From 08103f6c409fef657840cc6f300f40ace4ac559b Mon Sep 17 00:00:00 2001 From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:43:37 +0000 Subject: [PATCH 1/3] build: upgrade to TLibs 1.1.0 --- .github/workflows/build.yml | 4 ++-- README.md | 6 ++++-- pom.xml | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3a0b9dd..095880f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -26,11 +26,11 @@ jobs: - uses: actions/setup-java@v4 with: distribution: temurin - java-version: '21' + java-version: '25' cache: maven - name: Install pinned TLibs in Maven - uses: TF-Minecraft/TLibs/.github/actions/setup@61bd61b17fba45e5178612578805d7108596e8a0 + uses: TF-Minecraft/TLibs/.github/actions/setup@905a196217471252b96be5ecf8eeb16c9e85e41d with: token: ${{ secrets.DEPS_TOKEN }} diff --git a/README.md b/README.md index 0e01a09..94d5fb1 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,8 @@ python3 ../tlibs/tools/install-dependency.py --pom pom.xml mvn clean verify ``` -See [TLibs dependency setup](https://github.com/TF-Minecraft/TLibs/blob/61bd61b17fba45e5178612578805d7108596e8a0/DEPENDENCIES.md) -for private-source access, offline installation and the pinned binary versions. +See [TLibs dependency setup](https://github.com/TF-Minecraft/TLibs/blob/v1.1.0/DEPENDENCIES.md) +for public release installation, offline builds and rollback. Other declared build dependencies still need their usual preparation. + +Builds and server runtime require Java 25 and [TLibs 1.1.0](https://github.com/TF-Minecraft/TLibs/releases/tag/v1.1.0). diff --git a/pom.xml b/pom.xml index 09b60ca..0fcb240 100644 --- a/pom.xml +++ b/pom.xml @@ -12,7 +12,7 @@ tfminecraft.net - 1.0-tfmc-ecddb0e40a4d + 1.1.0 UTF-8 21 21 From 41451777a98c6ed9fe34df7f2182ce28f834b8f2 Mon Sep 17 00:00:00 2001 From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:48:36 +0000 Subject: [PATCH 2/3] ci: fetch verified dependencies from ServerAssets --- .github/dependencies.sha256 | 16 ++++++++++++++++ .github/scripts/prepare-release.sh | 22 ++++++++++++++++++++++ .github/workflows/build.yml | 25 ++----------------------- README.md | 8 ++++++++ libs/SHA256SUMS | 16 ---------------- pom.xml | 16 ++++++++-------- 6 files changed, 56 insertions(+), 47 deletions(-) create mode 100644 .github/dependencies.sha256 create mode 100644 .github/scripts/prepare-release.sh delete mode 100644 libs/SHA256SUMS diff --git a/.github/dependencies.sha256 b/.github/dependencies.sha256 new file mode 100644 index 0000000..9a8b744 --- /dev/null +++ b/.github/dependencies.sha256 @@ -0,0 +1,16 @@ +27e9906f137702e681af9a9cb913f65fb267e8d84aa14141546a7c97a2ce234d libs/VotingPlugin-7.0.jar +aaf20bbeba7963cec543ba1206ca0b1c6304efaa4607f3cb85e6602caa4d2319 libs/musicalinstruments-2.5.jar +ff96d058ed6d6aa6c147d8c16c0364581806ac5acee36873658a189a88242e96 libs/geiger_counter-1.1.3.jar +14850d7454374d7312305d3e84a391be720301e5964963f869b27ae97f6264eb libs/MMOCore-1.13.1.jar +8ff714bd3f486de26e9869462d4696eece5958287ce75a013cb30eb6bebd5e88 libs/MMOItems-6.10.1.jar +a3f86a50d38296dd0a91d375f0a9433192e6e8d3e9dcae2751c801e67d24d9cd libs/MythicLib-dist-1.7.1.jar +499239027c78b337d1da48dd1f0f07786164b8d59dcaa506602114bc9cbaca88 libs/vfbuilders-1.0.0.jar +791bc29301b4250a0f7ef3053a1999ace7e2ff0ddae8e79ff52bef0fee8034ed libs/vehicleframework-1.1.12.jar +0fedc530aaa9cd9e0a452d0bde95fb9fa0ecc31564ec625e3a0e2cef57c0aec8 libs/rpcharacters-1.1.7.jar +0b077b2d56e918cc6a8b4662a0b6ad8dc5c3cc11f6a2fe93acb7a25bdf3cb524 libs/interactiblefurniture-0.1.3-BETA.jar +5185b9e0ea8653ab61da07304f1573c6a9a5af97cf55a5d970c5a25f16bc743d libs/simplefactions-2.8.7.jar +64ea06ea92bf22785e6d541dd1b5f550edcdc4610d7a9748a91d715876ac079d libs/advancedcrafting-1.2.1.jar +e805d125cc6da3e76999f4658ad520c738715173f3d6a2d61ff638c5887dc338 libs/archeology-plugin-1.0.1.jar +f04892ad7d077634d57a0115526cff11664ff04b251ceb9cfd0355cdd04fce7a libs/marketblock-0.0.2.jar +8b862b768e5c0be1a07fd31edf6d746af353af820720cea35552485cb4688e54 libs/games-0.1.1.jar +c2b208566fb67db465caaaefdab09a2bbdcbb1261307c1c9d701c3f8a9eda2cc libs/cooking-0.1.5-ALPHA.jar diff --git a/.github/scripts/prepare-release.sh b/.github/scripts/prepare-release.sh new file mode 100644 index 0000000..ef77e8a --- /dev/null +++ b/.github/scripts/prepare-release.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash +set -euo pipefail +: "${GH_TOKEN:?Set DEPS_TOKEN with Contents read access to TF-Minecraft/ServerAssets}" +ref=6a368f76c89e856fa73299d17e2a40c5a1e2f20a +mkdir -p libs +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/27e9906f1377/VotingPlugin-7.0.jar?ref=$ref" > "libs/VotingPlugin-7.0.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/aaf20bbeba79/musicalinstruments-2.5.jar?ref=$ref" > "libs/musicalinstruments-2.5.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/ff96d058ed6d/geiger_counter-1.1.3.jar?ref=$ref" > "libs/geiger_counter-1.1.3.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/14850d745437/MMOCore-1.13.1.jar?ref=$ref" > "libs/MMOCore-1.13.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/8ff714bd3f48/MMOItems-6.10.1-20250521.175300-22.jar?ref=$ref" > "libs/MMOItems-6.10.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/a3f86a50d382/MythicLib-dist-1.7.1.jar?ref=$ref" > "libs/MythicLib-dist-1.7.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/499239027c78/vfbuilders-1.0.0.jar?ref=$ref" > "libs/vfbuilders-1.0.0.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/791bc29301b4/vehicleframework-1.1.12.jar?ref=$ref" > "libs/vehicleframework-1.1.12.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0fedc530aaa9/rpcharacters-1.1.7.jar?ref=$ref" > "libs/rpcharacters-1.1.7.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/0b077b2d56e9/interactiblefurniture-0.1.3-BETA.jar?ref=$ref" > "libs/interactiblefurniture-0.1.3-BETA.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/5185b9e0ea86/simplefactions-2.8.7.jar?ref=$ref" > "libs/simplefactions-2.8.7.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/64ea06ea92bf/advancedcrafting-1.2.1.jar?ref=$ref" > "libs/advancedcrafting-1.2.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/e805d125cc6d/archeology-plugin-1.0.1.jar?ref=$ref" > "libs/archeology-plugin-1.0.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/f04892ad7d07/marketblock-0.0.2.jar?ref=$ref" > "libs/marketblock-0.0.2.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/8b862b768e5c/games-0.1.1.jar?ref=$ref" > "libs/games-0.1.1.jar" +curl --fail --location --silent --show-error --retry 3 -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw+json" "https://api.github.com/repos/TF-Minecraft/ServerAssets/contents/jars/c2b208566fb6/cooking-0.1.5-ALPHA.jar?ref=$ref" > "libs/cooking-0.1.5-ALPHA.jar" +sha256sum --check .github/dependencies.sha256 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 095880f..c25a5ec 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -34,31 +34,10 @@ jobs: with: token: ${{ secrets.DEPS_TOKEN }} - - name: Fetch private dependencies + - name: Fetch and verify private dependencies env: GH_TOKEN: ${{ secrets.DEPS_TOKEN }} - run: | - mkdir -p libs - gh release download v1 --repo JustinasLa/tfmc-deps --dir libs --clobber \ - --pattern 'VotingPlugin-7.0.jar' \ - --pattern 'musicalinstruments-2.5.jar' \ - --pattern 'geiger_counter-1.1.3.jar' \ - --pattern 'MMOCore-1.13.1.jar' \ - --pattern 'MMOItems-6.10.1.jar' \ - --pattern 'MythicLib-dist-1.7.1.jar' \ - --pattern 'vehicleframework-1.1.11.jar' \ - --pattern 'vfbuilders-1.0.0.jar' \ - --pattern 'rpcharacters-1.1.7.jar' \ - --pattern 'interactiblefurniture-0.1.3-BETA.jar' \ - --pattern 'simplefactions-2.8.7.jar' \ - --pattern 'advancedcrafting-1.1.7.jar' \ - --pattern 'archeology-plugin-1.0.1.jar' \ - --pattern 'marketblock-0.0.2.jar' \ - --pattern 'games-0.1.1-api.jar' \ - --pattern 'cooking-0.1.5-ALPHA-api.jar' - - - name: Verify private dependencies - run: sha256sum -c libs/SHA256SUMS + run: bash .github/scripts/prepare-release.sh - name: Build run: mvn -B --no-transfer-progress clean package diff --git a/README.md b/README.md index 94d5fb1..94e1f04 100644 --- a/README.md +++ b/README.md @@ -21,3 +21,11 @@ for public release installation, offline builds and rollback. Other declared build dependencies still need their usual preparation. Builds and server runtime require Java 25 and [TLibs 1.1.0](https://github.com/TF-Minecraft/TLibs/releases/tag/v1.1.0). + +Other compile-time plugin APIs are fetched from a pinned private ServerAssets commit: +`GH_TOKEN` needs Contents read access to `TF-Minecraft/ServerAssets`; run +`bash .github/scripts/prepare-release.sh` before Maven. The script verifies +`.github/dependencies.sha256`. It uses the authorized inputs validated with this +upgrade, including VehicleFramework 1.1.12, AdvancedCrafting 1.2.1 and full +Cooking/Games JARs for their compile-time APIs. TLibs still downloads separately +from its public versioned release. diff --git a/libs/SHA256SUMS b/libs/SHA256SUMS deleted file mode 100644 index 831f40a..0000000 --- a/libs/SHA256SUMS +++ /dev/null @@ -1,16 +0,0 @@ -81d511d0830951f988615b6533cc93e82d00a83fb31e8ccbb36441ae3e8157ef *libs/MMOCore-1.13.1.jar -a37f7789fcdcd11c9e5890a2fac742aa4501749588af23182991953e06ee1d17 *libs/MMOItems-6.10.1.jar -e89a612e566e9b7dc4f43228adb8f6e560f293ea4107bae259c6dfd6732d7a70 *libs/MythicLib-dist-1.7.1.jar -19d6bdfc6799c8cd3ac117ce5e9e4569df2199fcf3201ffb6425bf775cfc20ee *libs/VotingPlugin-7.0.jar -dcb1abbadb868043973f14ac4e5f9a25b06caf67b06e127e683b93d8f40c9cfb *libs/advancedcrafting-1.1.7.jar -f446217f544ce2f62764c21d99a9d2d89b5a52dd8a590a908878f7b5e99eee54 *libs/archeology-plugin-1.0.1.jar -eb160cb364332dd199e9b41c9ade6955c90cef964c2babd1a2c9900d1d01dc90 *libs/cooking-0.1.5-ALPHA-api.jar -199069a52da848bc4f321702265966a4cee24ef9146d40bca68baf4a81bdcf5c *libs/games-0.1.1-api.jar -efd60fad17496e296501c7f48215ba026a4a0bf25e9961c5c6026c9615586e9d *libs/geiger_counter-1.1.3.jar -6cfb9f9937454fbb107eeb0980aa9e39334d4b67f5155a46a66cdef8d81b6888 *libs/interactiblefurniture-0.1.3-BETA.jar -929cc560e509690c962a1d46445986b6b853daeb0d1105dc9a92640b50ea046a *libs/marketblock-0.0.2.jar -aaf20bbeba7963cec543ba1206ca0b1c6304efaa4607f3cb85e6602caa4d2319 *libs/musicalinstruments-2.5.jar -84e2579eaa1d02b535a990a85aed04a3edccd5d31b0c43d819b846bc728c750a *libs/rpcharacters-1.1.7.jar -24e13ac50c361a276004f1142952a7f1d2a65ea830bf6b644f56ebdd95ed1ef2 *libs/simplefactions-2.8.7.jar -31543ed6b14cac21b214c79901017f2fdfd92e2c0982ebfcaf82d23894f16fbb *libs/vehicleframework-1.1.11.jar -d6c749c44a3ff6287200ff6b1c45a9a49157fd238880a70ea58f53dda7742d87 *libs/vfbuilders-1.0.0.jar diff --git a/pom.xml b/pom.xml index 0fcb240..b75be8b 100644 --- a/pom.xml +++ b/pom.xml @@ -117,9 +117,9 @@ local vehicleframework - 1.1.11 + 1.1.12 system - ${project.basedir}/libs/vehicleframework-1.1.11.jar + ${project.basedir}/libs/vehicleframework-1.1.12.jar @@ -190,22 +190,22 @@ ${project.basedir}/libs/marketblock-0.0.2.jar - + local games 0.1.1 system - ${project.basedir}/libs/games-0.1.1-api.jar + ${project.basedir}/libs/games-0.1.1.jar - + local cooking 0.1.5-ALPHA system - ${project.basedir}/libs/cooking-0.1.5-ALPHA-api.jar + ${project.basedir}/libs/cooking-0.1.5-ALPHA.jar From 3c5d0992bcfcce45baa3fc61f76754df5e8dc5ba Mon Sep 17 00:00:00 2001 From: Ryan Barlow <7389646+ryanbarlow97@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:49:55 +0000 Subject: [PATCH 3/3] test: verify checksum coverage for ServerAssets inputs --- .../activity/config/Tier1HooksTest.java | 26 +++++++++---------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/src/test/java/tfmc/justin/activity/config/Tier1HooksTest.java b/src/test/java/tfmc/justin/activity/config/Tier1HooksTest.java index 7bf586c..5798626 100644 --- a/src/test/java/tfmc/justin/activity/config/Tier1HooksTest.java +++ b/src/test/java/tfmc/justin/activity/config/Tier1HooksTest.java @@ -135,14 +135,14 @@ void everyListenerRecordedActivityIdExistsInConfig() throws IOException { } @Test - void everySha256sumsJarHasMatchingWorkflowPatternAndViceVersa() throws IOException { - Path sumsFile = Path.of("libs/SHA256SUMS"); - assertTrue(Files.exists(sumsFile), "libs/SHA256SUMS should exist"); - Path workflowFile = Path.of(".github/workflows/build.yml"); - assertTrue(Files.exists(workflowFile), "build.yml should exist"); + void everyChecksumJarHasMatchingDownloadAndViceVersa() throws IOException { + Path sumsFile = Path.of(".github/dependencies.sha256"); + assertTrue(Files.exists(sumsFile), ".github/dependencies.sha256 should exist"); + Path workflowFile = Path.of(".github/scripts/prepare-release.sh"); + assertTrue(Files.exists(workflowFile), "prepare-release.sh should exist"); Set jarsInSums = new HashSet<>(); - Pattern sumsLine = Pattern.compile("\\*(?:libs/)?(\\S+\\.jar)\\s*$"); + Pattern sumsLine = Pattern.compile("^[0-9a-f]{64} libs/(\\S+\\.jar)$"); for (String line : Files.readAllLines(sumsFile)) { if (line.isBlank()) continue; Matcher m = sumsLine.matcher(line.trim()); @@ -152,26 +152,26 @@ void everySha256sumsJarHasMatchingWorkflowPatternAndViceVersa() throws IOExcepti assertFalse(jarsInSums.isEmpty(), "SHA256SUMS should list at least one jar"); Set jarsInWorkflow = new HashSet<>(); - Pattern patternLine = Pattern.compile("--pattern\\s+'([^']+\\.jar)'"); + Pattern patternLine = Pattern.compile("> \"libs/([^\"]+\\.jar)\""); String workflowSource = Files.readString(workflowFile); Matcher m = patternLine.matcher(workflowSource); while (m.find()) { jarsInWorkflow.add(m.group(1)); } - assertFalse(jarsInWorkflow.isEmpty(), "build.yml should download at least one jar pattern"); + assertFalse(jarsInWorkflow.isEmpty(), "prepare-release.sh should download at least one jar"); assertEquals(jarsInSums, jarsInWorkflow, - "SHA256SUMS jars and build.yml --pattern jars should match exactly"); + "Checksum entries and downloaded jars should match exactly"); } @Test void everyPomSystemPathJarIsListedInSha256sums() throws IOException { Path pomFile = Path.of("pom.xml"); assertTrue(Files.exists(pomFile), "pom.xml should exist"); - Path sumsFile = Path.of("libs/SHA256SUMS"); + Path sumsFile = Path.of(".github/dependencies.sha256"); Set jarsInSums = new HashSet<>(); - Pattern sumsLine = Pattern.compile("\\*(?:libs/)?(\\S+\\.jar)\\s*$"); + Pattern sumsLine = Pattern.compile("^[0-9a-f]{64} libs/(\\S+\\.jar)$"); for (String line : Files.readAllLines(sumsFile)) { if (line.isBlank()) continue; Matcher m = sumsLine.matcher(line.trim()); @@ -187,8 +187,6 @@ void everyPomSystemPathJarIsListedInSha256sums() throws IOException { } assertFalse(jarsInPom.isEmpty(), "pom.xml should have at least one systemPath jar"); - for (String jar : jarsInPom) { - assertTrue(jarsInSums.contains(jar), "pom.xml systemPath jar '" + jar + "' missing from libs/SHA256SUMS"); - } + assertEquals(jarsInPom, jarsInSums, "Every system dependency must have exactly one pinned checksum"); } }