actions-warden 0.1.0 → 0.1.1

package/README.md

@@ -185,6 +185,39 @@ making findings visible directly in the GitHub UI.
 which fails the job by default. To collect findings without failing the build,
 set `continue-on-error: true` on the step.
 
+## Use it from Claude Code
+
+This repo is also a Claude Code plugin. Once installed, Claude will invoke
+`actions-warden` automatically whenever a prompt asks to audit, pin, or
+upgrade GitHub Actions workflows.
+
+**Option A - via the plugin marketplace (recommended):**
+
+```
+/plugin marketplace add chiz0me/claude-plugins
+/plugin install actions-warden@chiz0me
+```
+
+**Option B - drop the skill in directly (no marketplace):**
+
+```sh
+mkdir -p ~/.claude/skills/actions-warden
+curl -fsSL https://raw.githubusercontent.com/chiz0me/actions-warden/main/skills/actions-warden/SKILL.md \
+  -o ~/.claude/skills/actions-warden/SKILL.md
+```
+
+After installation, prompts like *"audit my workflows"*, *"pin my actions to
+SHAs"*, or *"check this workflow for script injection"* will route through the
+skill, which runs the CLI via `npx actions-warden` and explains the TOON
+output back to you.
+
+Plugin layout (per the Claude Code plugin spec):
+
+```
+.claude-plugin/plugin.json      # plugin manifest
+skills/actions-warden/SKILL.md  # the skill itself
+```
+
 ## Programmatic API
 
 Each command is also exported as an async function, so an LLM agent or
@@ -283,6 +316,26 @@ After the first release tag is pushed, open the release on github.com and tick
 "Publish this Action to the GitHub Marketplace" to list it. No automation
 required - the release workflow above handles everything except that opt-in.
 
+### Marketplace sync
+
+When a `vX.Y.Z` tag is pushed, the `sync-marketplace` job in `release.yml`
+updates the `actions-warden` plugin entry in
+[chiz0me/claude-plugins/.claude-plugin/marketplace.json](https://github.com/chiz0me/claude-plugins/blob/main/.claude-plugin/marketplace.json)
+to match. No-op when the marketplace is already on the target version.
+
+**One-time setup (cross-repo write requires a token the default
+`GITHUB_TOKEN` cannot provide):**
+
+1. Create a **fine-grained personal access token** at
+   https://github.com/settings/personal-access-tokens/new with:
+   - Repository access: **Only select repositories → `chiz0me/claude-plugins`**
+   - Permissions: **Contents: Read and write**
+2. In `chiz0me/actions-warden` repo settings, add it as an Actions secret
+   named **`MARKETPLACE_SYNC_TOKEN`**.
+
+After that, every release tag also writes a `sync: bump actions-warden to vX.Y.Z`
+commit to the marketplace repo.
+
 ### Publishing to npm
 
 The release workflow includes a `publish-npm` job that publishes to npm with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-warden",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Audit, pin, and upgrade GitHub Actions workflows. LLM-friendly TOON output, safe-by-default.",
   "author": "Naveen Yagati",
   "homepage": "https://github.com/chiz0me/actions-warden#readme",