plugins/.github/workflows/plugin-counts.yml at main · nself-org/plugins · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Plugin Counts

# registry.json, catalog.json and counts.json are projections (ADR 0009, P7-PLUG-36): the pinned cli tools/catalog generates
# them from free/*/plugin.json, releases.json and the licensed registry + bundles.json of nself-org/bundles at
# scripts/bundles.ref. This workflow is the drift gate: it regenerates them and fails when a committed file differs.
#
# Mode A (PLUGINS_PRO_CHECKOUT_TOKEN set): checks out bundles at scripts/bundles.ref and verifies all three files.
# Mode B (no token: forks, and this org until the owner provisions one): verifies registry.json only, with the bundle
#   membership and the licensed slugs read back from the committed catalog.json. catalog.json and counts.json are NOT
#   verified in Mode B; the job log says so. `bash scripts/plugin-counts.sh --check` with a bundles checkout is the full gate.

on:
  push:
    branches: [main]
    paths:
      - "registry.json"
      - "catalog.json"
      - "counts.json"
      - "releases.json"
      - "free/**/plugin.json"
      - "scripts/plugin-counts.sh"
      - "scripts/bundles.ref"
      - "scripts/cli-tools.version"
      - "scripts/catalog/**"
      - ".github/workflows/plugin-counts.yml"
  pull_request:
    branches: [main]
    paths:
      - "registry.json"
      - "catalog.json"
      - "counts.json"
      - "releases.json"
      - "free/**/plugin.json"
      - "scripts/plugin-counts.sh"
      - "scripts/bundles.ref"
      - "scripts/cli-tools.version"
      - "scripts/catalog/**"
      - ".github/workflows/plugin-counts.yml"
  repository_dispatch:
    types: [plugin-registry-updated]
  schedule:
    # 06:00 UTC nightly: catches licensed-side drift even when this repo has no qualifying push.
    - cron: "0 6 * * *"
  workflow_dispatch:

concurrency:
  group: plugin-counts-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  projections:
    name: Projections match their generator
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v7.0.1

      - name: Read the pins and the token state
        # `secrets.X` cannot be referenced in a step `if:`; resolve it into an output and gate on that.
        id: pins
        env:
          HAS_TOKEN: ${{ secrets.PLUGINS_PRO_CHECKOUT_TOKEN != '' }}
        run: |
          echo "bundles-ref=$(grep -v '^#' scripts/bundles.ref | head -1 | tr -d '[:space:]')" >> "$GITHUB_OUTPUT"
          echo "has-token=${HAS_TOKEN}" >> "$GITHUB_OUTPUT"

      - name: Setup Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version: '1.26.9'   # >= the go directive of the cli commit in scripts/cli-tools.version

      - name: Checkout bundles at scripts/bundles.ref (Mode A)
        if: steps.pins.outputs.has-token == 'true'
        uses: actions/checkout@v7.0.1
        with:
          repository: nself-org/bundles
          ref: ${{ steps.pins.outputs.bundles-ref }}
          path: bundles-checkout
          persist-credentials: false
          token: ${{ secrets.PLUGINS_PRO_CHECKOUT_TOKEN }}

      - name: Mode A, registry.json + catalog.json + counts.json match the generator
        if: steps.pins.outputs.has-token == 'true'
        env:
          BUNDLES_DIR: ${{ github.workspace }}/bundles-checkout
        run: bash scripts/plugin-counts.sh --check

      - name: Mode B, registry.json matches the generator (no bundles token)
        if: steps.pins.outputs.has-token != 'true'
        run: |
          echo "::notice::Mode B: PLUGINS_PRO_CHECKOUT_TOKEN is not configured, so catalog.json and counts.json were NOT"
          echo "::notice::verified against the private bundles repo. registry.json is verified below."
          bash scripts/plugin-counts.sh --check --free-only