v1.1.1 — DEEMO 1 Artwork Archive

Maintenance release of the DEEMO 1 artwork archive. The archived files are the same as in v1.1.0. This release tightens the deployment checks and the redirect rules of the fetchers, and closes the remaining minor findings of the independent review.

Browse: searchable gallery · slideshow

Archive contents

• data/ and assets/ are byte-identical to v1.1.0.
• No fetcher was run for this release. The fetcher changes below apply to future runs.

Deployment

• Release check: every run of the Pages workflow now checks that its tag has a published GitHub Release that is not a prerelease. The guard job, and again the build job, each make one read-only request to the GitHub API for it. This applies to a run started by a Release, to a manual run and to a re-run. The run is refused on any other answer: no Release, a draft, a prerelease, a Release of another tag, an error or an unreadable answer.
  • A re-run keeps the event of the run it repeats, so a release's run that is re-run after its Release became a draft or a prerelease, or was deleted, is refused. A re-run of the deploy job alone repeats no Release lookup, so re-run the whole run.
  • A run takes the workflow from its tag's commit. A run on a tag before v1.1.1 would use that tag's own workflow, which does not make this check; the github-pages environment refuses its deployment (see below).
• Tag form: a vX.Y.Z tag has three numbers without leading zeros. v1.10.0 is accepted; v1.02.0 and v01.1.0 are refused.
• Prerelease flag: the deploy job's own condition now also refuses a release event without a prerelease flag, as the guard and build jobs already did.
• Approved commit: the deploy job runs only for the commit that the guard job approved.
• Tag ruleset and environment: a repository ruleset, "Release tags v*", lets only repository admins create, move or delete v* tags. The github-pages environment now accepts deployments only from tags from v1.1.1 on, and no longer from main. A run takes the Pages workflow from its tag's commit, so the two keep anyone but an admin from deploying through the github-pages environment with a workflow of their own.
• Unchanged: publishing a Release still deploys its tag's commit after the full test workflow passes on it. Pushes and pull requests never deploy.

Fetchers and checks

• Archive fetcher redirects: a reachability check of a catalogued page follows a redirect only over https to the page's own host or its www. sibling (the host without its leading www., or with www. added when it has none).
  • A redirect to another host is followed only along an entry of a reviewed list, CROSS_HOST_REDIRECTS. No committed row was redirected to another host, so the list is empty.
  • A page on an IP address follows no redirect, and no redirect to an IP address is followed.
  • Any other redirect is not requested and is recorded as redirected_off_site.
  • This replaces the registrable-domain rule of v1.1.0.
• Redirect bodies: no request reads the body of a redirect any more. Before, requests read that body in full, even for a redirect it did not follow; in the wiki fetcher that read bypassed its 64 MiB response limit.
• Unreadable redirects: a redirect whose Location is not UTF-8 is now refused with the fetcher's own error, which names that Location, and nothing more is requested.
  • In the archive fetcher's reachability checks, that page is now recorded as request_failed. In v1.1.0 the error ended the whole catalog step, which was then recorded as an unexpected failure.
  • Elsewhere it was already recorded as a failed request, only with a bare UTF-8 decoding error.
  • In the wiki fetcher's discovery and DeemoSongs requests it still stops the run with an error, like any other refused request.
• Redirect targets: a Location is read the way requests reads it before it is resolved.
• Source check: a path is also refused when a piece becomes . or .. after Unicode normalization, after invisible format characters are removed, after an IIS-style %u escape is decoded, or after trailing dots and spaces are trimmed. None of the committed download URLs is affected.
• Tests: further tests pin the deployment guard, the redirect rules and the wiki fetcher's response handling.

Known gaps

• Weekly source check: its pull-request write path has not yet run against a live change.
• Pre-release review: its low-severity findings are left for v1.1.2. Among them, a re-run of the deploy job alone repeats no Release lookup; re-run the whole run instead.

Rights

The software is licensed under Apache-2.0 (see LICENSE and NOTICE). The original gallery design is by Mashiro (mashirozx/deemo). Song artwork and other game assets remain © Rayark Inc. and their respective creators; the software license grants no rights to these media. See the license and attribution index.

---

简体中文： DEEMO 1 曲绘档案的维护版本，存档文件与 v1.1.0 完全相同。

• 部署：
  • 每次运行（由 Release 触发、手动运行或重新运行）都会检查该标签是否有已发布、非预发布的 GitHub Release：检查任务和构建任务各向 GitHub API 发出一次只读请求，其他任何结果都会拒绝运行。只重新运行部署任务时不会再次查询 Release，因此应重新运行整次运行。
  • 运行使用标签所指提交中的工作流，v1.1.1 之前的标签不做这项检查；github-pages 环境现在只接受 v1.1.1 及之后的标签（不再接受 main），会拒绝这类运行的部署。
  • 标签的三个数字不能有前导零（v1.10.0 可以，v1.02.0 不行）。
  • 部署任务自身的条件现在也拒绝缺少预发布标记的 Release 事件（此前已由检查任务和构建任务拒绝）；部署任务只部署检查任务批准的提交。
  • 仓库规则集 "Release tags v*" 只允许仓库管理员创建、移动或删除 v* 标签。
• 抓取脚本：
  • 目录页面的可达性检查只跟随到页面自身主机（或加上、去掉 www.）的 https 重定向，或经审核列表中的跨主机重定向（该列表目前为空）；不跟随与 IP 地址有关的重定向。
  • 任何请求都不再读取重定向响应的正文（以前 requests 会完整读取该正文；在 wiki 抓取脚本中不受其 64 MiB 上限约束）。
  • 非 UTF-8 的重定向地址现在以抓取脚本自己的错误拒绝，并写明该地址；归档脚本的可达性检查只把该页面记为 request_failed，不再中断整个目录步骤；其他请求此前已记为失败。
  • 来源检查拒绝更多 ./.. 路径段的写法。
• 已知缺口： 每周来源检查的 PR 写入路径尚未在真实变更上运行过；发布前代码审查的低严重度问题留到 v1.1.2（例如只重新运行部署任务时不会再次查询 Release，应重新运行整次运行）。

曲绘及游戏素材的权利仍属于 Rayark Inc. 与对应创作者。