plugin-lint.yml

# Phase 2: Structural Validation
# Uses pull_request_target to have write permissions for PR comments/labels
# even when the PR comes from an external contributor (fork).
#
# SECURITY: pull_request_target runs the workflow from main (not from the PR),
# so the workflow code itself is trusted. We only checkout PR code for linting.

name: "Phase 1: Structure Validation"

on:
  pull_request_target:
    paths:
      - 'submissions/**'
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  detect-plugin:
    name: Detect changed plugin
    runs-on: ubuntu-latest
    outputs:
      plugin_dir: ${{ steps.find.outputs.plugin_dir }}
      plugin_name: ${{ steps.find.outputs.plugin_name }}
      is_new: ${{ steps.find.outputs.is_new }}
    steps:
      # Checkout the PR code (not main) for inspection
      - uses: actions/checkout@v4
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Find changed plugin directory
        id: find
        run: |
          CHANGED=$(git diff --name-only origin/main...${{ github.event.pull_request.head.sha }} -- 'submissions/' | head -100)

          if [ -z "$CHANGED" ]; then
            echo "No changes in submissions/"
            exit 1
          fi

          PLUGIN_NAME=$(echo "$CHANGED" | head -1 | cut -d'/' -f2)
          PLUGIN_DIR="submissions/${PLUGIN_NAME}"

          echo "plugin_dir=${PLUGIN_DIR}" >> "$GITHUB_OUTPUT"
          echo "plugin_name=${PLUGIN_NAME}" >> "$GITHUB_OUTPUT"

          if git show origin/main:"${PLUGIN_DIR}/plugin.yaml" > /dev/null 2>&1; then
            echo "is_new=false" >> "$GITHUB_OUTPUT"
          else
            echo "is_new=true" >> "$GITHUB_OUTPUT"
          fi

          echo "Plugin: ${PLUGIN_NAME} (dir: ${PLUGIN_DIR})"

      - name: Verify PR only modifies one plugin
        run: |
          CHANGED=$(git diff --name-only origin/main...${{ github.event.pull_request.head.sha }} -- 'submissions/')
          DIRS=$(echo "$CHANGED" | cut -d'/' -f2 | sort -u)
          COUNT=$(echo "$DIRS" | wc -l | tr -d ' ')

          if [ "$COUNT" -gt 1 ]; then
            echo "::error::PR modifies multiple plugins: $(echo $DIRS | tr '\n' ', ')."
            exit 1
          fi

      - name: Verify PR does not modify files outside submissions/
        run: |
          OUTSIDE=$(git diff --name-only origin/main...${{ github.event.pull_request.head.sha }} | grep -v '^submissions/' || true)
          if [ -n "$OUTSIDE" ]; then
            echo "::error::PR modifies files outside submissions/: ${OUTSIDE}."
            exit 1
          fi

  lint:
    name: Structure validation
    needs: detect-plugin
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: ${{ runner.os }}-cargo-lint-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: ${{ runner.os }}-cargo-lint-

      - name: Install plugin-store CLI
        run: cargo install --git https://github.com/okx/plugin-store.git plugin-store

      - name: Check if PR author is OKX org member
        id: org_check
        run: |
          AUTHOR="${{ github.event.pull_request.user.login }}"
          HEAD_REPO="${{ github.event.pull_request.head.repo.full_name }}"

          # Method 1: PR comes from okx/ org repo (direct push)
          if echo "$HEAD_REPO" | grep -q "^okx/"; then
            echo "is_okx_member=true" >> "$GITHUB_OUTPUT"
            echo "${AUTHOR} pushed from okx/ org repo — official prefix allowed"
            exit 0
          fi

          # Method 2: Check if author is a public member of okx org
          HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://api.github.com/orgs/okx/members/${AUTHOR}" \
            -H "Authorization: Bearer ${{ github.token }}")

          if [ "$HTTP_CODE" = "204" ]; then
            echo "is_okx_member=true" >> "$GITHUB_OUTPUT"
            echo "${AUTHOR} is an OKX org member — official prefix allowed"
          else
            echo "is_okx_member=false" >> "$GITHUB_OUTPUT"
            echo "${AUTHOR} is not an OKX org member (HTTP ${HTTP_CODE})"
          fi

      - name: Check name uniqueness
        id: name_check
        run: |
          PLUGIN_NAME="${{ needs.detect-plugin.outputs.plugin_name }}"
          IS_NEW="${{ needs.detect-plugin.outputs.is_new }}"

          if [ "$IS_NEW" != "true" ]; then
            echo "Plugin update (not new) — skip uniqueness check"
            echo "duplicate=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          # Fetch current registry and check for duplicate name
          REGISTRY=$(curl -sSL --max-time 10 \
            "https://raw.githubusercontent.com/okx/plugin-store/main/registry.json" 2>/dev/null || echo '{"plugins":[]}')

          EXISTING=$(echo "$REGISTRY" | jq -r '.plugins[].name' 2>/dev/null)

          if echo "$EXISTING" | grep -qx "$PLUGIN_NAME"; then
            echo "::error::Plugin name '${PLUGIN_NAME}' already exists in registry. Choose a different name."
            echo "duplicate=true" >> "$GITHUB_OUTPUT"
          else
            echo "Name '${PLUGIN_NAME}' is unique — OK"
            echo "duplicate=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Run lint
        id: lint
        env:
          PLUGIN_STORE_OFFICIAL: ${{ steps.org_check.outputs.is_okx_member == 'true' && '1' || '0' }}
        run: |
          set +e
          OUTPUT=$(plugin-store lint "${{ needs.detect-plugin.outputs.plugin_dir }}" 2>&1)
          EXIT_CODE=$?
          set -e

          # Append name uniqueness result
          if [ "${{ steps.name_check.outputs.duplicate }}" = "true" ]; then
            DUPE_MSG="  E034: name '${{ needs.detect-plugin.outputs.plugin_name }}' already exists in registry"
            OUTPUT=$(printf '%s\n%s' "$OUTPUT" "$DUPE_MSG")
            EXIT_CODE=1
          fi

          echo "$OUTPUT"

          {
            echo 'lint_output<<LINT_EOF'
            echo "$OUTPUT"
            echo 'LINT_EOF'
          } >> "$GITHUB_OUTPUT"

          echo "exit_code=${EXIT_CODE}" >> "$GITHUB_OUTPUT"

      - name: Add labels
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const isNew = '${{ needs.detect-plugin.outputs.is_new }}' === 'true';
            const passed = '${{ steps.lint.outputs.exit_code }}' === '0';
            const prNumber = ${{ github.event.pull_request.number }};

            const typeLabel = isNew ? 'new-plugin' : 'plugin-update';
            try {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: prNumber,
                labels: [typeLabel]
              });
            } catch (e) { console.log('Label error:', e.message); }

            if (passed) {
              try {
                await github.rest.issues.addLabels({
                  owner: context.repo.owner, repo: context.repo.repo,
                  issue_number: prNumber, labels: ['structure-validated']
                });
                await github.rest.issues.removeLabel({
                  owner: context.repo.owner, repo: context.repo.repo,
                  issue_number: prNumber, name: 'needs-fix'
                });
              } catch (e) { /* label not present */ }
            } else {
              try {
                await github.rest.issues.addLabels({
                  owner: context.repo.owner, repo: context.repo.repo,
                  issue_number: prNumber, labels: ['needs-fix']
                });
                await github.rest.issues.removeLabel({
                  owner: context.repo.owner, repo: context.repo.repo,
                  issue_number: prNumber, name: 'structure-validated'
                });
              } catch (e) { /* label not present */ }
            }

      - name: Post lint report as PR comment
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const output = `${{ steps.lint.outputs.lint_output }}`.replace(/`/g, '\\`');
            const passed = '${{ steps.lint.outputs.exit_code }}' === '0';
            const icon = passed ? '✅' : '❌';
            const status = passed ? 'PASSED' : 'FAILED';
            const prNumber = ${{ github.event.pull_request.number }};

            const body = `## ${icon} Phase 1: Structure Validation — ${status}\n\n\`\`\`\n${output}\n\`\`\`\n\n${passed ? '→ Proceeding to Phase 2: Build Verification' : '→ Please fix the errors above and push again.'}`;

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner, repo: context.repo.repo,
              issue_number: prNumber,
            });
            const botComment = comments.find(c =>
              c.user.type === 'Bot' && c.body.includes('Phase 1: Structure Validation')
            );

            const params = { owner: context.repo.owner, repo: context.repo.repo, body };
            if (botComment) {
              await github.rest.issues.updateComment({ ...params, comment_id: botComment.id });
            } else {
              await github.rest.issues.createComment({ ...params, issue_number: prNumber });
            }

      - name: Fail if lint errors
        if: steps.lint.outputs.exit_code != '0'
        run: exit 1