Ship a daily GitHub Actions routine that builds and pushes a clean plugin-only distribution from shawn-sandy/agentics to a new shawn-sandy/agentics-kit repo — eliminating docs/, CLAUDE.md, scripts/, and all other non-plugin files from every user install.
Read and implement all steps in the plan at docs/plans/publish-plugins-to-dist-repo-daily.html — Ship a daily publish pipeline from agentics to agentics-kit
Run as workflow — launch parallel subagents
Run a workflow to implement the plan at docs/plans/publish-plugins-to-dist-repo-daily.html — Ship a daily publish pipeline from agentics to agentics-kit
publish-plugins-to-dist-repo-daily.html
docs/plans/publish-plugins-to-dist-repo-daily.html
Context
The shawn-sandy/agentics repo currently serves as both the development workspace and the install source for all 12 marketplace plugins. When Claude Code installs a plugin via git-subdir, it clones the full repo and walks the declared path — but everything else in the repo (a 35 KB README.md, the entire docs/ tree, CLAUDE.md, .github/, scripts/, examples/, tests/, session screenshots) comes along for the ride. There is no install-time filter.
scripts/build-dist.mjs already solves the filtering problem: it reads marketplace.json plugins[] as the source of truth, copies only an allowlisted set of component directories per plugin (commands, skills, agents, hooks, .claude-plugin, templates, references, scripts, README.md, CHANGELOG.md, LICENSE) into dist/, and emits a clean marketplace.json (stripped of removed[]). The --check mode verifies no DROP patterns leaked. The --publish flag is a stub that exits non-zero.
The fix is a dedicated shawn-sandy/agentics-kit distribution repo — shaped identically to the source marketplace — populated daily by a GitHub Actions routine. The routine runs build-dist.mjs, verifies cleanliness with --check, then pushes the dist/ tree to the dist repo. Users who install from agentics-kit pull only plugin component files. The existing build-clean-plugin-dist.html plan (status: todo) targeted a release-triggered publish; this plan supersedes that trigger with a daily cron.
Files to Modify
- .github/workflows/
publish-dist.ymlnew daily cron + workflow_dispatch publish action- .claude-plugin/
marketplace.jsonmodified update 12 source.url values to agentics-kit- scripts/
build-dist.mjsmodified implement --publish modeREADME.mdmodified add Distribution section with new install pathCLAUDE.mdmodified document dist repo and manual publish command
Pipeline
schedule: cron '0 6 * * *' + workflow_dispatch
node scripts/build-dist.mjs
node scripts/build-dist.mjs --check
node scripts/build-dist.mjs --publish
shawn-sandy/agentics-kit
Steps
shawn-sandy/agentics-kit dist repo on GitHub manual
--publish has something to clone.Verify
gh repo view shawn-sandy/agentics-kit --json name,url and confirm it returns the repo name and URL without error. The repo should have at least one commit (an auto-generated README) so the shallow clone in --publish succeeds.
Command:
gh repo create shawn-sandy/agentics-kit --public --description "Clean plugin-only distribution for the agentics-kit Claude Code marketplace" --add-readmeDIST_REPO_TOKEN secret and DIST_REPO_URL variable on the source repo manual
GITHUB_TOKEN in GitHub Actions is scoped to the source repo and cannot push to agentics-kit — a fine-grained PAT with Contents: write on the dist repo is required. Storing it as a secret (not a variable) prevents it from appearing in logs.Verify
2.
gh secret set DIST_REPO_TOKEN --body "<token>" --repo shawn-sandy/agentics3.
gh variable set DIST_REPO_URL --body "https://github.com/shawn-sandy/agentics-kit.git" --repo shawn-sandy/agenticsConfirm:
gh secret list --repo shawn-sandy/agentics shows DIST_REPO_TOKEN; gh variable list --repo shawn-sandy/agentics shows DIST_REPO_URL.
--publish in scripts/build-dist.mjs
dist/ contents in, commits with --allow-empty (so every daily run produces a timestamped commit even when content is identical), and pushes — authenticating by embedding the PAT as x-access-token in the clone URL so no credential helper is needed.Verify
args.includes('--publish') branch stub with a publish() function call. The function should:1. Add
import { execSync } from 'node:child_process'; to the imports.2. Fail fast if
dist/ does not exist (user forgot to build first).3. Read
DIST_REPO_URL and DIST_REPO_TOKEN from process.env; exit non-zero if URL is missing.4. Build auth URL:
distUrl.replace('https://', 'https://x-access-token:' + token + '@').5. Clone:
git clone --depth=1 <authUrl> .dist-checkout/.6. Clear tracked files:
git ls-files | xargs rm -f inside the checkout.7. Copy:
cpSync(OUT_DIR, tmpDir, { recursive: true }).8. Get source SHA:
git rev-parse --short HEAD in ROOT.9. Set git identity,
git add -A, git commit --allow-empty -m "chore: sync from agentics@<sha>", git push.10. Remove
.dist-checkout/.Test locally:
node scripts/build-dist.mjs && DIST_REPO_URL=... DIST_REPO_TOKEN=... node scripts/build-dist.mjs --publish. Confirm process exits 0 and the dist repo on GitHub has a new commit.
.github/workflows/publish-dist.yml
0 6 * * *) keeps the dist repo current with any plugin changes merged since the last run. workflow_dispatch enables manual runs for testing and emergency publishes. Separating the build, check, and publish into distinct steps gives clear CI log sections and fails fast on leakage before attempting the push.Verify
name: Publish dist to agentics-kit
on:
schedule:
- cron: '0 6 * * *'
workflow_dispatch:
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: '20'
- name: Build dist
run: node scripts/build-dist.mjs
- name: Verify no leaks
run: node scripts/build-dist.mjs --check
- name: Publish to agentics-kit
run: node scripts/build-dist.mjs --publish
env:
DIST_REPO_URL: ${{ vars.DIST_REPO_URL }}
DIST_REPO_TOKEN: ${{ secrets.DIST_REPO_TOKEN }}
Verify: gh workflow list --repo shawn-sandy/agentics shows publish-dist.yml.
workflow_dispatch to seed the dist repo
--publish implementation all work end-to-end in CI.Verify
gh workflow run publish-dist.yml --repo shawn-sandy/agenticsWatch:
gh run watch --repo shawn-sandy/agenticsAfter the run completes green:
1.
gh api repos/shawn-sandy/agentics-kit/commits --jq '.[0].commit.message' should start with chore: sync from agentics@.2.
gh api repos/shawn-sandy/agentics-kit/git/trees/HEAD?recursive=1 --jq '[.tree[].path]' shows kit/plugins/* and .claude-plugin/marketplace.json but no docs/, no CLAUDE.md, no scripts/.
source.url values in .claude-plugin/marketplace.json to point at the dist repo
https://github.com/shawn-sandy/agentics.git, the full dev repo. Switching to https://github.com/shawn-sandy/agentics-kit.git means any /plugin install @agentics-kit command pulls from the clean dist going forward. The build script already rewrites source.url in the generated dist manifest — this step makes the source manifest consistent.Verify
grep -c "agentics-kit.git" .claude-plugin/marketplace.json returns 12. grep "agentics.git" .claude-plugin/marketplace.json returns no matches (all old URLs replaced).README.md and update CLAUDE.md
Verify
/plugin marketplace add shawn-sandy/agentics-kit install command; a note that agentics is the dev repo and agentics-kit is the clean dist; link to the publish workflow.CLAUDE.md — under Repository Structure, note
dist/ (local build output, gitignored). Under Common Commands, add gh workflow run publish-dist.yml --repo shawn-sandy/agentics for manual publishes.Verify:
grep -q "agentics-kit" README.md && grep -q "agentics-kit" CLAUDE.md && echo OK prints OK.
Tests
File: tests/publish/smoke-clean-dist.sh
Type: smoke test
Asserts: After running node scripts/build-dist.mjs, the dist/ tree contains all 12 active plugin directories, the clean marketplace.json, README.md, and LICENSE — and contains no docs/, CLAUDE.md, SOCIAL.md, scripts/, tests/, .github/, or *.png files.
Run: node scripts/build-dist.mjs && node scripts/build-dist.mjs --check && bash tests/publish/smoke-clean-dist.sh
publish() function — authentication and git operations
File: tests/publish/test-publish-fn.mjs
Targets: publish() in scripts/build-dist.mjs
Key cases: exits non-zero when dist/ missing; exits non-zero when DIST_REPO_URL unset; embeds token correctly in clone URL (x-access-token prefix); commit message contains source SHA; .dist-checkout/ is removed on success and on error.
File: tests/publish/test-workflow-config.sh
Targets: .github/workflows/publish-dist.yml
Key cases: YAML is valid (gh workflow view publish-dist.yml returns without error); cron schedule is 0 6 * * *; workflow_dispatch trigger present; DIST_REPO_TOKEN and DIST_REPO_URL are wired from secrets/vars in the publish step.
Acceptance Criteria
Verification
From a clean Claude Code session, run /plugin marketplace add shawn-sandy/agentics-kit followed by /plugin install code-review@agentics-kit. Confirm: (1) the install succeeds; (2) only .claude-plugin/, commands/, skills/, agents/, README.md, and CHANGELOG.md are present in the installed plugin directory — no docs/ tree, no plan files, no CLAUDE.md.
Additionally, wait for (or manually trigger) the next cron run and verify a new commit appears in shawn-sandy/agentics-kit with message chore: sync from agentics@<sha> where <sha> matches the current HEAD of shawn-sandy/agentics.
Completion Checklist
Completion Report
No items to report — all requirements met.