Build paid plugins individually with each owner's GitHub token

[simonhamp]

Problem

A full Satis rebuild (php artisan satis:build with no --plugin) sent every paid plugin in a single request using one shared GitHub token. A satis build can only authenticate to github.com as one identity, but paid plugins live in private repos across different owners/orgs — so one token can't clone them all and the rest fall back to unauthenticated requests, hitting GitHub's 60/hour rate limit. Combined with satis's --skip-errors, the build "succeeded" with most repos skipped and authoritatively overwrote packages.json with a near-empty index.

(Per-plugin syncs via SyncPluginReleases already used the owner's token, so only the full-rebuild path was affected.)

Changes

• buildAll() now builds each approved paid plugin individually, using its owner's GitHub token (resolved via ResolvesGitHubToken). Each is a partial, merging build on the satis side, so a single failure can never overwrite the published index with an incomplete set. Returns a per-plugin summary (plugins_count, failed, results).
• Refactor ResolvesGitHubToken to expose resolveGitHubTokenFor(Plugin) (the existing getGitHubToken() delegates to it, behaviour unchanged); SatisService now uses the trait.
• Add SatisService::buildForPlugin() — resolve owner token + build one plugin. The satis:build --plugin path now uses it too (previously it sent no token).
• satis:build command reports per-plugin dispatch results.
• Test updated: buildAll now sends one partial build per paid plugin (full_build === false), asserted via Http::assertSentCount(1).

Note

This is the root-cause fix; the companion guard in plugins.nativephp.com (NativePHP/plugins.nativephp.com#7) refuses to publish an incomplete full build as defense-in-depth. Paid plugins whose owner has not connected GitHub still fall back to config('services.github.token') (GITHUB_TOKEN), which is currently unset and not in .env.example — worth setting. The long-term fix is the GitHub App (in progress separately).

Testing

php artisan test tests/Feature/SatisSync/SatisSyncTest.php tests/Feature/Jobs/SyncPluginReleasesTest.php → 11 passed. php -l and Pint clean on changed files.

🤖 Generated with Claude Code