feat(distribution): sync the github-actions-conventions vocabulary to claude-code-plugins

[kyle-sexton]

No related issue: Phase 2 of the pr-pipeline config-reader plan in claude-code-plugins; no tracker item exists for it.

Hold: a human merges this.

Summary

claude-code-plugins is building resolve-config, the pr-pipeline config reader. It checks lane and activity names against components/github-actions-conventions/vocabulary.json, read from the base SHA. This PR makes the vocabulary and its schema managed files in claude-code-plugins at .github/standards/github-actions-conventions/.

Fix

• distribution/sync-manifest.yml: a new github-actions-conventions component (vocabulary.json, vocabulary.schema.json), added only to claude-code-plugins' managed list, next to trusted-actors.
• components/managed-files-guard/managed-files-guard.yml and -fleet.yml: both destination paths added to the paths: trigger, so the guard catches hand edits to the synced files, as it does for trusted-actors.

Verification

• bash harness/shell/run-tests.sh components/managed-files-guard/managed-files-guard.test.sh distribution/sync-manifest.test.sh: 2 passed, 0 failed.
• bash distribution/sync-manifest.sh validate: "Manifest valid: 41 components, 13 targets".
• Pre-commit (editorconfig, typos, gitleaks) passed.

Related

• The CI/CD Conventions session was consulted before this PR. The destination path is confirmed, no relocation is planned, and run-activity gets no runner-policy contract until it is promoted to ci-workflows.
• Consumer: the claude-code-plugins pr-pipeline config reader, which opens in a separate draft PR.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T16:17:20.856490Z	63edccf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 53s —— View job

---

Security review — /review:security-review

• Gather context (PR diff, changed files)
• Apply skip gate
• Report result

Skip gate: no security-relevant surface.

This PR only wires an already-existing component into the distribution/guard tooling:

• distribution/sync-manifest.yml — adds a github-actions-conventions entry mapping two existing, already-checked-in files (components/github-actions-conventions/vocabulary.json, vocabulary.schema.json) to a destination path, and adds that component to claude-code-plugins' managed list.
• components/managed-files-guard/managed-files-guard.yml and managed-files-guard-fleet.yml — add the two new destination paths to the existing paths: trigger list, so hand-edits to the synced files get caught, same as every other managed component.

No new code path, no secrets/token handling, no injection surface (command/SQL/path/template), and no authorization or trust-boundary change. The change is purely additive to data files (manifest mapping + trigger-path lists) and strengthens guard coverage rather than weakening it — not a case of removing or softening a standing instruction, so the instruction-surface-deletion lens doesn't apply either.

I inspected the referenced vocabulary.json directly: it's inert naming-convention metadata (stage/function/verb lists), no secrets or executable content.

No security issues found.

[claude]

Claude finished @kyle-sexton's task in 2m 27s —— View job

---

Code review complete

• Gather context (PR diff, files)
• Review distribution/sync-manifest.yml
• Review components/managed-files-guard/managed-files-guard.yml and -fleet.yml
• Post findings

No findings. This is a narrow, mechanical config change and it's internally consistent:

• distribution/sync-manifest.yml: the new github-actions-conventions component (vocabulary.json, vocabulary.schema.json) is alphabetically placed, follows the exact shape of the adjacent trusted-actors component, and is added only to melodic-software/claude-code-plugins's managed list (alphabetically inserted there too) — matching the PR's description.
• Both managed-files-guard.yml and managed-files-guard-fleet.yml get the same two new paths: entries, in the same sorted position, keeping the two files identical apart from their documented runs-on/name differences.
• The source files (components/github-actions-conventions/vocabulary.json + .schema.json) already exist and are an already-admitted, documented component (components/github-actions-conventions/README.md); this PR only adds a new sync destination for two of its files, so docs/component-lifecycle.md#admission-evidence (new-component admission) doesn't apply here — consumer/destination lists correctly stay in sync-manifest.yml per that doc rather than being duplicated into the README.
• components/managed-files-guard/managed-files-guard.test.sh asserts the paths: trigger equals the sorted union of every target's dest-paths output from the manifest — exactly the contract this PR's two files must satisfy, and the new entries line up with that union given where the component was inserted.
• PR body satisfies .claude/rules/pr-body-contract.md: opens with No related issue: <reason>, and carries non-empty ## Summary, ## Fix, ## Verification, ## Related sections.

I wasn't able to execute bash distribution/sync-manifest.sh validate or the test suite myself in this sandbox (shell commands beyond basic read-only ones require interactive approval that isn't available here), so the PR's own "2 passed, 0 failed" / "Manifest valid" verification claims are author-reported and unverified by me — my review above is based on static inspection of the manifest, the guard files, and the test contract they must satisfy.