commit SHA).- The job relies on checkout’s default credential persistence and then runs
git push origin HEAD:main; disable persisted credentials and push using an explicit token URL.
🔒 Suggested hardening diff
sync-version:
@@
- name: Checkout main
- uses: actions/checkout@v6
+ uses: actions/checkout@<PINNED_CHECKOUT_V6_SHA>
with:
ref: main
- # Default persist-credentials keeps the GITHUB_TOKEN so we can push back.
+ persist-credentials: false
@@
- name: Commit and push if the version files drifted
@@
- run: |
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
if [ -z "$(git status --porcelain version.txt .claude-plugin/plugin.json)" ]; then
echo "version files already match ${GITHUB_REF_NAME}; nothing to commit"
exit 0
fi
@@
- git push origin HEAD:main
+ git push "https://x-access-token:${GITHUB_TOKEN}`@github.com/`${GITHUB_REPOSITORY}.git" HEAD:main🧰 Tools
🪛 zizmor (1.25.2)
[warning] 69-73: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 70-70: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yaml around lines 69 - 73, Update the sync-version
job to harden the checkout and push steps: replace the unpinned
actions/checkout@v6 reference with a pinned commit SHA for actions/checkout, add
with: persist-credentials: false to the Checkout main step to avoid leaking the
default GITHUB_TOKEN, and change the push command that does git push origin
HEAD:main to use an explicit tokenized remote URL (e.g. git push
https://x-access-token:${{ secrets.GITHUB_TOKEN }}`@github.com/`${{
github.repository }} HEAD:main) so the push uses an explicit token rather than
persisted credentials.
Make the skills/ directory installable as agent skills through two channels without moving or restructuring any skill files. - Add .claude-plugin/plugin.json and .claude-plugin/marketplace.json so the four skills install as a Claude Code plugin (/plugin install codelens@codelens). - Document both install channels in the README: cross-agent via npx skills, and the native Claude Code plugin. - Add scripts/set-version.sh, the single setter for version.txt and the plugin manifest version. - Add a sync-version CI job that commits version.txt and plugin.json back to main from the tag after each release, keeping the installer-facing plugin version in lockstep (idempotent). - Record the version lockstep in CLAUDE.md and docs/development/setup.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
charliek
force-pushed
the
plugin-distribution
branch
from
46b4fac to
ff4778d
Compare
1 participant
Summary
Makes the
skills/directory installable as agent skills through two channels, without moving or restructuring any skill files..claude-plugin/plugin.jsonand.claude-plugin/marketplace.json(self-contained,source: "./"). Install with/plugin marketplace add charliek/codelensthen/plugin install codelens@codelens. Skills are namespacedcodelens:<skill-name>.npx skills add charliek/codelens, which auto-discoversskills/and installs into Claude Code plus 50+ other agents (Cursor, Codex, Copilot, Windsurf, ...). Needs no manifest.plugin.jsonhardcodes a version that Claude Code reads frommain, so a newsync-versionCI job commitsversion.txtand.claude-plugin/plugin.jsonback tomainfrom the tag after each release (idempotent).scripts/set-version.shis the shared setter, also used by the in-build step.Install
or
Notes
Apache-2.0and version is0.0.1, matching the repo (not the MIT /0.1.0placeholders).claude plugin validate . --strictpasses; both manifests parse;set-version.shis idempotent (byte-stable on a no-op run).mainHEAD is the installer-facing source of truth (the tag tree shows pre-bump version files). The bot push usesGITHUB_TOKEN, which does not re-triggerbuild.yml.🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Documentation