Pin grimoire marketplace, drop caveman and dead memoria entry - #20
Open
Jartans-Familiar wants to merge 1 commit into
Open
Pin grimoire marketplace, drop caveman and dead memoria entry#20Jartans-Familiar wants to merge 1 commit into
Jartans-Familiar wants to merge 1 commit into
Conversation
Three unpinned marketplace references, in .claude/settings.json and claude.yml, each resolving to whatever sat on a default branch when a consumer installed or a job ran. The workflow runs with the App token and API key in the environment. grimoire is pinned to ref: marketplace-v1.0.0. claude-code-action cannot pin a URL -- plugin_marketplaces runs `claude plugin marketplace add <url>`, which takes no ref -- so the workflow clones grimoire at the tag and passes the local path, which pins exactly. caveman is removed rather than pinned. It is third-party, its plugin.json declares SessionStart and UserPromptSubmit hooks running node, nothing in this repository names a use for it, and merlin removed it on the same grounds in 1.12.0. Removing it also means no read of the pinned revision is owed before the finding closes. Also drops claude-plugins-official, which nothing installed from, and memoria@grimoire, which grimoire no longer ships -- it was already false in settings.json but still listed in claude.yml, where a `claude plugin install memoria@grimoire` would fail and abort the step. Refs JAR-249, SEC-2026-0045, SEC-2026-0046
JartanFTW
requested changes
Aug 17, 2026
JartanFTW
left a comment
JartanFTW
left a comment
Collaborator
There was a problem hiding this comment.
I'd rather remove claude.yml outright than make these scaffold-diverging changes. We don't even use claude.yml.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pins the
grimoiremarketplace toref: marketplace-v1.0.0, removes the third-partycavemanmarketplace, and drops the deadmemoria@grimoireentry and the unusedclaude-plugins-officialmarketplace from.claude/settings.jsonand.github/workflows/claude.yml.claude-code-action'splugin_marketplacesinput takes no ref, so the workflow now clonesgrimoireat the pinned tag into$RUNNER_TEMPand passes that local path instead of a bare URL — that's what actually pins it.Refs JAR-249, SEC-2026-0045, SEC-2026-0046 (task e0371cf7-7ee9-42ab-a992-050a4a170213)