feat: attested-delivery Claude Code plugin (skill + dual-platform agent) - #14
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Packages the attested-delivery architecture as a Claude Code plugin rooted at this repo’s .github/ directory, including a dual-platform agent (Claude subagent + GitHub Copilot custom agent) and a full set of onboarding/architecture references.
Changes:
- Add
.github/.claude-plugin/plugin.jsonand.github/.claude-plugin/README.mdto make.github/an installable plugin root. - Add a dual-platform specialist agent at
.github/agents/attested-delivery.md. - Add the
attested-deliveryonboarding skill plus reference docs (workflow catalog, integration recipes, verification commands, platform constraints, rollout checklist, architecture).
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/.claude-plugin/plugin.json | Plugin manifest metadata (name/version/homepage/repo/keywords). |
| .github/.claude-plugin/README.md | Plugin installation + composition documentation. |
| .github/agents/attested-delivery.md | Dual-platform specialist agent instructions and workflow catalog summary. |
| .github/skills/attested-delivery/SKILL.md | Main onboarding/architecture skill with phased protocol and hard rules. |
| .github/skills/attested-delivery/references/architecture.md | Reference architecture + catalog roles + permissions conventions. |
| .github/skills/attested-delivery/references/integration-recipes.md | Caller wiring recipes for gates/seam/sign/verify across artifact shapes. |
| .github/skills/attested-delivery/references/platform-constraints.md | “Symptom → cause → fix” operational constraints/traps list. |
| .github/skills/attested-delivery/references/rollout-checklist.md | Phased rollout checklist and acceptance tests. |
| .github/skills/attested-delivery/references/verification.md | Workstation verification command set (gh/cosign). |
| .github/skills/attested-delivery/references/workflow-catalog.md | Catalog of 19 reusable workflows and their contracts/allow-list needs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Package the attested-delivery architecture as an installable Claude Code
plugin rooted at the .github/ directory, so both the skill and the agent
resolve from default plugin paths.
- .claude-plugin/plugin.json + README: manifest and plugin documentation
- agents/attested-delivery.md: specialist agent valid as BOTH a Claude
subagent and a GitHub Copilot custom agent (the default agents/ scan is
Copilot's .github/agents/ path; tools omitted for dual-format validity)
- skills/attested-delivery: onboarding skill aligned to the current
central-reusables + attestation-seam + verify-gates architecture
- references/workflow-catalog.md: deliberate, named index of all 19 bundled
reusable workflows, referenced as ${CLAUDE_PLUGIN_ROOT}/workflows/<name>.yml
Trim the caller recipes to the wiring shape and defer the authoritative workflow_call input contracts to references/workflow-catalog.md (the single source). Collapse the verify-gates snippet to a reference and point to the CI-validated attested-iac-template as the complete runnable caller, so the docs stop drifting as the reusables evolve.
Assert every workflow_call reusable under .github/workflows/ has an entry in workflow-catalog.md, and every catalog entry resolves to a real file. Mechanically prevents the docs-say-14/repo-ships-19 drift. SHA-pinned; runs on PRs touching workflows or the catalog.
- README: clarify plugin-dir path (<repo>/.github, not /path/to/.github/.github) - platform-constraints: per_page=100 (20 misses older tags and returns null) - integration-recipes: add trailing # vX.Y.Z to recipe B SHA-pin examples - workflow-catalog/architecture/agent: scope the shellcheck allow-list to redhat-plumbers-in-action/differential-shellcheck@* (least privilege) - workflow-catalog: sigstore/cosign-installer@* (allow-list UI form) - catalog-check: grep -qF fixed-string match (the . in .yml was a regex metachar) Resolves Copilot review comments on PR #14
zircote
force-pushed
the
feat/attested-delivery-plugin
branch
from
June 22, 2026 22:36
5c597c1 to
10978ee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Packages the attested-delivery architecture as an installable Claude Code plugin, rooted at the repo's
.github/directory so the skill and the agent both resolve from default plugin paths.What's included
.claude-plugin/plugin.json+ README — plugin manifest and documentation.agents/attested-delivery.md— a specialist agent authored once and valid as both a Claude subagent and a GitHub Copilot custom agent. The defaultagents/scan resolves to.github/agents/, which is exactly Copilot's custom-agent path;toolsis omitted so one file is full-access and valid under both platforms.skills/attested-delivery/— the architect & onboarding skill, aligned to the current architecture (central reusable workflows + the attestation seam + fail-closed verify-gates), superseding the older__ORG__-template flow.references/workflow-catalog.md— a deliberate, named index of all 19 bundled reusable workflows, referenced as${CLAUDE_PLUGIN_ROOT}/workflows/<name>.yml(the real workflows are the single source of truth — no copies).Why
.github/is the plugin rootPlugin component paths forbid
../, so a manifest nested deeper could not reference.github/agents/. Rooting the plugin at.github/makes the single dual-platform agent work and keeps the skill in the existing.github/skills/location.claude plugin validateconfirms a.github-named directory is accepted as a plugin root.Verification
claude plugin validatepasses.needs:references in an integration recipe).Notes
gh-attestedskill is referenced as an external dependency (not bundled here).