[External Plugin]: heygrc

[tristanroth1]

Plugin name

heygrc

Short description

GRC compliance review for your pull requests. Reviews each PR against ISO 27001, SOC 2, GDPR and the EU AI Act, grounded in your company profile. Public repos are free.

GitHub repository

better-isms/heygrc-plugin

Plugin path inside the repository

No response

Ref to review

Commit SHA to review

3b7d1b2022d686068f5e7096e278e5d2fa4107c2

Version

0.1.1

License identifier

MIT

Author name

Better ISMS

Author URL

https://heygrc.com

Homepage URL

https://heygrc.com

Keywords

heygrc, grc, compliance, iso-27001, soc-2, gdpr, github, pull-request, code-review

Additional notes for reviewers

This plugin is a setup skill (Agent Plugin / Claude Code layout). It does not review code locally and does not ship MCP. It walks the user to install the existing heyGRC GitHub App (https://github.com/apps/heygrc). Public repositories are free.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: heygrc

• Repository: https://github.com/better-isms/heygrc-plugin

• SHA: 3b7d1b2022d686068f5e7096e278e5d2fa4107c2

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	0 day(s)
Repository activity	repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 0 open issues/PRs
Homepage heuristics	⚠️ pricing

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: not_run
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ review (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-CbE2Rp/copilot-home/.copilot/installed-plugins/external-plugin-intake/heygrc/plugin.json.

Version match output

- 3b7d1b2022d686068f5e7096e278e5d2fa4107c2: matched version "0.1.1" at "plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "heygrc",
  "description": "GRC compliance review for your pull requests. Reviews each PR against ISO 27001, SOC 2, GDPR and the EU AI Act, grounded in your company profile. Public repos are free.",
  "version": "0.1.1",
  "author": {
    "name": "Better ISMS",
    "url": "https://heygrc.com"
  },
  "repository": "https://github.com/better-isms/heygrc-plugin",
  "homepage": "https://heygrc.com",
  "license": "MIT",
  "keywords": [
    "heygrc",
    "grc",
    "compliance",
    "iso-27001",
    "soc-2",
    "gdpr",
    "github",
    "pull-request",
    "code-review"
  ],
  "source": {
    "source": "github",
    "repo": "better-isms/heygrc-plugin",
    "sha": "3b7d1b2022d686068f5e7096e278e5d2fa4107c2"
  }
}

View workflow run

[tristanroth1]

/rerun-intake

Plugin lives at the repository root. Path field was the literal (root) which the intake snapshot could not resolve. Set to empty (_No response_) to match other root-plugin submissions. Author remains Better ISMS.

[tristanroth1]

/rerun-intake

Pinned SHA updated to 3b7d1b2022d686068f5e7096e278e5d2fa4107c2.
Skill frontmatter name is now review (matches directory; lowercase/hyphens). SETUP.md copied into the skill folder so refs stay inside the skill.
Author remains Better ISMS.