Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

0.7.0 invalidated the three published plugin distributions; they need republishing

Open
  • Is something wrong?
#79 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
github-actions
Domain
ci-cd, release

Research direction

Read publish.yml and the Generated-only workflow in chock-claude-plugins, chock-cursor-plugins, and chock-codex-plugins to understand how each publishes against chock 0.7.0. Run the publish workflow in each repository, then inspect the regenerated runtime diffs, paying attention to any enforcement-tier changes. Done means Generated-only is green on main in all three and any tier changes are noted in the publish notes.

Written by the indexing model from the issue text.

Description

What

The five-axis migration in #73 changed the compiled guard runtime. The three distribution repositories were published by framework v0.6.0 and have not been republished, so each one's Generated-only check now fails against chock's current main:

Repository Last published as Generated-only
chock-claude-plugins generated: catalog 3e01994… (framework v0.6.0) red
chock-cursor-plugins v0.6.0-era red
chock-codex-plugins v0.6.0-era red

Those workflows check out open-coder-ai/chock at current main and regenerate, so the failure appeared the moment 0.7.0 merged — no push to the distribution repos was involved. Run #21 of Generated-only on chock-claude-plugins' main was green on 2026-08-29 under 0.6.0; the same run today fails on the guard runtime diff (the Cursor permission: deny JSON and Codex exit-code block).

Why this is worth fixing promptly rather than at the next publish

Generated-only is not a lint — its own workflow comment calls it "the security argument": it proves that what a user installs is exactly what the catalog published. While it is red:

  • that proof is unavailable for all three published distributions, which is the strongest claim those repos make;
  • a genuine tampering diff would be indistinguishable from this standing failure;
  • the shipped plugins still carry the 0.6.0 runtime, so adopters installing today get the pre-migration behaviour while the catalog and framework have moved on.

What done looks like

  1. Run publish.yml on each of the three repositories against chock 0.7.0.
  2. Confirm Generated-only goes green on main in all three.
  3. Diff the regenerated runtime deliberately rather than rubber-stamping it: the migration re-graded 16 coverage cells, so if any plugin's stated enforcement tier moved, that belongs in the publish notes.

Related: chock-catalog#45 is the same 0.6→0.7 staleness in the catalog's own compiled artifacts. Both come from the same migration; neither is a defect in it.

Found while adding badges to the three distribution READMEs (chock-claude-plugins#2, chock-cursor-plugins#1, chock-codex-plugins#1) — those PRs touch only README.md, which is deliberately exempt from generation, and are blocked behind this.

Dominant language
Python
Stars
8
Forks
1
Avg merge
2h 48m
Merged PRs (30d)
114

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from open-coder-ai/chock

All issues in open-coder-ai/chock

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.