Pin the CLI plugins to their latest releases

Closed
RO
21h ago
+167-6

Why

basecamp-cli, hey and fizzy install from their default branch, but their CLIs install from releases. A fresh claude plugin install basecamp-cli@37signals today gets 08ee7ff7, the tip of basecamp-cli's main, labelled 0.13.2. That skill runs basecamp auth agent connect --json, which only unreleased main supports (basecamp/basecamp-cli#852). The released 0.13.2 CLI refuses it, and users see the agent work around our own instructions while connecting.

What

  • release-pins.json names each pinned plugin's CLI repo.
  • bin/pin-releases sets each entry's sha to its CLI's latest release commit. It never moves a pin backwards, and a second run changes nothing.
  • bin/check-marketplace adds rule 3: every pinned plugin carries a full commit sha.
  • .github/workflows/pin-releases.yml runs the script hourly and opens or updates a pin-releases PR when a pin moved. A PR opened with the workflow's token starts no other workflow, so the job runs bin/check-marketplace itself before pushing.
  • Initial pins from running the script: basecamp-cli and its alias at v0.13.2 (d742884a), hey at v1.9.0 (76ea03f5), fizzy at v4.0.1 (3834efe7).

The house-skills plugins and the hosted plugin aren't pinned. They don't drive a separately released CLI.

Verified locally

  • A fresh Claude Code 2.1.303 home, using this branch as its marketplace, installed basecamp-cli at d742884a, hey at 76ea03f5 and fizzy at 3834efe7. That covers both url and github sources.
  • Codex 0.163.0 installed basecamp-cli from this branch. Its basecamp-connect/SKILL.md is byte-identical to v0.13.2's.
  • With basecamp-cli pinned to main's tip, the script kept the pin. GitHub compares v0.13.2 as behind main.
  • actionlint and zizmor report nothing on the workflow, and bin/check-marketplace passes.
  • The workflow itself hasn't run. It can't before merge. After merging, a workflow_dispatch run should report every plugin unchanged.

Needs a person

  • Repo setting. The workflow needs "Allow GitHub Actions to create and approve pull requests". I couldn't read the setting (403).
  • Existing installs move only when the version goes up. Claude Code's plugin update compares plugin.json versions, not commits. I checked this: a pin to a same-version commit left an install on main, and a pin to a 0.13.3 commit moved it. So:
    • basecamp-cli: existing installs move at v0.13.3. Until then, this PR changes new installs only.
    • hey: its main and v1.9.0 both say 1.9.0, so installs move at its next release.
    • fizzy: plugin.json says 0.1.0 on main and on v4.0.1. Existing Fizzy installs never update today, pinned or not, until fizzy-cli stamps its version at release.
  • New installs change today. They get each CLI's release plugin instead of main's. hey and fizzy owners should agree.
  • Who merges each pin PR. As written, the workflow opens the PR and a person merges it.