From df2c8d37489c7c0e73a6d85cb8de26659b9d5d76 Mon Sep 17 00:00:00 2001 From: tobin Date: Mon, 11 May 2026 18:12:04 +0000 Subject: [PATCH] Bump bump-plugin-shas action so bump commits are signed The pinned version of anthropics/claude-plugins-community's bump-plugin-shas action creates the bump commit with a local git commit, which is unsigned and unmergeable under the required_signatures ruleset on main. The new SHA creates the commit via the GraphQL createCommitOnBranch mutation, which GitHub signs server-side, so weekly bump PRs (e.g. #1809) become mergeable. --- .github/workflows/bump-plugin-shas.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/bump-plugin-shas.yml b/.github/workflows/bump-plugin-shas.yml index 867cac8..a2d965f 100644 --- a/.github/workflows/bump-plugin-shas.yml +++ b/.github/workflows/bump-plugin-shas.yml @@ -31,7 +31,9 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@f846a0bcb0e721b1f93d60e8b73e91dafc4a1e87 + # createCommitOnBranch-based bump so commits are signed by GitHub and + # satisfy the org-level required_signatures ruleset on main. + - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@c41c6911de0afffd2bc5cd8b21fb1e06444ee13b with: marketplace-path: .claude-plugin/marketplace.json max-bumps: ${{ inputs.max_bumps || '20' }}