From 2c5f6491465961fcf636d52dbdf5c376ffc5bb11 Mon Sep 17 00:00:00 2001
From: Kandev Agent <agent@kandev.dev>
Date: Sun, 19 Jul 2026 17:32:19 +0100
Subject: [PATCH] ci: split plugin-registry Pages deploy into its own job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The single build-and-deploy job bound the `github-pages` environment at
the job level, so GitHub evaluated that environment's protection rules on
every PR run — failing the check even though the deploy steps were gated
to non-PR events. This broke every PR touching plugin-registry/**, which
is exactly what a plugin-submission PR does.

Split into a PR-safe `build` job (no environment) and a non-PR-gated
`deploy` job that owns the `github-pages` environment and runs only
`deploy-pages`. Behavior on push/schedule/workflow_call is unchanged; PRs
now run build+tests without tripping the environment gate. The star
refresh calls this workflow by file path, so the job rename is safe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/plugin-registry-index.yml | 28 +++++++++++++++------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/plugin-registry-index.yml b/.github/workflows/plugin-registry-index.yml
index 91015a976f..0b16433cdc 100644
--- a/.github/workflows/plugin-registry-index.yml
+++ b/.github/workflows/plugin-registry-index.yml
@@ -12,8 +12,8 @@ on:
     paths:
       - "plugin-registry/**"
       - ".github/workflows/plugin-registry-index.yml"
-  # Validate registry edits before merge (build + test run; the Pages deploy
-  # steps below are gated to non-PR events, so a PR never deploys).
+  # Validate registry edits before merge (the build job runs; the separate
+  # deploy job is gated to non-PR events, so a PR never deploys to Pages).
   pull_request:
     paths:
       - "plugin-registry/**"
@@ -39,12 +39,13 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  build-and-deploy:
-    name: Build index.json and deploy to Pages
+  # Build the catalog and, on non-PR events, stage it as a Pages artifact.
+  # Kept free of the `github-pages` environment so it runs on PRs — a job that
+  # binds that environment is checked against its protection rules even when its
+  # deploy steps are skipped, which fails every PR that touches plugin-registry/.
+  build:
+    name: Build index.json
     runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -85,7 +86,18 @@ jobs:
         with:
           path: _site
 
+  # Deploy the staged artifact to GitHub Pages. Separate job so the
+  # `github-pages` environment (and its protection rules) is only ever
+  # evaluated on non-PR events.
+  deploy:
+    name: Deploy to Pages
+    if: github.event_name != 'pull_request'
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        if: github.event_name != 'pull_request'
         uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4