Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .codex-plugin/plugin.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"name": "trigger.dev",
"version": "0.1.0",
"description": "Trigger.dev \u2013 build and deploy fully\u2011managed AI agents and workflows",
"author": {
"name": "triggerdotdev",
"url": "https://github.com/triggerdotdev"
},
"homepage": "https://github.com/triggerdotdev/trigger.dev",
"repository": "https://github.com/triggerdotdev/trigger.dev",
"keywords": [
"mcp",
"codex"
],
"mcpServers": "./.mcp.json"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 plugin.json references non-existent .mcp.json file

The mcpServers field in .codex-plugin/plugin.json:15 points to ./.mcp.json, but this file does not exist anywhere in the repository root. The only MCP-related JSON file is .cursor/mcp.json (which lives in a different directory and has a different structure with an empty mcpServers object). This means the Codex plugin will fail to resolve its MCP server configuration, making the plugin non-functional.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

}
26 changes: 26 additions & 0 deletions .github/workflows/codex-plugin-scanner.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: Codex Plugin Quality Gate

on:
push:
branches: [main]
pull_request:
branches: [main]

concurrency:
group: codex-plugin-scanner-${{ github.ref }}
cancel-in-progress: true

jobs:
scan:
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Codex plugin scanner
uses: hashgraph-online/hol-codex-plugin-scanner-action@e83708a91ae4812872aa2905b99ad559a55c74ab
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚩 Third-party GitHub Action from lesser-known organization

The workflow at .github/workflows/codex-plugin-scanner.yml:22 uses hashgraph-online/hol-codex-plugin-scanner-action@e83708a91ae4812872aa2905b99ad559a55c74ab. While it is correctly pinned to a commit SHA (good security practice, consistent with the actions/checkout pin on line 20), hashgraph-online is not a well-known or widely-adopted GitHub Actions publisher. The action runs with contents: read permissions which limits blast radius, but the action could still exfiltrate repository source code. Worth verifying this is an intentional and trusted dependency.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

with:
plugin_dir: "."
mode: scan
fail_on_severity: critical