cue-ai 0.3.0

package/resources/claude-plugins-official/.github/workflows/bump-plugin-shas.yml

@@ -0,0 +1,69 @@
+name: Bump Plugin SHAs
+
+# Nightly sweep: for each external entry whose upstream HEAD has moved past
+# its pinned SHA, validate at the new SHA with `claude plugin validate`
+# inline, then open one PR with all passing bumps. Each run force-resets the
+# bump/plugin-shas branch, so a previous night's unmerged PR is replaced (and
+# its review state discarded) — review and merge same-day to avoid churn.
+#
+# Bot-free — uses the default GITHUB_TOKEN. PRs opened with GITHUB_TOKEN don't
+# trigger on:pull_request workflows, so the policy scan (`Scan Plugins`, a
+# required status check on main) would never run and the bump PR could never
+# merge. workflow_dispatch is exempt from that recursion guard, so we dispatch
+# the scan ourselves on the bump branch after the PR is opened. The check run
+# lands on the branch HEAD — the same SHA as the PR head — and satisfies the
+# required check.
+#
+# max-bumps is set above the external-entry count so a single run can clear
+# any backlog. The cost-control mechanisms are downstream:
+#   - scan-plugins.yml caches verdicts by (plugin, sha) so an unchanged SHA
+#     is never re-scanned across nightly force-resets.
+#   - revert-failed-bumps.yml drops policy-failing entries from the bump PR
+#     so one bad upstream can't block the rest.
+# See those files for details.
+
+on:
+  schedule:
+    - cron: '23 7 * * *'  # Daily 07:23 UTC
+  workflow_dispatch:
+    inputs:
+      max_bumps:
+        description: Cap on plugins bumped this run
+        required: false
+        default: '130'
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write  # gh workflow run scan-plugins.yml on the bump branch
+
+concurrency:
+  group: bump-plugin-shas
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    # Per-bump cost is ~2s (ls-remote + shallow clone + validate); 130 entries
+    # is ~5 min. The 60 min ceiling absorbs slow upstreams without letting a
+    # pathological run consume the default 360 min budget.
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      # createCommitOnBranch-based bump so commits are signed by GitHub and
+      # satisfy the org-level required_signatures ruleset on main.
+      - uses: anthropics/claude-plugins-community/.github/actions/bump-plugin-shas@c41c6911de0afffd2bc5cd8b21fb1e06444ee13b
+        id: bump
+        with:
+          marketplace-path: .claude-plugin/marketplace.json
+          max-bumps: ${{ inputs.max_bumps || '130' }}
+          claude-cli-version: latest
+
+      # `bump/plugin-shas` is the action's default `pr-branch`. The scan diffs
+      # the branch against origin/main (the action's base-ref fallback when
+      # there's no pull_request event) and scans only the bumped entries.
+      - name: Dispatch policy scan on bump branch
+        if: steps.bump.outputs.pr-url != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run scan-plugins.yml --ref bump/plugin-shas

package/resources/claude-plugins-official/.github/workflows/check-mcp-urls.yml

@@ -0,0 +1,129 @@
+name: Check MCP URLs
+
+# Liveness check for http/sse MCP server URLs declared by plugins vendored
+# in this repo. Catches typos in new submissions and upstream endpoints that
+# disappear after merge.
+#
+# Scope: only plugins whose files live in this working tree (marketplace
+# entries with a string `source`, e.g. "./plugins/foo"). External entries
+# are pinned to an upstream repo at a SHA — reading their .mcp.json would
+# mean cloning every upstream on each run, which is slow and flaky. Those
+# are out of scope for now.
+#
+# What counts as "alive": anything that proves the hostname/path resolves to
+# a server. 401/403/405/5xx all pass — auth and method errors are expected
+# without credentials. Only 404/410 and connection/DNS/TLS failures fail.
+
+on:
+  pull_request:
+    paths:
+      - '.claude-plugin/marketplace.json'
+      - 'plugins/**'
+      - 'external_plugins/**'
+      - '.github/workflows/check-mcp-urls.yml'
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Discover and probe MCP server URLs
+        run: |
+          set -euo pipefail
+
+          MARKETPLACE=".claude-plugin/marketplace.json"
+
+          # Each line: "<plugin>\t<server>\t<url>". Marketplace entries with a
+          # string `source` are local paths; objects describe an external repo
+          # pinned at a SHA, which we don't have checked out — skip those.
+          discover() {
+            jq -r '.plugins[] | select(.source | type == "string") | "\(.name)\t\(.source)"' "$MARKETPLACE" |
+            while IFS=$'\t' read -r plugin src; do
+              dir="${src#./}"
+              [[ -d "$dir" ]] || continue
+              for cfg in "$dir/.mcp.json" "$dir/mcp.json" "$dir/.claude-plugin/plugin.json"; do
+                [[ -f "$cfg" ]] || continue
+                # MCP config comes in two shapes: a bare map of server name ->
+                # config, or wrapped under a top-level "mcpServers" key (also
+                # the shape inside plugin.json). Normalize, then keep entries
+                # with an http/sse type and a string url.
+                jq -r --arg plugin "$plugin" '
+                  (if (type == "object" and has("mcpServers")) then .mcpServers else . end)
+                  | to_entries[]
+                  | select((.value | type) == "object")
+                  | select(.value.type == "http" or .value.type == "sse")
+                  | select(.value.url | type == "string")
+                  | "\($plugin)\t\(.key)\t\(.value.url)"
+                ' "$cfg" 2>/dev/null || true
+              done
+            done | sort -u
+          }
+
+          # Returns 0 on pass, 1 on fail; prints "PASS|FAIL  <code>  <note>".
+          probe() {
+            local url="$1"
+            local code
+            # HEAD first — cheap and covers plain web endpoints. -L follows
+            # redirects so a permanent redirect to a live page still passes.
+            code="$(curl -sS -o /dev/null -w '%{http_code}' \
+                      --connect-timeout 10 --max-time 10 \
+                      --retry 2 --retry-delay 2 \
+                      -L -I "$url" 2>/dev/null || echo "000")"
+
+            # MCP endpoints typically reject HEAD (404/405) but answer POST
+            # with a JSON-RPC body. Retry as a real MCP client would.
+            if [[ "$code" == "000" || "$code" == "404" || "$code" == "405" ]]; then
+              code="$(curl -sS -o /dev/null -w '%{http_code}' \
+                        --connect-timeout 10 --max-time 10 \
+                        --retry 2 --retry-delay 2 \
+                        -L -X POST \
+                        -H 'Content-Type: application/json' \
+                        -H 'Accept: application/json, text/event-stream' \
+                        --data '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"ci","version":"0"}}}' \
+                        "$url" 2>/dev/null || echo "000")"
+            fi
+
+            case "$code" in
+              000)      echo "FAIL  $code  unreachable"; return 1 ;;
+              404|410)  echo "FAIL  $code  gone"; return 1 ;;
+              *)        echo "PASS  $code"; return 0 ;;
+            esac
+          }
+
+          entries="$(discover)"
+          if [[ -z "$entries" ]]; then
+            echo "::notice::No http/sse MCP server URLs found in vendored plugins."
+            exit 0
+          fi
+
+          failures=0
+          printf '%-24s %-18s %-52s %s\n' "PLUGIN" "SERVER" "URL" "RESULT"
+          while IFS=$'\t' read -r plugin server url; do
+            # Skip URLs with template placeholders — they need user config
+            # and can't be probed as-is.
+            if [[ "$url" == *'${'* || "$url" == *'{{'* ]]; then
+              printf '%-24s %-18s %-52s %s\n' "$plugin" "$server" "$url" "SKIP  templated"
+              continue
+            fi
+            result="$(probe "$url")" || true
+            printf '%-24s %-18s %-52s %s\n' "$plugin" "$server" "$url" "$result"
+            if [[ "$result" == FAIL* ]]; then
+              failures=$((failures + 1))
+              echo "::error::MCP server URL for plugin '$plugin' (server '$server') is unreachable: $url ($result)"
+            fi
+          done <<< "$entries"
+
+          echo
+          if (( failures > 0 )); then
+            echo "::error::$failures MCP server URL(s) failed liveness check."
+            exit 1
+          fi
+          echo "All MCP server URLs reachable."

package/resources/claude-plugins-official/.github/workflows/close-external-prs.yml

@@ -0,0 +1,47 @@
+name: Close External PRs
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  check-membership:
+    if: vars.DISABLE_EXTERNAL_PR_CHECK != 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if author has write access
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const author = context.payload.pull_request.user.login;
+
+            const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: author
+            });
+
+            if (['admin', 'write'].includes(data.permission)) {
+              console.log(`${author} has ${data.permission} access, allowing PR`);
+              return;
+            }
+
+            console.log(`${author} has ${data.permission} access, closing PR`);
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body: `Thanks for your interest! This repo only accepts contributions from Anthropic team members. If you'd like to submit a plugin to the marketplace, please submit your plugin [here](https://clau.de/plugin-directory-submission).`
+            });
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              state: 'closed'
+            });

package/resources/claude-plugins-official/.github/workflows/revert-failed-bumps.yml

@@ -0,0 +1,284 @@
+name: Revert Failed Bumps
+
+# Drops policy-failing entries from a bump PR so one bad upstream can't
+# block the rest. Runs after a Scan Plugins workflow_run on bump/plugin-shas
+# concludes with a failure: read the per-entry verdicts the scan uploaded,
+# revert just the failing entries' source.sha back to main's pin, push a
+# follow-up signed commit, and re-dispatch the scan. The re-dispatched scan
+# finds only cached-pass entries in the new diff and goes green in seconds.
+#
+# Scope and guardrails — this job has contents:write so it must be tight:
+#   - Only acts on bump/plugin-shas (literal branch match).
+#   - Only acts when the scan was dispatched (workflow_dispatch event), i.e.
+#     by bump-plugin-shas.yml. A scan on a regular PR never triggers this.
+#   - Only reverts source.sha. If any other field in a failing entry differs
+#     from main, the run aborts — that means the bump branch was tampered
+#     with and a human needs to look.
+#   - Bounded at MAX_REVERT_PASSES per night via a PR comment marker; a
+#     persistent loop means the cache or scan is broken and a human needs
+#     to look.
+#   - The revert commit is created with createCommitOnBranch (GitHub-signed,
+#     compare-and-swap via expectedHeadOid) — no signing key on the runner.
+
+on:
+  workflow_run:
+    workflows: ["Scan Plugins"]
+    types: [completed]
+
+permissions:
+  contents: read
+
+env:
+  MARKETPLACE: .claude-plugin/marketplace.json
+  BUMP_BRANCH: bump/plugin-shas
+  MAX_REVERT_PASSES: '3'
+  REVERT_MARKER: '<!-- revert-failed-bumps -->'
+
+jobs:
+  revert:
+    # Tight gate: the triggering scan must be a workflow_dispatch run on the
+    # bump branch (i.e. the one bump-plugin-shas.yml dispatched) that failed.
+    # A scan on a regular PR, a passing scan, or a manual dispatch on another
+    # branch must never reach this job.
+    if: >
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.event == 'workflow_dispatch' &&
+      github.event.workflow_run.head_branch == 'bump/plugin-shas'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write       # createCommitOnBranch on bump/plugin-shas
+      pull-requests: write  # comment on / close the bump PR
+      actions: write        # gh workflow run scan-plugins.yml --ref bump/plugin-shas
+    concurrency:
+      group: revert-failed-bumps
+      cancel-in-progress: false
+    steps:
+      # The artifact carries run-failed.json (just plugin names) and
+      # run-verdicts.json (full per-entry verdicts for the PR comment). It is
+      # uploaded by scan-plugins.yml for every relevant run so we can tell
+      # "policy failures found" from "scan never ran" (infra error → no revert).
+      # The artifact won't exist when the scan died before the upload step
+      # (cache restore error, jq failure, timeout) — that is an infra error,
+      # not a policy failure, so the right move is to do nothing. The
+      # download must not fail the job; the next step handles the missing file.
+      - name: Download scan verdicts
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: scan-verdicts
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: scan-out
+
+      - name: Determine revert set
+        id: plan
+        run: |
+          set -euo pipefail
+          if [[ ! -f scan-out/run-failed.json ]]; then
+            echo "::warning::No run-failed.json in scan artifact — nothing to revert."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if ! jq -e 'type == "array"' scan-out/run-failed.json >/dev/null 2>&1; then
+            echo "::warning::run-failed.json is not a JSON array — refusing to act."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          fail_count="$(jq 'length' scan-out/run-failed.json)"
+          if [[ "$fail_count" -eq 0 ]]; then
+            # The scan job failed but reported zero policy failures: that is
+            # an infra error (API key missing, clone failure, schema break).
+            # Reverting nothing is correct; surfacing the infra error is the
+            # scan job's responsibility.
+            echo "::notice::Scan failed with zero parsed policy failures — infra error, not a policy failure. Not reverting."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "act=true" >> "$GITHUB_OUTPUT"
+          echo "fail_count=$fail_count" >> "$GITHUB_OUTPUT"
+          echo "Failing entries:"
+          jq -r '.[]' scan-out/run-failed.json
+
+      - name: Locate bump PR and check revert budget
+        if: steps.plan.outputs.act == 'true'
+        id: pr
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          # Resolve the bump PR by head ref. `gh pr list --head <ref>` matches
+          # by ref name across forks, so reject any PR whose head repo isn't
+          # ours — a fork PR named bump/plugin-shas must never reach the
+          # contents:write paths below.
+          pr_json="$(gh api "repos/$REPO/pulls?head=${REPO%%/*}:$BUMP_BRANCH&base=main&state=open&per_page=1" \
+            --jq '.[0] // empty')"
+          if [[ -z "$pr_json" ]]; then
+            echo "::warning::No open bump PR on $BUMP_BRANCH — nothing to revert."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          pr_number="$(jq -r '.number' <<<"$pr_json")"
+          head_repo="$(jq -r '.head.repo.full_name' <<<"$pr_json")"
+          head_sha="$(jq -r '.head.sha' <<<"$pr_json")"
+          # The list endpoint omits `commits`; the single-PR endpoint has it.
+          commit_count="$(gh api "repos/$REPO/pulls/$pr_number" --jq '.commits')"
+          if [[ "$head_repo" != "$REPO" ]]; then
+            echo "::error::Bump PR head is from $head_repo, not $REPO — refusing to act."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Loop bound: every nightly bump force-resets the branch to a single
+          # commit and every revert pass adds exactly one. Counting commits is
+          # therefore the per-night pass count + 1, with no date math, no
+          # pagination, and no exposure to comment spoofing.
+          if [[ "$commit_count" -gt $(( MAX_REVERT_PASSES + 1 )) ]]; then
+            echo "::error::Revert budget exhausted ($((commit_count - 1))/$MAX_REVERT_PASSES passes on this PR). The cache or scan is likely broken — needs a human."
+            gh pr comment "$pr_number" --repo "$REPO" --body \
+              "$REVERT_MARKER"$'\n\n'"⚠️ Revert budget exhausted ($((commit_count - 1)) passes). The scan keeps failing after reverting — likely a cache or scan bug. Pausing automatic reverts until the next nightly bump."
+            echo "act=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "Bump PR #$pr_number @ $head_sha ($commit_count commit(s))"
+          {
+            echo "act=true"
+            echo "number=$pr_number"
+            echo "head_sha=$head_sha"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Revert failing SHAs
+        if: steps.plan.outputs.act == 'true' && steps.pr.outputs.act == 'true'
+        id: revert
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
+        run: |
+          set -euo pipefail
+          mkdir -p work
+
+          gh api "repos/$REPO/contents/${MARKETPLACE}?ref=$HEAD_SHA" --jq '.content' | base64 -d > work/head.json
+          gh api "repos/$REPO/contents/${MARKETPLACE}?ref=main" --jq '.content' | base64 -d > work/base.json
+
+          # Build the reverted marketplace: for each failing plugin, restore
+          # source.sha to main's value. Refuse if anything else differs — a
+          # difference outside source.sha on a bump-branch entry means the
+          # branch was tampered with.
+          jq -c -s \
+            '.[0] as $head | .[1] as $base | (.[2] | map({(.): true}) | add // {}) as $fail
+             | ($base.plugins | map({(.name): .}) | add // {}) as $b
+             | $head | .plugins = [
+                 .plugins[] |
+                 if ($fail[.name] // false) and ($b[.name] // null) != null then
+                   # Verify the only delta is source.sha — never silently
+                   # accept a structural change masquerading as a bump.
+                   if (. | del(.source.sha)) == ($b[.name] | del(.source.sha)) then
+                     .source.sha = $b[.name].source.sha
+                   else
+                     error("entry \(.name) differs from main beyond source.sha — refusing to revert")
+                   end
+                 else . end
+               ]' \
+            work/head.json work/base.json scan-out/run-failed.json > work/reverted.json.compact
+
+          # Match the marketplace's existing pretty-print so the diff is
+          # human-reviewable.
+          jq --indent 2 '.' work/reverted.json.compact > work/reverted.json
+
+          # Two no-action cases:
+          #  - nothing actually reverted (failed names not in this PR's diff)
+          #  - everything reverted (the file is back to main → PR is empty)
+          if cmp -s work/reverted.json.compact <(jq -c '.' work/head.json); then
+            echo "::notice::No entries to revert (failing names not in this PR)."
+            echo "committed=false" >> "$GITHUB_OUTPUT"
+            echo "empty=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if cmp -s work/reverted.json.compact <(jq -c '.' work/base.json); then
+            echo "::warning::Every bumped entry failed policy — the PR would be empty."
+            echo "committed=false" >> "$GITHUB_OUTPUT"
+            echo "empty=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Vendored entries have a string `source` — restrict to object
+          # sources or `.source.sha` errors.
+          reverted="$(jq -c -s \
+            '.[0] as $head | .[1] as $rev
+             | ($head.plugins | map(select(.source | type == "object") | {(.name): .source.sha}) | add // {}) as $h
+             | [$rev.plugins[] | select(.source | type == "object")
+                | select(($h[.name] // null) != .source.sha) | .name]' \
+            work/head.json work/reverted.json.compact)"
+          echo "Reverted: $reverted"
+          echo "reverted=$reverted" >> "$GITHUB_OUTPUT"
+
+          msg="Drop $(jq 'length' <<<"$reverted") policy-failing entries from bump"
+          # createCommitOnBranch: GitHub-signed, expectedHeadOid CAS so a
+          # concurrent force-reset from the nightly bump fails this push
+          # loudly instead of being clobbered. The base64'd marketplace can
+          # exceed MAX_ARG_STRLEN, so the body travels via stdin.
+          oid="$(jq -n \
+            --rawfile content work/reverted.json \
+            --arg repo   "$REPO" \
+            --arg branch "$BUMP_BRANCH" \
+            --arg oid    "$HEAD_SHA" \
+            --arg msg    "$msg" \
+            --arg path   "$MARKETPLACE" \
+            '{
+              query: "mutation($repo:String!,$branch:String!,$oid:GitObjectID!,$msg:String!,$path:String!,$contents:Base64String!){createCommitOnBranch(input:{branch:{repositoryNameWithOwner:$repo,branchName:$branch},message:{headline:$msg},fileChanges:{additions:[{path:$path,contents:$contents}]},expectedHeadOid:$oid}){commit{oid}}}",
+              variables: { repo: $repo, branch: $branch, oid: $oid, msg: $msg, path: $path, contents: ($content | @base64) }
+            }' \
+            | gh api graphql --input - --jq '.data.createCommitOnBranch.commit.oid')"
+          [[ "$oid" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::createCommitOnBranch did not return a commit OID."; exit 1; }
+          echo "committed=true" >> "$GITHUB_OUTPUT"
+          echo "empty=false" >> "$GITHUB_OUTPUT"
+          echo "::notice::Pushed revert commit $oid to $BUMP_BRANCH."
+
+      - name: Close empty bump PR
+        if: steps.revert.outputs.empty == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ steps.pr.outputs.number }}
+        run: |
+          set -euo pipefail
+          gh pr comment "$PR" --repo "$REPO" --body \
+            "$REVERT_MARKER"$'\n\n'"Every bumped entry failed the policy scan. Closing — the next nightly run will retry."
+          gh pr close "$PR" --repo "$REPO"
+
+      - name: Comment with revert detail
+        if: steps.revert.outputs.committed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ steps.pr.outputs.number }}
+          REVERTED: ${{ steps.revert.outputs.reverted }}
+          SCAN_RUN_URL: ${{ github.event.workflow_run.html_url }}
+        run: |
+          set -euo pipefail
+          {
+            printf '%s\n\n' "$REVERT_MARKER"
+            echo "Dropped $(jq 'length' <<<"$REVERTED") entrie(s) that failed the policy scan. The remaining bumps were unaffected."
+            echo
+            echo "| Plugin | Violations |"
+            echo "|---|---|"
+            # `violations` is model-generated text shaped by a cloned external
+            # repo. Strip markdown control characters and wrap in a code span
+            # so a prompt-injected upstream can't smuggle links/images/table
+            # breakouts into a public PR comment.
+            jq -r --argjson rev "$REVERTED" \
+              'def neutralize: gsub("[|\n\r\\[\\]<>`]"; " ");
+               .[] | select(.name as $n | $rev | index($n))
+               | "| \(.name) | `\(.violations | neutralize | .[0:200])` |"' \
+              scan-out/run-verdicts.json
+            echo
+            echo "These entries will be retried at their next upstream SHA. See the [scan run]($SCAN_RUN_URL) for full verdicts."
+          } > /tmp/comment.md
+          gh pr comment "$PR" --repo "$REPO" --body-file /tmp/comment.md
+
+      - name: Re-dispatch scan on revised bump branch
+        if: steps.revert.outputs.committed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run scan-plugins.yml --ref "$BUMP_BRANCH"