From be05f7f95ef5de456127a39ba424fb6c2c3ff911 Mon Sep 17 00:00:00 2001 From: StuBehan Date: Sat, 24 Oct 2026 14:48:01 +0100 Subject: [PATCH] ci: pin the validator CLIs in a lockfile --- .github/workflows/validate.yml | 24 ++- scripts/package-lock.json | 369 +++++++++++++++++++++++++++++++++ scripts/package.json | 10 + 3 files changed, 397 insertions(+), 6 deletions(-) create mode 100644 scripts/package-lock.json create mode 100644 scripts/package.json diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index b72a488..ede8b16 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -10,12 +10,11 @@ on: permissions: contents: read -# Third-party validators are pinned to commits. Bump deliberately. +# Third-party validators are pinned: the upstream repos to commits here, the npm +# packages in scripts/package-lock.json. Bump deliberately. env: CURSOR_PLUGINS_SHA: c7f203457c16815379130697c41e74fd202e9978 # github.com/cursor/plugins (schemas/plugin.schema.json) XAI_MARKETPLACE_SHA: e5c73400a2ec55fa0abd1efbc8908a5aa801dcce # github.com/xai-org/plugin-marketplace (scripts/) - CLAUDE_CODE_VERSION: 2.1.234 # npm @anthropic-ai/claude-code - CODEX_VERSION: 0.147.0 # npm @openai/codex jobs: manifests: @@ -37,7 +36,13 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - - run: npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" + # Installed outside the checkout: installing the plugin from source copies the + # whole directory, so a node_modules in it would ship with the test install. + - name: install the CLIs pinned in scripts/package-lock.json + run: | + cp scripts/package.json scripts/package-lock.json "$RUNNER_TEMP" + (cd "$RUNNER_TEMP" && npm ci) + echo "$RUNNER_TEMP/node_modules/.bin" >> "$GITHUB_PATH" - name: validate manifests with the Claude Code CLI run: | claude plugin validate .claude-plugin/plugin.json @@ -62,7 +67,13 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - - run: npm install -g "@openai/codex@${CODEX_VERSION}" + # Installed outside the checkout: installing the plugin from source copies the + # whole directory, so a node_modules in it would ship with the test install. + - name: install the CLIs pinned in scripts/package-lock.json + run: | + cp scripts/package.json scripts/package-lock.json "$RUNNER_TEMP" + (cd "$RUNNER_TEMP" && npm ci) + echo "$RUNNER_TEMP/node_modules/.bin" >> "$GITHUB_PATH" - name: add this repo as a Codex marketplace, install, confirm the MCP server registers env: CODEX_HOME: ${{ runner.temp }}/codex @@ -91,7 +102,8 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 22 - - run: npm install --no-save ajv@8.20.0 ajv-formats@3.0.1 + - run: npm ci + working-directory: scripts - run: node scripts/validate-cursor.mjs .upstream/cursor-plugins grok-build: diff --git a/scripts/package-lock.json b/scripts/package-lock.json new file mode 100644 index 0000000..80597b1 --- /dev/null +++ b/scripts/package-lock.json @@ -0,0 +1,369 @@ +{ + "name": "stackone-plugin-validators", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "stackone-plugin-validators", + "devDependencies": { + "@anthropic-ai/claude-code": "2.1.234", + "@openai/codex": "0.147.0", + "ajv": "8.20.0", + "ajv-formats": "3.0.1" + } + }, + "node_modules/@anthropic-ai/claude-code": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.234.tgz", + "integrity": "sha512-Q53mRcFLqPAWfkvqn7vOzTtMHprzwKdKGRW4OS/Kgr/Tsa+2pyVwVetLb7DRZxhBkYsYld2l8Eo4SX76YoNOOA==", + "dev": true, + "hasInstallScript": true, + "license": "SEE LICENSE IN README.md", + "bin": { + "claude": "bin/claude.exe" + }, + "engines": { + "node": ">=22.0.0" + }, + "optionalDependencies": { + "@anthropic-ai/claude-code-darwin-arm64": "2.1.234", + "@anthropic-ai/claude-code-darwin-x64": "2.1.234", + "@anthropic-ai/claude-code-linux-arm64": "2.1.234", + "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.234", + "@anthropic-ai/claude-code-linux-x64": "2.1.234", + "@anthropic-ai/claude-code-linux-x64-musl": "2.1.234", + "@anthropic-ai/claude-code-win32-arm64": "2.1.234", + "@anthropic-ai/claude-code-win32-x64": "2.1.234" + } + }, + "node_modules/@anthropic-ai/claude-code-darwin-arm64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-arm64/-/claude-code-darwin-arm64-2.1.234.tgz", + "integrity": "sha512-ghlFkFWQSofz0EfHGReeegORZAhDOrwNTgNz+5ZBTbKFuhe0P9YPhWANbJLhCkZjRGXAulixWJkjSPdJEu4XJQ==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "darwin" + ] + }, + "node_modules/@anthropic-ai/claude-code-darwin-x64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-x64/-/claude-code-darwin-x64-2.1.234.tgz", + "integrity": "sha512-r4WKQ6tB7lHU+ICZIY8NeVA0dW19tAavkx8/JVeblLDy1W2fL4iZqmq8SWZvA1rdCa1coQm23Ffb4yVcVfi8vQ==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "darwin" + ] + }, + "node_modules/@anthropic-ai/claude-code-linux-arm64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64/-/claude-code-linux-arm64-2.1.234.tgz", + "integrity": "sha512-+uKUA99AEcsdEoPpWqDq46jCuPLbmb+HgF67zZ7Et7vPzQpUZp+UAERVFz6QPxqib+wNUdRTpHrbVJNMqBaj/Q==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "linux" + ] + }, + "node_modules/@anthropic-ai/claude-code-linux-arm64-musl": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64-musl/-/claude-code-linux-arm64-musl-2.1.234.tgz", + "integrity": "sha512-yryt18rM+B15g8y1F/x+w1kCyGA12Ui/L2yjCecF6d/TvwNzQZPuPshF2hYl6PBbS2/3gSsBZObQI8ET2CLpng==", + "cpu": [ + "arm64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "linux" + ] + }, + "node_modules/@anthropic-ai/claude-code-linux-x64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.234.tgz", + "integrity": "sha512-dB5vN+njWgjNLUmlviXQ2vCupBahNVjSn9gtR9Cc5D/zn2AZrq2FisbOpnx7WVWVj3GA1YqJ+xAgDsObq0JIuA==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "glibc" + ], + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "linux" + ] + }, + "node_modules/@anthropic-ai/claude-code-linux-x64-musl": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64-musl/-/claude-code-linux-x64-musl-2.1.234.tgz", + "integrity": "sha512-8FtxluTXq7M7A3vYRliTG7rsy4MmX+nSfbrYBxvuPNvLrhyp9uRbB9pIdRJAsRhUq2wU68aC/bJBD6UaDD6E7w==", + "cpu": [ + "x64" + ], + "dev": true, + "libc": [ + "musl" + ], + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "linux" + ] + }, + "node_modules/@anthropic-ai/claude-code-win32-arm64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-arm64/-/claude-code-win32-arm64-2.1.234.tgz", + "integrity": "sha512-7488MgGzigh6Ztw6IUXChmh/0Qm9bxzy9jMr6hhW+oaTaI3opPbeIkCOUw1Up/b1X1CZGNkZiss4vDrKc6o7MA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "win32" + ] + }, + "node_modules/@anthropic-ai/claude-code-win32-x64": { + "version": "2.1.234", + "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-x64/-/claude-code-win32-x64-2.1.234.tgz", + "integrity": "sha512-599lu9t31nRE/y8rxCnDtqzPmsNE1bgyKE9aCSitdp6w6cD4bkvUGcnEeqe4jyWdQHQY7sRDjvRXNuS0TwzmYw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "SEE LICENSE IN LICENSE.md", + "optional": true, + "os": [ + "win32" + ] + }, + "node_modules/@openai/codex": { + "version": "0.147.0", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0.tgz", + "integrity": "sha512-EQLEXecAG2ptxI7UpBMo2TR/ga5596/c/OsYF/0LoUDh5JANZ7IoGqlzBEWbuEVQ76JePIbtTW/ihCkp1a7Z3w==", + "dev": true, + "license": "Apache-2.0", + "bin": { + "codex": "bin/codex.js" + }, + "engines": { + "node": ">=16" + }, + "optionalDependencies": { + "@openai/codex-darwin-arm64": "npm:@openai/codex@0.147.0-darwin-arm64", + "@openai/codex-darwin-x64": "npm:@openai/codex@0.147.0-darwin-x64", + "@openai/codex-linux-arm64": "npm:@openai/codex@0.147.0-linux-arm64", + "@openai/codex-linux-x64": "npm:@openai/codex@0.147.0-linux-x64", + "@openai/codex-win32-arm64": "npm:@openai/codex@0.147.0-win32-arm64", + "@openai/codex-win32-x64": "npm:@openai/codex@0.147.0-win32-x64" + } + }, + "node_modules/@openai/codex-darwin-arm64": { + "name": "@openai/codex", + "version": "0.147.0-darwin-arm64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-darwin-arm64.tgz", + "integrity": "sha512-BEUVkiOW7kLcRyrMLfAr/h9wF8sRVJyZDy6OHtVn6QGDXiv3BvAZVTY1Pu9xF7KdIdkYXbp4uayN0aDQQaAUJw==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/@openai/codex-darwin-x64": { + "name": "@openai/codex", + "version": "0.147.0-darwin-x64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-darwin-x64.tgz", + "integrity": "sha512-Tb8McE5SvJIH0Vs5R6sq7u+quiC931yan2KOOl6km1OdZ82+Wi7eF5XrSFPs5CF7xCgoIK4Vs+byMbT5hN+ZUw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/@openai/codex-linux-arm64": { + "name": "@openai/codex", + "version": "0.147.0-linux-arm64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-linux-arm64.tgz", + "integrity": "sha512-SLC1JXw2TYfr/c3HhrJubyyLelq7vTOLWVmiThFA+z0+WgzCPmaseJ/kzDD3Gge/TO7fCnnj7UcPmC0d2c8XAg==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/@openai/codex-linux-x64": { + "name": "@openai/codex", + "version": "0.147.0-linux-x64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-linux-x64.tgz", + "integrity": "sha512-0W9MBxPpWW0cSkNqrTDN2jR7rzzT7oNMhQY5446lT2Lw5cz5yhDTck4Va9rjkQEm+HlFzP/dmEMSZbXfJsINmw==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "linux" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/@openai/codex-win32-arm64": { + "name": "@openai/codex", + "version": "0.147.0-win32-arm64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-win32-arm64.tgz", + "integrity": "sha512-e2ZstJ8zT8Rm1nvR7CUVO+Gr3cTChE41+VfOzGhynzDXEoW0wfbjUQbc2bWbh1arG94LMm4y3dqBtUIbSrfeGA==", + "cpu": [ + "arm64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/@openai/codex-win32-x64": { + "name": "@openai/codex", + "version": "0.147.0-win32-x64", + "resolved": "https://registry.npmjs.org/@openai/codex/-/codex-0.147.0-win32-x64.tgz", + "integrity": "sha512-oT7Ss5fAPf2fiWE9QNURqZcQGAAawSVxmIUdgPzckq4KFZAM+pRz9JbM4Rr498CjtbNgTOjWvDJ+DXvIBSfOPA==", + "cpu": [ + "x64" + ], + "dev": true, + "license": "Apache-2.0", + "optional": true, + "os": [ + "win32" + ], + "engines": { + "node": ">=16" + } + }, + "node_modules/ajv": { + "version": "8.20.0", + "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz", + "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==", + "dev": true, + "license": "MIT", + "dependencies": { + "fast-deep-equal": "^3.1.3", + "fast-uri": "^3.0.1", + "json-schema-traverse": "^1.0.0", + "require-from-string": "^2.0.2" + }, + "funding": { + "type": "github", + "url": "https://github.com/sponsors/epoberezkin" + } + }, + "node_modules/ajv-formats": { + "version": "3.0.1", + "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz", + "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "ajv": "^8.0.0" + }, + "peerDependencies": { + "ajv": "^8.0.0" + }, + "peerDependenciesMeta": { + "ajv": { + "optional": true + } + } + }, + "node_modules/fast-deep-equal": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz", + "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==", + "dev": true, + "license": "MIT" + }, + "node_modules/fast-uri": { + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/fastify" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fastify" + } + ], + "license": "BSD-3-Clause" + }, + "node_modules/json-schema-traverse": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", + "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==", + "dev": true, + "license": "MIT" + }, + "node_modules/require-from-string": { + "version": "2.0.2", + "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz", + "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + } + } +} diff --git a/scripts/package.json b/scripts/package.json new file mode 100644 index 0000000..1914618 --- /dev/null +++ b/scripts/package.json @@ -0,0 +1,10 @@ +{ + "name": "stackone-plugin-validators", + "private": true, + "devDependencies": { + "@anthropic-ai/claude-code": "2.1.234", + "@openai/codex": "0.147.0", + "ajv": "8.20.0", + "ajv-formats": "3.0.1" + } +}