Add Codex plugin quality gate CI

[internet-dot]

Adds a CI workflow to validate Codex plugin manifests using the HOL Codex Plugin Scanner.

This workflow runs automatically on any PR that modifies plugin files (.codex-plugin/, skills/, .mcp.json) and ensures:

• Manifest structure is valid
• Skills are properly defined
• MCP configuration is correct
• Quality score meets the minimum threshold (80/100)

Scanner: codex-plugin-scanner | awesome-codex-plugins

[sentry]

Bug: The workflow uses a mutable tag (@v1) for a third-party GitHub Action, creating a supply chain risk as the underlying code can be changed without notice.
_{Severity: CRITICAL}

Suggested Fix

To mitigate the supply chain risk, replace the mutable tag @v1 with the full, immutable commit SHA of the specific version of the action you intend to use. This ensures the executed code never changes unexpectedly. Before pinning, verify the action's source code and the contributor's affiliation to ensure it is trustworthy. If the action is not necessary, remove the workflow entirely.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/plugin-quality-gate.yml#L16

Potential issue: The workflow file `.github/workflows/plugin-quality-gate.yml`
introduces a dependency on a third-party GitHub Action using a mutable tag,
`hashgraph-online/hol-codex-plugin-scanner-action@v1`. This practice is insecure because
the owner of the action can update the code behind the `@v1` tag at any time without
notification. Since the workflow is triggered on changes to common files and has
repository access, a malicious update could inject arbitrary code into the CI/CD
pipeline, potentially leading to code or data exfiltration. The action is from an
unaffiliated organization, increasing the risk.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/xcodebuildmcp@307

commit: 6ae49e5

[internet-dot]

Closing. My mistake, this was a duplicate.