From a7696814384e5c7ce55805d560e7b6c2ba41c293 Mon Sep 17 00:00:00 2001 From: Bryan Thompson <238056179+bryan-anthropic@users.noreply.github.com> Date: Wed, 12 Aug 2026 11:51:06 -0500 Subject: [PATCH 1/2] ci(scan): adopt static pin check for auto-exec MCP launchers (annotate-only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-pin scan-plugins to the community#2361 head: deterministic detection of floating npx/bunx/uvx/pipx MCP-server launcher specs (registry-resolved at session start, not fixed by the pinned source SHA). This surface stays annotate-only — fail-on-unpinned-autoexec is deliberately not set, and no waivers file is shipped (no adjudicated pin exceptions here). Re-pin to the merge SHA once community#2361 lands. Co-Authored-By: Claude Fable 5 --- .github/workflows/scan-plugins.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/scan-plugins.yml b/.github/workflows/scan-plugins.yml index 05ed33603..ce2c626ad 100644 --- a/.github/workflows/scan-plugins.yml +++ b/.github/workflows/scan-plugins.yml @@ -194,9 +194,10 @@ jobs: # The verdict (cached + fresh) is what gates the job, not the action's # exit code, and the revert workflow needs the artifact even on failure. continue-on-error: true - # Pinned to claude-plugins-community#34 (WIF input support). - # TODO: re-pin to a main-branch SHA once #34 merges. - uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@426e469f322952061102b286b378c0c9733a0934 + # Pinned to claude-plugins-community#2361 (static pin check for + # auto-exec MCP launchers — detection always on, warn-only here). + # TODO: re-pin to the main-branch merge SHA once #2361 merges. + uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@3f3ff3f254ac412c5ff89cb00ed8f1219bba36a0 with: # Anthropic auth via Workload Identity Federation — the action # mints a GitHub OIDC token (id-token: write above) and the claude @@ -208,6 +209,9 @@ jobs: marketplace-path: .scan-cache/scan-targets.json policy-prompt: .github/policy/prompt.md fail-on-findings: "true" + # Static pin check: detection + annotation only on this surface + # (fail-on-unpinned-autoexec deliberately not set; no waivers file + # — this marketplace has no adjudicated pin exceptions). claude-cli-version: latest # Merge fresh verdicts into the cache and assemble this run's full From c27d6ec399e5e933b6d09c162a9eabb5533cc512 Mon Sep 17 00:00:00 2001 From: Bryan Thompson <238056179+bryan-anthropic@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:49:06 -0500 Subject: [PATCH 2/2] re-pin scan-plugins to the #2361 merge SHA (24a5ecd5) Driver: unattended --- .github/workflows/scan-plugins.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scan-plugins.yml b/.github/workflows/scan-plugins.yml index ce2c626ad..fe56070d9 100644 --- a/.github/workflows/scan-plugins.yml +++ b/.github/workflows/scan-plugins.yml @@ -197,7 +197,7 @@ jobs: # Pinned to claude-plugins-community#2361 (static pin check for # auto-exec MCP launchers — detection always on, warn-only here). # TODO: re-pin to the main-branch merge SHA once #2361 merges. - uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@3f3ff3f254ac412c5ff89cb00ed8f1219bba36a0 + uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@24a5ecd5dd88e201e185e1174b7797a4e857dd67 with: # Anthropic auth via Workload Identity Federation — the action # mints a GitHub OIDC token (id-token: write above) and the claude