Release and validate the Codex, Cursor and Cortex Code plugins

[diego-sigma]

What changed

The next sync brings plugins for four assistants: plugins/claude, plugins/codex, plugins/cursor and plugins/coco, plus the Codex marketplace (.agents/plugins/marketplace.json) and the Cursor marketplace (.cursor-plugin/marketplace.json). Today both workflows only know about Claude. This PR teaches them the other three.

Release

• The version comes from every plugin manifest on every host (.claude-plugin, .codex-plugin, .cursor-plugin, .cortex-plugin), and they must agree on one X.Y.Z. A plugin folder without its host's manifest, or a folder under plugins/ that isn't a known host, stops the release, so nothing gets archived without its version being checked.
• Each plugin is archived once per host:
  • Claude: <name>-<slug>.claude.plugin, holding the folder's contents, as before. Only the extension is new (it was .plugin).
  • Codex, Cursor, Cortex Code: <name>-<slug>.codex.zip, .cursor.zip, .coco.zip, each holding the <name>/ folder.
• The "changed without a version bump" check now counts changes under every host's plugins/ folder and in all three marketplace files.
• The existing safeguards are unchanged: main only, no manual trigger, the X.Y.Z check before the version reaches a tag, the released-from-a-commit-not-on-main check, the token scoped to the steps that use it, zip -y, and the concurrency group.

Validate

• New step, "Check the other hosts' plugins". Every JSON file under the Codex, Cursor and Cortex Code plugins must parse. Every plugin folder needs its manifest, each marketplace must list exactly the plugin folders on disk, and every manifest and marketplace entry, Claude's included, must carry the same version.
• The Claude CLI validation, the symlink refusal and the pinned actions are unchanged.

Merge order

Merge this before the next sync PR. The next sync is the first to carry the other hosts. If it merges under the current Release, the release would attach only the Claude archives, and under the old .plugin name.

Merging this one on its own publishes nothing. main stays at 0.11.6, whose release already exists, and only .github/ changes, so Release finds the release in place and stops.

Test plan

I ran each changed step offline by pulling its script out of the YAML. Inputs were the current main and a preview of the next sync (13 plugins x 4 hosts at 0.11.8).

• Work out the version: next sync gives 52 plugins at 0.11.8 (v0.11.8-beta). Current main gives 13 at 0.11.6. No plugins gives none=true. These are refused: one Cursor manifest at another version, a Cortex Code plugin with no manifest, an unknown host folder, a version with a newline in it, 0.11.8-rc1.
• Archive each plugin: next sync gives 52 archives, 13 each of .claude.plugin, .codex.zip, .cursor.zip, .coco.zip. A Claude archive has the plugin's files at its root, and a Codex archive has the single <name>/ folder. No .DS_Store in any archive. Current main gives 13 .claude.plugin.
• Changed-without-bump filter: counts plugins/codex/..., plugins/coco/..., .agents/plugins/marketplace.json, .cursor-plugin/marketplace.json, .claude-plugin/marketplace.json. Ignores README.md and .github/.
• Check the other hosts' plugins: passes on the next sync and on current main. These fail: broken JSON in a Cortex Code .mcp.json, a Cursor marketplace entry at another version, a Codex marketplace missing a plugin, a Codex manifest or a Claude manifest at another version.
• Refuse symlinks: passes on the next sync, fails with a link added.
• claude plugin validate --strict (2.1.284) on the next sync's marketplace, all 13 Claude manifests and all 13 skills folders: passes.
• Both workflow files parse as YAML.
• Validate is green on this PR.
• After the next sync PR merges: its release has 52 assets.

🤖 Generated with Claude Code