Skip to content

Release: 4 features, 1 fix, 1 test, 1 chore → Main#8181

Merged
h0lybyte merged 7 commits intomainfrom
dev
Mar 17, 2026
Merged

Release: 4 features, 1 fix, 1 test, 1 chore → Main#8181
h0lybyte merged 7 commits intomainfrom
dev

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Mar 17, 2026

Release: Dev → Main

7 atomic commits ready for main

Features

Bug Fixes

Tests

Chores


This PR is automatically maintained by CI — KBVE Studio

… and rate limits (#8179)

Uses axum::serve as a mock GitHub API to test HTTP status → JediError
mapping (401, 403, 404, 429, 500), rate limit header parsing, PR
filtering in list_issues, and invalid JSON handling. 11 new tests.
…etworking, pool indexing (#8176)

* feat(axum-kbve): add captured creature sync and PendingAuth timeout

- send_captured_state_to_new_clients: sends all captured creatures to
  newly authenticated clients so they skip rendering those slots
- timeout_pending_auth: despawns clients that sit in PendingAuth for
  more than 10 seconds without sending a valid JWT

Ref: #8152

* feat(isometric): add client-side creature capture networking

Add CreaturePoolIndex component to all creature spawn pools (firefly,
butterfly, frog) for server-side creature identification. Add
receive_creature_captured system that processes CreatureCaptured messages
from the server and marks matching pool entities as Captured + Hidden.
Add CapturedCreatures resource to track captured state client-side,
cleared on disconnect for clean reconnect.

* feat(isometric): add CreatureCaptureEvent observer for server requests

Add CreatureCaptureEvent and forward_creature_capture_to_server observer
that sends CreatureCaptureRequest messages to the game server when
triggered. Future creature interaction systems (click/proximity) can
fire this event to initiate server-validated captures.
Add POST /api/servers/submit endpoint with belt-and-suspenders validation,
IP-based rate limiting (5 req/60s), and edge function forwarding. Frontend
submitServer() now routes through Rust API instead of direct edge calls.

Closes #7727
@github-actions
Copy link
Contributor Author

github-actions bot commented Mar 17, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 3 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/kanban-sync.yml

PackageVersionLicenseIssue Type
actions/checkout6.*.*NullUnknown License
actions/github-script8.*.*NullUnknown License
actions/setup-node6.*.*NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 6.*.* 🟢 5.9
Details
CheckScoreReason
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/github-script 8.*.* 🟢 7.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1013 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
actions/actions/setup-node 6.*.* 🟢 6.1
Details
CheckScoreReason
Maintained🟢 1012 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 9binaries present in source code
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9

Scanned Files

  • .github/workflows/kanban-sync.yml

@github-actions github-actions bot changed the title Release: 1 feature, 1 test → Main Release: 2 features, 1 test → Main Mar 17, 2026
…as (#8185)

Add DroidDownscaleSchema and DroidUpscaleSchema to DroidEventSchemas
to fix TS2345 errors in main.ts where emit() calls used unregistered
event types. Add 67 new tests covering event bus, UI state, toast state,
auth state, event type schemas, and bento tile validation.
@github-actions github-actions bot changed the title Release: 2 features, 1 test → Main Release: 2 features, 1 fix, 1 test → Main Mar 17, 2026
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@github-actions github-actions bot changed the title Release: 2 features, 1 fix, 1 test → Main Release: 2 features, 1 fix, 1 test, 1 chore → Main Mar 17, 2026
…#8188)

* feat(ci): add daily kanban sync workflow for project board snapshots

Add kanban-sync.yml that fetches all items from KBVE Project Board
(GitHub Projects V2) via GraphQL, generates nx-kanban.json (machine-
readable) and nx-kanban.mdx (static dashboard page), and opens a PR
to dev. Runs daily at 06:00 UTC with manual dispatch support.

Uses fixed branch (automated/kanban-sync) to avoid PR spam — force-
pushes updates to existing open PR instead of creating duplicates.

Closes #8137

* fix(ci): escape MDX-unsafe characters in security audit generator

Add _escape_mdx() to nx-security-to-mdx.py that converts <, >, {, },
&, and | to HTML entities before writing advisory titles into MDX
tables. Fixes Astro build failure caused by literal << in js-yaml
advisory title being parsed as JSX.

* feat(ci): add mermaid charts and MDX escaping to kanban sync

Add escapeMdx() to sanitize issue titles with <, >, {, }, | characters
before writing to MDX tables. Add mermaid pie chart (items by status)
and flowchart (pipeline flow with counts) to the generated kanban page.

* fix(api): wrap npcdb.json response as { npcs, index } to match other DB endpoints

Aligns npcdb.json with itemdb/mapdb/questdb response format so
external consumers (Bevy, e2e tests) can parse all DB APIs uniformly.
@h0lybyte h0lybyte self-requested a review as a code owner March 17, 2026 12:21
@github-actions github-actions bot changed the title Release: 2 features, 1 fix, 1 test, 1 chore → Main Release: 3 features, 1 fix, 1 test, 1 chore → Main Mar 17, 2026
#8187)

* feat(bevy_npc): add creature feature with game-agnostic ECS components

Add `creature` feature flag to bevy_npc providing shared ECS types for
creature pooling and capture that work across any Bevy game:
- CreaturePoolIndex(u32) — pool entity identification
- CreatureState enum — Pooled/Active/Captured lifecycle
- CapturedCreatures resource — ProtoNpcId-keyed capture tracking
- CreatureCaptureEvent — generic capture trigger
- CreaturePlugin — registers resources

Uses ProtoNpcId instead of hardcoded CreatureKind enum so new creature
types don't require protocol changes. Re-exported via bevy_kbve_net
npcdb feature for downstream access.

* refactor(isometric,axum-kbve): migrate to shared bevy_npc::creature types

Replace local CapturedCreatures, CreatureState, CreaturePoolIndex, and
CreatureCaptureEvent with shared types from bevy_npc::creature feature.
Both client and server now use ProtoNpcId-keyed CapturedCreatures resource
instead of hardcoded CreatureKind tuples. Adds bidirectional mapping
helpers (creature_kind_to_npc_id, npc_id_to_creature_kind) as bridge
until protocol migrates away from CreatureKind enum.
@github-actions github-actions bot changed the title Release: 3 features, 1 fix, 1 test, 1 chore → Main Release: 4 features, 1 fix, 1 test, 1 chore → Main Mar 17, 2026
@h0lybyte h0lybyte merged commit dfd45e6 into main Mar 17, 2026
16 of 17 checks passed
@github-project-automation github-project-automation bot moved this from Review to Done in KBVE Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant