[github-actions]

Closes #1602. Submitted by @ajma.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1602.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[paseo-bot]

Merge celebration is approved, @ajma. I migrated the existing listing to your npm release, preserved its registry ID and original publication date, and removed the old description and screenshot overrides so your packaged description, overview and image control the listing. Nothing is required from you now.

Optional next release: update the “Celebrate merged work” setting hint, which still says celebration happens when a workspace is archived. The new merge-triggered behavior lets users choose archival afterward.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67; trusted registry main 2c35d336a24f3cd197c708a2189db9616990755a. Completed PR head 21dc5233d357a355edf53c990340ed1211361bcd, replacing intake head fb0b03b13801cd7d2938c8f2b6d45d3fff63dcaf. Read the PR, submission issue #1602 and accepted original submission #530/#531. Both submission issues belong to GitHub account ID 136692 (ajma); current listing attribution and npm repository metadata agree. No npm provenance attestation is supplied; provenance is optional.
• Artifact: @ajma/paseo-merge-celebration@0.1.0, downloaded from https://registry.npmjs.org/@ajma/paseo-merge-celebration/-/paseo-merge-celebration-0.1.0.tgz. Computed SHA-512 matches npm metadata and the record: sha512-llASZ3R/1K7SBj3z+q7Igkx0vfN9N7A92HURO3Z52ga8nJhot4IlcWlrxAoK23W66WfCkWJGtDUZcIkzU1OkAw==. Checked all 24 tarball paths before confined extraction, with regular files only. Independently fetched the old approved Git commit 85b5039bf43699e4ee831f2c7282569b2f0b373b, without hooks/submodules, checked its archive paths and compared both artifacts. Inspected the complete shipped runtime source, manifest, package metadata, README, English overview and screenshot. Both entries and imported local files are present. No translations shipped.
• Installation: no production dependencies, manifest preparation/build commands, install lifecycle hooks or runtime software downloads. Runtime external imports are host libraries (@getpaseo/plugin, React, React Native and Zod). Development scripts are not installation steps and were not executed. A production dependency lock is not needed for this artifact.
• Access and execution: server/contribute.ts:29–65,68–106 watches workspace status, suppresses initial merged history and verifies subsequent merge events. server/github.ts:7–15,29–60,93–173 uses argument-array execFile calls for read-only Git queries and GitHub CLI PR/issue reads, with a timeout and bounded output. Repository names derive from GitHub-shaped URLs; the local branch commit must match the merged PR head. The CLI inherits existing authentication/environment, sends repository/PR/issue identifiers to GitHub and returns titles and up to three plain-text issue excerpts to connected Paseo clients. No direct credential-file access, unrelated transmission, shell interpolation, eval or remote code execution was found.
• Compared with the old artifact, celebration now follows verified merge detection rather than requiring archival, adds settings and user-controlled workspace actions, and retains pending events for up to 24 hours (100 events, in memory). index.client.tsx:31–42 and client/celebration.tsx:252–325 route opening/archival through Paseo only on the corresponding button or shortcut; previews have no actionable workspace ID. Host settings are saved through the settings API. Text is rendered as text, not HTML. Native clients return before contributing UI; browser mounting, shortcut ownership, reduced motion and teardown were inspected. No plugin-owned filesystem deletion or software installation was found.
• Listing: retained ID, categories, submitter, submission date and publication date; pinned npm and removed intake. Removed obsolete Git-specific metadata overrides; the supplied overview and screenshot are used directly. The screenshot shows the celebration with sample content; PNG SHA-256 bb61587daf7c7a277c6b0c05c148feaa973183e1fff765be4f7da4a436319fc3.
• Validation: trusted main scripts match the review branch. Online changed-record validation passes (435 well-formed records, one pinned artifact matched); all 189 registry tests pass. Validate passed for this exact head: https://github.com/getpaseo/plugins/actions/runs/41116042624. The earlier workflow hold was approved. No author requirement or factory incompatibility remains. Plugin/dependency code was not installed, built, imported or run. Author-reported live tests were read as supporting evidence, not independently repeated; CLI authentication, UI behavior and host-library internals were not dynamically tested or re-audited.