tobin df2c8d3748 Bump bump-plugin-shas action so bump commits are signed ...

The pinned version of anthropics/claude-plugins-community's
bump-plugin-shas action creates the bump commit with a local git commit,
which is unsigned and unmergeable under the required_signatures ruleset
on main. The new SHA creates the commit via the GraphQL
createCommitOnBranch mutation, which GitHub signs server-side, so weekly
bump PRs (e.g. #1809) become mergeable.

2026-05-11 19:31:47 +00:00

..

policy

Tighten policy scan: hook scope, telemetry, disclosure; make blocking (#1771)

2026-05-07 17:34:32 -05:00

scripts

Adopt validate-plugins action suite; pin all external SHAs (#1762)

2026-05-07 14:18:52 -05:00

workflows

Bump bump-plugin-shas action so bump commits are signed

2026-05-11 19:31:47 +00:00