The marketplace has two channels. The alpha one is fully automated. The stable
one has a version and a source.ref that must move
together on a GA release, and nothing writes the ref — it has
only ever moved by hand.
Four writers touch marketplace.json. None of them touches the stable pin's ref.
| writer | writes | stable ref? |
|---|---|---|
| release-please extra-files | $.plugins[1].version | no — alpha only, by index |
| stamp-counts sync_versions() | the entry whose ref == "main" | no — selects alpha by ref |
| stamp_marketplace_json() | descriptions | no |
| build-plugins Phase 9 | manifest sync | no |
The alpha entry is selected by ref (.source.ref == "main")
rather than by name — deliberately, after an incident where a name-selected
stamp clobbered the pinned entry. That care is exactly why the stable entry
ended up with no writer at all.
scripts/stamp-counts.sh runs on EVERY build
its own comment block documents the incident
where a build-time stamp clobbered the pin
wrong home
.github/workflows/release.yml
tag-triggered (on: push: tags: v*)
release-bot token already minted
version already extracted
right home — fires once, on a real release
Guarded by semver_is_prerelease(), which already exists and is
already used by release-announce.yml. The stable pin must move on
a GA tag and stay still for every -alpha.N, which is most of them.
A test that cannot fail is not evidence. Desync the pin and run it.
baseline version=9.8.0 ref=v9.8.0 14 passed, 0 failed desync version=9.9.0 ref=v9.8.0 exit 1 ✗ 'ork' version '9.9.0' does not match its pin 'v9.8.0' (expected ref v9.9.0) 13 passed, 1 failed restore version=9.8.0 ref=v9.8.0 14 passed, 0 failed marketplace.json byte-identical
$.plugins[0].version — the stable entry — is not a
governed jsonpath. Only $.plugins[1].version is. And the File
Guard exempts bot authors, which the release workflow already is. So a
bot-authored stable bump is clear on both counts. Verified against
release-please-guard.yml:57-62 and :132-151 rather
than assumed.