From 8875399eb15ebe1e33b0294dba4ceef649bc90a7 Mon Sep 17 00:00:00 2001
From: Donald Pinckney <donald.pinckney@temporal.io>
Date: Sun, 5 Jul 2026 05:17:04 -0400
Subject: [PATCH 1/2] Add release workflow to bump Claude plugin version

Manually-dispatched workflow that increments the version in
.claude-plugin/plugin.json (patch/minor/major), commits the bump
directly to main, and pushes a v<version> tag. Pushes over SSH using
a deploy key so it can bypass the main ruleset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 72 +++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..43f0d10
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,72 @@
+name: Release Claude Plugin
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        description: "Version bump type"
+        type: choice
+        required: true
+        default: patch
+        options:
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ssh-key: ${{ secrets.RELEASE_SSH_KEY }}
+
+      - name: Bump plugin version
+        id: bump
+        run: |
+          set -euo pipefail
+          PLUGIN_FILE=".claude-plugin/plugin.json"
+
+          OLD_VERSION=$(jq -r '.version' "$PLUGIN_FILE")
+          if [ -z "$OLD_VERSION" ] || [ "$OLD_VERSION" = "null" ]; then
+            echo "Could not read version from $PLUGIN_FILE" >&2
+            exit 1
+          fi
+
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
+
+          case "${{ inputs.bump }}" in
+            major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
+            minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
+            patch) PATCH=$((PATCH + 1)) ;;
+          esac
+
+          NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
+
+          tmp=$(mktemp)
+          jq --arg v "$NEW_VERSION" '.version = $v' "$PLUGIN_FILE" > "$tmp"
+          mv "$tmp" "$PLUGIN_FILE"
+
+          echo "old_version=$OLD_VERSION" >> "$GITHUB_OUTPUT"
+          echo "new_version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Bumped $OLD_VERSION -> $NEW_VERSION"
+
+      - name: Commit and tag
+        env:
+          NEW_VERSION: ${{ steps.bump.outputs.new_version }}
+          OLD_VERSION: ${{ steps.bump.outputs.old_version }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git add .claude-plugin/plugin.json
+          git commit -m "Bump version from ${OLD_VERSION} to ${NEW_VERSION}"
+          git tag "v${NEW_VERSION}"
+
+          git push origin HEAD:main
+          git push origin "v${NEW_VERSION}"

From 502b1271ccff709b6d4be932210d86f99adc81df Mon Sep 17 00:00:00 2001
From: Donald Pinckney <donald.pinckney@temporal.io>
Date: Sun, 5 Jul 2026 05:22:37 -0400
Subject: [PATCH 2/2] Route workflow_dispatch input through env to avoid shell
 injection

Copy inputs.bump into a step-level env var and reference "$BUMP" in the
run block instead of interpolating ${{ inputs.bump }} directly, per
opengrep security.gha.run-shell-injection-inputs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 43f0d10..a952acf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,8 @@ jobs:
 
       - name: Bump plugin version
         id: bump
+        env:
+          BUMP: ${{ inputs.bump }}
         run: |
           set -euo pipefail
           PLUGIN_FILE=".claude-plugin/plugin.json"
@@ -39,7 +41,7 @@ jobs:
 
           IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
 
-          case "${{ inputs.bump }}" in
+          case "$BUMP" in
             major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;;
             minor) MINOR=$((MINOR + 1)); PATCH=0 ;;
             patch) PATCH=$((PATCH + 1)) ;;