From 94af1bf199e25abf6bda2aced22639b203a5e729 Mon Sep 17 00:00:00 2001
From: Michael Kantor <6068672+kantorcodes@users.noreply.github.com>
Date: Sat, 4 Jul 2026 14:36:24 -0400
Subject: [PATCH] fix: claim-notice permissions, README fallback, stale mirror
 files

Three bugs fixed:

1. claim-notice.yml: pull_request -> pull_request_target
   Fork PRs get read-only GITHUB_TOKEN on pull_request events.
   pull_request_target runs with base branch token, granting
   pull-requests: write permission. The workflow only runs
   scripts/post-claim-notice.py from the base branch (no PR code
   execution), so this is safe.

2. post-claim-notice.py: README fallback when plugin not in registry
   When a PR is merged, the claim-notice workflow fires immediately
   but the registry sync hasn't completed yet. Now falls back to
   checking the local README.md for plugin repo URLs.

3. generate_plugins_json.py: add SKILL.md, .github/dependabot.yml,
   codex.mcp.json, .mcp.json to OPTIONAL_PLUGIN_FILES
   These trust-relevant files were not mirrored from upstream repos,
   causing stale trust scores (e.g. VidSeeds.ai stuck at security 66
   despite upstream having SECURITY.md, SKILL.md, Dependabot config).
---
 .github/workflows/claim-notice.yml |  2 +-
 scripts/generate_plugins_json.py   |  4 ++++
 scripts/post-claim-notice.py       | 18 ++++++++++++++++--
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/claim-notice.yml b/.github/workflows/claim-notice.yml
index b18160cab..b33b448b5 100644
--- a/.github/workflows/claim-notice.yml
+++ b/.github/workflows/claim-notice.yml
@@ -1,7 +1,7 @@
 name: Plugin Claim Notice
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - closed
     paths:
diff --git a/scripts/generate_plugins_json.py b/scripts/generate_plugins_json.py
index 3209d1233..c71e8f5f7 100644
--- a/scripts/generate_plugins_json.py
+++ b/scripts/generate_plugins_json.py
@@ -45,6 +45,10 @@
     "yarn.lock",
     ".codexignore",
     ".agents/plugins/marketplace.json",
+    "SKILL.md",
+    ".github/dependabot.yml",
+    "codex.mcp.json",
+    ".mcp.json",
   )
 METADATA_ONLY_MIRROR_REPOS = {
     # EOC's repo-root Codex plugin references a large skills/commands catalog.
diff --git a/scripts/post-claim-notice.py b/scripts/post-claim-notice.py
index 581d00e3c..8bf976837 100755
--- a/scripts/post-claim-notice.py
+++ b/scripts/post-claim-notice.py
@@ -267,8 +267,22 @@ def main():
     # 5. Check which PR repos are in the registry
     matched = pr_repos & registry_repos
     if not matched:
-        print("  Skipping: none of the PR repos are in the registry")
-        return 0
+        # Fallback: check local README.md — the plugin may have just been merged
+        # and the registry sync hasn't completed yet
+        print("  Not in registry yet, checking local README.md...")
+        readme_path = os.path.join(os.path.dirname(os.path.dirname(__file__)), "README.md")
+        if os.path.exists(readme_path):
+            readme_content = open(readme_path, encoding="utf-8").read().lower()
+            readme_matched = {r for r in pr_repos if r.lower() in readme_content}
+            if readme_matched:
+                print(f"  Found in README (pending registry sync): {', '.join(readme_matched)}")
+                matched = readme_matched
+            else:
+                print("  Skipping: none of the PR repos are in the registry or README")
+                return 0
+        else:
+            print("  Skipping: README.md not found and repos not in registry")
+            return 0
 
     print(f"  Matched in registry: {', '.join(matched)}")