[kyle-sexton]

No related issue: owner decision Q14 (failing workflows)

Summary

The claude-code-plugins online link check has failed every run in its history (last 10: all failure, latest run 42809150911). In that run, 40 of the 63 dead-link locations were eval case prompts and graders that cite made-up URLs by design (x.com/fakehandle/..., attacker.tld, sms-admin.corp.internal, github.com/acme/...). The workflow name also carries the repository name, which the naming decision drops.

Fix

• Exclude every plugins/<p>/[skills/<s>/]evals/ tree from the online check. This replaces the old exclude for the attribution golden fixtures, which sits inside one of those trees.
• Rename the workflow from "Maintenance Check Links Online Claude Code Plugins" to "Maintenance Check Links Online".

The remaining dead links are real and are fixed in claude-code-plugins itself. That repository's maintenance-file-dead-links.yml triggers on this workflow's name:; the claude-code-plugins fix PR adds the new name to its trigger, so it should land before the sync PR that carries this rename.

Verification

• Every eval markdown file in claude-code-plugins sits under a path the new regex matches (git ls-files 'plugins/**/*.md' | grep -E '^plugins/[^/]+/.+/evals/' | grep -vE '^plugins/[^/]+/(skills/[^/]+/)?evals/' prints nothing), and plugins/evals/ (a plugin named evals) is not matched.
• 40 of the 63 locations in the run's link-check-online-dead-links artifact match the regex.
• After the sync lands in claude-code-plugins, a dispatched run of the workflow confirms the result.

Related

• Consumer fix: melodic-software/claude-code-plugins (dead links and the maintenance-file-dead-links.yml trigger), linked once opened.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VQb9Q2ceZLXhTR4d1vkTCe

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T00:08:58.485134Z	a0280cc	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed a0280cc7a68e4f212137ad0db780a78ca7dd681e: 0 finding(s), 0 as inline comments.

No findings. I reviewed the one changed file, components/lychee-online/targets/claude-code-plugins.yml.

• Exclude regex: (^|/)plugins/[^/]+/(skills/[^/]+/)?evals/ covers plugins/<p>/evals/ and plugins/<p>/skills/<s>/evals/. By reading the pattern, it also covers the old attribution golden-fixtures path, so replacing that exclude loses nothing. A plugin named evals (plugins/evals/...) does not match.
• Rename: Maintenance Check Links Online Claude Code Plugins appears nowhere else in this repository, so there is no stale citation here to reconcile. The PR body already says the consumer repo's maintenance-file-dead-links.yml trigger must land first. That sequencing sits outside this diff and I could not check it.
• PR body contract: The body has No related issue: <reason> and the four required sections.

I did not run lychee or the regex against the consuming repository's file tree. The PR's claims about the 40 of 63 dead-link locations and the git ls-files check are author-claimed and unverified by me.

Observation, not a finding: the destination path in distribution/sync-manifest.yml:307 still carries the -claude-code-plugins suffix, so the file name keeps it while the workflow name: drops it. That is probably deliberate, since the file name has to stay unique per consumer, but I did not verify it.

[github-actions]

claude-security-review reviewed a0280cc7a68e4f212137ad0db780a78ca7dd681e: 0 finding(s), 0 as inline comments.

No security findings.

The diff changes one file, components/lychee-online/targets/claude-code-plugins.yml, with two edits:

• It drops the repo suffix from the workflow name.
• It widens the lychee --exclude-path regex to skip any plugins/<plugin>/(skills/<skill>/)?evals/ directory.

Neither edit touches a trust control. Both fall outside the skip-gate carve-outs, so the full review applied.

• Trusted-actor list, token scope, kill switch, merge hold, token broker: none is touched.
• Permissions and secrets: the diff changes none.
• The uses: ...@main reference: it is unchanged context, not part of this diff.
• The wider exclusion: it only stops the link checker from fetching URLs in eval cases. That removes outbound requests and exposes no secret or token. A missed broken link in those directories is a link-hygiene matter, not a security one.
• The rename: it is cosmetic. The diff doesn't show whether the name feeds a required-check or ruleset match, but that is a CI-config concern with no exploit path.

I did not read PR context, settled-thread or prior-findings files, because the wrapper supplied none.

critical-findings: 0