plugin-publish.yml

# Phase 7: Auto-publish (v2)
#
# After a PR is merged to main, this workflow:
# 1. Detects changed plugins
# 2. For external repo plugins: copies SKILL + scripts + assets into community repo
# 3. For compiled plugins (Rust/Go): builds on 3 platforms, uploads Release to THIS repo
# 4. Generates registry.json and pushes to plugin-store repo
# 5. Creates git tags
#
# Supports three submission modes:
#   Mode A: Direct upload (SKILL.md in submissions/)
#   Mode B: External repo (plugin.yaml points to developer's repo)
#   Mode C: Claude marketplace import (same as B, auto-generated by CLI)

name: "Phase 5: Publish"

on:
  push:
    branches: [main]
    paths:
      - 'submissions/**'

permissions:
  contents: write

concurrency:
  group: publish-pipeline
  cancel-in-progress: false

jobs:
  # ═══════════════════════════════════════════════════════════════
  #  Step 1: Detect changes + extract build info
  # ═══════════════════════════════════════════════════════════════
  detect:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.detect.outputs.has_changes }}
      changed_plugins: ${{ steps.detect.outputs.changed_plugins }}
      build_plugins_json: ${{ steps.build_info.outputs.build_plugins_json }}
      has_builds: ${{ steps.build_info.outputs.has_builds }}
      has_external: ${{ steps.external.outputs.has_external }}
      external_plugins_json: ${{ steps.external.outputs.external_plugins_json }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect changed plugins
        id: detect
        run: |
          CHANGED=$(git diff --name-only HEAD~1...HEAD -- 'submissions/' || true)
          if [ -z "$CHANGED" ]; then
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          PLUGINS=$(echo "$CHANGED" | cut -d'/' -f2 | sort -u | tr '\n' ' ' | sed 's/ $//')
          echo "changed_plugins=${PLUGINS}" >> "$GITHUB_OUTPUT"
          echo "has_changes=true" >> "$GITHUB_OUTPUT"
          echo "Changed plugins: ${PLUGINS}"

      - name: Install yq
        if: steps.detect.outputs.has_changes == 'true'
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      # ── Detect external repo plugins (Mode B/C) ────────────────
      - name: Detect external repo plugins
        id: external
        if: steps.detect.outputs.has_changes == 'true'
        run: |
          EXTERNAL="[]"
          for YAML in submissions/*/plugin.yaml; do
            [ -f "$YAML" ] || continue
            PLUGIN_NAME=$(basename "$(dirname "$YAML")")

            SKILL_REPO=$(yq '.components.skill.repo // ""' "$YAML")
            SKILL_COMMIT=$(yq '.components.skill.commit // ""' "$YAML")

            # External = has repo field AND it's not our own community repo
            if [ -n "$SKILL_REPO" ] && [ "$SKILL_REPO" != "okx/plugin-store-community" ]; then
              ITEM=$(jq -n \
                --arg name "$PLUGIN_NAME" \
                --arg repo "$SKILL_REPO" \
                --arg commit "$SKILL_COMMIT" \
                '{name:$name, repo:$repo, commit:$commit}')
              EXTERNAL=$(echo "$EXTERNAL" | jq --argjson item "$ITEM" '. + [$item]')
              echo "External plugin: $PLUGIN_NAME → $SKILL_REPO@$SKILL_COMMIT"
            fi
          done

          echo "external_plugins_json=$(echo "$EXTERNAL" | jq -c '.')" >> "$GITHUB_OUTPUT"
          COUNT=$(echo "$EXTERNAL" | jq length)
          if [ "$COUNT" -gt 0 ]; then
            echo "has_external=true" >> "$GITHUB_OUTPUT"
            echo "Found $COUNT external repo plugins"
          else
            echo "has_external=false" >> "$GITHUB_OUTPUT"
          fi

      # ── Detect build plugins (Rust/Go only) ────────────────────
      - name: Detect build plugins
        id: build_info
        if: steps.detect.outputs.has_changes == 'true'
        run: |
          BUILD_PLUGINS="[]"

          # Check existing releases on THIS repo (community)
          EXISTING_TAGS=$(gh release list --limit 100 --json tagName --jq '.[].tagName' 2>/dev/null || echo "")

          for YAML in submissions/*/plugin.yaml; do
            [ -f "$YAML" ] || continue
            PLUGIN_NAME=$(basename "$(dirname "$YAML")")
            [ "$PLUGIN_NAME" = "_example-plugin" ] && continue

            BUILD_LANG=$(yq '.build.lang // ""' "$YAML")
            [ -z "$BUILD_LANG" ] && continue
            # Only Rust/Go compile to binary releases
            # TypeScript/Node → npm install -g (injected into pre-flight by Phase 4)
            # Python → pip install (injected into pre-flight by Phase 4)
            case "$BUILD_LANG" in typescript|node|python) continue ;; esac

            VERSION=$(yq '.version' "$YAML")
            RELEASE_TAG="plugins/${PLUGIN_NAME}@${VERSION}"
            if echo "$EXISTING_TAGS" | grep -qF "$RELEASE_TAG"; then
              echo "Release exists: $RELEASE_TAG — skipping"
              continue
            fi

            SOURCE_REPO=$(yq '.build.source_repo // ""' "$YAML")
            SOURCE_COMMIT=$(yq '.build.source_commit // ""' "$YAML")
            SOURCE_DIR=$(yq '.build.source_dir // "."' "$YAML")
            BINARY_NAME=$(yq '.build.binary_name // ""' "$YAML")
            BUILD_MAIN=$(yq '.build.main // ""' "$YAML")

            ITEM=$(jq -n \
              --arg name "$PLUGIN_NAME" --arg lang "$BUILD_LANG" \
              --arg repo "$SOURCE_REPO" --arg commit "$SOURCE_COMMIT" \
              --arg dir "$SOURCE_DIR" --arg bin "$BINARY_NAME" --arg main "$BUILD_MAIN" \
              '{name:$name, lang:$lang, source_repo:$repo, source_commit:$commit, source_dir:$dir, binary_name:$bin, main:$main}')
            BUILD_PLUGINS=$(echo "$BUILD_PLUGINS" | jq --argjson item "$ITEM" '. + [$item]')
            echo "Need build: $PLUGIN_NAME ($BUILD_LANG)"
          done

          echo "build_plugins_json=$(echo "$BUILD_PLUGINS" | jq -c '.')" >> "$GITHUB_OUTPUT"
          COUNT=$(echo "$BUILD_PLUGINS" | jq length)
          echo "has_builds=$([ "$COUNT" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

  # ═══════════════════════════════════════════════════════════════
  #  Step 2: Copy external repo skills into community repo
  # ═══════════════════════════════════════════════════════════════
  copy-external:
    name: Copy external skills
    needs: detect
    if: needs.detect.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      # ── Copy Mode A: direct uploads (skills inside submissions/) ──
      - name: Copy direct upload skills
        run: |
          for YAML in submissions/*/plugin.yaml; do
            [ -f "$YAML" ] || continue
            PLUGIN_NAME=$(basename "$(dirname "$YAML")")

            SKILL_REPO=$(yq '.components.skill.repo // ""' "$YAML")
            SKILL_DIR=$(yq '.components.skill.dir // ""' "$YAML")

            # Mode A: no external repo, skill dir is local
            if [ -z "$SKILL_REPO" ] && [ -n "$SKILL_DIR" ]; then
              SRC="submissions/${PLUGIN_NAME}/${SKILL_DIR}"
              DEST="skills/${PLUGIN_NAME}"
              if [ -d "$SRC" ]; then
                rm -rf "$DEST"
                mkdir -p "$DEST"
                cp -r "$SRC"/* "$DEST/" 2>/dev/null || true
                echo "Mode A: Copied ${SRC}/* → ${DEST}/"
              fi
            fi
          done

      - name: Copy skills from external repos
        env:
          EXTERNAL_PLUGINS: ${{ needs.detect.outputs.external_plugins_json }}
        run: |
          [ "${{ needs.detect.outputs.has_external }}" = "true" ] || { echo "No external plugins"; exit 0; }
          echo "$EXTERNAL_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            REPO=$(echo "$PLUGIN" | jq -r '.repo')
            COMMIT=$(echo "$PLUGIN" | jq -r '.commit')

            echo "Copying skills from ${REPO}@${COMMIT} → skills/${NAME}/"

            # Clone external repo at pinned commit
            git clone --depth=100 "https://github.com/${REPO}.git" "/tmp/ext-${NAME}"
            cd "/tmp/ext-${NAME}"
            git checkout "$COMMIT"
            cd -

            # Create target directory
            DEST="skills/${NAME}"
            rm -rf "$DEST"
            mkdir -p "$DEST"

            # Copy skill content (Claude marketplace compatible structure)
            # Claude marketplace repos use skills/<name>/ — flatten into DEST directly
            SKILL_SUBDIR="/tmp/ext-${NAME}/skills/${NAME}"
            if [ -d "$SKILL_SUBDIR" ]; then
              # Claude marketplace format: copy contents of skills/<name>/ directly
              cp -r "$SKILL_SUBDIR"/* "$DEST/" 2>/dev/null || true
              echo "  Copied skills/${NAME}/* (Claude marketplace format, flattened)"
            else
              # Flat format: copy individual directories
              for dir in scripts assets commands hooks references; do
                if [ -d "/tmp/ext-${NAME}/${dir}" ]; then
                  cp -r "/tmp/ext-${NAME}/${dir}" "$DEST/"
                  echo "  Copied ${dir}/"
                fi
              done
            fi

            # Copy SKILL.md if not already present (check multiple locations)
            if [ ! -f "$DEST/SKILL.md" ]; then
              if [ -f "/tmp/ext-${NAME}/SKILL.md" ]; then
                cp "/tmp/ext-${NAME}/SKILL.md" "$DEST/SKILL.md"
                echo "  Copied root SKILL.md"
              elif [ -f "/tmp/ext-${NAME}/skill.md" ]; then
                cp "/tmp/ext-${NAME}/skill.md" "$DEST/SKILL.md"
                echo "  Copied root skill.md → SKILL.md"
              fi
            fi

            # Copy .mcp.json if present
            if [ -f "/tmp/ext-${NAME}/.mcp.json" ]; then
              cp "/tmp/ext-${NAME}/.mcp.json" "$DEST/.mcp.json"
              echo "  Copied .mcp.json"
            fi

            rm -rf "/tmp/ext-${NAME}"
          done

      - name: Regenerate marketplace.json
        run: |
          python3 << 'PYEOF'
          import json, os, re

          plugins = []
          for name in sorted(os.listdir('skills')):
              skill_path = os.path.join('skills', name)
              if not os.path.isdir(skill_path):
                  continue
              desc = ''
              yaml_path = os.path.join('submissions', name, 'plugin.yaml')
              if os.path.exists(yaml_path):
                  with open(yaml_path) as f:
                      for line in f:
                          m = re.match(r'^description:\s*["\'](.+)["\']\s*$', line)
                          if m:
                              desc = m.group(1)
                              break
              plugins.append({
                  'name': name,
                  'description': desc or f'Plugin: {name}',
                  'source': f'./skills/{name}'
              })

          marketplace = {
              'name': 'okx-plugin-store-community',
              'description': 'Community plugins for OKX Plugin Store.',
              'owner': {'name': 'OKX', 'email': 'plugin-store@okx.com'},
              'plugins': plugins
          }

          os.makedirs('.claude-plugin', exist_ok=True)
          with open('.claude-plugin/marketplace.json', 'w') as f:
              json.dump(marketplace, f, indent=2, ensure_ascii=False)
              f.write('\n')
          print(f'marketplace.json: {len(plugins)} plugins')
          PYEOF

      - name: Commit copied skills + marketplace.json
        run: |
          git config user.name "plugin-store-bot"
          git config user.email "bot@plugin-store.local"
          git add skills/ .claude-plugin/marketplace.json
          git diff --staged --quiet && echo "No changes" && exit 0
          git commit -m "auto: copy plugin skills + update marketplace.json"
          for attempt in 1 2 3; do
            if git push; then echo "Push succeeded"; break; fi
            echo "Push failed (attempt $attempt/3), rebasing..."
            git pull --rebase origin main
          done

  # ═══════════════════════════════════════════════════════════════
  #  Step 3: Multi-platform build (Rust/Go only)
  # ═══════════════════════════════════════════════════════════════
  build-release:
    name: Build (${{ matrix.target }})
    needs: [detect, copy-external]
    if: always() && needs.detect.outputs.has_builds == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        target: [x86_64-unknown-linux-gnu, aarch64-apple-darwin, x86_64-apple-darwin]
        include:
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-apple-darwin
            os: macos-latest
    steps:
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: 'stable'
          check-latest: true

      - uses: actions/checkout@v4

      - name: Build plugins
        env:
          BUILD_PLUGINS: ${{ needs.detect.outputs.build_plugins_json }}
        run: |
          echo "$BUILD_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            LANG=$(echo "$PLUGIN" | jq -r '.lang')
            REPO=$(echo "$PLUGIN" | jq -r '.source_repo')
            COMMIT=$(echo "$PLUGIN" | jq -r '.source_commit')
            DIR=$(echo "$PLUGIN" | jq -r '.source_dir')
            BIN=$(echo "$PLUGIN" | jq -r '.binary_name')
            [ "$DIR" = "." ] && DIR=""

            echo "Building $NAME ($LANG) for ${{ matrix.target }}"
            if [ -n "$REPO" ] && [ "$REPO" != "null" ]; then
              # External repo: clone at pinned commit
              git clone --depth=100 "https://github.com/${REPO}.git" "/tmp/build-${NAME}"
              cd "/tmp/build-${NAME}" && git checkout "$COMMIT"
            else
              # Local source: copy from submissions directory
              cp -r "submissions/${NAME}" "/tmp/build-${NAME}"
              cd "/tmp/build-${NAME}"
            fi
            [ -n "$DIR" ] && cd "$DIR"

            case "$LANG" in
              rust)
                rustup target add ${{ matrix.target }} 2>/dev/null || true
                cargo build --release --target ${{ matrix.target }}
                cp "target/${{ matrix.target }}/release/${BIN}" "/tmp/${BIN}-${{ matrix.target }}"
                ;;
              go)
                case "${{ matrix.target }}" in
                  x86_64-unknown-linux-gnu) GOOS=linux; GOARCH=amd64 ;;
                  aarch64-apple-darwin)     GOOS=darwin; GOARCH=arm64 ;;
                  x86_64-apple-darwin)      GOOS=darwin; GOARCH=amd64 ;;
                esac
                CGO_ENABLED=0 GOOS=$GOOS GOARCH=$GOARCH go build -o "/tmp/${BIN}-${{ matrix.target }}" -ldflags="-s -w" .
                ;;
            esac
            cd /tmp
          done

      - uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.target }}
          path: /tmp/*-${{ matrix.target }}
          if-no-files-found: ignore

  # ═══════════════════════════════════════════════════════════════
  #  Step 4: Create Release on THIS repo (community)
  # ═══════════════════════════════════════════════════════════════
  create-release:
    name: Create Release
    needs: [detect, build-release]
    if: always() && needs.detect.outputs.has_builds == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - uses: actions/download-artifact@v4
        with:
          path: /tmp/all-artifacts
          merge-multiple: true

      - name: Create releases
        env:
          BUILD_PLUGINS: ${{ needs.detect.outputs.build_plugins_json }}
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "$BUILD_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            BIN=$(echo "$PLUGIN" | jq -r '.binary_name')

            YAML_FILE="submissions/${NAME}/plugin.yaml"
            if [ ! -f "$YAML_FILE" ]; then
              echo "::warning::$YAML_FILE not found, skipping release for $NAME"
              continue
            fi
            VERSION=$(yq '.version' "$YAML_FILE")

            mkdir -p "/tmp/release-${NAME}"
            cp /tmp/all-artifacts/${BIN}-* "/tmp/release-${NAME}/" 2>/dev/null || true
            chmod +x /tmp/release-${NAME}/* 2>/dev/null || true

            cd "/tmp/release-${NAME}"
            if ls ${BIN}-* 1>/dev/null 2>&1; then
              sha256sum ${BIN}-* > checksums.txt

              TAG="plugins/${NAME}@${VERSION}"
              TITLE="${NAME} v${VERSION} (community)"
              NOTES="Source: $(echo "$PLUGIN" | jq -r '.source_repo')@$(echo "$PLUGIN" | jq -r '.source_commit')"

              # Release on THIS repo (community), not plugin-store
              # If release exists, delete it first then recreate (ensures clean assets)
              echo "Creating release: $TAG with $(ls ${BIN}-* | wc -l) binaries"
              gh release delete "$TAG" --repo "${{ github.repository }}" --yes 2>/dev/null || true
              gh release create "$TAG" \
                --repo "${{ github.repository }}" \
                --title "$TITLE" \
                --notes "$NOTES" \
                ${BIN}-* checksums.txt 2>&1 && echo "Release created: $TAG" \
                || echo "::warning::Release create failed for $TAG"
            fi
            cd /tmp
          done

  # ═══════════════════════════════════════════════════════════════
  #  Step 5: Update registry.json in plugin-store repo
  # ═══════════════════════════════════════════════════════════════
  publish-registry:
    name: Update registry
    needs: [detect, copy-external, create-release]
    if: always() && needs.detect.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # Re-checkout to get the latest commit (after copy-external may have pushed)
          ref: main

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - name: Generate registry entries
        run: |
          ENTRIES="[]"
          COMMIT_SHA=$(git rev-parse HEAD)

          for PLUGIN_DIR in submissions/*/; do
            YAML_FILE="${PLUGIN_DIR}plugin.yaml"
            [ -f "$YAML_FILE" ] || continue
            NAME=$(yq '.name' "$YAML_FILE")
            [ "$NAME" = "_example-plugin" ] && continue

            VERSION=$(yq '.version' "$YAML_FILE")
            BUILD_LANG=$(yq '.build.lang // ""' "$YAML_FILE")
            BUILD_BINARY_NAME=$(yq '.build.binary_name // ""' "$YAML_FILE")

            # Determine skill dir: external plugins have skills/<name>/ in community
            # Direct uploads have submissions/<name>/skills/<name>/
            SKILL_REPO_VAL=$(yq '.components.skill.repo // ""' "$YAML_FILE")
            if [ -n "$SKILL_REPO_VAL" ] && [ "$SKILL_REPO_VAL" != "okx/plugin-store-community" ]; then
              # External: skill was copied to skills/<name>/
              SKILL_DIR="skills/${NAME}"
            else
              # Direct: skill is in submissions/<name>/skills/<name>/
              SKILL_DIR=$(yq '.components.skill.dir // .components.skills[0].dir // ""' "$YAML_FILE")
            fi

            ENTRY=$(YAML_FILE="$YAML_FILE" COMMIT_SHA="$COMMIT_SHA" \
              BUILD_LANG="$BUILD_LANG" BUILD_BINARY_NAME="$BUILD_BINARY_NAME" \
              VERSION="$VERSION" SKILL_DIR="$SKILL_DIR" NAME="$NAME" \
              python3 << 'PYEOF'
          import json, os

          yf = os.environ["YAML_FILE"]
          def yq(expr):
              return os.popen(f"yq '{expr}' {yf}").read().strip()

          name = os.environ["NAME"]
          skill_dir = os.environ["SKILL_DIR"]

          # Dynamically find SKILL.md path
          import glob
          skill_md_path = ""
          # Search in skills/<name>/ first (post-copy canonical location)
          candidates = glob.glob(f"skills/{name}/**/SKILL.md", recursive=True)
          if not candidates:
              # Fallback: search in submissions/<name>/
              candidates = glob.glob(f"submissions/{name}/**/SKILL.md", recursive=True)
          if candidates:
              skill_md_path = candidates[0]

          REPO = "okx/plugin-store-community"
          BASE = f"https://raw.githubusercontent.com/{REPO}/main"
          GUI  = f"https://github.com/{REPO}/tree/main"

          entry = {
              "name": name,
              "version": os.environ["VERSION"],
              "description": yq(".description"),
              "author": {"name": yq(".author.name")},
              "category": yq(".category"),
              "tags": json.loads(yq(".tags | @json")),
              "type": yq('.type // "community-developer"'),
              "components": {
                  "skill": {
                      "repo": REPO,
                      "dir": skill_dir,
                      "commit": os.environ["COMMIT_SHA"]
                  }
              },
              "link": yq(f'.link // "{GUI}/submissions/{name}"'),
              "homepage": f"{GUI}/submissions/{name}",
              "readme_url": f"{BASE}/submissions/{name}/README.md",
              "skill_url": f"{BASE}/{skill_md_path}" if skill_md_path else "",
              "summary_url": f"{BASE}/submissions/{name}/SUMMARY.md",
              "skill_summary_url": f"{BASE}/submissions/{name}/SKILL_SUMMARY.md",
          }


          lang = os.environ.get("BUILD_LANG", "")
          bin_name = os.environ.get("BUILD_BINARY_NAME", "")
          version = os.environ.get("VERSION", "")

          if lang and bin_name:
              entry["build"] = {
                  "lang": lang,
                  "source_repo": yq(".build.source_repo"),
                  "source_commit": yq(".build.source_commit"),
                  "binary_name": bin_name
              }
              if lang == "python":
                  entry["components"]["python"] = {
                      "source_repo": yq(".build.source_repo"),
                      "source_commit": yq(".build.source_commit"),
                      "install_command": f"pip install git+https://github.com/{yq('.build.source_repo')}@{yq('.build.source_commit')}"
                  }
              elif lang in ("typescript", "node"):
                  entry["components"]["npm"] = {
                      "source_repo": yq(".build.source_repo"),
                      "source_commit": yq(".build.source_commit"),
                      "install_command": f"npm install -g git+https://github.com/{yq('.build.source_repo')}#{yq('.build.source_commit')}"
                  }
              else:
                  # Rust/Go: binary Release on community repo
                  entry["components"]["binary"] = {
                      "repo": "okx/plugin-store-community",
                      "asset_pattern": bin_name + "-{target}",
                      "checksums_asset": "checksums.txt",
                      "release_tag": f"plugins/{name}@{version}"
                  }

          print(json.dumps(entry))
          PYEOF
            )

            ENTRIES=$(echo "$ENTRIES" | jq --argjson entry "$ENTRY" '. + [$entry]')
          done

          echo "$ENTRIES" > /tmp/community_entries.json
          echo "Generated $(echo "$ENTRIES" | jq length) community plugin entries"

      - name: Create git tags (max 20, prune oldest)
        run: |
          MAX_TAGS=20

          for PLUGIN_NAME in ${{ needs.detect.outputs.changed_plugins }}; do
            YAML="submissions/${PLUGIN_NAME}/plugin.yaml"
            [ -f "$YAML" ] || continue
            [ "$PLUGIN_NAME" = "_example-plugin" ] && continue
            VERSION=$(yq '.version' "$YAML")
            TAG="plugins/${PLUGIN_NAME}@${VERSION}"
            if git rev-parse "$TAG" >/dev/null 2>&1; then
              echo "Tag $TAG exists"
            else
              git tag "$TAG"
              echo "Created tag: $TAG"
            fi
          done
          git push --tags || true

          # Prune oldest plugin tags if total exceeds MAX_TAGS
          ALL_TAGS=$(git tag -l 'plugins/*' --sort=creatordate)
          COUNT=$(echo "$ALL_TAGS" | grep -c . || true)
          if [ "$COUNT" -gt "$MAX_TAGS" ]; then
            EXCESS=$((COUNT - MAX_TAGS))
            echo "Tag count ${COUNT} exceeds limit ${MAX_TAGS}, pruning ${EXCESS} oldest tags..."
            echo "$ALL_TAGS" | head -n "$EXCESS" | while read OLD_TAG; do
              echo "  Deleting: $OLD_TAG"
              git tag -d "$OLD_TAG" 2>/dev/null || true
              git push origin ":refs/tags/$OLD_TAG" 2>/dev/null || true
            done
          else
            echo "Tag count ${COUNT}/${MAX_TAGS} — within limit"
          fi

      # Summary generation is now in Phase 6 (plugin-summary.yml) with maintainer approval.
      # No inline summary generation in publish workflow.

      - name: Update registry in plugin-store repo
        env:
          PLUGIN_STORE_TOKEN: ${{ secrets.PLUGIN_STORE_TOKEN }}
        run: |
          git clone --depth=1 "https://x-access-token:${PLUGIN_STORE_TOKEN}@github.com/okx/plugin-store.git" /tmp/plugin-store
          cd /tmp/plugin-store

          CURRENT=$(cat registry.json)
          OFFICIAL=$(echo "$CURRENT" | jq '[.plugins[] | select(.type != "community-developer" and .type != "community")]')
          COMMUNITY_NEW=$(cat /tmp/community_entries.json)

          # Merge community entries: preserve link/extra from existing registry
          COMMUNITY_OLD=$(echo "$CURRENT" | jq '[.plugins[] | select(.type == "community-developer" or .type == "community")]')
          COMMUNITY=$(jq -n \
            --argjson old "$COMMUNITY_OLD" \
            --argjson new "$COMMUNITY_NEW" \
            '[$new[] | . as $entry |
              ($old | map(select(.name == $entry.name)) | first // null) as $existing |
              if $existing then
                $entry
                + (if $existing.link then {link: $existing.link} else {} end)
                + (if $existing.extra then {extra: $existing.extra} else {} end)
              else $entry end
            ]')

          # Merge and deduplicate by name (last wins)
          MERGED=$(jq -n \
            --argjson official "$OFFICIAL" \
            --argjson community "$COMMUNITY" \
            --arg stats_url "$(echo "$CURRENT" | jq -r '.stats_url // ""')" \
            '{schema_version: 1, stats_url: $stats_url, plugins: [($official + $community) | group_by(.name)[] | last]}')

          echo "$MERGED" | jq '.' > registry.json

          git config user.name "plugin-store-bot"
          git config user.email "bot@plugin-store.local"
          git add registry.json
          git diff --staged --quiet && echo "No registry changes" && exit 0

          git commit -m "Update registry.json with community plugins"
          for attempt in 1 2 3; do
            if git push; then echo "Registry updated"; exit 0; fi
            echo "Push failed ($attempt/3), retrying..."
            git pull --rebase origin main
          done
          echo "ERROR: Failed to push registry" >&2; exit 1