Pin figma plugin to an immutable ref (v2.2.96-figquery.1)

[gjethwani-figma]

What changed

Updates the already-listed figma entry in plugins/external.json:

• adds source.ref: "v2.2.96-figquery.1", an annotated tag in figma/mcp-server-guide
• updates version from 1.0.0 to 2.2.96, matching .github/plugin/plugin.json on that tag

.github/plugin/marketplace.json is regenerated via node ./eng/generate-marketplace.mjs.

Why

The entry had no ref, so it tracked the repository's default branch and installs were not reproducible. eng/external-plugin-validation.mjs warns on marketplace entries whose source omits an immutable ref/sha locator; pinning the tag clears that warning.

The listed version had been 1.0.0 since the entry was added in #1143 while the plugin itself moved to 2.2.96. Because runVersionMatchGate returns not_run when neither source.ref nor source.sha is present, that drift was never visible to CI. Pinning the ref makes the gate runnable, so the version is corrected here in the same change.

Notes for reviewers

• The tag is annotated and points at a commit already on the repository, so the ref is immutable.
• Validation was run locally against the edited entry with the marketplace policy: no errors, no warnings.
• The plugin repository is public: https://github.com/figma/mcp-server-guide
• vally lint reports 95 findings against this plugin's skills: 94 outside-skill-dir references and 1 file-length violation. The file-length finding and 91 of the reference findings are present verbatim on the currently-served default branch. They surface now only because the quality gate first becomes runnable once a ref exists. Eight reference findings are new at this ref and four present on the default branch are gone, a net change of +3. Four of the eight involve references/fig-builder.md, a file this ref adds: three point at it and one comes from it. One is a genuine dead link: figma-generate-design/SKILL.md points to ../figma-implement-design/SKILL.md, which does not exist.

🤖 Generated with Claude Code

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🛑 External plugin PR checks failed (submitter fixes required)

• Changed entries detected: 1
• Workflow state label: requires-submitter-fixes
• Status legend: ✅ pass · ⚠️ warning · 🛑 fail

Per-plugin quality summary

Plugin	spec compliance (non-blocking)	vally lint	install smoke test	version match	ref/sha consistency	canvas structure	overall	source tree
figma	⚠️ warning	🛑 fail	✅ pass	✅ pass	⚪ not_run	⚪ not_run	🛑 fail	v2.2.96-figquery.1

Gate output details

figma - spec compliance (⚠️ warning)

Agent Plugins v1.0.0 manifest warnings:
- manifest location is ".github/plugin/plugin.json"; expected "plugin.json" at plugin root
- $schema should be "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json"
- schema validation: manifest must have required property '$schema'

figma - vally lint (🛑 fail)

❌ figma-code-connect (1/2 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ File length (529 lines) exceeds limit (500).
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
❌ figma-create-new-file (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 1 invalid file reference(s): ../figma-use-slides/references/slide-grid.md (outside-skill-dir) at line 80.
❌ figma-design-to-code (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 1 invalid file reference(s): ../figma-generate-design/SKILL.md (outside-skill-dir) at line 9.
❌ figma-generate-design (1/2 checks passed, 1 failed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✗ [valid-refs] 1 of 1 skill(s) have invalid file references.
        ✗ valid-refs: Found 18 invalid file reference(s): ../figma-use/SKILL.md (outside-skill-dir) at line 11, ../figma-implement-design/SKILL.md (outside-skill-dir) at line 18, ../figma-use/SKILL.md (outside-skill-dir) at line 19, ../figma-code-connect/SKILL.md (outside-skill-dir) at line 20, ../figma-use/references/variable-patterns.md (outside-skill-dir) at line 172, ../figma-use/references/text-style-patterns.md (outside-skill-dir) at line 199, ../figma-use/references/effect-style-patterns.md (outside-skill-dir) at line 199, ../figma-use/references/fig-builder.md (outside-skill-dir) at line 203, ../figma-use/references/component-patterns.m
...output truncated...

figma - install smoke test (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-T9GnSv/copilot-home/.copilot/installed-plugins/external-plugin-intake/figma/.github/plugin/plugin.json.

figma - version match (pass)

- v2.2.96-figquery.1: matched version "2.2.96" at ".github/plugin/plugin.json".

figma - ref/sha consistency (not_run)

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

figma - canvas structure (not_run)

Canvas structure gate skipped because plugin is not tagged with "canvas".

- figma: spec=warning, vally-lint=fail, install-smoke=pass, version-match=pass, ref-sha-consistency=not_run, canvas-structure=not_run, overall=fail

[aaronpowell]

Thanks for adding the ref pin.

You may have noticed that there was an error with Vally linting the skills in the plugin. While it is true that the reason for the failures are valid in many scenarios they aren't overly critical here IMO. When creating a skill, they shouldn't reference files that are outside the rooted path of the SKILL.md file itself, so when it does ../<some other skill>/references/... it is a validation error. This is because if the skill was installed in isolation (gh skills install ...) the skill could fail because it can't find files it needs.

Since this is shipping as a plugin though, it's not really of concern.