Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Around line 1-17: Add a regression test job that validates the workflow's
enforcement by running the same scanner action against known-good and known-bad
fixture directories and asserting expected outcomes; create a new job (e.g.,
scan-regression) that reuses the "Codex plugin scanner" step but sets plugin_dir
to a "fixtures/good" and "fixtures/bad" path in separate steps or matrix, and
for the bad fixture assert the step fails (or check exit code/output) while for
the good fixture assert success, so future edits to the "scan" job cannot
silently weaken checks.
- Around line 3-7: Add a top-level concurrency stanza to the GitHub Actions
workflow to prevent duplicate runs for the same ref/PR (use a key like
github.workflow + github.ref and cancel-in-progress: true), and update the job
configuration that currently targets only ubuntu (look for runs-on or matrix.os
in the job definition) to include a windows runner (e.g., add "windows-latest"
to the matrix or an explicit job run) so Windows path/sep edge cases are
covered; ensure the concurrency block is placed alongside the on: stanza and the
job matrix/runs-on change is applied to the CI job responsible for the
codex-plugin scan.
- Around line 9-12: Add explicit least-privilege permissions and a job timeout
to the "scan" job: in the job definition for scan, add a minimal permissions
block (e.g., only permissions: contents: read and id-token: write or whatever
minimal scopes your scanner requires) and set timeout-minutes to a sensible
value (e.g., 10-30) to prevent hung runs; update the "scan" job YAML to include
these keys adjacent to runs-on/steps so the workflow uses limited token scope
and a hard timeout.
- Around line 13-15: The workflow currently uses mutable version tags (e.g.,
actions/checkout@v4 and hashgraph-online/hol-codex-plugin-scanner-action@v1);
update each uses: entry to reference the immutable commit SHA for those actions
(replace `@vX` with @<full-commit-sha>), and apply the same change across all
workflows (ci.yml, pr-ci.yml, codeql.yml) to remove mutable tags; also add an
explicit permissions block with least-privilege scopes, add concurrency settings
(concurrency: { group: github.workflow + github.ref, cancel-in-progress: true })
to prevent duplicate runs, and include a windows runner job or matrix entry
(ubuntu + windows) so the scanner runs on windows to catch path/case issues
before merging.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Line 24: The workflow currently sets plugin_dir: "." which scans the entire
repo and pulls in unrelated files; change the plugin_dir value to
".codex-plugin/" in the codex-plugin-scanner workflow so the scanner targets the
plugin manifest location (.codex-plugin/plugin.json) and avoids repo-wide
noise—update the plugin_dir key in the job definition to ".codex-plugin/" (look
for plugin_dir in the workflow file).

---

Duplicate comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Line 15: The workflow currently only runs on "ubuntu-latest", so add a Windows
job to cover path-separator/case-sensitivity edge cases by turning the job into
a matrix or adding a parallel job that uses "windows-latest"; update the job
that currently sets "runs-on: ubuntu-latest" (the scanner/packaging job) to
either use a matrix.runs-on: [ubuntu-latest, windows-latest] or add an explicit
windows leg, and ensure any OS-specific steps (checkout, build, packaging) run
for both runners so filesystem semantics are exercised.
- Around line 13-24: Add a new GitHub Actions job named "scan-regression"
alongside the existing "scan" job that runs a small matrix over fixtures ("good"
and "bad") to validate the scanner gate; reuse the same checkout step and the
hashgraph-online/hol-codex-plugin-scanner-action invocation but set plugin_dir
to point at the fixture subfolders (e.g., plugin_dir: "fixtures/${{ matrix.case
}}"), configure matrix: [case: good,bad] and set expected outcome: allow the
good case to pass and assert the bad case fails (use continue-on-error: true and
a follow-up step to fail the job when matrix.case == 'bad' and the scanner
succeeded, or invert logic to require non-zero exit for bad), and include
timeout/permissions matching the existing "scan" job so future edits are
validated by fixture-based regression tests.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Around line 9-11: The concurrency group is currently hardcoded as
"codex-plugin-scanner-${{ github.ref }}" which can collide with other workflows;
update the concurrency group to include the workflow name (use the built-in
github.workflow value) so it becomes "${{ github.workflow }}-${{ github.ref }}"
to namespace by workflow and avoid cross-workflow cancellation (modify the
concurrency.group value in the concurrency block).
- Around line 21-25: The workflow step named "Codex plugin scanner" is pointing
plugin_dir to the repo root; update the action input plugin_dir to the actual
manifest directory ".codex-plugin" so the scanner reads
.codex-plugin/plugin.json; locate the step using the action identifier
hashgraph-online/hol-codex-plugin-scanner-action and change plugin_dir from "."
to ".codex-plugin" (leave min_score as-is) so the quality gate runs against the
correct manifest.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Around line 3-7: The workflow lacks a manual trigger so you cannot run
regression scans without committing; add a manual trigger by including
workflow_dispatch under the top-level on: (alongside push and pull_request) in
the .github/workflows/codex-plugin-scanner.yml file so maintainers can run the
scanner workflow manually for plugin manifest/regression checks.

---

Duplicate comments:
In @.github/workflows/codex-plugin-scanner.yml:
- Line 15: The workflow currently hard-codes runs-on: ubuntu-latest so Windows
path and case-sensitivity edge cases won't be exercised; change the job to use a
matrix (strategy.matrix.os) and set runs-on: ${{ matrix.os }} with at least
ubuntu-latest and windows-latest entries (and optionally macos-latest) so the
scanner runs on Windows too, and update any OS-specific step commands (e.g.,
shell settings or path separators) referenced in the job to be matrix-safe (use
Node/PowerShell cross-platform actions or conditional steps if needed).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/plugin-scanner-fixtures/bad/.codex-plugin/plugin.json:
- Around line 4-5: Remove the trailing comma after the "description" property in
the JSON manifest so the file parses as valid JSON; specifically edit the
plugin.json entry containing the "description" key to ensure the last property
before the closing brace has no comma (the trailing comma causes the parse error
at the closing brace).

In @.github/workflows/codex-plugin-scanner.yml:
- Around line 33-47: The regression workflow job scan-regression only runs on
ubuntu-latest which leaves Windows untested; update the scan-regression matrix
to include os: [ubuntu-latest, windows-latest] (or add a separate matrix axis
with key os) so the regression runs on both platforms, and ensure the job's
shell setting is compatible on Windows by setting shell: bash (or conditionally
using shell: bash on windows-latest) so path-casing and separator issues on
Windows will be exercised; modify the matrix and shell configuration for the
scan-regression job accordingly.