Install the ai-config plugin by default in claude.yml and claude-code-review.yml (opt out via use-ai-config)

[dem-extra1]

Closes #319

Both claude.yml (the @claude agent) and claude-code-review.yml (the reviewer)
now install the d-morrison/ai-config
plugin (ai-config@d-morrison) by default, so a consumer repo picks up the
lab's shared skills, commands, and review conventions without listing them itself.
Consumers opt out with use-ai-config: false.

What changed

Input	Type	Default	Purpose
use-ai-config	boolean	true	Install ai-config@d-morrison. Set false to opt out.
plugin-marketplaces	string	''	Further marketplace Git URLs, layered on top.
plugins	string	''	Further plugin refs, layered on top.

Everything is additive: claude-code-review.yml's built-in
code-review@claude-code-plugins (and its anthropics/claude-code.git
marketplace) is never replaced, only added to.

The plugin-marketplaces / plugins inputs were opt-in-only in this PR's first
commit; they are unchanged in shape, just re-scoped to further sources on top of
the new default rather than being the only route to ai-config.

Wiring

• claude.yml composes the marketplace/plugin lists inline, gated on its own
  boolean input.
• claude-code-review.yml passes use-ai-config through to
  run-claude-review-attempt, which owns the reviewer's composition, at both
  call sites (the initial attempt and the gha#185 stub-retry).
• The two ai-config literals are deliberately spelled out in both
  claude.yml and run-claude-review-attempt/action.yml rather than shared: a
  composite action cannot uses: a sibling local action, since a relative path
  resolves against the caller's checkout instead of the action's (gha#284), so
  a shared composite would break for every consumer. Both sites carry a comment
  pointing at the other.

Verification

• d-morrison/ai-config is public ("private": false via the repos API), so
  the anonymous clone the plugin install performs works in a consumer's CI. This
  matters because upstream's installPlugins() stops on the first install error
  and throws, so an unreachable marketplace would fail the whole run.
• The marketplace name (d-morrison) and plugin name (ai-config) were read from
  .claude-plugin/marketplace.json in that repo, not assumed.
• Blank-line safety re-confirmed against the pinned claude-code-action
  (be7b93b, v1.0.183): parseMarketplaces() and parsePlugins() in
  base-action/src/install-plugins.ts both trim and filter empty entries, so an
  unset slot in the block scalar adds nothing.
• Both workflows and the composite parse as YAML; the repo's own
  check-new-line-breaks reports no missing semantic breaks on the diff; no
  em-dashes or other non-ASCII punctuation in any added line.

Review finding addressed

The inline finding on the previous round was correct: "each marketplace name must
match one listed in plugin-marketplaces" was ambiguous, since that input holds
URLs rather than names. Reworded at all four sites to state that the name comes
from the marketplace's own .claude-plugin/marketplace.json and is not derived
from the URL.

Docs

README table (both rows), website/workflows.qmd (both rows),
website/reference/claude.qmd and claude-code-review.qmd (Inputs tables plus
example blocks), examples/claude.yml and examples/claude-code-review.yml
(example blocks, now showing the opt-out), and two changelog.d/ fragments
(added for the inputs, changed for the new default).

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Verdict

Ready for merge

[claude]

Code review

Reviewed the full diff (adds opt-in plugin-marketplaces/plugins passthrough inputs to claude.yml and claude-code-review.yml, threaded through run-claude-review-attempt's composite action for the reviewer's two call sites, with matching README/website/reference/examples doc-sync and a changelog.d/ fragment).

Verification performed:

• Confirmed against anthropics/claude-code-action's pinned source (base-action/src/install-plugins.ts) that its marketplace/plugin parsers trim and filter blank lines, so the new code comments claim about safely appending an empty extra-marketplaces/extra-plugins line is accurate.
• Confirmed the new inputs are consumed strictly as action with: inputs, never concatenated into a run: shell script, and upstream installs via a spawned argument array plus regex validation, so no script-injection vector is introduced.
• Confirmed workflow_call inputs here are caller/consumer-repo-controlled, not attacker/PR-content-controlled, so no new trust-boundary issue.
• Confirmed both claude-code-review.yml call sites (initial attempt and the gha issue 185 stub-retry attempt) thread the new inputs identically.
• Confirmed all three required doc-sync sites (README.md table, website/workflows.qmd table, website/reference/*.qmd Inputs table plus example line) are updated for both new inputs on both workflows, plus examples/*.yml stubs and the changelog fragment.
• Confirmed the ai-config@d-morrison example against d-morrison/ai-config's actual marketplace manifest (declares name d-morrison, plugin ai-config).
• The YAML block-scalar conversion in run-claude-review-attempt/action.yml preserves the exact prior built-in values byte-for-byte.

One minor finding was posted inline: the plugins input descriptions phrase "Each marketplace name must match one listed in plugin-marketplaces above" is ambiguous, since plugin-marketplaces holds URLs, not names. Non-blocking, documentation clarity only, does not affect behavior. See the inline comment for the suggested rewording and the three other spots with the same phrasing.

Note: the PR description still reads "WIP --- opened up front to claim the issue; implementing now," but the diff itself is a complete, working implementation. Worth updating the description before merge so reviewers or mergers do not mistake it for an in-progress stub.

No bugs, security issues, or blocking CLAUDE.md violations found.

[claude]

Verdict

Ready for merge (the minor documentation-clarity nit noted above is optional, at the author's discretion).

[github-actions]

Claude finished review — View run

---

Review complete for d-morrison/gha#321.

Process: dispatched 2 CLAUDE.md-compliance agents + 2 bug/security agents in parallel over the diff, independently fact-checked their claims against anthropics/claude-code-action's actual pinned source and d-morrison/ai-config's marketplace manifest, then posted results to the PR.

Findings: one minor, non-blocking documentation-clarity issue — the plugins input description's phrase "Each marketplace name must match one listed in plugin-marketplaces" is ambiguous (that field holds URLs, not names). Posted as an inline comment with a suggested rewording, citing all four locations where the phrasing repeats. No bugs, no security issues, no blocking CLAUDE.md violations — the doc-sync (README/website/reference/examples), the dual call-site wiring in claude-code-review.yml, and the empty-input safety claim were all independently verified against source.

Posted the findings summary and a separate ### Verdict comment.

One housekeeping note: while working around a Bash-tool restriction on markdown headings mid-body, an early throwaway test comment (#5086505466, duplicate "### Verdict / Ready for merge" text) got posted to the PR before I found the workaround. I don't have delete/edit permission in this run to remove it — it's redundant but not contradictory, just worth a human cleaning it up if desired.

Verdict

Ready for merge (pending the optional documentation-clarity fix above, at the author's discretion).

[github-actions]

💰 Cost: $11.3949 (review) — run

[d-morrison]

Working on this --- paws off until I'm done.

Following up on the review above: per user direction, extending this PR so the ai-config plugin is installed by default (consumers opt out), rather than being purely opt-in. Also folding in the inline documentation-clarity fix.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.

_{2026-07-27 05:10 UTC}

[claude]

Code review

Reviewed the current head commit (eec2c216), which substantially expands this PR beyond what the prior review rounds saw: the second commit (ae8df623, reviewed at this comment) only added opt-in plugin-marketplaces/plugins passthrough inputs, whereas this commit reworks that into installing ai-config@d-morrison by default via a new use-ai-config input (opt-out), per d-morrison's follow-up PR comment directing that extension. No review has run against this commit yet — this is a fresh pass over the current diff, not a re-run of the prior verdict.

Verification performed on the new diff:

• Confirmed both .github/workflows/claude.yml and .github/actions/run-claude-review-attempt/action.yml each define plugin_marketplaces/plugins exactly once in their respective with: blocks (no duplicate-key YAML hazard from the added lines).
• Confirmed claude-code-review.yml threads use-ai-config / plugin-marketplaces / plugins identically at both call sites (the initial attempt and the gha#185 stub-retry attempt).
• Re-verified against the pinned anthropics/claude-code-action source (base-action/src/install-plugins.ts at be7b93b) that parseMarketplaces()/parsePlugins() trim and filter blank lines, and that installPlugins() awaits each add/install sequentially with no try/catch, so an error on any one entry does stop the whole run — both claims this PR's comments/description make about that upstream behavior check out.
• Re-verified d-morrison/ai-config's .claude-plugin/marketplace.json: marketplace name d-morrison, plugin name ai-config — ai-config@d-morrison is correct.
• Confirmed the doc-sync this repo's CLAUDE.md requires is complete for all three new inputs on both workflows: README.md's table row, website/workflows.qmd's table row, and each website/reference/*.qmd Inputs table + commented example line, plus examples/*.yml stubs and two changelog.d/ fragments.
• Confirmed the ambiguous-phrasing finding from the prior review round ("Each marketplace name must match one listed in plugin-marketplaces above") is fixed at all four sites this diff touches, now reading "...must match the name that marketplace declares in its own .claude-plugin/marketplace.json — it is not derived from the URL written into plugin-marketplaces" (or the .qmd equivalent). No re-raise needed.

No bugs, security issues, or CLAUDE.md violations found in the new diff. The default-on behavior change itself is the PR's stated intent (per d-morrison's own follow-up comment directing it), not a design concern to flag.

Verdict

Ready for merge

[github-actions]

Claude finished review — View run

---

Posted the review comment to the PR: #321 (comment)

Summary

The PR's current head commit (eec2c216) substantially reworks what the two prior review rounds saw — it changes the opt-in plugin-marketplaces/plugins design into installing ai-config@d-morrison by default (opt-out via use-ai-config). No review had yet run against this commit, so this was a fresh full pass, not a confirming re-check.

Verified and clean:

• plugin_marketplaces/plugins are each defined exactly once per with: block in both claude.yml and run-claude-review-attempt/action.yml — no duplicate-key hazard.
• claude-code-review.yml wires the three new inputs identically at both call sites (initial attempt + gha#185 stub-retry).
• Upstream claude-code-action's install-plugins.ts (pinned be7b93b) confirmed to trim/filter blank lines and to abort on first error, matching the PR's claims.
• d-morrison/ai-config's marketplace manifest confirmed: ai-config@d-morrison is correct.
• Doc-sync complete across README, website/workflows.qmd, both website/reference/*.qmd pages, and examples/*.yml.
• The prior round's ambiguous-phrasing finding is fixed at all four sites.

No new bugs, security issues, or CLAUDE.md violations found.

Verdict

Ready for merge

[github-actions]

💰 Cost: $2.5694 (review) — run

[d-morrison]

Ready for merge

Verified at head eec2c216:

• All 29 check runs completed, every one success or skipped. require-review finished at 02:22:16 UTC, ten seconds after the review job it gates on, so this is the settled state rather than a snapshot taken while the gate was still running.
• Review verdict is genuine and current: the review bot posted Ready for merge with no findings against this exact commit, and its comment shows it re-derived the upstream install-plugins.ts behavior and the ai-config marketplace manifest itself rather than taking the PR description's word for either.
• One inline thread, resolved (the ambiguous-phrasing finding from the prior round). No other open threads.
• Merges cleanly: git merge-tree against current main reports zero conflicts, and main has not moved since this branch was cut.

Which reviewer this rests on. The clean call is the review bot's alone. Copilot was requested at this head and declined at 02:14:55 UTC with "unable to review this pull request because the user who requested the review has reached their quota limit" — the third such refusal on this PR, after 359e110 and ae8df62. That is a refusal, not an approval and not a silent pass, so it is worth knowing that no second independent reviewer has looked at the default-on change.

The one thing worth a human's eye before merging, since no reviewer can settle it: this flips behavior for every existing consumer of @v2, not just new ones. After the tag slides, every repo calling claude.yml or claude-code-review.yml starts installing ai-config@d-morrison with no caller-side change. That is the PR's stated intent, and the opt-out is one input, but the blast radius is every consumer repo at once. Upstream's installPlugins() aborts on the first install error, so d-morrison/ai-config becoming unreachable would fail those runs; it is public today, which is why this is a note rather than a blocker.

Not merging - leaving that call to you.

---

Generated by Claude Code