kandev/.github/workflows/plugin-registry-index.yml

name: Plugin Registry Index

# Builds the marketplace catalog (plugin-registry/index.json) from the curated
# plugins.yaml pointer list and publishes it to GitHub Pages. This is the single
# source of the built catalog: its daily schedule also serves as the star-count
# refresh (see plugin-registry-stars.yml for a manual "refresh now" trigger).

on:
  # Rebuild whenever the curated list or the build tooling changes.
  push:
    branches: [main]
    paths:
      - "plugin-registry/**"
      - ".github/workflows/plugin-registry-index.yml"
  # Validate registry edits before merge (the build job runs; the separate
  # deploy job is gated to non-PR events, so a PR never deploys to Pages).
  pull_request:
    paths:
      - "plugin-registry/**"
      - ".github/workflows/plugin-registry-index.yml"
  # Manual rebuild.
  workflow_dispatch:
  # Allow a sibling workflow (star refresh) to invoke this build.
  workflow_call:
  # Daily rebuild — keeps star counts and latest versions fresh without commits.
  schedule:
    - cron: "0 6 * * *"

# Least-privilege for a Pages deploy: read source, write Pages, mint the OIDC
# token deploy-pages needs.
permissions:
  contents: read
  pages: write
  id-token: write

# Only one concurrent Pages deployment; let an in-progress deploy finish.
concurrency:
  group: plugin-registry-pages
  cancel-in-progress: false

jobs:
  # Build the catalog and, on non-PR events, stage it as a Pages artifact.
  # Kept free of the `github-pages` environment so it runs on PRs — a job that
  # binds that environment is checked against its protection rules even when its
  # deploy steps are skipped, which fails every PR that touches plugin-registry/.
  build:
    name: Build index.json
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"

      - name: Test build script
        run: node --test plugin-registry/build-index.test.mjs

      - name: Build index.json
        # Zero-dependency Node script (stdlib + global fetch); no install step.
        # GITHUB_TOKEN authenticates the GitHub API calls. It reads the public
        # plugin repos fine here; at larger scale, reading arbitrary external
        # repos' stars reliably may want a PAT with `public_repo` scope set as
        # this secret instead.
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node plugin-registry/build-index.mjs

      - name: Stage Pages site
        # Publish index.json under /plugins/index.json on the Pages host.
        run: |
          mkdir -p _site/plugins
          cp plugin-registry/index.json _site/plugins/index.json

      - name: Configure Pages
        if: github.event_name != 'pull_request'
        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5

      - name: Upload Pages artifact
        if: github.event_name != 'pull_request'
        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
        with:
          path: _site

  # Deploy the staged artifact to GitHub Pages. Separate job so the
  # `github-pages` environment (and its protection rules) is only ever
  # evaluated on non-PR events.
  deploy:
    name: Deploy to Pages
    if: github.event_name != 'pull_request'
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deploy.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deploy
        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4