[jjoanna2-debug]

Closes #862

Summary

Add an opt-in Codex marketplace entry and plugin containing the existing project icon, LinkedIn workflow skill, and MCP command pinned to release 4.23.3. Keep plugin and MCP enablement independent. The release workflow updates and checks both version fields together.

The skill requires explicit authorization for messages and connection requests. Installing the plugin does not sign in; actual LinkedIn reads or login can still start the managed browser.

Verification

• 9 plugin contract and malformed-candidate tests passed.
• Ruff, formatting, ty, and all pre-commit hooks passed.
• The packaged 4.23.3 command initialized and listed all 19 tools with an unchanged browser-process snapshot.
• The actual release step advanced both plugin fields to 9.8.7 in a temporary fixture.
• Merged current upstream main 13734bab without rewriting the original contribution. CI, attribution, Greptile, and Socket checks all pass at 12dda1c.

The separate host-dependent test failures and their test-only fix remain scoped to #864 and #865; they are not plugin regressions. No live LinkedIn data or write operation was used in this verification.

Synthetic prompt

Package the released LinkedIn MCP server as an opt-in Codex plugin with its existing icon, workflow skill, exact MCP version pin, independent enablement, release-version synchronization, and tests for those contracts. Preserve explicit write authorization and document browser startup accurately.

Reviewed and updated with GPT-6 Astra Ultra.

[greptile-apps]

Greptile Summary

The PR adds an opt-in Codex marketplace plugin for the existing LinkedIn MCP server and keeps its runtime package pin synchronized with releases.

• Adds the marketplace entry, plugin manifest, pinned MCP configuration, icon, and LinkedIn workflow skill.
• Documents independent plugin and MCP enablement, browser startup behavior, and explicit authorization requirements for writes.
• Extends release automation and contract tests to update and validate both plugin version fields.
• Clarifies that profile-based message sending may create a separate conversation rather than reply to an existing thread.

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule violations identified.

The plugin remains opt-in, its MCP runtime is exactly version-pinned, release automation updates and validates both version fields, and the workflow and documentation changes do not introduce a concrete failure.

Important Files Changed

Filename	Overview
.agents/plugins/marketplace.json	Defines the locally sourced marketplace plugin as available rather than automatically enabled.
plugins/linkedin-mcp-server/.codex-plugin/plugin.json	Defines plugin metadata, UI assets, bundled skills, and the MCP configuration reference.
plugins/linkedin-mcp-server/.mcp.json	Configures the LinkedIn MCP server through uvx with an exact release-version pin.
plugins/linkedin-mcp-server/skills/linkedin-mcp/SKILL.md	Provides scoped LinkedIn workflow guidance with explicit authorization requirements for write actions.
.github/workflows/release.yml	Synchronizes and verifies the plugin manifest and MCP package versions during releases.
tests/test_codex_plugin.py	Adds contract tests for opt-in behavior, version synchronization, assets, write safeguards, and malformed configurations.
.github/workflows/check-attribution.yml	Runs attribution validation for bot-opened pull requests as well as human-opened pull requests.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    U[User adds marketplace] --> P[Installs opt-in Codex plugin]
    P --> S[LinkedIn workflow skill]
    P --> M[Pinned MCP configuration]
    M --> X[uvx mcp-server-linkedin@version]
    R[Release workflow] --> V[Update plugin manifest version]
    R --> X2[Update MCP package pin]
    V --> C[Cross-file version verification]
    X2 --> C
    C --> G[Commit synchronized release files]

Loading

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into feature/862-cod..." | Re-trigger Greptile}

[jjoanna2-debug]

@stickerdaniel, refreshed against main (13734bab) at 12dda1c. CI and the fresh Greptile review pass; the packaged command still exposes all 19 tools without starting a browser. Could you review this version?

[stickerdaniel]

Thanks for the pr!