Files
security-game/TODO.md
T
zwitschi b4d189c325
Full build / Import + headless tests (push) Successful in 36s
Full build / Full desktop build + optional release (push) Successful in 3m37s
Publish releases with the runner's checkout credentials
The v0.2.10 tag build still failed to publish: its env dump showed no token at all,
because this Gitea/act runner does not provide `github.token`, and the repo has no
GITEA_TOKEN secret.

publish_release.sh now resolves credentials in order: GITEA_TOKEN,
GITEA_AUTH_HEADER, ~/.git-credentials, then the local git extraheader that
actions/checkout writes for the job. That header carries the runner's basic-auth
credentials for the same server, so tag builds publish with no repo secret.

Verified by adding the extraheader locally and publishing v0.2.10 (all five
artifacts: Linux/Windows/macOS ports, NSIS installer, AppImage), then removing it.

Docs: RELEASING describes the four credential sources and warns that github.token is
not available here; MEMORY records both failed attempts and the final fix; TODO keeps
the "verify on the next tag" follow-up. Version 0.2.11.
2026-10-31 21:30:24 +01:00

2.9 KiB
Raw Permalink Blame History

TODO

Godot 4.3 prototype. Release v0.2.9 is tagged. Headless suite 139/139, plus the session, PLAN-verb, crowd, emergency, timeline, audio, and windowed focus/radial smokes.

Host REQUIRE_SIGNIN_VIEW stays deferred.

Scenario content still missing vs PLAN lists

  • Joke Shop: guest on the reservation list without ID; borrowed/mismatched ID; guest refuses wand screening; late arrival during a performance.
  • Studio: filming-boundary repeat (influencer ignores a posted line); celebrity-arrival crowd spike (more rubberneckers, not only one arrive spawn).
  • Building: "activate body camera" and "request reason" once those verbs exist, used in at least one authored event.

Distribution follow-up (host config, deferred)

Verified via API+host credentials (2026-10-31):

  • Repo is public (private:false) and account has admin rights.
  • Release v0.2.1 now carries all five artifacts (portable binaries + NSIS installer + AppImage).
  • Remaining host setting: instance-wide [service] REQUIRE_SIGNIN_VIEW=true makes anonymous browsing/downloads redirect to login. Host admin: REQUIRE_SIGNIN_VIEW = false under [service] in app.ini, restart Gitea. Alternative: mirror downloads.

Release pipeline follow-up

  • Fix tools/publish_release.sh: the ~/.git-credentials branch never set AUTH, so every tag build since v0.2.2 failed to publish.
  • Add a github.token fallback in .gitea/workflows/build.yml (the repo has no GITEA_TOKEN secret).
  • Fall back to the checkout's git extraheader when no token/credentials exist (the Gitea runner does not expose github.token).
  • Verify the fallback on the next tag push produces a release automatically.
  • Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not retained; would need local rebuilds) or leave them superseded by the latest.

Open Polish

  • Keep % placeholders stable in Strings.fmt when adding keys (positional formatting).

Screen design references (QA tooling)

  • tools/screen_designs.py generate writes one reference design per screen (from the docs/ descriptions) to docs/screens/designs/, with an offline --draft wireframe mode and an OpenRouter --ai mockup mode.
  • tools/screen_designs.py compare checks docs/screenshots/*.png against the designs (aspect ratio, size, blank-frame, and layout/palette/detail drift).
  • Vision-model judge for semantic screenshot comparison. Pixel and perceptual metrics cannot decide whether a frame's composition is correct; a follow-up should send the capture + reference design to a vision model and ask whether they depict the same screen.

Tooling (when an editor workflow exists)

  • IDE/editor-based GUT integration. Until then the custom headless runner stays.
  • Optional later: author venues as .tres resources instead of ScenarioFactory functions.