Files
security-game/TODO.md
T
zwitschi 6684d36739
Full build / Import + headless tests (push) Successful in 26s
Full build / Full desktop build + optional release (push) Failing after 3m58s
Fix release publishing and add a CI token fallback
Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.
2026-10-31 21:23:09 +01:00

2.8 KiB
Raw Blame History

TODO

Godot 4.3 prototype. Release v0.2.9 is tagged. Headless suite 139/139, plus the session, PLAN-verb, crowd, emergency, timeline, audio, and windowed focus/radial smokes.

Host REQUIRE_SIGNIN_VIEW stays deferred.

Scenario content still missing vs PLAN lists

  • Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest refuses wand screening; late arrival during a performance.
  • Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival crowd spike (more rubberneckers, not only one arrive spawn).
  • Building: "activate body camera" and "request reason" once those verbs exist, used in at least one authored event.

Distribution follow-up (host config, deferred)

Verified via API+host credentials (2026-10-31):

  • Repo is public (private:false) and account has admin rights.
  • Release v0.2.1 now carries all five artifacts (portable binaries + NSIS installer + AppImage).
  • Remaining host setting: instance-wide [service] REQUIRE_SIGNIN_VIEW=true makes anonymous browsing/downloads redirect to login. Host admin: REQUIRE_SIGNIN_VIEW = false under [service] in app.ini, restart Gitea. Alternative: mirror downloads.

Release pipeline follow-up

  • Fix tools/publish_release.sh: the ~/.git-credentials branch never set AUTH, so every tag build since v0.2.2 failed to publish.
  • Add a github.token fallback in .gitea/workflows/build.yml (the repo has no GITEA_TOKEN secret).
  • Verify the fallback on the next tag push produces a release automatically.
  • Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not retained; would need local rebuilds) or leave them superseded by the latest.

Open Polish

  • Keep % placeholders stable in Strings.fmt when adding keys (positional formatting).

Screen design references (QA tooling)

  • tools/screen_designs.py generate writes one reference design per screen (from the docs/ descriptions) to docs/screens/designs/, with an offline --draft wireframe mode and an OpenRouter --ai mockup mode.
  • tools/screen_designs.py compare checks docs/screenshots/*.png against the designs (aspect ratio, size, blank-frame, and layout/palette/detail drift).
  • Vision-model judge for semantic screenshot comparison. Pixel and perceptual metrics cannot decide whether a frame's composition is correct; a follow-up should send the capture + reference design to a vision model and ask whether they depict the same screen.

Tooling (when an editor workflow exists)

  • IDE/editor-based GUT integration. Until then the custom headless runner stays.
  • Optional later: author venues as .tres resources instead of ScenarioFactory functions.