Add CI for submitting plugins to Marketplace on merge by niekert · Pull Request #548 · framer/plugins

niekert · 2026-02-05T13:01:46Z

⚠️ THIS DIFF is messed up because its stacked on top of: #549 and it won't let me change parent branches on forks.

Description

This PR changes github action workflows

Submit on Merge

Runs when a PR is merged and the Submit on merge label is active on PR
Extracts a Changelog from the PR body
Submits a new version of a Plugin for each plugin with changed files

Submit Plugin

Manually callable with a pluginPath and changelog input
Submits a new version of the given plugin to the marketplace
Can be invoked from another repo (eg workshop)
Or to submit a plugin if the label was forgotten

Check PR body

Already checked if PR body was set
If "Submit on merge" label is present it expects a Changelog to be present in the PR body.

framer-plugin-tools

This moves https://github.com/framer/framer-plugin-tools into packages/plugin-tools. It rewrites the script in TS and adds some exports that can be used as well.

Existing plugins now reference the workspace version of plugin-tools too

Checklist

Set UP development and production environments in CI and configure secrets and env variables
Change development to production in CI jobs after QA
Publish a new version of framer-plugin-tools
Wait for https://github.com/framer/creators/pull/2487/files to hit production
Update Slack workflow to post to #team-plugins instead of #test

Testing

Please test in the niekert/plugins fork. LMK so I can give you QA permissions.

niekert · 2026-02-05T13:04:37Z

.github/workflows/submit-on-merge.yml

+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'Submit on merge')
+    # FIXME: Should be production
+    environment: development


note to self to fix before merging.

niekert · 2026-02-05T13:05:24Z

.github/workflows/submit-on-merge.yml

+          ERROR_WEBHOOK_URL: ${{ secrets.ERROR_WEBHOOK_URL }}
+          RETOOL_URL: ${{ secrets.RETOOL_URL }}
+          # FIXME: Should be production
+          FRAMER_ENV: development


niekert · 2026-02-05T13:13:35Z

scripts/submit-plugin.ts

+const SubmissionResponseSchema = v.object({
+    version: v.number(),
+    // FIXME: THIS SHOULD BE DEPLOYED:
+    // SEE: https://github.com/framer/creators/pull/2487/files


note to self: remove the fallback

niekert · 2026-02-05T14:04:36Z

@cursor review

niekert · 2026-02-05T14:05:13Z

/gemini review

niekert · 2026-02-05T14:05:31Z

@codex review

chatgpt-codex-connector · 2026-02-05T14:05:38Z

To use Codex here, create a Codex account and connect to github.

niekert · 2026-02-05T14:07:51Z

@codex review

cursor

Cursor Bugbot has reviewed your changes and found 3 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

cursor · 2026-02-05T14:11:11Z

.github/workflows/submit-on-merge.yml

+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'Submit on merge')
+    # FIXME: Should be production
+    environment: development


Development environment hardcoded instead of production

High Severity

The workflow has environment: development and FRAMER_ENV: development hardcoded with FIXME comments. The PR notes explicitly state "note to self to fix before merging." If merged as-is, all plugins submitted via the "Submit on merge" flow would go to the development environment instead of production.

Additional Locations (1)

.github/workflows/submit-on-merge.yml#L61-L62

cursor · 2026-02-05T14:11:11Z

packages/plugin-tools/src/build-and-zip.ts

+
+export function runBuildScript(cwd: string): Promise<void> {
+    return new Promise((resolve, reject) => {
+        const buildProcess = exec("npm run build", { cwd })


Build script uses npm but plugins require yarn

High Severity

The runBuildScript function executes npm run build, but the plugins in this monorepo have build scripts like "build": "run g:build" where run is yarn's workspace command. When npm executes this script in a shell, it will fail because run is not a recognized command outside of yarn's context.

Good one. This is what framer-plugin-tools does currently but we can detect the package manager from the lock file.

I will do this in a follow up to not extend the scope of this PR further.

cursor · 2026-02-05T14:11:11Z

.github/workflows/shippy.yml

+            package.json
+            yarn.lock
+            .yarnrc.yml
+            .yarn


Sparse checkout missing required .tool-versions file

High Severity

The sparse checkout configuration does not include .tool-versions, but the Setup Node.js step on line 51 requires this file via node-version-file: .tool-versions. The workflow will fail because the file won't exist after the sparse checkout completes.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cfb070c03c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-05T14:14:40Z

scripts/submit-plugin.ts

+
+        // 4. Fetch user's plugins to find the database plugin ID
+        log.step("Fetching Plugin from Framer")
+        const plugins = await fetchMyPlugins(config)


Skip Framer API lookup during dry runs

Guard the Framer plugin lookup behind !config.dryRun, because the current flow always calls fetchMyPlugins before the dry-run branch and therefore still requires a valid SESSION_TOKEN and network access. In practice, a dry run configured as documented (without submission secrets) exits early with "Session token is required," so the dry_run workflow input cannot be used for safe validation runs.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-05T14:14:40Z

.github/workflows/submit-plugin.yml

+        run: yarn turbo run build --filter=framer-plugin-tools
+
+      - name: Submit plugin
+        run: yarn tsx scripts/submit-plugin.ts


Checkout the workflow repository before running local scripts

For workflow_call, this job currently checks out the caller repository by default, but then executes scripts/submit-plugin.ts from the workspace. That means cross-repo callers (the stated use case) fail unless they coincidentally contain this repo’s scripts/ layout and framer-plugin-tools workspace package. Add an explicit checkout of this repository (or otherwise source the script/tooling) before invoking these commands.

Useful? React with 👍 / 👎.

Will focus on cross repo invoking in follow up but good call

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Also removing ref type overwrites

- Improve clarity of effect names - Better support deletion of multiple files - Ensure local deletions always require confirmation on resync

- Add packages/plugin-tools with build and pack functionality - Add g:pack script to root package.json - Update all plugin package.json files to use workspace dependency - Keep backwords compatibility but allow specifying additional options

- Add GitHub Actions workflows for plugin submission - Add scripts for validating PR body and submitting plugins - Add test:scripts command and related dev dependencies - Update PR template

niekert commented Feb 5, 2026

View reviewed changes

niekert force-pushed the main branch 2 times, most recently from 2975293 to cfb070c Compare February 5, 2026 14:03

cursor bot reviewed Feb 5, 2026

View reviewed changes

chatgpt-codex-connector bot reviewed Feb 5, 2026

View reviewed changes

niekert force-pushed the main branch 3 times, most recently from de2c668 to 865b14a Compare February 5, 2026 15:44

dependabot bot and others added 15 commits February 5, 2026 20:33

Make comparison to slug column case insensitive

0d055c8

Add code link Plugin and CLI

899dcd8

Fixing lint / formatting errors

6d1ae45

eslint fixes

159b380

Update tests

8b8ac04

More lint/ts fixes

60ebe0a

No more auto-verbose logging

aa0858c

Fix publishing by bundling shared package

6eda437

Dark mode

d47d7f8

Cleanup api.ts

a34ee36

Update tests

b821688

Cleanup

8d9af20

Lockfile fixes from rebase

89a006b

Updating types and controller tests

2cd2f4c

huntercaron and others added 21 commits February 5, 2026 20:33

Biome formatting

336c728

Cleanup

5a483cd

Better handling for jsdeliver errors

6a25207

Also removing ref type overwrites

Publish

3b45d10

Switch to ts import extensions

6eb1f74

Update html title

4733542

Upgrade deps

5092fa7

Improve conflict detection

7083487

Remove unnecessary string cast

d19f10d

Add iconi

b27028e

Rework file deletions

c9a9123

- Improve clarity of effect names - Better support deletion of multiple files - Ensure local deletions always require confirmation on resync

Typesafe file content restoration

994c09a

Remove unused queue logic

0acf723

Release

21b5802

Add asset and readme

7dd77d4

node22 target

999cafa

Add tests for packPlugin

7e2bedc

rename to zipPluginDistribution

d28c187

support relative and absolute paths

e789f38

Add plugin submission workflow and GH integrations

3d1d28e

- Add GitHub Actions workflows for plugin submission - Add scripts for validating PR body and submitting plugins - Add test:scripts command and related dev dependencies - Update PR template

niekert force-pushed the main branch from 865b14a to 3d1d28e Compare February 5, 2026 20:36

Conversation

niekert commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ THIS DIFF is messed up because its stacked on top of: #549 and it won't let me change parent branches on forks.

Description

Submit on Merge

Submit Plugin

Check PR body

framer-plugin-tools

Checklist

Testing

Uh oh!

niekert Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

niekert Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

niekert Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

niekert commented Feb 5, 2026

Uh oh!

niekert commented Feb 5, 2026

Uh oh!

niekert commented Feb 5, 2026

Uh oh!

chatgpt-codex-connector bot commented Feb 5, 2026

Uh oh!

niekert commented Feb 5, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 5, 2026

Choose a reason for hiding this comment

Development environment hardcoded instead of production

Uh oh!

cursor bot Feb 5, 2026

Choose a reason for hiding this comment

Build script uses npm but plugins require yarn

Uh oh!

niekert Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot Feb 5, 2026

Choose a reason for hiding this comment

Sparse checkout missing required .tool-versions file

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

niekert Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

niekert commented Feb 5, 2026 •

edited

Loading

niekert Feb 5, 2026 •

edited

Loading