From f02b0636217aebc1c1940670e1ae8bb277659592 Mon Sep 17 00:00:00 2001
From: Aric Camarata <aric.camarata@gmail.com>
Date: Fri, 11 Sep 2026 06:50:37 -0400
Subject: [PATCH] fix(ci): stop the counts gate turning main red over a missing
 secret

The cross-repo job exit 1'd when PLUGINS_PRO_CHECKOUT_TOKEN was absent. That
secret is owner-gated and does not exist, so the job failed on every push to
main from the moment it landed. A permanently-red main hides real failures
instead of catching them, which is worse than the gap it was flagging.

Adopts the Mode A / Mode B shape registry-check.yml already uses. With the
secret, counts.json is regenerated and diffed against the committed copy as
before. Without it, the job says plainly that the pro side was not verified and
that the free side was, and stops. It never skips silently.

The case that actually matters is untouched: scripts/plugin-counts.sh still
exits 1 rather than emit free-only counts, so a partial artifact can never be
generated or published. Verifying half is fine; publishing half is not.
---
 .github/workflows/plugin-counts.yml | 37 ++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/plugin-counts.yml b/.github/workflows/plugin-counts.yml
index 7a45560..3b1fd07 100644
--- a/.github/workflows/plugin-counts.yml
+++ b/.github/workflows/plugin-counts.yml
@@ -59,22 +59,39 @@ jobs:
           HAS_TOKEN: ${{ secrets.PLUGINS_PRO_CHECKOUT_TOKEN != '' }}
         run: echo "has-token=${HAS_TOKEN}" >> "$GITHUB_OUTPUT"
 
-      - name: Fail loudly if PLUGINS_PRO_CHECKOUT_TOKEN is not configured
+      # Mode B — the secret is absent, so the cross-repo half cannot run.
+      #
+      # This step used to `exit 1` here. That was wrong and it turned main red on
+      # every push: PLUGINS_PRO_CHECKOUT_TOKEN is owner-gated and does not exist,
+      # so the job could never pass, and a permanently-red main hides real
+      # failures rather than catching them.
+      #
+      # The distinction that matters: GENERATING counts without the pro registry
+      # must hard-fail, because a free-only artifact published as if complete is
+      # the exact bug this pipeline exists to remove. scripts/plugin-counts.sh
+      # still does that and exits 1 on a missing sibling. VERIFYING only the free
+      # half is legitimate, and the verify-free-only job above already did it.
+      #
+      # So this announces which mode ran and stops, loudly and visibly. It never
+      # skips silently, and it never lets a stale counts.json through unnoticed:
+      # the free-side check still ran, and the nightly cron plus the notice below
+      # keep the gap visible. Same Mode A / Mode B shape as registry-check.yml.
+      - name: Mode B — cross-repo verification skipped (no secret)
         if: steps.check-token.outputs.has-token != 'true'
         run: |
-          echo "ERROR: PLUGINS_PRO_CHECKOUT_TOKEN not configured." >&2
-          echo "This gate cannot verify counts.json without reading the" >&2
-          echo "private nself-org/plugins-pro registry, and it never emits" >&2
-          echo "partial (free-only) counts as a fallback — a silently-wrong" >&2
-          echo "count is the exact failure this generator exists to prevent." >&2
-          echo "Provision the secret (owner-gated, scoped read access to" >&2
-          echo "nself-org/plugins-pro) to enable this gate." >&2
-          exit 1
+          echo "::notice::Mode B — PLUGINS_PRO_CHECKOUT_TOKEN is not configured, so"
+          echo "::notice::counts.json was NOT verified against the private plugins-pro"
+          echo "::notice::registry. The free registry WAS verified by the job above."
+          echo "::notice::Provision the secret (owner-gated, scoped read access to"
+          echo "::notice::nself-org/plugins-pro) to enable the full cross-repo gate."
+          echo "Mode B: free-side verified, pro-side NOT verified (secret absent)."
 
       - name: Checkout plugins (this repo)
+        if: steps.check-token.outputs.has-token == 'true'
         uses: actions/checkout@v7
 
       - name: Checkout plugins-pro
+        if: steps.check-token.outputs.has-token == 'true'
         uses: actions/checkout@v7
         with:
           repository: nself-org/plugins-pro
@@ -82,9 +99,11 @@ jobs:
           token: ${{ secrets.PLUGINS_PRO_CHECKOUT_TOKEN }}
 
       - name: Regenerate counts.json
+        if: steps.check-token.outputs.has-token == 'true'
         run: bash scripts/plugin-counts.sh --json > /tmp/fresh-counts.json
 
       - name: Verify committed counts.json matches a fresh regeneration
+        if: steps.check-token.outputs.has-token == 'true'
         run: |
           python3 -c "
           import json, sys