Cap Retry-After waits at 20s, lower scout's npm concurrency to 4, and add job timeouts so a rate-limited weekly or nightly run fails visibly instead of running for hours.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EHYZtiXaVB71TSBhHnynk4
needs-human is a maintainer gate (e.g. a project held for using the V1 SDK); re-running triage on a push used to replace it with ready.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
pull_request.base.sha is the base commit from when an older PR was opened, so validate counted everything merged to main since then (README.md, dist/registry.json, other entries) as part of the PR and failed it. Use origin/<base ref>, whose merge base with the PR merge commit is the current base tip.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GitHub creates pull_request runs for PRs opened or updated by github-actions[bot] as action_required, and that run (not a workflow_dispatch run on the same commit) is what the required check on main binds to. The README workflow, openPullRequest (submissions, scout, health) and reprobe now approve the held validate run. Generated files are allowed only on PRs opened by github-actions[bot] from this repo's bot/readme-* branches.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GitHub rulesets reject direct pushes while a status check is required, even when the pushed commit's check passed (verified: GH013 'Required status check "validate" is expected' on a commit with a successful validate run). The README workflow now opens a PR from bot/readme-<sha>, dispatches validate on it and squash-merges it once green; older bot README PRs are closed as superseded.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Deploy keys are disabled for this org and GitHub Actions cannot be a ruleset bypass actor, so main is protected by requiring a passing validate check on every commit. The README workflow stages its regenerated commit on bot/readme-<sha>, dispatches validate there (allowed to touch generated files only for that bot branch), waits for success and fast-forwards main. Adds a catalog policy link to the README header and documents the branch protection.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
An inconclusive probe no longer releases a PR that a reviewer held for V1 code. All outbound requests go through a host allowlist (api.github.com, registry.npmjs.org, api.npmjs.org).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Escape backslashes as well as pipes in markdown table cells
- Decide gist/discussion/npm-page links by parsed hostname instead of substring or unanchored regex checks (README, site)
- Encode every '/' in scoped npm names; validate npm names before calling the registry
- The REST helper only calls https://api.github.com and rejects dot segments
- npm ci --ignore-scripts in every workflow (no dependency needs install scripts)
- Move write permissions to job level in issues.yml and site.yml
Co-Authored-By: Claude Opus 5.5 <[email protected]>
check-pr no longer flags repo URL changes that GitHub redirects (renames/transfers) or that only add a monorepo path, so bot rename PRs stay clean. The scout files packages built on @opencode/plugin as plugins and other @opencode/* consumers (SDK/client tools) as projects.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
docs/policy.md is the reference the bots link to (admission, V2 rule, V1 sunset, health and removal, discovery, automation map). contributing.md documents the issue form, scaffolder and fields. The review-loop prompts now defer schema/duplicate/V2 checks to CI, drop the 6-month activity rule, and require merging through PRs instead of pushing to main. Translated READMEs link to this repo's contributing guide.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
site/index.html is a dependency-free page over registry.json and a fresh health.json: search, category/kind/topic/API/maintenance filters, sorting by stars or recent updates, shareable URL state, light and dark themes, phone layout. site.yml rebuilds it on every catalog change and daily.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- health.yml: rolling "Catalog health report" issue; bot PRs that follow renamed repos and remove entries archived/missing/deprecated for 30+ days, and V1-only plugins after the 2027-01-01 sunset. Inactivity alone only changes a badge.
- reprobe.yml: re-checks needs-v2 PRs nightly; unblocks and notifies the original author when the target migrates (filling kind/topics/compat on same-repo branches), closes after 60 days on V1.
- scout.yml: weekly issue ranking npm packages published since V2 that depend on @opencode/* and are not listed yet; ticking a box opens a PR (maintainers only). discovery/declined.txt suppresses candidates.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The "Add an entry" issue form collects fields; issues.yml runs scripts/submit-entry.js, which validates and probes the entry, comments the result and opens a PR from submission/<issue> (updated on every issue edit). Contributors never write YAML or touch the README, the two most common rejection causes. npm run new writes a correctly formatted entry locally. Bot PRs dispatch the validate check because GITHUB_TOKEN pushes do not trigger workflows.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
validate-pr.yml now runs on every PR (README-only PRs previously got no feedback), drops tj-actions/changed-files, runs unit tests, scripts/check-pr.js and a README/registry generation dry run, and supports workflow_dispatch so bot branches get the check. New plugin entries that are V1-only are blocked; declared compat must match what is detected. triage.yml labels PRs (ready, needs-v2, needs-metadata, needs-human, category) and keeps one results comment, using base-branch code only and reading PR files as data. The README workflow uses full history and Node 24.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A single unparseable entry used to blank a whole README category and still exit 0. generate-readme and export-json now validate the whole catalog and refuse to write on any problem, check that every entry renders exactly once, and escape contributor text. Plugins are grouped by primary topic and other categories by kind; plugins show V2 / V1 only / unverified; section headers show counts; a Recently Added table comes from git history. registry.json gains kind, topics, also, compat, repoPath and npmPackage (existing fields unchanged).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- kind/topics: keyword first pass, then reviewed and corrected by hand for all 513 entries
- compat: detected from npm packages, package.json and source (scripts/utils/compat.js). Plugins: 134 v2, 125 v1, 12 unverified; 13 entries the review loop marked V2 pin @opencode-ai/plugin 1.x, and ~20 loop V2 verdicts based only on the absence of V1 markers are V1 plugin functions in source
- npm and path filled where verifiable (package repository matches the entry); 9 bogus npm values from install prose were not kept
- 29 repo URLs updated to the renamed/transferred repository; xberg-io entries point at their live repos instead of the archived monorepo; lavi uses repo + path instead of a /tree/ URL
- removed projects/opencode-sessions.yaml (same repo as plugins/opencode-sessions.yaml)
- install: renamed to installation:, mojibake fixed, inline HTML links removed from two descriptions
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Entries gain a fixed kind and 1-3 topics (replacing 374 one-off tags as the categorization axis), an OpenCode API compat field (required for plugins), and npm/path for packages and monorepo folders. repo must be a repository root; unknown fields such as install: or repository: are rejected. Cross-entry rules (one entry per repo+path, kind must fit the category, no placeholder owners or mojibake) live in scripts/utils/catalog.js, and validate.js now always loads the whole catalog and fails on unparseable YAML. Adds npm run fmt for canonical formatting and drops the unused glob dependency.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unquoted ': ' sequences in taglines/descriptions made plain.yaml,
godmode.yaml, opencode-boffin.yaml, opencode-obvious-grid.yaml and
agentbox.yaml unparseable, which has failed every README generation
run on main since they were merged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
