Add the plugin submission issue form and workflow - #4
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The new Submission workflow references non-existent artifact action versions and the new stars lookup currently makes builds/submissions fail on transient GitHub API errors.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds a “Submit a plugin” GitHub issue form and a new Submission workflow that validates a submitted owner/name repository and automatically opens a registry.yaml PR, while also extending the published plugin index/detail docs to include GitHub stars for directory ordering.
Changes:
- Introduces
.github/ISSUE_TEMPLATE/submit-plugin.ymland.github/workflows/submit.ymlto turn submission issues intoregistry.yamlPRs and comment validation results back to the issue. - Extends the registry build output contract to include
starsinindex.jsonand per-plugin detail JSON, backed by a newSource.RepoInfo()GitHub API call plus tests. - Updates
README.mdanddocs/CONTRACT.mdto document the new submission flow and requiredSUBMIT_TOKENsecret behavior.
File summaries
| File | Description |
|---|---|
| README.md | Documents stars in the index contract and the new issue-form-based submission flow. |
| docs/CONTRACT.md | Updates submission instructions to prefer the submission issue workflow, with manual PR as fallback. |
| internal/registry/source.go | Extends Source with RepoInfo() and implements it for GitHubSource. |
| internal/registry/build.go | Adds stars to IndexEntry and populates it during buildDetail. |
| internal/registry/source_test.go | Extends fake GitHub API server/test coverage to include RepoInfo() behavior. |
| internal/registry/build_test.go | Updates build expectations to assert Stars in index and detail output. |
| internal/registry/validate_test.go | Updates the in-memory source stub to support returning stars. |
| cmd/registry/main_test.go | Updates the Source stub to satisfy the new RepoInfo() interface method. |
| .github/workflows/submit.yml | Adds the new issue-driven submission/PR-opening automation. |
| .github/ISSUE_TEMPLATE/submit-plugin.yml | Adds the “Submit a plugin” issue form with required repository + contract checkbox. |
| .github/ISSUE_TEMPLATE/config.yml | Enables blank issues. |
Review details
- Files reviewed: 11/11 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Without SUBMIT_TOKEN the org blocks Action-created PRs, so a passing submission previously wedged: it pushed a branch, failed at gh pr create, posted no comment, and every re-run then failed to push (non-fast-forward). Guard on HAS_TOKEN to comment and stop before pushing when the secret is unset, force-with-lease the bot branch push, and comment (then exit 1) if PR creation still fails. Document SUBMIT_TOKEN as required, from a dedicated machine identity. Sanitize submitted-plugin output before echoing it into issue comments (zero-width space after '@', modifier-letter grave for backticks, a ~~~~ fence) so a submission can't inject mentions or close the fence; cut the 6000-byte cap on a line boundary. Give empty-REPO parses a friendly comment instead of the generic failure text. Tighten the owner half of the repo pattern to exclude '.', matching goblogplatform/goblog#570; apply the same tightening to internal/registry/registry.go's repoPattern. Reject submission names that are '.'/'..' or still end in '.git' after the URL strip. Add a submit-scoped concurrency group, persist-credentials: false on check's checkout, and a build test covering a RepoInfo failure being skipped rather than failing the whole build. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A submitted plugin could still print a line of tildes to close the ~~~~ fence around its echoed output; replace every tilde (in addition to '@' and backtick) with a lookalike so no fence-syntax character survives sanitisation. head -c 6000 | head -n -1 emptied the comment when result.txt was a single line at or past the cap (head -n -1 drops the only line). Compute the capped chunk first, then only trim a trailing partial line when the file was actually truncated and the chunk contains a newline to trim, appending a "(truncated)" marker either way. internal/registry/registry.go: repoPattern's tightened owner charset still let the name half be "." or "..", or end in ".git" (e.g. owner/.. or owner/repo.git). Reject those explicitly in LoadRegistry after the regex match, with two new TestLoadRegistry_Errors cases. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Re the summary's action-version claim: actions/upload-artifact@v7 and actions/download-artifact@v8 both resolve via the tags API; Validate on this PR is green with checkout@v7/setup-go@v7. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a "Submit a plugin" issue form and a
Submissionworkflow: thecheckjob (contents: readonly) parsesowner/namefrom the form and runsregistry buildagainst it in the sandbox; therespondjob opens theregistry.yamlpull request when validation passes, or comments the failure (or an "already listed" notice) on the issue when it doesn't. Updatesdocs/CONTRACT.mdandREADME.mdto describe the new flow and theSUBMIT_TOKENrepository secret needed for the bot's PRs to triggerValidate.Depends on #3 (
feat/stars) — this branch is based on it soregistry buildsees thestarsfield; please merge #3 first, then this one.issuesevents run from the default branch, so the live end-to-end proof (opening real submission issues) can only happen after this merges; see the report for the exact two-issue proof procedure.🤖 Generated with Claude Code