fix: correct passport verification and public skill guidance (#191) #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Plugin security | |
| on: | |
| push: | |
| # The repository's machine ship loop opens PRs with GITHUB_TOKEN. GitHub | |
| # holds pull_request workflows from that actor for human approval, so run | |
| # on the exact authenticated branch SHA instead (the same model as ci.yml). | |
| branches: [main, "ship/**"] | |
| paths: | |
| - ".claude-plugin/**" | |
| - "plugins/agent-guild/**" | |
| - ".github/workflows/plugin-security.yml" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: hashgraph-online/ai-plugin-scanner-action@v1 | |
| with: | |
| plugin_dir: "plugins/agent-guild" | |
| fail_on_severity: high |