zerodenet · higanbana986 · Sep 9, 2026 · Sep 9, 2026
diff --git a/.github/ISSUE_TEMPLATE/submit-plugin.yml b/.github/ISSUE_TEMPLATE/submit-plugin.yml
@@ -1,12 +1,13 @@
 name: Submit a plugin / 提交插件
 description: Request a listing or release update in the marketplace. / 申请收录插件或更新发行版本。
 title: '[Plugin] '
+labels: ['plugin:submission']
 body:
   - type: markdown
     attributes:
       value: |
-        Publish and sign the plugin in its own repository first. Attach marketplace-entry.json or submit a PR using templates/plugin-entry.json.
-        先在独立仓库签名发布插件，再附上 marketplace-entry.json 或参照 templates/plugin-entry.json 提交 PR。不要提交源码、安装包或私钥。
+        Publish and sign the plugin in its own repository first. Provide the GitHub Release URL for marketplace-entry.json. Automation validates it and opens a review PR.
+        先在独立仓库签名发布插件，再提供 marketplace-entry.json 的 GitHub Release 链接，自动化会校验并生成审核 PR。不要提交源码、安装包或私钥。
   - type: dropdown
     id: host
     attributes:
@@ -34,11 +35,12 @@ body:
       label: Release URL and source commit / 发行地址与源码提交
     validations:
       required: true
-  - type: textarea
+  - type: input
     id: metadata
     attributes:
-      label: Release metadata / 发行元数据
-      description: Attach marketplace-entry.json or include platform, immutable URL, SHA-256 and byte size for every artifact. / 附上元数据文件，或填写各平台产物的固定地址、SHA-256 与字节数。
+      label: Release metadata URL / 发行元数据链接
+      description: An immutable GitHub Release asset URL, not a branch file. / 提供 GitHub Release 的固定产物链接，不要使用分支文件地址。
+      placeholder: https://github.com/owner/plugin/releases/download/v0.0.1/marketplace-entry.json
     validations:
       required: true
   - type: textarea

diff --git a/.github/labels.json b/.github/labels.json
@@ -0,0 +1,10 @@
+[
+  {"name":"plugin:submission","color":"5319E7","description":"Plugin listing or release submission / 插件收录申请"},
+  {"name":"plugin:update","color":"1D76DB","description":"Upstream release update / 上游发行更新"},
+  {"name":"host:zboard","color":"0052CC","description":"ZBoard plugin / 面板插件"},
+  {"name":"host:znet-sink","color":"0E8A16","description":"ZNet Sink plugin / 客户端插件"},
+  {"name":"status:needs-info","color":"D93F0B","description":"Metadata needs correction / 需要补充或修正元数据"},
+  {"name":"status:in-review","color":"FBCA04","description":"Validated metadata awaiting maintainer review / 等待维护者审核"},
+  {"name":"status:accepted","color":"0E8A16","description":"Release recorded in the main catalog / 已收录到主分支目录"},
+  {"name":"status:closed","color":"BFD4F2","description":"Submission or proposal closed without inclusion / 已关闭但未收录"}
+]
diff --git a/.github/workflows/marketplace.yml b/.github/workflows/marketplace.yml
@@ -0,0 +1,41 @@
+name: Marketplace synchronization
+on:
+  issues:
+    types: [opened, edited, reopened, labeled, closed]
+  pull_request_target:
+    types: [closed]
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: '23 */6 * * *'
+  workflow_dispatch:
+permissions: {}
+concurrency:
+  group: marketplace-synchronization
+  cancel-in-progress: false
+jobs:
+  synchronize:
+    if: github.repository == 'zerodenet/plugins'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      # Privileged events always run reviewed default-branch code, never a
+      # contributor checkout or anything extracted from a plugin package.
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python3 -m unittest discover -s tests
+      - run: python3 scripts/validate.py
+      - name: Maintain labels and propose catalog updates
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: python3 scripts/marketplace_sync.py
diff --git a/README.md b/README.md
@@ -8,7 +8,7 @@ A public registry of independently maintained plugins for [ZBoard](https://githu
 
 | Host | Registry | Available projects |
 | --- | --- | --- |
-| ZBoard | [catalogs/zboard.json](catalogs/zboard.json) | [OAuth for ZBoard](https://github.com/higanbana986/zboard-oauth) — source available; signed release pending |
+| ZBoard | [catalogs/zboard.json](catalogs/zboard.json) | [OAuth for ZBoard](https://github.com/higanbana986/zboard-oauth) — [v0.0.1 released](https://github.com/higanbana986/zboard-oauth/releases/tag/v0.0.1); [listing under review](https://github.com/zerodenet/plugins/issues/1) |
 | ZNet Sink | [catalogs/znet-sink.json](catalogs/znet-sink.json) | No submissions yet |
 
 OAuth connects GitHub, Google and custom OAuth2 / OpenID Connect providers to ZBoard. Its source, tests, configuration guides and release workflows are maintained in its independent repository. ZBoard retains control of account creation, registration policy and sessions.
@@ -37,6 +37,7 @@ All maintained registry data and policies live on `main`. Plugin source and bina
 
 ## Documentation
 
+- [Submission and update automation](docs/automation.md)
 - [Registry format](docs/registry-format.md)
 - [Publishing and review](docs/publishing.md)
 - [Host responsibilities](docs/governance.md)

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -8,7 +8,7 @@
 
 | 宿主 | 注册表 | 已有项目 |
 | --- | --- | --- |
-| ZBoard | [catalogs/zboard.json](catalogs/zboard.json) | [OAuth for ZBoard](https://github.com/higanbana986/zboard-oauth) — 源码可用，签名发行待发布 |
+| ZBoard | [catalogs/zboard.json](catalogs/zboard.json) | [OAuth for ZBoard](https://github.com/higanbana986/zboard-oauth) — [v0.0.1 已发布](https://github.com/higanbana986/zboard-oauth/releases/tag/v0.0.1)，[收录审核中](https://github.com/zerodenet/plugins/issues/1) |
 | ZNet Sink | [catalogs/znet-sink.json](catalogs/znet-sink.json) | 暂无提交 |
 
 OAuth 将 GitHub、Google 和自定义 OAuth2 / OpenID Connect 提供方接入 ZBoard。源码、测试、配置指南和发行流程均在独立仓库维护。账户创建、注册策略及会话仍由 ZBoard 核心掌管。
@@ -37,6 +37,7 @@ docs/           注册表格式、发行规范及宿主边界
 
 ## 文档
 
+- [收录与更新自动化](docs/automation.zh-CN.md)
 - [注册表格式](docs/registry-format.zh-CN.md)
 - [发布与审核](docs/publishing.zh-CN.md)
 - [宿主职责](docs/governance.zh-CN.md)

diff --git a/docs/automation.md b/docs/automation.md
@@ -0,0 +1,47 @@
+# Marketplace automation
+
+**English** · [简体中文](automation.zh-CN.md)
+
+The market proposes catalog changes from published GitHub releases. It does not rebuild plugins, execute their packages, sign releases on behalf of publishers, or merge its own proposals.
+
+## Submissions
+
+Publish `marketplace-entry.json` alongside the signed packages, then include its immutable GitHub Release asset URL in the submission form. Existing issues containing that URL are also supported. The workflow checks the release and opens a catalog PR. Correcting the issue reruns validation; one bot comment is maintained instead of adding repeated status messages.
+
+The metadata must describe exactly one release. Its repository, version and source commit must match the publishing repository and tag, including annotated tags. Every artifact URL, SHA-256 and size must match an asset in that release. Downloads are restricted to GitHub HTTPS release hosting; metadata is limited to 256 KiB. No contributor code is checked out or executed by the privileged workflow.
+
+These checks establish consistency with GitHub's release records. Maintainers still verify publisher/key ownership, package signatures, requested capabilities, migration behavior and actual host test evidence before merging. A submitted public key does not grant trust. Merge catalog PRs by squash or rebase to keep `main` linear.
+
+## Labels
+
+Definitions live in [.github/labels.json](../.github/labels.json). The workflow creates missing labels and updates their colors and descriptions, preserving unrelated labels.
+
+| Label | Meaning |
+| --- | --- |
+| `plugin:submission` | Initial listing or submitted release |
+| `plugin:update` | Release update found by the scheduled check |
+| `host:zboard`, `host:znet-sink` | Host inferred from validated metadata |
+| `status:needs-info` | Missing or invalid submission metadata |
+| `status:in-review` | Catalog PR awaits review |
+| `status:accepted` | Proposal merged or release already present on `main` |
+| `status:closed` | Submission or proposal closed without inclusion |
+
+Labels describe workflow state. Applying `status:accepted` manually cannot write to a catalog or approve an installation. Edits are read again before preparing a PR. A merge closes a linked submission only if its recorded body still matches, or a subsequent reconciliation verifies that its release is already recorded.
+
+## Upstream updates
+
+Every six hours, the workflow checks the latest stable GitHub Release for each plugin with an already recorded release and publisher key. Source-only listings are excluded. New releases create separate PRs and append to the existing history. Plugin ID, host, repository and publisher-key changes are rejected. A changed artifact for an existing version is rejected as well.
+
+A deterministic branch identifies each plugin/version proposal. Repeated runs reuse the existing PR, including closed proposals; rejected updates are not silently reopened. Reopen the proposal manually after resolving review feedback. When several upstream versions appear between scans, the latest stable release is proposed; intermediate versions can be submitted individually.
+
+The workflow also runs after a main-branch push and can be started from **Actions → Marketplace synchronization → Run workflow**. Commits are made as `github-actions[bot]`. The OAuth repository needs no cross-repository token: publishing its release metadata is sufficient for subsequent scheduled discovery after first inclusion.
+
+## Repository setup
+
+Enable **Settings → Actions → General → Workflow permissions → Allow GitHub Actions to create and approve pull requests**. The workflow requests only repository contents, issues and pull-request write permissions; it never approves PRs. Organization policy may control this setting. A permission failure fails the Action rather than labeling a publisher's valid submission as incorrect.
+
+GitHub may require a maintainer to approve checks on PRs created with `GITHUB_TOKEN`; check the PR's workflow banner. See [GitHub's workflow trigger rules](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow). No personal access token is required by this implementation.
+
+## Installation feeds
+
+Merging a PR updates `catalogs/zboard.json` or `catalogs/znet-sink.json`. These remain source catalogs. Publishing and renewing a signed host installation feed is a separate distribution operation with a separate market signing key; this workflow does not turn source JSON into an installable feed.
diff --git a/docs/automation.zh-CN.md b/docs/automation.zh-CN.md
@@ -0,0 +1,47 @@
+# 市场自动化
+
+[English](automation.md) · **简体中文**
+
+市场根据已公开的 GitHub Release 提议更新目录，不重新编译插件、不执行安装包、不代替发布者签名，也不自动合并自己的 PR。
+
+## 收录申请
+
+将 `marketplace-entry.json` 与签名安装包一同发布，在申请表中填写固定的 GitHub Release 产物链接。已有申请正文中的同类链接也可识别。工作流校验发行信息后生成目录 PR；编辑申请会重新校验，机器人维护同一条状态评论，避免重复刷屏。
+
+元数据只描述一个版本，仓库、版本、源码提交必须与实际发行及标签一致，支持解析附注标签。每个包的 URL、SHA-256 和大小必须与该次 Release 中的产物记录一致。元数据下载限定 GitHub HTTPS 发行托管域名，最大 256 KiB。带写权限的工作流不检出或执行贡献者代码。
+
+这些检查证明元数据与 GitHub 发行记录一致。合并前，维护者仍须核验发布者及公钥归属、安装包签名、所需能力、迁移行为及实际宿主测试证据。提交公钥不授予信任。目录 PR 使用 squash 或 rebase 合并，保持 `main` 线性历史。
+
+## 标签
+
+定义见 [.github/labels.json](../.github/labels.json)。工作流自动创建缺失标签并同步颜色和说明，保留无关标签。
+
+| 标签 | 含义 |
+| --- | --- |
+| `plugin:submission` | 首次收录或提交的发行版本 |
+| `plugin:update` | 定时检查发现的发行更新 |
+| `host:zboard`、`host:znet-sink` | 根据有效元数据识别的宿主 |
+| `status:needs-info` | 申请元数据缺失或有误 |
+| `status:in-review` | 已生成目录 PR，等待审核 |
+| `status:accepted` | PR 已合并，或版本已存在于主分支目录 |
+| `status:closed` | 申请或提议已关闭，未收录 |
+
+标签描述流程状态，手工添加 `status:accepted` 不会写入目录，也不能批准宿主安装。准备 PR 前会重新读取申请正文。合并后仅在关联申请正文仍与记录一致时关闭申请，或由后续对账核实其版本已被收录后关闭。
+
+## 上游更新
+
+每 6 小时检查已有发行记录和发布者公钥的插件仓库，读取最新稳定版 GitHub Release。只有源码的条目不会自动收录。发现新版本后单独生成 PR，并追加到原有发行历史；插件 ID、宿主、仓库、公钥变化以及既有版本的产物变化会被拒绝。
+
+每个插件及版本使用固定提议分支，多次运行复用同一个 PR。被关闭的提议不会静默重开，解决审核反馈后由维护者手动重开。如果两次扫描间发布了多个版本，自动提议最新稳定版；中间版本可逐个提交申请。
+
+工作流也在 `main` 更新后运行，并支持从 **Actions → Marketplace synchronization → Run workflow** 手动启动。自动提交使用 `github-actions[bot]` 身份。OAuth 仓库无需配置跨仓库 Token；首次收录后，只需随 Release 发布元数据即可被定时发现。
+
+## 仓库设置
+
+启用 **Settings → Actions → General → Workflow permissions → Allow GitHub Actions to create and approve pull requests**。工作流仅申请仓库内容、Issue 和 PR 写权限，不会批准 PR。组织策略可能控制此设置。权限不足会使 Action 失败，不会把有效申请误标为资料错误。
+
+GitHub 可能要求维护者批准由 `GITHUB_TOKEN` 创建的 PR 检查，请查看 PR 上的工作流提示，参见 [GitHub 触发规则](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow)。本实现不需要个人访问 Token。
+
+## 安装目录
+
+PR 合并后更新 `catalogs/zboard.json` 或 `catalogs/znet-sink.json`，它们仍是源目录。宿主签名安装目录的发布及续签需要独立的市场签名密钥和分发流程；本工作流不会将源 JSON 直接变成可安装目录。
diff --git a/docs/publishing.md b/docs/publishing.md
@@ -16,6 +16,9 @@ Submit the release using the issue form or PR template. Update only the relevant
 
 CI validates repository metadata and never executes submitted packages. Maintainers independently verify publisher/key ownership, release-to-source correspondence, package signatures, digests and host test evidence. A green source-validation check alone is insufficient for an installable listing.
 
+
+An issue containing the release metadata URL is validated automatically and linked to a generated review PR. After first inclusion, scheduled checks propose new stable releases without a cross-repository publisher token. Labels track validation, review and inclusion; they do not authorize a merge. See [marketplace automation](automation.md) for setup and failure handling.
+
 ## Signed installation feeds
 
 The source catalogs are not directly installable. A distribution publisher must select host- and platform-compatible reviewed artifacts, create the host's signed catalog, serve it over an accepted HTTPS download path and renew it before expiry. Catalog signing uses a market key distinct from plugin publisher keys.

diff --git a/docs/publishing.zh-CN.md b/docs/publishing.zh-CN.md
@@ -16,6 +16,9 @@
 
 CI 校验仓库元数据，不执行提交的安装包。维护者独立核实发布者及公钥归属、发行与源码关系、包签名、摘要和宿主测试证据。仅通过源目录校验不足以证明版本可安装。
 
+
+提供发行元数据链接的申请会自动校验并关联生成的审核 PR。首次收录后，定时检查会提议新的稳定版，无需发布者配置跨仓库 Token。标签跟踪校验、审核和收录状态，不授予合并权限。设置及故障处理见[市场自动化](automation.zh-CN.md)。
+
 ## 签名安装目录
 
 源目录不能直接用于安装。分发发布者需选择已审核、兼容宿主和平台的产物，生成宿主格式的签名目录，使用宿主接受的 HTTPS 下载路径提供文件，并在过期前续签。市场目录密钥与插件发布者密钥分别管理。