Publish the GitHub Action to the Marketplace and list it

Model the GitHub Actions channel as a push channel so it surfaces in the
"Available on" strip on mdsmith.dev (the strip filters to mechanism: push)
alongside the install picker and table:

- Switch the channel to mechanism: push with registry github.com/marketplace,
  credential GITHUB_TOKEN, job release, and a Marketplace channel URL; drop
  unlisted and the install-table glob exclusion. The release job drafts a
  release that carries action.yml; publishing it adds/updates the Marketplace
  listing (one-time Developer Agreement acceptance required).
- Name the action "mdsmith" for a clean Marketplace slug.
- Add a marketplace-major-tag workflow that, on release publish, moves the
  major-version tag (v0) onto the release so uses: jeduden/mdsmith@v0 tracks
  the latest 0.x build. It pushes via a masked http.extraheader with
  persist-credentials: false, matching the benchmark-publish pattern.

Regenerate channels.yaml and the catalogs; tighten one line of release.md
prose so its push-channels table stays within the file-length budget.

https://claude.ai/code/session_01TKgJTS4UcFPqtdwkxYzTUC

Author: claude

.github/copilot-instructions.md

@@ -54,7 +54,7 @@ row: "- [{summary}](../{filename})"
 - [Rebase, CI monitoring, and review comment resolution.](../docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](../docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](../docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture, puts `mdsmith` on `PATH`, and runs the command in its `args` input; referenced as `uses: jeduden/mdsmith@<commit-sha>`.](../docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](../docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](../docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](../docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](../docs/development/release-channels/homebrew.md)

.github/workflows/marketplace-major-tag.yml

@@ -0,0 +1,48 @@
+name: Marketplace major tag
+
+# When a release is published, move the major-version tag (e.g. v0) onto it,
+# so `uses: jeduden/mdsmith@v0` tracks the latest published release — the
+# convenience ref the GitHub Marketplace listing advertises. Pinning to a
+# commit SHA or a full release tag stays the hardened option; see
+# docs/development/release-channels/github-actions.md.
+#
+# The release workflow drafts the release; a maintainer publishes it, and that
+# manual publish (not a GITHUB_TOKEN action) is what fires this event.
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  major-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Never persist the token in git config; the push below
+          # authenticates via a masked http.extraheader instead.
+          persist-credentials: false
+
+      - name: Move the major-version tag onto the published release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          # v0.41.0 -> v0; the major tag floats across the 0.x series.
+          major="${TAG%%.*}"
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -f "$major"
+
+          # The push authenticates via a masked http.extraheader (checkout
+          # ran with persist-credentials: false).
+          auth_header=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          echo "::add-mask::$auth_header"
+          git -c http.extraheader="AUTHORIZATION: basic $auth_header" \
+            push -f origin "refs/tags/$major"

AGENTS.md

@@ -60,7 +60,7 @@ row: "- [{summary}]({filename})"
 - [Rebase, CI monitoring, and review comment resolution.](docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture, puts `mdsmith` on `PATH`, and runs the command in its `args` input; referenced as `uses: jeduden/mdsmith@<commit-sha>`.](docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](docs/development/release-channels/homebrew.md)

CLAUDE.md

@@ -46,7 +46,7 @@ row: "- [{summary}]({filename})"
 - [Rebase, CI monitoring, and review comment resolution.](docs/development/pr-fixup-workflow.md)
 - [The `jeduden/asdf-mdsmith` plugin installs the checksum-verified prebuilt binary; the short form awaits the asdf-plugins registry entry.](docs/development/release-channels/asdf.md)
 - [A single-file `.flatpak` bundle built in CI from the x86_64 Linux release binary and attached to each GitHub release, installed by file with host filesystem access for the linter.](docs/development/release-channels/flatpak.md)
-- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture, puts `mdsmith` on `PATH`, and runs the command in its `args` input; referenced as `uses: jeduden/mdsmith@<commit-sha>`.](docs/development/release-channels/github-actions.md)
+- [A composite action at the repository root downloads the checksum-verified release binary for the runner's OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.](docs/development/release-channels/github-actions.md)
 - [Per-platform mdsmith binaries plus the .vsix, the checksum file, and a Sigstore signature, attached to a tag-named release.](docs/development/release-channels/github-releases.md)
 - [`go install` compiles mdsmith from the tagged module source with the host Go 1.25+ toolchain; no prebuilt binary is downloaded.](docs/development/release-channels/go.md)
 - [The `jeduden/homebrew-mdsmith` tap installs the checksum-verified prebuilt binary for macOS or Linux on Intel or arm64.](docs/development/release-channels/homebrew.md)

action.yml

@@ -1,4 +1,4 @@
-name: mdsmith Markdown linter
+name: mdsmith
 description: >-
   Install the mdsmith Markdown linter from a checksum-verified GitHub release
   binary for the runner's OS and architecture, put it on PATH, and optionally

docs/development/release-channels/github-actions.md

@@ -3,21 +3,23 @@ title: GitHub Actions
 summary: >-
   A composite action at the repository root downloads the
   checksum-verified release binary for the runner's OS and
-  architecture, puts `mdsmith` on `PATH`, and runs the
-  command in its `args` input; referenced as
-  `uses: jeduden/mdsmith@<commit-sha>`.
-mechanism: pull
+  architecture and puts `mdsmith` on `PATH`; published to
+  the GitHub Marketplace and referenced as
+  `uses: jeduden/mdsmith@v0`.
+mechanism: push
 artifact: cli
 command: "uses: jeduden/mdsmith@v0"
 audience: Linting Markdown inside GitHub Actions CI
 platforms: [linux, macos, windows]
-channelurl: https://github.com/jeduden/mdsmith
+registry: github.com/marketplace
+credential: GITHUB_TOKEN
+job: release
+channelurl: https://github.com/marketplace/actions/mdsmith
 weight: 15
-unlisted: true
 ---
 # GitHub Actions
 
-Release page: <https://github.com/jeduden/mdsmith>
+Release page: <https://github.com/marketplace/actions/mdsmith>
 
 The repository root carries an `action.yml`, so a workflow
 step runs mdsmith with:
@@ -64,20 +66,23 @@ against the release `checksums.txt`. So the action and the
 binary it fetches are both pinned by digest, not by a
 movable name.
 
-No released commit carries the action yet. Pin to a commit
-SHA from this branch, or from `main` once it merges, to use
-it today. After the next release, pin to that release's
-commit. The convenience tag `@v0` comes later: it must be
-created and moved onto a release that ships `action.yml`.
+The action publishes to the GitHub Marketplace through a
+release. The `release` job drafts a release at the tagged
+commit, which carries this `action.yml`. Publishing that
+draft adds or updates the Marketplace listing.
+
+The first listing is a manual, one-time step. The
+maintainer accepts the Marketplace Developer Agreement and
+enables it on a release. A unique action `name` and
+`branding` are required; `action.yml` sets both.
+
+A `marketplace-major-tag` workflow runs on each published
+release. It moves the `@v0` major tag onto that release, so
+`uses: jeduden/mdsmith@v0` tracks the latest 0.x build. The
+first release that ships this `action.yml` makes the listing
+and `@v0` resolve. Until then, pin to a commit SHA on
+`main`.
 
 You can also skip the action entirely. Run the release
 binary in a `run:` step. That repeats by hand the download
 and verify steps the action automates.
-
-Because no published tag installs the action yet, this
-channel sets `unlisted: true` in its frontmatter, so
-`sync-channels` keeps it out of the website install picker
-and the install-guide table excludes it by glob. The
-`action.yml` and this doc stay; only the user-facing
-listings wait for a release to carry the action. Drop both
-once `uses: jeduden/mdsmith@v0` resolves.

docs/development/release.md

@@ -12,12 +12,11 @@ summary: >-
 ---
 # Release Pipeline
 
-`.github/workflows/release.yml` publishes mdsmith to
-every channel below. Release-time secrets travel as
-short-lived OIDC tokens. The remaining long-lived
-PATs are gated by the `release` GitHub environment.
-Each channel has its own file under
-`release-channels/`; the catalog re-renders on
+`.github/workflows/release.yml` publishes mdsmith to every
+channel below. Release-time secrets travel as short-lived
+OIDC tokens. The remaining long-lived PATs are gated by the
+`release` GitHub environment. Each channel has its own file
+under `release-channels/`; the catalog re-renders on
 `mdsmith fix`.
 
 <?catalog
@@ -32,6 +31,7 @@ row: "| [{title}]({filename}) | <{channelurl}> | {credential} |"
 | Channel                                                                    | Release page                                                          | Credential              |
 | -------------------------------------------------------------------------- | --------------------------------------------------------------------- | ----------------------- |
 | [Flatpak](release-channels/flatpak.md)                                     | <https://github.com/jeduden/mdsmith/releases>                         | GITHUB_TOKEN + OIDC     |
+| [GitHub Actions](release-channels/github-actions.md)                       | <https://github.com/marketplace/actions/mdsmith>                      | GITHUB_TOKEN            |
 | [GitHub Releases](release-channels/github-releases.md)                     | <https://github.com/jeduden/mdsmith/releases>                         | GITHUB_TOKEN + OIDC     |
 | [npm](release-channels/npm.md)                                             | <https://www.npmjs.com/package/@mdsmith/cli>                          | OIDC Trusted Publishing |
 | [Obsidian](release-channels/obsidian.md)                                   | <https://github.com/jeduden/mdsmith/releases>                         | GITHUB_TOKEN + OIDC     |

docs/guides/install.md

@@ -43,7 +43,6 @@ glob:
   - "../development/release-channels/*.md"
   - "!../development/release-channels/proto.md"
   - "!../development/release-channels/winget.md"
-  - "!../development/release-channels/github-actions.md"
 where: 'artifact: "cli"'
 sort: numeric:weight
 header: |
@@ -65,6 +64,7 @@ row: "| {title} | `{command}` | {audience} |"
 | GitHub Releases | `curl -LO https://github.com/jeduden/mdsmith/releases/latest/download/mdsmith-<os>-<arch>`                                                | Air-gapped hosts and direct binary control        |
 | Scoop           | `scoop install mdsmith`                                                                                                                   | Windows users with Scoop installed                |
 | Flatpak         | `curl -LO https://github.com/jeduden/mdsmith/releases/latest/download/mdsmith-x86_64.flatpak && flatpak install ./mdsmith-x86_64.flatpak` | Sandboxed Linux x86_64 desktops via Flatpak       |
+| GitHub Actions  | `uses: jeduden/mdsmith@v0`                                                                                                                | Linting Markdown inside GitHub Actions CI         |
 <?/catalog?>
 
 A bare `mise use mdsmith@latest` needs a registry entry —

website/data/channels.yaml

@@ -174,3 +174,15 @@
     - editor
   url: https://github.com/jeduden/mdsmith/releases
   weight: 14
+- title: GitHub Actions
+  summary: 'A composite action at the repository root downloads the checksum-verified release binary for the runner''s OS and architecture and puts `mdsmith` on `PATH`; published to the GitHub Marketplace and referenced as `uses: jeduden/mdsmith@v0`.'
+  mechanism: push
+  artifact: cli
+  command: 'uses: jeduden/mdsmith@v0'
+  audience: Linting Markdown inside GitHub Actions CI
+  platforms:
+    - linux
+    - macos
+    - windows
+  url: https://github.com/marketplace/actions/mdsmith
+  weight: 15