draft: @game-ci/dedicated-server-provisioning plugin (structural skeleton) - #132
Closed
frostebite wants to merge 2 commits into
Closed
draft: @game-ci/dedicated-server-provisioning plugin (structural skeleton)#132frostebite wants to merge 2 commits into
frostebite wants to merge 2 commits into
Conversation
…nctional yet) Structural skeleton for a dedicated-server provisioning plugin (docker-compose/systemd units, health checks), complementing rather than duplicating a build-time server-packaging step. Not wired into core's default load list; provision-server is not yet a core command. See plugins/dedicated-server-provisioning/README.md.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI's bun install --frozen-lockfile was failing on this branch since the lockfile never reflected the new plugins/<name> workspace member.
Member
Author
|
Superseded by #142, which lands this skeleton verbatim. Consolidated rather than merged individually: every one of these PRs touches |
frostebite
added a commit
that referenced
this pull request
Aug 24, 2026
…eline, provisioning, service directory, anti-cheat) (#144) * feat(orchestrator): build-lifecycle capabilities (symbols, visual baseline, provisioning, service directory, anti-cheat) Implements five capabilities that were drafted as standalone @game-ci/* plugin skeletons (#128, #130, #132, #133, #136) as real orchestrator features instead. A plugin exists to add user-facing command surface - a new verb, engine, or deploy target (steam-deploy, runtime-test-framework, the engine plugins). None of these five are that. They are things that happen *to* a build or a running job, which is what orchestrator already does: it owns providers/ (where a job runs) plus services/ for cache, hooks, output, preflight, reliability, secrets and sync. Two of them overlapped existing orchestrator surface outright - anti-cheat registered options and no command at all (that is middleware-service), and screen-capture duplicated the built-in `images` output type. What landed: symbol-collector.ts + `symbols` output type - finds dSYM bundles, PDB, Breakpad, DWARF and IL2CPP maps under a build. Sits beside the existing coverage/logs/metrics built-ins because symbols must be captured at build time or they are gone: once the machine is torn down, every future crash report from that build is unsymbolicatable. A .dSYM is reported as one bundle entry rather than descended into, since the symbolicator needs the bundle structure intact. Uploading is left to the existing ArtifactUploadHandler - no vendor-specific upload path here. visual-baseline.ts + `visual-baseline` output type - digest-based comparison of this run's captures against the accepted reference set. Deliberately NOT perceptual diffing: a byte hash answers "did this change at all" exactly, with no image codec, and pretending it were a threshold diff would be worse than not offering one. An empty baseline reports as unverified rather than as a pass, so the check cannot go vacuous after an accidental baseline deletion. dedicated-server-provisioner.ts - docker-compose, systemd unit and ufw rules from a typed config. Pure functions; nothing is written or executed, so a generator bug cannot mutate a real host. Port protocol is always explicit (a UDP game port published as TCP yields a server that starts cleanly and is unreachable), the unit is ordered after docker.service so a reboot does not race the daemon, and it does not run as root by default. service-directory.ts - registry for exposed job endpoints, with the disclosure rules as the actual content. An ephemeral tunnel URL is an unauthenticated entry point into a machine holding source and credentials, and CI logs are often public, so visibility is explicit per service and formatForLog redacts the whole private URL - a random subdomain IS the secret, so partial masking would still leak it. Does not start tunnels; a caller registers whatever URL it resolved. anti-cheat-middleware.ts - preset over the existing Middleware type, running at post-build (before default-priority packaging, or an unprotected binary ships) with allowFailure forced false. The SDKs are NDA-gated so the command is caller-supplied rather than guessed; credentials go through OrchestratorSecret instead of being interpolated into a shell string. All five are exported from the package entry point. Tests: 50 new, passing under BOTH vitest and bun - they avoid vi.mock(module, fn), which is what makes the 244 pre-existing orchestrator failures fail under bun's runner, so this adds none of them. tsc --noEmit is clean and oxfmt has been applied. * test: update built-in output-type counts for symbols/visual-baseline The registry tests assert the number of built-in types, so adding `symbols` and `visual-baseline` broke them: 8 -> 10 built-in, and 9 -> 11 for the built-in-plus-one-custom case. Also adds both new names to the it.each parity list, so they get the same defined/name/builtIn coverage every other built-in type has rather than only being counted. Caught by CI, not locally: I had run only the new test files. Full `vitest run` now passes except two failures that reproduce identically on a clean main (an rclone step test, and cli-integration timing out under parallel load) - both pre-existing and unrelated.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Structural skeleton for a dedicated-server provisioning plugin: generates docker-compose/systemd units, firewall/port config, and a health-check endpoint for self-hosters - the "stand this up" ops half, complementing rather than duplicating a separate build-time server-packaging step. Not functional yet, and
provision-serveris not yet registered as a core CLI command.See
plugins/dedicated-server-provisioning/README.mdfor what's real vs. TODO.