Tighten the Validate and Release workflows

[diego-sigma]

Summary

Tightens the two workflows before the first plugins land here.

Validate

• Fails if the checkout contains a symlink. claude plugin validate reads through a symlinked manifest and prints what it points at, and the release archive would follow links too.
• persist-credentials: false on checkout, and the CLI's telemetry turned off.
• CLI pinned to 2.1.284. Tested beforehand: validating a repository full of hooks, MCP server commands, helper scripts and bundles ran none of them.

Release

• Publishes only from main, with no manual trigger. A manual run from another branch would have published that branch's content, and tags here can't be moved or deleted.
• Before building a tag from the version, checks that every plugin carries the same X.Y.Z version.
• If a release for the version already exists, the run now fails instead of skipping when either:
  • the release came from a commit that isn't on main
  • the plugins changed since that release without a version bump
• The token is set only on the steps that use it. Archives store symlinks as links. One release runs at a time.

Both

• actions/checkout pinned to a commit (v7.0.1).
• .github/dependabot.yml keeps action pins current, holding new releases for 3 days.

Test plan

• All three files parse.
• The version step, run on its own: no plugins gives none=true, three plugins at 0.11.5 give tag=v0.11.5-beta, and these all fail:
  • mismatched versions
  • a version string with an embedded newline
  • 0.11.5-rc1
• The symlink step passes a clean tree and fails on one with a link.
• "Already released" checks: they call the GitHub compare API, so they run for the first time on the first merge after a release.

🤖 Generated with Claude Code