Weekly Research2026-05-25 — Anthropic Enforcement Settled, Plugin Marketplace Matures, gh-aw v0.75.x #141
Weekly Research2026-05-25 — Anthropic Enforcement Settled, Plugin Marketplace Matures, gh-aw v0.75.x
#141
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Report date: 2026-05-25 · Repo state: v0.2.1 (stable, last commit d688265 on 2026-04-23) · Open issues: 20
Anthropic Platform Signals
The enforcement arc has settled — this plugin is on the right side of the line.
The policy sequence that concluded in early April is now stable background:
This plugin's auth path (
claude setup-token→CLAUDE_CODE_OAUTH_TOKEN→ official@anthropic-ai/claude-codenpm CLI) is exactly the use case Anthropic documents and permits. The framing inskills/install-workflow/auth.md:1–16— distinguishing the gh-aw sandbox proxy issue from Anthropic policy — is correct and should stay.Watch item — June 15, 2026: Anthropic is reportedly separating
claude -p(headless/Agent SDK) usage into its own credit pool on Pro/Max subscriptions, distinct from interactive usage. If this lands as described, headless runs may consume from a fixed monthly budget rather than the general subscriber allocation. This is the most significant near-term risk to the plugin's subscription wedge. No action needed now, but monitor the Anthropic changelog around that date.New auth path in
claude-code-action: Workload Identity Federation (OIDC keyless auth) shipped inanthropics/claude-code-actionv1.0.130–133 this week. OIDC exchanges a GitHub runner's short-lived token for an Anthropic access token — no long-lived secret stored at all. This doesn't affect the plugin's current approach, but it's worth noting as a future simplification path for enterprise users who want to avoid secret rotation.Claude Code Plugin Ecosystem
The marketplace is now first-class infrastructure.
As of Claude Code v2.1.108+, the plugin system has matured significantly:
anthropics/claude-plugins-official(curated) andclaude-community(reviewed submissions). Install syntax:/plugin install {name}@claude-plugins-official``.claude-code-action@v1acceptsplugins:input natively. Workflows can now declare plugin dependencies in YAML — plugins are installed into the runner before the agent runs. This is a meaningful new distribution channel: a user who runsclaude-code-actioncan pull this plugin in with a one-line YAML addition, without a separate/plugin installstep.blockedMarketplacesconfig added — teams can prevent unauthorized marketplace sources. This also means approved marketplace listing becomes a trust signal, not just discovery.Direct action item: Issue #63 — the awesome-claude-code submission form values — has been ready since April 21 and became eligible April 26. It is now 4 weeks overdue. This is the highest-leverage external visibility action available and costs about 10 minutes.
gh-awUpstream ActivityVery active release pace; OAuth support still unresolved.
gh-awreleased v0.75.4 on May 24 (yesterday). The project is releasing 1–2 patch versions per day this week. Notable recent changes:create-check-runsafe output type added,gh aw upgradenow updates source.mdfilesIssue #16498 (native
CLAUDE_CODE_OAUTH_TOKENsupport): Still open, still explicitly "not supported" per gh-aw maintainers. The FAQ directs Claude users toANTHROPIC_API_KEY. No implementation is planned. The two-passsedtweak inskills/install-workflow/auth.md:52–62remains necessary and correct.No breaking auth changes in v0.74.x–0.75.x that affect this plugin's approach. The current pinned version in
.github/aw/actions-lock.json(v0.68.3) is well behind current; worth checking if upgrading is warranted.New
githubnext/agenticscatalog entries: Research did not surface specific new catalog workflow additions this week. The catalog at the SHA pinned in.github/aw/actions-lock.jsonremains the reference for/discover-workflows.Competitive Landscape
claude-code-action@v1is the most proximate competitor; no direct gh-aw fork threat.anthropics/claude-code-action@v1(GA with breaking changes from beta):direct_prompt→prompt,moderemoved, all config moved intoclaude_argspassthrough. Now supportsplugins:andplugin_marketplaces:inputs. This is both a competitor (raw PR-comment triggering) and a distribution channel (plugin-native installation).gh-awadding OAuth support found. The ecosystem has converged on API keys or OIDC; the OAuth angle is a dead end upstream.Differentiation holding: The plugin's moat is in the gh-aw integration layer (catalog-driven discovery, atomic installs, auth decision tree) and the agent-team multi-workflow pattern — not raw PR-commenting, which
claude-code-actionhandles natively. This distinction should be sharper in the README.Subscription-Backed CI Signals
Community has adapted; one near-term policy change to watch.
The April 4 enforcement produced significant community reaction (a 2,238-upvote r/ClaudeAI thread, cancellations). The community has since moved to adaptation — migrating to API keys or alternative providers for third-party tools. The discourse has quieted.
What still works in CI (unambiguous as of today): Running the official Claude Code binary on a remote server or GitHub Actions runner is within ToS. Restriction is binary-identity-level. This plugin's use case is explicitly compliant.
June 15, 2026 watch: If Anthropic separates Agent SDK credits from general subscriber allocation, the cost model for subscription-backed CI changes. A user currently gets effectively unlimited headless runs on their Pro subscription; a fixed monthly pool would change the economics. This would be the most significant policy risk since the Feb 2026 ToS update. No defensive action needed now, but the plugin should be ready to update the auth cost framing in
auth.mdif the change lands as described.Strategic Suggestions
1. File the awesome-claude-code submission this week (issue #63)
The submission form values have been ready for 4 weeks. A listing in a 44.8k-star curated collection is the single highest-leverage organic discovery action available at this stage. The form is web-UI only; the pre-submission checklist is already complete per the issue. Close issue #63 after filing.
2. Submit to
anthropics/claude-plugins-officialand test theplugins:distribution pathclaude-code-action@v1now accepts aplugins:input that installs plugins into the runner before the agent runs. This means any user runningclaude-code-actioncan get this plugin with a one-line YAML addition — no separate install step. Submitting to the official registry converts everyclaude-code-actionuser into a potential one-line adopter. The submission process (PR toanthropics/claude-plugins-official) is the first step. Test theplugins:input path on the playground to verify the install-from-runner flow works correctly.3. Add a June 15 monitoring flag to the roadmap
The incoming Agent SDK credit pool change is the only near-term policy risk to the plugin's subscription wedge. Add a calendar note or issue to check Anthropic's changelog on/around June 15 and update
auth.mdif the change affects headless run cost accounting. If the credit pool is sufficiently generous, no user impact; if it's restrictive, the API-key path inauth.mdneeds to move from "fallback" to co-primary recommendation.Enjoyable Anecdote
Garry Tan, president of Y Combinator, published his entire Claude Code setup as a public GitHub repo (
garrytan/gstack). This apparently happened organically — someone spotted his dotfiles mention of Claude Code and he just... made it public. The repo has attracted significant attention because it validates the "serious practitioner using this as primary dev tooling" framing that every plugin in this ecosystem is implicitly riding. The fact that a YC president's personal workflow stack is now a GitHub repo that anyone can fork — and that it's structurally similar to whatgithub-agent-runnerenables — is a decent signal that the plugin format has found genuine traction beyond hobbyist territory.Research methodology — queries, commands, and tools used
Web searches performed (via research subagent):
Anthropic Claude Code OAuth token CI policy 2026Anthropic ToS subscription third-party tools ban 2026Claude Code plugin marketplace v2.1 2026anthropics/claude-plugins-official registryhesreallyhim/awesome-claude-code recent issues May 2026gh-aw releases v0.75 May 2026github/gh-aw CLAUDE_CODE_OAUTH_TOKEN issue 16498githubnext/agentics catalog new workflows May 2026zircote/aw-author updates 2026anthropics/claude-code-action v1.0 releases May 2026Harness.io Worker Agents CI agentic 2026OpenHarness HKUDS agentic CIOIDC workload identity federation Anthropic GitHub Actions 2026Claude subscription CI reddit r/ClaudeAI 2026Anthropic agent SDK credit pool June 2026Anthropic careers Claude Code systems engineer 2026garrytan gstack Claude Code setupsolo founder Claude Code plugin portfolio 2026arXiv 2605.18747 code agent harnessGitHub MCP tools used:
mcp__github__list_issues— verkyyi/github-agent-runner (open issues, perPage=30)mcp__github__list_commits— verkyyi/github-agent-runner (perPage=10)Bash / Grep commands on local repo:
Grep pattern=CLAUDE_CODE_OAUTH_TOKEN path=skills/install-workflow/auth.md output_mode=content— verified OAuth token usage and two-pass sed tweak (lines 9, 16, 47, 57–62, 64, 70, 79)Grep pattern=dispatch-workflow|create-agent-task path=catalog/agent-team output_mode=count— confirmeddispatch-workflowused (8 occurrences);create-agent-tasknot present (prior research run hallucinated this identifier)Codebase exploration:
Beta Was this translation helpful? Give feedback.
All reactions