webgrip/claude-config

⚠ Superseded for opencode (2026-07-13). The team's standard agent is now opencode; the org estate (guidelines, guard-secrets, renovate-trigger, permission profiles, bootstrap) lives in webgrip/webgrip-ai-skills — see its docs/onboarding-opencode.md. This marketplace remains functional for anyone still on Claude Code during the transition and is otherwise frozen (no new features here; org-guidelines is maintained in webgrip-ai-skills/org/ and should be considered authoritative there).

Shared Claude Code configuration for the webgrip GitHub org, distributed as a plugin marketplace. One source of truth for the org baseline; repo-specific skills/agents/hooks stay in their own repos.

What's in the webgrip plugin

Component	What it does
org-guidelines.md	Org operating principles (GitOps-first, secrets-need-a-human, trunk-based, mise, Renovate). Injected into context at session start via a SessionStart hook — this is the org-wide "general CLAUDE.md".
hooks/guard-secrets.sh	PreToolUse (Edit/Write) — blocks decrypted artifacts, plaintext in *.sops.yaml, and (best-effort) plaintext secrets via gitleaks.
agents/renovate-trigger.md	Subagent that forces a full Renovate run across all discovered projects via the in-cluster renovate-operator.

Use it in a repo

Add to the repo's .claude/settings.json so it auto-enables on trust (no manual install):

{
  "extraKnownMarketplaces": {
    "webgrip": { "source": { "source": "github", "repo": "webgrip/claude-config" } }
  },
  "enabledPlugins": { "webgrip@webgrip": true }
}

Or interactively: /plugin marketplace add webgrip/claude-config then /plugin install webgrip@webgrip.

Layout

.claude-plugin/marketplace.json     # marketplace manifest
plugins/webgrip/
  .claude-plugin/plugin.json        # plugin manifest
  org-guidelines.md                 # injected at SessionStart
  hooks/{hooks.json,guard-secrets.sh}
  agents/renovate-trigger.md
  skills/                           # add org-generic skills here

Adding to the plugin

• Org-generic task recipe → plugins/webgrip/skills/<name>/SKILL.md.
• Repo-specific (e.g. this cluster's add-app, talos, cnpg-database) → keep it in that repo's .claude/skills/.
• Bump version in plugin.json on meaningful changes (or omit it for commit-SHA versioning).