plugin-publish.yml

# Phase 7: Auto-publish (v2)
#
# After a PR is merged to main, this workflow:
# 1. Detects changed plugins
# 2. For external repo plugins: copies SKILL + scripts + assets into community repo
# 3. For compiled plugins (Rust/Go): builds on 3 platforms, uploads Release to THIS repo
# 4. Generates registry.json and pushes to plugin-store repo
# 5. Creates git tags
#
# Supports three submission modes:
#   Mode A: Direct upload (SKILL.md in skills/)
#   Mode B: External repo (plugin.yaml points to developer's repo)
#   Mode C: Claude marketplace import (same as B, auto-generated by CLI)

name: "Phase 5: Publish"

on:
  push:
    branches: [main]
    paths:
      - 'skills/**'
  workflow_dispatch:
    inputs:
      rebuild_all:
        description: 'Rebuild ALL plugins (force re-create releases)'
        required: false
        default: 'false'
        type: boolean

permissions:
  contents: write

# Concurrency removed — Phase 5 runs in parallel.
# Registry conflicts are handled by rebase retry (5 attempts) + auto-issue on failure.
# Release Draft issues are handled by un-draft step at the end.

jobs:
  # ═══════════════════════════════════════════════════════════════
  #  Step 1: Detect changes + extract build info
  # ═══════════════════════════════════════════════════════════════
  detect:
    name: Detect changes
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.detect.outputs.has_changes }}
      changed_plugins: ${{ steps.detect.outputs.changed_plugins }}
      build_plugins_json: ${{ steps.build_info.outputs.build_plugins_json }}
      has_builds: ${{ steps.build_info.outputs.has_builds }}
      has_external: ${{ steps.external.outputs.has_external }}
      external_plugins_json: ${{ steps.external.outputs.external_plugins_json }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Detect changed plugins
        id: detect
        run: |
          # workflow_dispatch with rebuild_all: treat ALL plugins as changed
          if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.rebuild_all }}" = "true" ]; then
            PLUGINS=$(ls -d skills/*/plugin.yaml 2>/dev/null | xargs -I{} dirname {} | xargs -I{} basename {} | sort -u | tr '\n' ' ' | sed 's/ $//')
            if [ -z "$PLUGINS" ]; then
              echo "has_changes=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "changed_plugins=${PLUGINS}" >> "$GITHUB_OUTPUT"
            echo "has_changes=true" >> "$GITHUB_OUTPUT"
            echo "Rebuild-all mode: ${PLUGINS}"
            exit 0
          fi

          CHANGED=$(git diff --name-only HEAD~1...HEAD -- 'skills/' || true)
          if [ -z "$CHANGED" ]; then
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          PLUGINS=$(echo "$CHANGED" | cut -d'/' -f2 | sort -u | tr '\n' ' ' | sed 's/ $//')
          echo "changed_plugins=${PLUGINS}" >> "$GITHUB_OUTPUT"
          echo "has_changes=true" >> "$GITHUB_OUTPUT"
          echo "Changed plugins: ${PLUGINS}"

      - name: Install yq
        if: steps.detect.outputs.has_changes == 'true'
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      # ── Detect external repo plugins (Mode B/C) ────────────────
      - name: Detect external repo plugins
        id: external
        if: steps.detect.outputs.has_changes == 'true'
        run: |
          EXTERNAL="[]"
          for YAML in skills/*/plugin.yaml; do
            [ -f "$YAML" ] || continue
            PLUGIN_NAME=$(basename "$(dirname "$YAML")")

            SKILL_REPO=$(yq '.components.skill.repo // ""' "$YAML")
            SKILL_COMMIT=$(yq '.components.skill.commit // ""' "$YAML")

            # External = has repo field AND it's not our own repo
            if [ -n "$SKILL_REPO" ] && [ "$SKILL_REPO" != "okx/plugin-store" ]; then
              ITEM=$(jq -n \
                --arg name "$PLUGIN_NAME" \
                --arg repo "$SKILL_REPO" \
                --arg commit "$SKILL_COMMIT" \
                '{name:$name, repo:$repo, commit:$commit}')
              EXTERNAL=$(echo "$EXTERNAL" | jq --argjson item "$ITEM" '. + [$item]')
              echo "External plugin: $PLUGIN_NAME → $SKILL_REPO@$SKILL_COMMIT"
            fi
          done

          echo "external_plugins_json=$(echo "$EXTERNAL" | jq -c '.')" >> "$GITHUB_OUTPUT"
          COUNT=$(echo "$EXTERNAL" | jq length)
          if [ "$COUNT" -gt 0 ]; then
            echo "has_external=true" >> "$GITHUB_OUTPUT"
            echo "Found $COUNT external repo plugins"
          else
            echo "has_external=false" >> "$GITHUB_OUTPUT"
          fi

      # ── Detect build plugins (Rust/Go only) ────────────────────
      - name: Detect build plugins
        id: build_info
        if: steps.detect.outputs.has_changes == 'true'
        env:
          CHANGED_PLUGINS: ${{ steps.detect.outputs.changed_plugins }}
        run: |
          BUILD_PLUGINS="[]"

          # Check existing releases on THIS repo (community)
          EXISTING_TAGS=$(gh release list --limit 100 --json tagName --jq '.[].tagName' 2>/dev/null || echo "")

          # Only iterate over plugins that CHANGED in this commit (not all plugins)
          for PLUGIN_NAME in $CHANGED_PLUGINS; do
            YAML="skills/${PLUGIN_NAME}/plugin.yaml"
            [ -f "$YAML" ] || continue
            [ "$PLUGIN_NAME" = "_example-plugin" ] && continue

            BUILD_LANG=$(yq '.build.lang // ""' "$YAML")
            [ -z "$BUILD_LANG" ] && continue
            # Only Rust/Go compile to binary releases
            # TypeScript/Node → npm install -g (injected into pre-flight by Phase 4)
            # Python → pip install (injected into pre-flight by Phase 4)
            case "$BUILD_LANG" in typescript|node|python) continue ;; esac

            VERSION=$(yq '.version' "$YAML")
            RELEASE_TAG="plugins/${PLUGIN_NAME}@${VERSION}"
            if echo "$EXISTING_TAGS" | grep -qF "$RELEASE_TAG"; then
              if [ "${{ github.event_name }}" = "workflow_dispatch" ] && [ "${{ inputs.rebuild_all }}" = "true" ]; then
                echo "Rebuild-all: force rebuilding $RELEASE_TAG"
              else
                echo "Release exists: $RELEASE_TAG — skipping"
                continue
              fi
            fi

            SOURCE_REPO=$(yq '.build.source_repo // ""' "$YAML")
            SOURCE_COMMIT=$(yq '.build.source_commit // ""' "$YAML")
            SOURCE_DIR=$(yq '.build.source_dir // "."' "$YAML")
            BINARY_NAME=$(yq '.build.binary_name // ""' "$YAML")
            BUILD_MAIN=$(yq '.build.main // ""' "$YAML")

            ITEM=$(jq -n \
              --arg name "$PLUGIN_NAME" --arg lang "$BUILD_LANG" --arg version "$VERSION" \
              --arg repo "$SOURCE_REPO" --arg commit "$SOURCE_COMMIT" \
              --arg dir "$SOURCE_DIR" --arg bin "$BINARY_NAME" --arg main "$BUILD_MAIN" \
              '{name:$name, lang:$lang, version:$version, source_repo:$repo, source_commit:$commit, source_dir:$dir, binary_name:$bin, main:$main}')
            BUILD_PLUGINS=$(echo "$BUILD_PLUGINS" | jq --argjson item "$ITEM" '. + [$item]')
            echo "Need build: $PLUGIN_NAME ($BUILD_LANG)"
          done

          echo "build_plugins_json=$(echo "$BUILD_PLUGINS" | jq -c '.')" >> "$GITHUB_OUTPUT"
          COUNT=$(echo "$BUILD_PLUGINS" | jq length)
          echo "has_builds=$([ "$COUNT" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

  # ═══════════════════════════════════════════════════════════════
  #  Step 2: Fetch external repo skills + update marketplace
  # ═══════════════════════════════════════════════════════════════
  fetch-external:
    name: Fetch external skills
    needs: detect
    if: needs.detect.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      # ── Fetch Mode B: external repo skills into skills/<name>/ ──
      - name: Fetch skills from external repos
        env:
          EXTERNAL_PLUGINS: ${{ needs.detect.outputs.external_plugins_json }}
        run: |
          [ "${{ needs.detect.outputs.has_external }}" = "true" ] || { echo "No external plugins"; exit 0; }
          echo "$EXTERNAL_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            REPO=$(echo "$PLUGIN" | jq -r '.repo')
            COMMIT=$(echo "$PLUGIN" | jq -r '.commit')

            echo "Fetching skills from ${REPO}@${COMMIT} → skills/${NAME}/"

            # Clone external repo at pinned commit
            git clone --depth=100 "https://github.com/${REPO}.git" "/tmp/ext-${NAME}"
            cd "/tmp/ext-${NAME}"
            git checkout "$COMMIT"
            cd -

            # Target directory already exists in skills/
            DEST="skills/${NAME}"
            mkdir -p "$DEST"

            # Copy skill content (Claude marketplace compatible structure)
            # Claude marketplace repos use skills/<name>/ — flatten into DEST directly
            SKILL_SUBDIR="/tmp/ext-${NAME}/skills/${NAME}"
            if [ -d "$SKILL_SUBDIR" ]; then
              # Claude marketplace format: copy contents of skills/<name>/ directly
              cp -r "$SKILL_SUBDIR"/* "$DEST/" 2>/dev/null || true
              echo "  Copied skills/${NAME}/* (Claude marketplace format, flattened)"
            else
              # Flat format: copy individual directories
              for dir in scripts assets commands hooks references; do
                if [ -d "/tmp/ext-${NAME}/${dir}" ]; then
                  cp -r "/tmp/ext-${NAME}/${dir}" "$DEST/"
                  echo "  Copied ${dir}/"
                fi
              done
            fi

            # Copy SKILL.md if not already present (check multiple locations)
            if [ ! -f "$DEST/SKILL.md" ]; then
              if [ -f "/tmp/ext-${NAME}/SKILL.md" ]; then
                cp "/tmp/ext-${NAME}/SKILL.md" "$DEST/SKILL.md"
                echo "  Copied root SKILL.md"
              elif [ -f "/tmp/ext-${NAME}/skill.md" ]; then
                cp "/tmp/ext-${NAME}/skill.md" "$DEST/SKILL.md"
                echo "  Copied root skill.md → SKILL.md"
              fi
            fi

            # Copy .mcp.json if present
            if [ -f "/tmp/ext-${NAME}/.mcp.json" ]; then
              cp "/tmp/ext-${NAME}/.mcp.json" "$DEST/.mcp.json"
              echo "  Copied .mcp.json"
            fi

            rm -rf "/tmp/ext-${NAME}"
          done

      - name: Regenerate marketplace.json
        run: |
          python3 << 'PYEOF'
          import json, os, re

          plugins = []
          for name in sorted(os.listdir('skills')):
              skill_path = os.path.join('skills', name)
              if not os.path.isdir(skill_path):
                  continue
              desc = ''
              # In merged repo, plugin.yaml lives in skills/<name>/
              yaml_path = os.path.join('skills', name, 'plugin.yaml')
              if os.path.exists(yaml_path):
                  with open(yaml_path) as f:
                      for line in f:
                          m = re.match(r'^description:\s*["\'](.+)["\']\s*$', line)
                          if m:
                              desc = m.group(1)
                              break
              plugins.append({
                  'name': name,
                  'description': desc or f'Plugin: {name}',
                  'source': f'./skills/{name}'
              })

          marketplace = {
              'name': 'okx-plugin-store',
              'description': 'Official and community plugins for OKX Plugin Store.',
              'owner': {'name': 'OKX', 'email': 'plugin-store@okx.com'},
              'plugins': plugins
          }

          os.makedirs('.claude-plugin', exist_ok=True)
          with open('.claude-plugin/marketplace.json', 'w') as f:
              json.dump(marketplace, f, indent=2, ensure_ascii=False)
              f.write('\n')
          print(f'marketplace.json: {len(plugins)} plugins')
          PYEOF

      - name: Commit fetched skills + marketplace.json
        run: |
          git config user.name "plugin-store-bot"
          git config user.email "bot@plugin-store.local"
          git add skills/ .claude-plugin/marketplace.json
          git diff --staged --quiet && echo "No changes" && exit 0
          git commit -m "auto: fetch external plugin skills + update marketplace.json"
          for attempt in 1 2 3; do
            if git push; then echo "Push succeeded"; break; fi
            echo "Push failed (attempt $attempt/3), rebasing..."
            git pull --rebase origin main
          done

  # ═══════════════════════════════════════════════════════════════
  #  Step 3: Multi-platform build (Rust/Go only)
  # ═══════════════════════════════════════════════════════════════
  build-release:
    name: Build (${{ matrix.target }})
    needs: [detect, fetch-external]
    if: always() && needs.detect.outputs.has_builds == 'true'
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        target:
          - x86_64-apple-darwin
          - aarch64-apple-darwin
          - x86_64-unknown-linux-musl
          - i686-unknown-linux-musl
          - aarch64-unknown-linux-musl
          - armv7-unknown-linux-musleabihf
          - x86_64-pc-windows-msvc
          - i686-pc-windows-msvc
          - aarch64-pc-windows-msvc
        include:
          - target: x86_64-apple-darwin
            os: macos-latest
          - target: aarch64-apple-darwin
            os: macos-latest
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            zigbuild: true
          - target: i686-unknown-linux-musl
            os: ubuntu-latest
            zigbuild: true
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            zigbuild: true
          - target: armv7-unknown-linux-musleabihf
            os: ubuntu-latest
            zigbuild: true
          - target: x86_64-pc-windows-msvc
            os: windows-latest
          - target: i686-pc-windows-msvc
            os: windows-latest
          - target: aarch64-pc-windows-msvc
            os: windows-latest
    steps:
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: 'stable'
          check-latest: true

      - name: Set up Zig (for musl cross-compilation)
        if: matrix.zigbuild
        uses: mlugg/setup-zig@v1
        with:
          version: 0.13.0

      - name: Install cargo-zigbuild
        if: matrix.zigbuild
        run: cargo install cargo-zigbuild --locked

      - uses: actions/checkout@v4

      - name: Build plugins
        shell: bash
        env:
          BUILD_PLUGINS: ${{ needs.detect.outputs.build_plugins_json }}
        run: |
          mkdir -p "${GITHUB_WORKSPACE}/build-output"
          echo "$BUILD_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do (
            set +e
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            LANG=$(echo "$PLUGIN" | jq -r '.lang')
            REPO=$(echo "$PLUGIN" | jq -r '.source_repo')
            COMMIT=$(echo "$PLUGIN" | jq -r '.source_commit')
            DIR=$(echo "$PLUGIN" | jq -r '.source_dir')
            BIN=$(echo "$PLUGIN" | jq -r '.binary_name')
            [ "$DIR" = "." ] && DIR=""

            echo "Building $NAME ($LANG) for ${{ matrix.target }}"
            if [ -n "$REPO" ] && [ "$REPO" != "null" ]; then
              # External repo: clone at pinned commit
              git clone --depth=100 "https://github.com/${REPO}.git" "${GITHUB_WORKSPACE}/build-src-${NAME}"
              cd "${GITHUB_WORKSPACE}/build-src-${NAME}" && git checkout "$COMMIT"
            else
              # Local source: copy from skills directory
              cp -r "skills/${NAME}" "${GITHUB_WORKSPACE}/build-src-${NAME}"
              cd "${GITHUB_WORKSPACE}/build-src-${NAME}"
            fi
            [ -n "$DIR" ] && cd "$DIR"

            case "$LANG" in
              rust)
                rustup target add ${{ matrix.target }} 2>/dev/null || true

                # For any target with openssl dependency: ensure vendored openssl works
                if grep -q 'openssl' Cargo.lock 2>/dev/null; then
                  # Add vendored openssl if not already present
                  if ! grep -q 'openssl.*vendored' Cargo.toml 2>/dev/null; then
                    echo "Adding vendored openssl..."
                    cargo add openssl --features vendored 2>/dev/null || \
                      sed -i 's/\[dependencies\]/[dependencies]\nopenssl = { version = "0.10", features = ["vendored"] }/' Cargo.toml 2>/dev/null || true
                  fi

                  # Windows: vendored openssl needs Perl with full modules.
                  # GitHub Actions Windows runners use MSYS2 perl which lacks modules.
                  # Install OpenSSL via vcpkg and point openssl-sys to it instead.
                  case "${{ matrix.target }}" in
                    x86_64-pc-windows-msvc)
                      VCPKG_TRIPLET="x64-windows-static"
                      ;;
                    i686-pc-windows-msvc)
                      VCPKG_TRIPLET="x86-windows-static"
                      ;;
                    aarch64-pc-windows-msvc)
                      VCPKG_TRIPLET="arm64-windows-static"
                      ;;
                  esac
                  if [ -n "$VCPKG_TRIPLET" ]; then
                    echo "Installing pre-built OpenSSL via vcpkg ($VCPKG_TRIPLET)..."
                    VCPKG_ROOT="${VCPKG_INSTALLATION_ROOT:-/c/vcpkg}"
                    vcpkg install "openssl:${VCPKG_TRIPLET}" 2>/dev/null || true
                    export OPENSSL_DIR="${VCPKG_ROOT}/installed/${VCPKG_TRIPLET}"
                    export OPENSSL_STATIC=1
                    export OPENSSL_NO_VENDOR=1
                    echo "  OPENSSL_DIR=${OPENSSL_DIR}"
                  fi
                fi

                # For musl and Windows targets: if openssl is pulled in (native-tls), switch to rustls-tls.
                # musl: vendored openssl needs libatomic (missing in zigbuild)
                # Windows: vcpkg openssl install is fragile (PowerShell download timeouts, missing headers)
                NEED_RUSTLS_PATCH=false
                case "${{ matrix.target }}" in
                  *musl*|*windows*) NEED_RUSTLS_PATCH=true ;;
                esac
                if [ "$NEED_RUSTLS_PATCH" = "true" ] && grep -q 'openssl-sys' Cargo.lock 2>/dev/null; then
                  echo "Detected openssl on ${{ matrix.target }} — patching reqwest to rustls-tls..."
                  # 1. Patch reqwest to use rustls-tls (remove native-tls default)
                  python3 -c "import re; c=open('Cargo.toml').read(); c=re.sub(r'reqwest\s*=\s*\{[^}]+\}',lambda m:(m.group(0) if 'rustls-tls' in m.group(0) else re.sub(r'features\s*=\s*\[','features = [\"rustls-tls\", ',m.group(0).replace('}',', default-features = false}') if 'default-features' not in m.group(0) else re.sub(r'default-features\s*=\s*true','default-features = false',m.group(0)))),c); open('Cargo.toml','w').write(c)"
                  # 2. Ensure vendored openssl for indirect deps (solana-sdk, pumpfun, etc.)
                  if ! grep -q 'openssl.*vendored' Cargo.toml 2>/dev/null; then
                    echo "Adding vendored openssl for indirect deps..."
                    cargo add openssl --features vendored 2>/dev/null || sed -i 's/\[dependencies\]/[dependencies]\nopenssl = { version = "0.10", features = ["vendored"] }/' Cargo.toml 2>/dev/null || true
                  fi
                  # 3. Install musl-tools for vendored openssl compilation
                  if [ "${{ matrix.zigbuild }}" = "true" ]; then
                    sudo apt-get install -y musl-tools 2>/dev/null || true
                  fi
                  cargo generate-lockfile 2>/dev/null || true
                fi

                if [ "${{ matrix.zigbuild }}" = "true" ]; then
                  cargo zigbuild --release --target ${{ matrix.target }}
                else
                  cargo build --release --target ${{ matrix.target }}
                fi
                # Copy binary (Windows adds .exe)
                case "${{ matrix.target }}" in
                  *windows*) cp "target/${{ matrix.target }}/release/${BIN}.exe" "${GITHUB_WORKSPACE}/build-output/${BIN}-${{ matrix.target }}.exe" ;;
                  *) cp "target/${{ matrix.target }}/release/${BIN}" "${GITHUB_WORKSPACE}/build-output/${BIN}-${{ matrix.target }}" ;;
                esac
                ;;
              go)
                case "${{ matrix.target }}" in
                  x86_64-unknown-linux-musl)    GOOS=linux;   GOARCH=amd64 ;;
                  i686-unknown-linux-musl)      GOOS=linux;   GOARCH=386 ;;
                  aarch64-unknown-linux-musl)   GOOS=linux;   GOARCH=arm64 ;;
                  armv7-unknown-linux-musleabihf) GOOS=linux; GOARCH=arm; GOARM=7 ;;
                  aarch64-apple-darwin)        GOOS=darwin;  GOARCH=arm64 ;;
                  x86_64-apple-darwin)         GOOS=darwin;  GOARCH=amd64 ;;
                  x86_64-pc-windows-msvc)      GOOS=windows; GOARCH=amd64 ;;
                  i686-pc-windows-msvc)        GOOS=windows; GOARCH=386 ;;
                  aarch64-pc-windows-msvc)     GOOS=windows; GOARCH=arm64 ;;
                esac
                if [ "$GOOS" = "windows" ]; then
                  CGO_ENABLED=0 GOOS=$GOOS GOARCH=$GOARCH go build -o "${GITHUB_WORKSPACE}/build-output/${BIN}-${{ matrix.target }}.exe" -ldflags="-s -w" .
                else
                  CGO_ENABLED=0 GOOS=$GOOS GOARCH=$GOARCH go build -o "${GITHUB_WORKSPACE}/build-output/${BIN}-${{ matrix.target }}" -ldflags="-s -w" .
                fi
                ;;
            esac
            cd /tmp
          ) || echo "::warning::Build failed for plugin, continuing with others"
          done

      - uses: actions/upload-artifact@v4
        with:
          name: binaries-${{ matrix.target }}
          path: build-output/*-${{ matrix.target }}*
          if-no-files-found: ignore

  # ═══════════════════════════════════════════════════════════════
  #  Step 4: Create Release on THIS repo (community)
  # ═══════════════════════════════════════════════════════════════
  create-release:
    name: Create Release
    needs: [detect, build-release]
    if: always() && needs.detect.outputs.has_builds == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - uses: actions/download-artifact@v4
        with:
          path: artifacts
          merge-multiple: true

      - name: Debug artifacts
        run: |
          echo "=== Downloaded artifacts ==="
          find artifacts -type f | sort
          echo "=== End ==="

      - name: Create releases
        env:
          BUILD_PLUGINS: ${{ needs.detect.outputs.build_plugins_json }}
          GH_TOKEN: ${{ github.token }}
        run: |
          # DO NOT git pull here. Use the same commit that build used.
          # Pulling latest main causes version mismatch: tag gets new version
          # but binary was compiled from old Cargo.toml version.
          REPO_ROOT="$(pwd)"
          echo "$BUILD_PLUGINS" | jq -r '.[] | @base64' | while read ENCODED; do
            PLUGIN=$(echo "$ENCODED" | base64 -d)
            NAME=$(echo "$PLUGIN" | jq -r '.name')
            BIN=$(echo "$PLUGIN" | jq -r '.binary_name')
            # Use version from detect-time JSON (same commit as build),
            # NOT from plugin.yaml on disk (which could be from a newer commit)
            VERSION=$(echo "$PLUGIN" | jq -r '.version')

            YAML_FILE="${REPO_ROOT}/skills/${NAME}/plugin.yaml"
            if [ ! -f "$YAML_FILE" ]; then
              echo "::warning::$YAML_FILE not found, skipping release for $NAME"
              continue
            fi

            RELEASE_DIR="${REPO_ROOT}/release-${NAME}"
            mkdir -p "$RELEASE_DIR"
            # Exact match: copy only ${BIN}-${target} files, not ${BIN}-something-else-*
            # This prevents pancakeswap-* from matching pancakeswap-clmm-*
            for f in ${REPO_ROOT}/artifacts/${BIN}-*; do
              base=$(basename "$f")
              # Strip .exe suffix for matching, then check the part after ${BIN}- is a valid target
              stripped="${base%.exe}"
              target_part="${stripped#${BIN}-}"
              case "$target_part" in
                aarch64-apple-darwin|x86_64-apple-darwin|x86_64-unknown-linux-musl|i686-unknown-linux-musl|aarch64-unknown-linux-musl|armv7-unknown-linux-musleabihf|x86_64-pc-windows-msvc|i686-pc-windows-msvc|aarch64-pc-windows-msvc)
                  cp "$f" "$RELEASE_DIR/"
                  ;;
              esac
            done
            chmod +x "$RELEASE_DIR"/* 2>/dev/null || true

            cd "$RELEASE_DIR"
            if ls ${BIN}-* 1>/dev/null 2>&1; then
              sha256sum ${BIN}-* > checksums.txt

              TAG="plugins/${NAME}@${VERSION}"
              TITLE="${NAME} v${VERSION}"
              SRC_REPO=$(echo "$PLUGIN" | jq -r '.source_repo // empty')
              SRC_COMMIT=$(echo "$PLUGIN" | jq -r '.source_commit // empty')
              AUTHOR=$(yq '.author.name // "Community"' "$YAML_FILE" 2>/dev/null || echo "Community")
              AUTHOR_GH=$(yq '.author.github // ""' "$YAML_FILE" 2>/dev/null || echo "")
              DESC=$(yq '.description // ""' "$YAML_FILE" 2>/dev/null || echo "")
              LANG=$(echo "$PLUGIN" | jq -r '.lang // "unknown"')
              PLATFORM_COUNT=$(ls ${BIN}-* 2>/dev/null | wc -l | tr -d ' ')

              NOTES_FILE="${REPO_ROOT}/release-notes-${NAME}.md"
              CONTRIBUTOR="${AUTHOR_GH:-$AUTHOR}"
              if [ -n "$SRC_REPO" ] && [ -n "$SRC_COMMIT" ]; then
                SRC_LINE="Source: [${SRC_REPO}](https://github.com/${SRC_REPO}/tree/${SRC_COMMIT})"
              else
                SRC_LINE="Source: skills/${NAME}/ (included in submission)"
              fi
              printf '%s\n' "## What's Changed" "" "- **${NAME}** v${VERSION} -- ${DESC}" "- Language: ${LANG} | Platforms: ${PLATFORM_COUNT}" "- Install: npx skills add okx/plugin-store --skill ${NAME}" "- ${SRC_LINE}" "" "## New Contributors" "" "- **${CONTRIBUTOR}** made their first contribution" "" "## Contributors" "" "- **${CONTRIBUTOR}**" "" "---" "Published by OKX Plugin Store CI" > "$NOTES_FILE"

              echo "Creating release: $TAG with ${PLATFORM_COUNT} binaries"

              # Verify binary version matches tag version before publishing.
              # This catches cases where Cargo.toml version != plugin.yaml version.
              NATIVE_BIN="${BIN}-x86_64-unknown-linux-musl"
              if [ -f "$NATIVE_BIN" ]; then
                chmod +x "$NATIVE_BIN"
                BIN_VERSION=$("./$NATIVE_BIN" --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
                if [ -n "$BIN_VERSION" ] && [ "$BIN_VERSION" != "$VERSION" ]; then
                  echo "::warning::Version mismatch for ${NAME}: tag=${VERSION} but binary=${BIN_VERSION}. Attempting auto-fix..."

                  # Auto-fix: the binary has the REAL version. Use it as the release version.
                  # This handles the case where plugin.yaml was bumped but this run compiled older Cargo.toml.
                  FIXED_VERSION="$BIN_VERSION"
                  FIXED_TAG="plugins/${NAME}@${FIXED_VERSION}"
                  echo "  Auto-fix: using binary version ${FIXED_VERSION} instead of ${VERSION}"
                  VERSION="$FIXED_VERSION"
                  TAG="$FIXED_TAG"
                  TITLE="${NAME} v${FIXED_VERSION}"

                  # Also try: checkout latest main and check if Cargo.toml matches plugin.yaml now
                  LATEST_CARGO_VER=$(git show origin/main:skills/${NAME}/Cargo.toml 2>/dev/null | grep '^version' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
                  LATEST_YAML_VER=$(git show origin/main:skills/${NAME}/plugin.yaml 2>/dev/null | grep '^version' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

                  if [ -n "$LATEST_CARGO_VER" ] && [ -n "$LATEST_YAML_VER" ] && [ "$LATEST_CARGO_VER" = "$LATEST_YAML_VER" ] && [ "$LATEST_CARGO_VER" != "$BIN_VERSION" ]; then
                    # Check if this run was ALREADY triggered by an auto-rebuild.
                    # If so, don't retry again — prevents infinite loop.
                    LAST_COMMIT_MSG=$(git log -1 --pretty=%s 2>/dev/null || echo "")
                    if echo "$LAST_COMMIT_MSG" | grep -q "^auto: trigger ${NAME} rebuild"; then
                      echo "::error::Binary ${BIN_VERSION} still stale after auto-rebuild. Manual fix needed: ensure Cargo.toml version matches plugin.yaml (${LATEST_YAML_VER})."
                      cd "$REPO_ROOT"
                      continue
                    fi

                    # First time: auto-trigger rebuild
                    echo "::warning::Binary ${BIN_VERSION} is stale. Latest main has ${LATEST_CARGO_VER}. Auto-triggering rebuild (one-time)..."
                    git fetch origin main 2>/dev/null || true
                    git checkout origin/main -- "skills/${NAME}/SKILL.md" 2>/dev/null || true
                    echo "" >> "${REPO_ROOT}/skills/${NAME}/SKILL.md"
                    git -C "$REPO_ROOT" add "skills/${NAME}/SKILL.md"
                    git -C "$REPO_ROOT" -c user.name="plugin-store-bot" -c user.email="bot@plugin-store.local" \
                      commit -m "auto: trigger ${NAME} rebuild (binary v${BIN_VERSION} != plugin v${LATEST_YAML_VER})" 2>/dev/null || true
                    git -C "$REPO_ROOT" push origin HEAD:main 2>/dev/null && \
                      echo "  Auto-rebuild triggered for ${NAME}" || \
                      echo "::warning::Auto-rebuild push failed for ${NAME}. Manual rebuild needed."

                    cd "$REPO_ROOT"
                    continue
                  fi

                  echo "  Publishing with binary version ${VERSION}"
                fi
                if [ -n "$BIN_VERSION" ]; then
                  echo "  Version verified: binary=${BIN_VERSION} tag=${VERSION} ✓"
                else
                  echo "  Version check: --version not supported, skipping verification"
                fi
              fi

              # Strategy: create new release FIRST, then delete old one.
              # This ensures users always have a working release during transitions.
              # If the old tag exists, we need to delete it before creating (GitHub requires unique tags).
              # But we use a temp tag to keep the old release alive until the new one is confirmed.

              # Check if old release exists
              OLD_RELEASE_EXISTS=false
              if gh release view "$TAG" --repo "${{ github.repository }}" > /dev/null 2>&1; then
                OLD_RELEASE_EXISTS=true
                echo "  Existing release found for $TAG — will replace after new release is confirmed"
              fi

              # Delete old release+tag (required before creating same tag at new commit)
              if [ "$OLD_RELEASE_EXISTS" = "true" ]; then
                gh release delete "$TAG" --repo "${{ github.repository }}" --yes --cleanup-tag 2>/dev/null || true
              fi

              # Create release targeting main branch (not a specific SHA).
              # Using a SHA fails when auto-commits (registry.json) advance main
              # between checkout and release creation (HTTP 422: target_commitish invalid).
              if gh release create "$TAG" \
                --repo "${{ github.repository }}" \
                --title "$TITLE" \
                --notes-file "$NOTES_FILE" \
                --target "main" \
                ${BIN}-* checksums.txt 2>&1; then
                echo "Release created: $TAG"

                # Clean up old VERSION releases for this plugin
                # New version confirmed → delete all older versions
                gh release list --repo "${{ github.repository }}" --limit 100 --json tagName --jq '.[].tagName' \
                  | grep "^plugins/${NAME}@" \
                  | grep -v "^${TAG}$" \
                  | while read OLD_VER_TAG; do
                    echo "  Deleting old version: $OLD_VER_TAG"
                    gh release delete "$OLD_VER_TAG" --repo "${{ github.repository }}" --yes --cleanup-tag 2>/dev/null || true
                  done

                # Clean up old NAME releases (plugin rename scenario)
                OLD_TAG_PATTERN="plugins/${BIN}@"
                if [ "$OLD_TAG_PATTERN" != "plugins/${NAME}@" ]; then
                  gh release list --repo "${{ github.repository }}" --limit 100 --json tagName --jq '.[].tagName' \
                    | grep "^${OLD_TAG_PATTERN}" \
                    | while read OLD_NAME_TAG; do
                      echo "  Deleting renamed release: $OLD_NAME_TAG"
                      gh release delete "$OLD_NAME_TAG" --repo "${{ github.repository }}" --yes --cleanup-tag 2>/dev/null || true
                    done
                fi
              else
                echo "::warning::Release create failed for $TAG"
              fi
            else
              echo "::warning::No binaries found for $NAME in artifacts"
              ls -la ${REPO_ROOT}/artifacts/ 2>/dev/null | head -20
            fi
            cd "$REPO_ROOT"
          done

  # ═══════════════════════════════════════════════════════════════
  #  Step 5: Update registry.json in plugin-store repo
  # ═══════════════════════════════════════════════════════════════
  publish-registry:
    name: Update registry
    needs: [detect, fetch-external, create-release]
    if: always() && needs.detect.outputs.has_changes == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # Re-checkout to get the latest commit (after copy-external may have pushed)
          ref: main

      - name: Install yq
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - name: Generate registry entries
        run: |
          ENTRIES="[]"
          COMMIT_SHA=$(git rev-parse HEAD)

          for PLUGIN_DIR in skills/*/; do
            YAML_FILE="${PLUGIN_DIR}plugin.yaml"
            [ -f "$YAML_FILE" ] || continue
            NAME=$(yq '.name' "$YAML_FILE")
            [ "$NAME" = "_example-plugin" ] && continue

            VERSION=$(yq '.version' "$YAML_FILE")
            BUILD_LANG=$(yq '.build.lang // ""' "$YAML_FILE")
            BUILD_BINARY_NAME=$(yq '.build.binary_name // ""' "$YAML_FILE")

            # In merged repo, all skills live directly in skills/<name>/
            SKILL_DIR="skills/${NAME}"

            ENTRY=$(YAML_FILE="$YAML_FILE" COMMIT_SHA="$COMMIT_SHA" \
              BUILD_LANG="$BUILD_LANG" BUILD_BINARY_NAME="$BUILD_BINARY_NAME" \
              VERSION="$VERSION" SKILL_DIR="$SKILL_DIR" NAME="$NAME" \
              python3 << 'PYEOF'
          import json, os

          yf = os.environ["YAML_FILE"]
          def yq(expr):
              return os.popen(f"yq '{expr}' {yf}").read().strip()

          name = os.environ["NAME"]
          skill_dir = os.environ["SKILL_DIR"]

          # Dynamically find SKILL.md path
          import glob
          skill_md_path = ""
          candidates = glob.glob(f"skills/{name}/**/SKILL.md", recursive=True)
          if candidates:
              skill_md_path = candidates[0]

          REPO = "okx/plugin-store"
          BASE = f"https://raw.githubusercontent.com/{REPO}/main"
          GUI  = f"https://github.com/{REPO}/tree/main"

          entry = {
              "name": name,
              "version": os.environ["VERSION"],
              "description": yq(".description"),
              "author": {"name": yq(".author.name")},
              "category": yq(".category"),
              "tags": json.loads(yq(".tags | @json")),
              "type": yq('.type // "community-developer"'),
              "components": {
                  "skill": {
                      "repo": REPO,
                      "dir": skill_dir,
                      "commit": os.environ["COMMIT_SHA"]
                  }
              },
              "link": yq(f'.link // "{GUI}/skills/{name}"'),
              "homepage": f"{GUI}/skills/{name}",
              "readme_url": f"{BASE}/skills/{name}/README.md",
              "skill_url": f"{BASE}/{skill_md_path}" if skill_md_path else "",
              "summary_url": f"{BASE}/skills/{name}/SUMMARY.md",
          }


          lang = os.environ.get("BUILD_LANG", "")
          bin_name = os.environ.get("BUILD_BINARY_NAME", "")
          version = os.environ.get("VERSION", "")

          if lang and bin_name:
              entry["build"] = {
                  "lang": lang,
                  "source_repo": yq(".build.source_repo"),
                  "source_commit": yq(".build.source_commit"),
                  "binary_name": bin_name
              }
              if lang == "python":
                  entry["components"]["python"] = {
                      "source_repo": yq(".build.source_repo"),
                      "source_commit": yq(".build.source_commit"),
                      "install_command": f"pip install git+https://github.com/{yq('.build.source_repo')}@{yq('.build.source_commit')}"
                  }
              elif lang in ("typescript", "node"):
                  entry["components"]["npm"] = {
                      "source_repo": yq(".build.source_repo"),
                      "source_commit": yq(".build.source_commit"),
                      "install_command": f"npm install -g git+https://github.com/{yq('.build.source_repo')}#{yq('.build.source_commit')}"
                  }
              else:
                  # Rust/Go: binary Release on plugin-store repo
                  entry["components"]["binary"] = {
                      "repo": "okx/plugin-store",
                      "asset_pattern": bin_name + "-{target}",
                      "checksums_asset": "checksums.txt",
                      "release_tag": f"plugins/{name}@{version}"
                  }

          print(json.dumps(entry))
          PYEOF
            )

            ENTRIES=$(echo "$ENTRIES" | jq --argjson entry "$ENTRY" '. + [$entry]')
          done

          echo "$ENTRIES" > /tmp/community_entries.json
          echo "Generated $(echo "$ENTRIES" | jq length) community plugin entries"

      - name: Create git tags (max 20, prune oldest)
        run: |
          MAX_TAGS=20

          for PLUGIN_NAME in ${{ needs.detect.outputs.changed_plugins }}; do
            YAML="skills/${PLUGIN_NAME}/plugin.yaml"
            [ -f "$YAML" ] || continue
            [ "$PLUGIN_NAME" = "_example-plugin" ] && continue
            VERSION=$(yq '.version' "$YAML")
            TAG="plugins/${PLUGIN_NAME}@${VERSION}"
            if git rev-parse "$TAG" >/dev/null 2>&1; then
              echo "Tag $TAG exists"
            else
              git tag "$TAG"
              echo "Created tag: $TAG"
            fi
          done
          git push --tags || true

          # Prune oldest plugin tags if total exceeds MAX_TAGS
          ALL_TAGS=$(git tag -l 'plugins/*' --sort=creatordate)
          COUNT=$(echo "$ALL_TAGS" | grep -c . || true)
          if [ "$COUNT" -gt "$MAX_TAGS" ]; then
            EXCESS=$((COUNT - MAX_TAGS))
            echo "Tag count ${COUNT} exceeds limit ${MAX_TAGS}, pruning ${EXCESS} oldest tags..."
            echo "$ALL_TAGS" | head -n "$EXCESS" | while read OLD_TAG; do
              echo "  Deleting: $OLD_TAG"
              git tag -d "$OLD_TAG" 2>/dev/null || true
              git push origin ":refs/tags/$OLD_TAG" 2>/dev/null || true
            done
          else
            echo "Tag count ${COUNT}/${MAX_TAGS} — within limit"
          fi


      - name: Update registry in this repo
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Full-scan approach: regenerate registry.json from ALL skills/ directories.
          # This eliminates concurrent push conflicts — every run produces the complete
          # registry, so the last push always wins and is always correct.

          git pull origin main --rebase 2>/dev/null || true

          python3 << 'PYEOF'
          import json, os, yaml, glob

          # Read current registry to preserve link/extra fields
          with open("registry.json") as f:
              current = json.load(f)
          existing_by_name = {p["name"]: p for p in current.get("plugins", [])}

          plugins = []
          for yaml_path in sorted(glob.glob("skills/*/plugin.yaml")):
              plugin_dir = os.path.dirname(yaml_path)
              name = os.path.basename(plugin_dir)
              if name.startswith("_"):
                  continue

              with open(yaml_path) as f:
                  data = yaml.safe_load(f) or {}

              entry = {
                  "name": name,
                  "version": str(data.get("version", "0.1.0")),
                  "description": data.get("description", ""),
                  "author": data.get("author", {}),
                  "license": data.get("license", "MIT"),
                  "category": data.get("category", ""),
                  "tags": data.get("tags", []),
              }

              # Detect plugin type
              build = data.get("build", {}) or {}
              components = data.get("components", {}) or {}
              skill = components.get("skill", {}) or {}

              if skill.get("repo"):
                  entry["type"] = "community"
              elif build.get("source_repo"):
                  entry["type"] = "community-developer"
              elif build.get("lang"):
                  entry["type"] = "community-developer"
              else:
                  entry["type"] = data.get("type", "community")

              # Add binary component if applicable
              if build.get("lang") in ("rust", "go"):
                  bin_name = build.get("binary_name", name)
                  entry["components"] = {
                      "skill": {"dir": skill.get("dir", ".")},
                      "binary": {
                          "repo": "okx/plugin-store",
                          "asset_pattern": f"{bin_name}-{{target}}",
                          "checksums_asset": "checksums.txt",
                          "release_tag": f"plugins/{name}@{entry['version']}"
                      }
                  }
              else:
                  entry["components"] = {"skill": {"dir": skill.get("dir", ".")}}

              # Add api_calls if present
              api_calls = data.get("api_calls", [])
              if api_calls:
                  entry["api_calls"] = api_calls

              # Preserve link/extra from existing registry
              existing = existing_by_name.get(name, {})
              if "link" in existing:
                  entry["link"] = existing["link"]
              if "extra" in existing:
                  entry["extra"] = existing["extra"]

              plugins.append(entry)

          result = {
              "schema_version": 1,
              "stats_url": current.get("stats_url", ""),
              "plugins": plugins
          }

          with open("registry.json", "w") as f:
              json.dump(result, f, indent=2, ensure_ascii=False)
              f.write("\n")

          print(f"Registry regenerated: {len(plugins)} plugins from skills/ scan")
          PYEOF

          git config user.name "plugin-store-bot"
          git config user.email "bot@plugin-store.local"
          git add registry.json
          git diff --staged --quiet && echo "No registry changes" && exit 0

          git commit -m "Update registry.json (full scan of skills/)"
          for attempt in 1 2 3 4 5; do
            if git push; then echo "Registry updated"; exit 0; fi
            echo "Push conflict ($attempt/5) — pulling latest and regenerating..."
            git reset --soft HEAD~1
            git checkout -- registry.json
            git pull origin main --rebase 2>/dev/null || git pull origin main
            # Re-run the full scan on latest main (just re-execute the python above)
            python3 -c "
          import json, os, yaml, glob
          with open('registry.json') as f: current = json.load(f)
          existing = {p['name']: p for p in current.get('plugins', [])}
          plugins = []
          for yp in sorted(glob.glob('skills/*/plugin.yaml')):
              d = os.path.dirname(yp); name = os.path.basename(d)
              if name.startswith('_'): continue
              with open(yp) as f: data = yaml.safe_load(f) or {}
              build = data.get('build', {}) or {}
              comp = data.get('components', {}).get('skill', {}) or {}
              e = {'name': name, 'version': str(data.get('version','0.1.0')), 'description': data.get('description',''), 'author': data.get('author',{}), 'license': data.get('license','MIT'), 'category': data.get('category',''), 'tags': data.get('tags',[]), 'type': 'community-developer' if build.get('lang') else data.get('type','community')}
              if build.get('lang') in ('rust','go'):
                  bn = build.get('binary_name', name)
                  e['components'] = {'skill': {'dir': comp.get('dir','.')}, 'binary': {'repo':'okx/plugin-store','asset_pattern':f'{bn}-{{target}}','checksums_asset':'checksums.txt','release_tag':f'plugins/{name}@{e[\"version\"]}'}}
              else:
                  e['components'] = {'skill': {'dir': comp.get('dir','.')}}
              ac = data.get('api_calls', [])
              if ac: e['api_calls'] = ac
              old = existing.get(name, {})
              if 'link' in old: e['link'] = old['link']
              if 'extra' in old: e['extra'] = old['extra']
              plugins.append(e)
          with open('registry.json','w') as f: json.dump({'schema_version':1,'stats_url':current.get('stats_url',''),'plugins':plugins},f,indent=2,ensure_ascii=False); f.write('\n')
          print(f'Regenerated: {len(plugins)} plugins')
          "
            git add registry.json
            git diff --staged --quiet && { echo "No changes after regeneration"; exit 0; }
            git commit -m "Update registry.json (full scan, retry $attempt)"
          done
          echo "::error::Failed to push registry after 5 attempts"
          exit 1

      - name: Un-draft all releases
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          echo "Checking for draft releases to publish..."
          DRAFTS=$(gh release list --repo "${{ github.repository }}" --limit 200 --json tagName,isDraft --jq '.[] | select(.isDraft) | .tagName')
          if [ -z "$DRAFTS" ]; then
            echo "No draft releases found"
            exit 0
          fi
          echo "$DRAFTS" | while read TAG; do
            echo "Publishing draft: $TAG"
            gh release edit "$TAG" --repo "${{ github.repository }}" --draft=false 2>&1 || true
          done
          echo "Done. All releases published."