fix: CI failure on main (Validate Claude Code Plugin, 1563350) #106
Description
CI Failure: Validate Claude Code Plugin
Commit: 1563350df7d4cfe61dfd20b72b5019f155302e17
Run: https://github.com/JacobPEvans/claude-code-plugins/actions/runs/22799093907
Failure Logs
=== FAILED JOB: validate ===
2026-03-07T12:31:53.7163096Z ❌ Deny in main worktree: None
2026-03-07T12:31:53.7163654Z ❌ Deny when branch is main: None
2026-03-07T12:31:53.7163960Z ✅ Allow for non-main: None
2026-03-07T12:31:53.7164215Z ✅ Ignore other tools: None
2026-03-07T12:31:53.7164484Z ❌ Deny NotebookEdit in main: None
2026-03-07T12:31:53.7228745Z Running: ./git-guards/scripts/test_shlex_valueerror.py
2026-03-07T12:31:53.8514274Z PASS [ValueError: unclosed double-quote with hooksPath in fallback subcommand]: decision=silent_allow
2026-03-07T12:31:53.8515657Z PASS [ValueError: unclosed single-quote with hooksPath substring]: decision=silent_allow
2026-03-07T12:31:53.8516685Z PASS [well-formed hooksPath bypass after unknown option still denies]: decision=deny
2026-03-07T12:31:53.8517663Z PASS [hooksPath pattern inside quoted commit message stays silent_allow]: decision=silent_allow
2026-03-07T12:31:53.8518049Z
2026-03-07T12:31:53.8518146Z ALL TESTS PASSED
2026-03-07T12:31:53.8566848Z Running: ./git-guards/scripts/test_graphql_guidance.py
2026-03-07T12:31:54.0853959Z PASS [shell var + -f flag]: decision=allow
2026-03-07T12:31:54.0854682Z PASS [wrong mutation: addPullRequestReviewComment]: decision=allow
2026-03-07T12:31:54.0855518Z PASS [wrong mutation: resolvePullRequestReviewThread]: decision=allow
2026-03-07T12:31:54.0856043Z PASS [correct mutation resolveReviewThread]: decision=silent_allow
2026-03-07T12:31:54.0856444Z PASS [gh pr list unaffected]: decision=silent_allow
2026-03-07T12:31:54.0856878Z PASS [combined: -f flag + wrong mutation + shell var]: decision=allow
2026-03-07T12:31:54.0857281Z PASS [jq false positive check]: decision=silent_allow
2026-03-07T12:31:54.0857622Z PASS [multi-line trailing backslash]: decision=allow
2026-03-07T12:31:54.0857834Z
2026-03-07T12:31:54.0857920Z ALL TESTS PASSED
2026-03-07T12:31:54.0911376Z Running: ./git-guards/scripts/test_gh_guard.py
2026-03-07T12:31:54.4123857Z PASS [gh pr comment deny]: decision=deny
2026-03-07T12:31:54.4124435Z PASS [gh pr comment -b flag]: decision=deny
2026-03-07T12:31:54.4124846Z PASS [gh repo delete ask]: decision=ask
2026-03-07T12:31:54.4125368Z PASS [gh release delete ask]: decision=ask
2026-03-07T12:31:54.4125662Z PASS [gh issue close ask]: decision=ask
2026-03-07T12:31:54.4125922Z PASS [gh pr close ask]: decision=ask
2026-03-07T12:31:54.4126187Z PASS [gh pr merge ask]: decision=ask
2026-03-07T12:31:54.4126814Z PASS [gh pr list silent]: decision=silent_allow
2026-03-07T12:31:54.4127155Z PASS [gh issue list silent]: decision=silent_allow
2026-03-07T12:31:54.4127478Z PASS [gh pr view silent]: decision=silent_allow
2026-03-07T12:31:54.4127782Z PASS [gh repo view silent]: decision=silent_allow
2026-03-07T12:31:54.4128087Z PASS [non-gh command]: decision=silent_allow
2026-03-07T12:31:54.4128275Z
2026-03-07T12:31:54.4128355Z ALL TESTS PASSED
2026-03-07T12:31:54.4179966Z Running: ./git-guards/scripts/test_permission_guard.py
2026-03-07T12:31:55.0206486Z PASS [git rm plain]: decision=silent_allow
2026-03-07T12:31:55.0207121Z PASS [git rm --cached]: decision=silent_allow
2026-03-07T12:31:55.0207655Z PASS [git rm -f]: decision=ask
2026-03-07T12:31:55.0208081Z PASS [git rm --force]: decision=ask
2026-03-07T12:31:55.0208510Z PASS [git rm -r]: decision=ask
2026-03-07T12:31:55.0208921Z PASS [git rm -rf]: decision=ask
2026-03-07T12:31:55.0209338Z PASS [git rm -r -f]: decision=ask
2026-03-07T12:31:55.0209774Z PASS [git restore]: decision=ask
2026-03-07T12:31:55.0210189Z PASS [git clean]: decision=ask
2026-03-07T12:31:55.0210478Z PASS [git reset]: decision=ask
2026-03-07T12:31:55.0210739Z FAIL [git push --force]: decision=deny
2026-03-07T12:31:55.0211011Z Expected: ask, Got: deny
2026-03-07T12:31:55.0211265Z PASS [git commit --no-verify]: decision=deny
2026-03-07T12:31:55.0211547Z PASS [rm .git/hooks]: decision=deny
2026-03-07T12:31:55.0211808Z PASS [ls command]: decision=silent_allow
2026-03-07T12:31:55.0212087Z PASS [git -C rm plain]: decision=silent_allow
2026-03-07T12:31:55.0212389Z PASS [git -C commit --no-verify]: decision=deny
2026-03-07T12:31:55.0212676Z PASS [git -C reset --hard]: decision=ask
2026-03-07T12:31:55.0213286Z PASS [git -C -c core.hooksPath deny]: decision=deny
2026-03-07T12:31:55.0213589Z PASS [git -C restore ask]: decision=ask
2026-03-07T12:31:55.0213889Z PASS [hooksPath in value only]: decision=silent_allow
2026-03-07T12:31:55.0214233Z PASS [--no-pager before -c hooksPath]: decision=deny
2026-03-07T12:31:55.0214604Z PASS [valid -c then --bare then -c hooksPath]: decision=deny
2026-03-07T12:31:55.0214997Z PASS [hooksPath in commit message]: decision=silent_allow
2026-03-07T12:31:55.0215464Z
2026-03-07T12:31:55.0215559Z SOME TESTS FAILED
2026-03-07T12:31:55.0270050Z ##[error]Process completed with exit code 1.
2026-03-07T12:31:55.0341240Z Post job cleanup.
2026-03-07T12:31:55.1138007Z [command]/usr/bin/git version
2026-03-07T12:31:55.1175546Z git version 2.53.0
2026-03-07T12:31:55.1216666Z Temporarily overriding HOME='/home/runner/work/_temp/78b27d43-5936-48d9-985c-5572d50a73b1' before making global git config changes
2026-03-07T12:31:55.1218158Z Adding repository directory to the temporary git global config as a safe directory
2026-03-07T12:31:55.1223161Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/claude-code-plugins/claude-code-plugins
2026-03-07T12:31:55.1255830Z Removing SSH command configuration
2026-03-07T12:31:55.1262379Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
2026-03-07T12:31:55.1322700Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2026-03-07T12:31:55.1568555Z Removing HTTP extra header
2026-03-07T12:31:55.1573487Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
2026-03-07T12:31:55.1607801Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2026-03-07T12:31:55.1846570Z Removing includeIf entries pointing to credentials config files
2026-03-07T12:31:55.1852888Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
2026-03-07T12:31:55.1876468Z includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git.path
2026-03-07T12:31:55.1877407Z includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git/worktrees/*.path
2026-03-07T12:31:55.1877919Z includeif.gitdir:/github/workspace/.git.path
2026-03-07T12:31:55.1878271Z includeif.gitdir:/github/workspace/.git/worktrees/*.path
2026-03-07T12:31:55.1887296Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git.path
2026-03-07T12:31:55.1910099Z /home/runner/work/_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.1920804Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git.path /home/runner/work/_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.1956087Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git/worktrees/*.path
2026-03-07T12:31:55.1978875Z /home/runner/work/_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.1988785Z [command]/usr/bin/git config --local --unset includeif.gitdir:/home/runner/work/claude-code-plugins/claude-code-plugins/.git/worktrees/*.path /home/runner/work/_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.2022208Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git.path
2026-03-07T12:31:55.2044318Z /github/runner_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.2052437Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git.path /github/runner_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.2084066Z [command]/usr/bin/git config --local --get-all includeif.gitdir:/github/workspace/.git/worktrees/*.path
2026-03-07T12:31:55.2105735Z /github/runner_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.2115494Z [command]/usr/bin/git config --local --unset includeif.gitdir:/github/workspace/.git/worktrees/*.path /github/runner_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config
2026-03-07T12:31:55.2148319Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
2026-03-07T12:31:55.2387528Z Removing credentials config '/home/runner/work/_temp/git-credentials-9cc4d205-7c82-4803-b912-9b1b2c6f3325.config'
2026-03-07T12:31:55.2530707Z Cleaning up orphan processes
Task
Please investigate and fix the CI failure on the main branch. Open a pull request with the fix.
Do not add workarounds or ignores - fix the actual root cause.