Simplify the starter to a marketplace with two maintenance plugins

.github/CODEOWNERS

@@ -1,15 +1,5 @@
-# Code owners review changes to the paths below. Replace these examples with
-# real GitHub users or teams before you ship, then require code owner review in
-# a branch protection rule or ruleset. This file alone doesn't enforce review.
-# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-#
-# *                              @your-org/ai-customizations
-# /.github/workflows/            @your-org/ai-customizations-admins
-# /.github/copilot/settings.json @your-org/ai-customizations-admins
-# /scripts/                      @your-org/ai-customizations-admins
-# /evals/                        @your-org/ai-customizations
-# /marketplace.json              @your-org/ai-customizations-admins
-# /plugins/<plugin-with-hooks>/  @your-org/ai-customizations-admins
+# For more information, see [docs](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax)
 
 # This repository is maintained by:
+
 * @github/code-ai-evals

.github/copilot/settings.json

@@ -8,11 +8,7 @@
     }
   },
   "enabledPlugins": {
-    "bug-report@plugin-marketplace-starter": true,
-    "team-brainstorm@plugin-marketplace-starter": true,
-    "format-json@plugin-marketplace-starter": true,
-    "customization-authoring@plugin-marketplace-starter": true,
-    "code-review@plugin-marketplace-starter": true,
-    "json-configuration@plugin-marketplace-starter": true
+    "marketplace-maintainer@plugin-marketplace-starter": true,
+    "plugin-authoring@plugin-marketplace-starter": true
   }
 }

.github/scripts/check-local-catalog.mjs

@@ -0,0 +1,33 @@
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export function checkLocalCatalog(root = process.cwd()) {
+  const read = (path) => JSON.parse(readFileSync(resolve(root, path), "utf8"));
+  const folders = existsSync(resolve(root, "plugins"))
+    ? readdirSync(resolve(root, "plugins"), { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name)
+    : [];
+  for (const folder of folders) {
+    read(`plugins/${folder}/plugin.json`);
+  }
+  for (const plugin of read("marketplace.json").plugins) {
+    const source = plugin?.source;
+    const local = typeof source === "string" && source.trim().length > 0;
+    const remote = source !== null && typeof source === "object" && !Array.isArray(source);
+    if (!local && !remote) {
+      throw new Error(`${plugin?.name ?? "(unnamed plugin)"}: source must be a non-empty local folder path or a remote source object.`);
+    }
+    if (!local) continue;
+    const manifest = read(`${plugin.source}/plugin.json`);
+    for (const field of ["name", "version", "description"]) {
+      if (manifest[field] !== plugin[field]) {
+        throw new Error(`${plugin.name}: marketplace.json and ${plugin.source}/plugin.json disagree on ${field}.`);
+      }
+    }
+  }
+}
+
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {
+  checkLocalCatalog();
+  console.log("Local catalog entries match their plugin.json files.");
+}

.github/scripts/check-remote-pins.mjs

@@ -0,0 +1,109 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync, realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const agentPluginsSchema = /^https:\/\/agent-plugins\.org\/schemas\/\d+\.\d+\.\d+\/plugin\.schema\.json$/;
+const supportedSchemas = new Set(["1.0.0", "1.1.0"].map((version) => `https://agent-plugins.org/schemas/${version}/plugin.schema.json`));
+// Copilot CLI's plugin reference (github/docs@8e7396e); legacy order also tested in d838c30^.
+const legacyManifestPaths = [".plugin/plugin.json", "plugin.json", ".github/plugin/plugin.json", ".claude-plugin/plugin.json"];
+
+export function githubApi(endpoint, run = spawnSync) {
+  const result = run("gh", ["api", endpoint, "--include", "-H", "Accept: application/vnd.github.raw+json"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error) throw new Error(`Couldn't run gh api (${result.error.code ?? "process error"}).`);
+  const response = /^HTTP\/[\d.]+\s+(\d{3})[^\r\n]*\r?\n[\s\S]*?\r?\n\r?\n([\s\S]*)$/.exec(result.stdout ?? "");
+  if (!response) {
+    throw new Error(`GitHub API request failed for ${endpoint} (exit ${result.status}; no HTTP response).`);
+  }
+  const status = Number(response[1]);
+  if (result.status !== 0 && status === 200) {
+    throw new Error(`gh api failed for ${endpoint} (exit ${result.status}) despite HTTP 200.`);
+  }
+  return { status, body: response[2] };
+}
+
+function parseJson(body, label) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new Error(`${label} isn't valid JSON.`);
+  }
+}
+
+function requireSuccess(response, label) {
+  if (response.status !== 200) {
+    throw new Error(`${label}: GitHub API returned HTTP ${response.status}${response.status === 404 ? " (not found, or your token can't read it)" : ""}.`);
+  }
+}
+
+export function checkRemotePin(entry, api = githubApi) {
+  const fail = (message) => { throw new Error(`${entry.name}: ${message}`); };
+  const { source, repo, path, sha, ref } = entry.source ?? {};
+  if (source !== "github") fail("only github remote sources are supported.");
+  if (!/^[0-9a-f]{40}$/.test(sha ?? "")) fail("source.sha must be a full 40-character commit.");
+  if (ref !== undefined && (typeof ref !== "string" || !ref.trim())) {
+    fail("source.ref must be a non-empty string when supplied.");
+  }
+
+  const commit = api(`repos/${repo}/commits/${sha}`);
+  requireSuccess(commit, `${entry.name}: commit ${sha} in ${repo}`);
+  if (parseJson(commit.body, `${entry.name}: commit response`).sha !== sha) {
+    fail(`GitHub didn't return the pinned commit ${sha}.`);
+  }
+  if (ref !== undefined) {
+    const refCommit = api(`repos/${repo}/commits/${encodeURIComponent(ref)}`);
+    requireSuccess(refCommit, `${entry.name}: ref ${ref} in ${repo}`);
+    if (parseJson(refCommit.body, `${entry.name}: ref response`).sha !== sha) {
+      fail(`source.ref ${ref} doesn't resolve to the pinned commit ${sha}.`);
+    }
+  }
+
+  const fetched = new Map();
+  const load = (candidate) => {
+    if (fetched.has(candidate)) return fetched.get(candidate);
+    const file = path ? `${path}/${candidate}` : candidate;
+    const encoded = file.split("/").map(encodeURIComponent).join("/");
+    const response = api(`repos/${repo}/contents/${encoded}?ref=${sha}`);
+    if (response.status === 404) {
+      fetched.set(candidate, undefined);
+      return undefined;
+    }
+    requireSuccess(response, `${entry.name}: ${repo}/${file}`);
+    const manifest = { file, data: parseJson(response.body, `${entry.name}: ${file} at ${sha}`) };
+    fetched.set(candidate, manifest);
+    return manifest;
+  };
+
+  const root = load("plugin.json");
+  let manifest;
+  if (typeof root?.data?.$schema === "string" && agentPluginsSchema.test(root.data.$schema)) {
+    if (!supportedSchemas.has(root.data.$schema)) fail(`root plugin.json declares an unsupported Agent Plugins schema: ${root.data.$schema}.`);
+    manifest = root;
+  } else {
+    for (const candidate of legacyManifestPaths) {
+      manifest = load(candidate);
+      if (manifest) break;
+    }
+  }
+  if (!manifest) fail(`no plugin.json under ${path || "the repository root"} at ${sha}.`);
+  if (manifest.data?.name !== entry.name) {
+    fail(`upstream ${manifest.file} is named ${manifest.data?.name}, expected ${entry.name}.`);
+  }
+  if (entry.version !== undefined && manifest.data.version !== undefined && manifest.data.version !== entry.version) {
+    fail(`upstream ${manifest.file} has version ${manifest.data.version}, expected ${entry.version}.`);
+  }
+  return manifest.file;
+}
+
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {
+  const entries = JSON.parse(readFileSync("marketplace.json", "utf8")).plugins
+    .filter((entry) => typeof entry.source === "object");
+  for (const entry of entries) {
+    const file = checkRemotePin(entry);
+    console.log(`${entry.name}: ${entry.source.repo}@${entry.source.sha} (${file}) ok`);
+  }
+  if (!entries.length) console.log("No remote pins to check.");
+}