Add workflow to tag plugin versions for dependency resolution - #497
Merged
Merged
Conversation
openshift-ci
Bot
added
the
approved
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a GitHub Actions workflow that triggers on pushes to main (when plugin.json files change) and manual dispatch, runs a job that checks out tags, scans plugin directories for ChangesPlugin Version Tagging Automation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 errors)
✅ Passed checks (8 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-plugin-versions.yml:
- Around line 46-57: Add a workflow-level concurrency stanza to serialize runs
so the non-atomic sequence (the check `git tag -l "$tag"` followed by `claude
plugin tag --push`) cannot race; update the YAML to include a top-level
concurrency with a stable group (for example using the workflow name and ref
like `${{ github.workflow }}-${{ github.ref }}` or `${{ github.ref_name }}`) so
parallel runs that might touch the same `tag`/`plugin_path` are serialized and
avoid spurious increments of `errors` when tag creation races.
- Around line 19-25: Update the workflow to set actions/checkout (the step using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to
persist-credentials: false so credentials are not left for later steps, and
replace the insecure one-liner run step (the `curl -fsSL
https://claude.ai/install.sh | bash` command) with Claude Code’s documented
pinned release integrity flow: pin a specific release tag, download the release
binary and its manifest.json plus manifest.json.sig, verify the manifest
signature with GPG, then verify the binary SHA-256 matches the manifest before
installation; implement these steps as separate run actions in the same job to
ensure signature and hash verification occur prior to executing the installer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bdfb4372-ad0d-4509-9ec3-abe29ec80907
📒 Files selected for processing (1)
.github/workflows/tag-plugin-versions.yml
stbenjam
force-pushed
the
tags
branch
2 times, most recently
from
May 24, 2026 11:36
59cda08 to
7e3c3a1
Compare
3 tasks
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-plugin-versions.yml:
- Line 17: Replace the non-immutable container reference
"ghcr.io/anthropics/claude-code:latest" used in the workflow's image: entry with
a pinned digest form (ghcr.io/anthropics/claude-code@sha256:<actual-digest>) to
make runs reproducible; obtain the digest by pulling the image locally (docker
pull ghcr.io/anthropics/claude-code:latest) and inspecting the repo digest
(e.g., docker inspect or docker image inspect / docker manifest inspect) then
update the image value to the returned `@sha256`:<digest>.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a7c5960e-f64c-488c-b419-d1d809e9ea13
📒 Files selected for processing (1)
.github/workflows/tag-plugin-versions.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/tag-plugin-versions.yml (1)
21-21:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin the container image to an immutable digest.
Line 21 uses
:latest, which makes runs non-reproducible and weakens supply-chain traceability.Suggested fix
- image: ghcr.io/anthropics/claude-code:latest + image: ghcr.io/anthropics/claude-code@sha256:<resolved-digest>#!/bin/bash set -euo pipefail # Resolve current digest for ghcr.io/anthropics/claude-code:latest (read-only) token="$(python - <<'PY' import json, urllib.request url = "https://ghcr.io/token?service=ghcr.io&scope=repository:anthropics/claude-code:pull" print(json.load(urllib.request.urlopen(url))["token"]) PY )" digest="$(curl -fsSI \ -H "Authorization: Bearer ${token}" \ -H "Accept: application/vnd.oci.image.manifest.v1+json" \ "https://ghcr.io/v2/anthropics/claude-code/manifests/latest" \ | awk -F': ' 'tolower($1)=="docker-content-digest"{gsub("\r","",$2); print $2}')" echo "ghcr.io/anthropics/claude-code@${digest}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tag-plugin-versions.yml at line 21, Replace the floating tag image reference "ghcr.io/anthropics/claude-code:latest" in the workflow with an immutable digest form "ghcr.io/anthropics/claude-code@<digest>" so runs are reproducible and supply-chain traceable; obtain the current manifest digest for the latest tag (e.g., via the provided token + manifest request or any OCI registry query) and update the image line in .github/workflows/tag-plugin-versions.yml to use that sha256 digest string instead of :latest.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/tag-plugin-versions.yml:
- Around line 11-12: Restrict the manual dispatch to only the main branch by
changing the workflow_dispatch declaration to include a branch filter (e.g.,
workflow_dispatch: { branches: [ "main" ] }) or by adding a top-level
conditional that prevents runs unless github.ref == 'refs/heads/main'; update
the existing workflow_dispatch entry so manual runs on feature branches are
blocked and only the main branch can trigger the release tagging.
---
Duplicate comments:
In @.github/workflows/tag-plugin-versions.yml:
- Line 21: Replace the floating tag image reference
"ghcr.io/anthropics/claude-code:latest" in the workflow with an immutable digest
form "ghcr.io/anthropics/claude-code@<digest>" so runs are reproducible and
supply-chain traceable; obtain the current manifest digest for the latest tag
(e.g., via the provided token + manifest request or any OCI registry query) and
update the image line in .github/workflows/tag-plugin-versions.yml to use that
sha256 digest string instead of :latest.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7b1cf2a3-9a3e-4a24-9a8e-143f55ae5d6f
📒 Files selected for processing (1)
.github/workflows/tag-plugin-versions.yml
Member
Author
|
The "Git Push Safety Rules" failure is a false positive — this workflow is specifically designed to push tags automatically on merge to |
stbenjam
force-pushed
the
tags
branch
3 times, most recently
from
May 24, 2026 11:50
4cfbd89 to
ccb1473
Compare
Creates {plugin-name}--v{version} tags using `claude plugin tag --push`
on each push to main that changes a plugin.json. Supports manual
workflow_dispatch to backfill tags for all existing plugins.
See: https://code.claude.com/docs/en/plugin-dependencies#tag-plugin-releases-for-version-resolution
enxebre
reviewed
May 26, 2026
| continue | ||
| fi | ||
|
|
||
| git tag "$tag" |
Contributor
There was a problem hiding this comment.
I wonder if we might want to make this annotated tags so we preserve some metadata
Contributor
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: enxebre, stbenjam The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creates {plugin-name}--v{version} tags using
claude plugin tag --pushon each push to main that changes a plugin.json. Supports manual workflow_dispatch to backfill tags for all existing plugins.See: https://code.claude.com/docs/en/plugin-dependencies#tag-plugin-releases-for-version-resolution
Summary by CodeRabbit