HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Version and publish the Client/Contracts packages and server artifacts #19

New Issue
Open
opened 2026-07-15 10:04:29 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:29 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #14, #15, #18

Outcome

Make server and SDK releases reproducible, compatible, and consumable by both games.

Scope

  • Define SemVer policy for SDK APIs, HTTP/UDP contracts, ticket formats, and server behavior.
  • Publish FinalFactory.Rendezvous.Client and Contracts to the chosen Gitea NuGet registry with metadata, symbols, SourceLink, and changelog.
  • Publish versioned container artifacts and immutable checksums.
  • Add API/contract compatibility gates and a server/client/protocol compatibility matrix.
  • Add dependency vulnerability/license review, locked restore, SBOM, container scanning, and release provenance/signing where supported.
  • Add staging smoke/canary, release notes, rollback, and key/protocol migration procedure.
  • Ensure LiteNetLib 1.x examples/APIs cannot accidentally compile against the pinned 2.x integration.

Acceptance criteria

  • A tagged release builds reproducibly and publishes packages plus container exactly once.
  • Breaking public/API/wire changes fail CI unless the appropriate major/protocol version changes.
  • Both consumer projects can pin and restore the packages.
  • Server declares its supported client/protocol window.
  • Release notes identify compatibility, security, configuration, and migration impact.
  • Staging smoke exercises HTTP registration/browse and UDP mediation before promotion.
  • Artifacts contain no development secrets or mutable latest-only dependency.
Parent: #1 Depends on: #14, #15, #18 ## Outcome Make server and SDK releases reproducible, compatible, and consumable by both games. ## Scope - Define SemVer policy for SDK APIs, HTTP/UDP contracts, ticket formats, and server behavior. - Publish `FinalFactory.Rendezvous.Client` and `Contracts` to the chosen Gitea NuGet registry with metadata, symbols, SourceLink, and changelog. - Publish versioned container artifacts and immutable checksums. - Add API/contract compatibility gates and a server/client/protocol compatibility matrix. - Add dependency vulnerability/license review, locked restore, SBOM, container scanning, and release provenance/signing where supported. - Add staging smoke/canary, release notes, rollback, and key/protocol migration procedure. - Ensure LiteNetLib 1.x examples/APIs cannot accidentally compile against the pinned 2.x integration. ## Acceptance criteria - A tagged release builds reproducibly and publishes packages plus container exactly once. - Breaking public/API/wire changes fail CI unless the appropriate major/protocol version changes. - Both consumer projects can pin and restore the packages. - Server declares its supported client/protocol window. - Release notes identify compatibility, security, configuration, and migration impact. - Staging smoke exercises HTTP registration/browse and UDP mediation before promotion. - Artifacts contain no development secrets or mutable latest-only dependency.
Kyuubi added reference codex/issue-19-release-artifacts 2026-07-16 16:12:23 +02:00
Kyuubi self-assigned this 2026-07-16 16:12:23 +02:00
Kyuubi commented 2026-07-16 16:12:41 +02:00
Author
Owner
Copy Link
Copy Source

Starting issue #19 on codex/issue-19-release-artifacts, stacked on the completed/pushed #18 branch.

Planned acceptance path:

  1. inventory current package/container metadata and Gitea Actions capabilities;
  2. define one version authority plus SemVer/protocol/ticket/server compatibility policy;
  3. make Client/Contracts deterministic NuGet+symbols+SourceLink artifacts and server/container immutable artifacts with checksums/SBOM/provenance;
  4. add API/wire compatibility, locked restore, vulnerability/license, container scan, secret/mutable-tag, and exactly-once tagged-publish gates;
  5. add consumer restore fixtures for both supported target shapes, staging HTTP+UDP smoke before promotion, release notes, rollback, and key/protocol migration procedures;
  6. run adversarial review and complete Debug/Release/package/container/release verification before pushing evidence.

No registry publication or tag will be created until the local release pipeline is proven and external credentials/registry state are explicitly available.

Starting issue #19 on `codex/issue-19-release-artifacts`, stacked on the completed/pushed #18 branch. Planned acceptance path: 1. inventory current package/container metadata and Gitea Actions capabilities; 2. define one version authority plus SemVer/protocol/ticket/server compatibility policy; 3. make Client/Contracts deterministic NuGet+symbols+SourceLink artifacts and server/container immutable artifacts with checksums/SBOM/provenance; 4. add API/wire compatibility, locked restore, vulnerability/license, container scan, secret/mutable-tag, and exactly-once tagged-publish gates; 5. add consumer restore fixtures for both supported target shapes, staging HTTP+UDP smoke before promotion, release notes, rollback, and key/protocol migration procedures; 6. run adversarial review and complete Debug/Release/package/container/release verification before pushing evidence. No registry publication or tag will be created until the local release pipeline is proven and external credentials/registry state are explicitly available.
Kyuubi commented 2026-07-16 17:52:24 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and verified on codex/issue-19-release-artifacts at cc5793f935f2621de5553212f98e6dd3ec89549a.

Evidence:

  • Clean-tree formal release build passed in the digest-pinned release builder; provenance records this exact commit with treeState: clean.
  • Release build passed locked restore, license policy, NuGet vulnerability audit, formatting, OpenAPI drift, two clean builds, byte-identical Client/Contracts .nupkg + .snupkg, SourceLink, byte-identical Server DLL/PDB/archive, and scoped SPDX generation.
  • Debug and Release suites: 291 passed, 0 failed, 0 skipped.
  • Real downstream restore gate passed pinned SpaceGame 77519b0cc418a27f8d408ae2d7b8812fbe087c04 and Unscouted 7807dbee86eb8b98e702f1eb89c88adff728f635, including Unscouted's direct LiteNetLib 2.1.4 pin.
  • Current-commit linux/amd64 OCI candidate was built twice without cache; exported tars were byte-identical at SHA-256 6cf70318c248903230f23520c9873781f44743ae94f4cc828f0d9600e1a93f03, with image ID sha256:e95d8add7c595c644f86ba0025a6b2970946609a875c8aa17ffff0b1aedab4d4.
  • That exact image passed hardened Compose staging: HTTP live/ready, registration/browse, authenticated UDP mediation, and direct traffic. Runtime evidence: user 1654:1654, read-only root, non-privileged, all capabilities dropped.
  • Adversarial branch audit and final re-audit: GO; all release/checksum/SBOM/toolchain/platform/consumer/image-identity findings fixed.
  • Tag workflow independently gates compatibility changes, pins builder/Buildx/BuildKit/actions/platform, rejects all HIGH/CRITICAL Trivy findings, emits normalized package/runtime + container SPDX, verifies build/publish-ready/signing-ready/published artifact schemas, binds the registry digest into signed checksums/provenance, and prevents duplicate publication.

No production tag, package, container, signature, or Gitea release was published during implementation; those irreversible writes remain correctly restricted to the protected tag workflow and its production secrets. The issue remains open until the stacked roadmap branch is landed.

Implemented and verified on `codex/issue-19-release-artifacts` at `cc5793f935f2621de5553212f98e6dd3ec89549a`. Evidence: - Clean-tree formal release build passed in the digest-pinned release builder; provenance records this exact commit with `treeState: clean`. - Release build passed locked restore, license policy, NuGet vulnerability audit, formatting, OpenAPI drift, two clean builds, byte-identical Client/Contracts `.nupkg` + `.snupkg`, SourceLink, byte-identical Server DLL/PDB/archive, and scoped SPDX generation. - Debug and Release suites: 291 passed, 0 failed, 0 skipped. - Real downstream restore gate passed pinned SpaceGame `77519b0cc418a27f8d408ae2d7b8812fbe087c04` and Unscouted `7807dbee86eb8b98e702f1eb89c88adff728f635`, including Unscouted's direct LiteNetLib 2.1.4 pin. - Current-commit linux/amd64 OCI candidate was built twice without cache; exported tars were byte-identical at SHA-256 `6cf70318c248903230f23520c9873781f44743ae94f4cc828f0d9600e1a93f03`, with image ID `sha256:e95d8add7c595c644f86ba0025a6b2970946609a875c8aa17ffff0b1aedab4d4`. - That exact image passed hardened Compose staging: HTTP live/ready, registration/browse, authenticated UDP mediation, and direct traffic. Runtime evidence: user 1654:1654, read-only root, non-privileged, all capabilities dropped. - Adversarial branch audit and final re-audit: GO; all release/checksum/SBOM/toolchain/platform/consumer/image-identity findings fixed. - Tag workflow independently gates compatibility changes, pins builder/Buildx/BuildKit/actions/platform, rejects all HIGH/CRITICAL Trivy findings, emits normalized package/runtime + container SPDX, verifies build/publish-ready/signing-ready/published artifact schemas, binds the registry digest into signed checksums/provenance, and prevents duplicate publication. No production tag, package, container, signature, or Gitea release was published during implementation; those irreversible writes remain correctly restricted to the protected tag workflow and its production secrets. The issue remains open until the stacked roadmap branch is landed.
Sign in to join this conversation.
codex/issue-19-release-artifacts
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#19
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?