Skip to content

chore: bump modules submodule (hermetic image pinning) - #181

Merged
ValgulNecron merged 2 commits into
mainfrom
chore/bump-modules-pinning
Jul 22, 2026
Merged

ValgulNecron merged 2 commits into
mainfrom
chore/bump-modules-pinning

Conversation

@ValgulNecron

Copy link
Copy Markdown
Collaborator

Companion pointer bump for gameplane-module#35, whose docs landed here in #178.

  • Every module's default image is now pinned by digest, so a server binary can no longer change underneath a user on pod restart with no version bump or changelog. Not hypothetical: terraria-latest moved from Terraria 1.4.4.9 to 1.4.5.6, changing the network protocol version and breaking the e2e Terraria bot.
  • Eight games gained a real spec.versions list, so a floating tag survives only where drift is the user's explicit, labelled choice.
  • validate.py enforces the rule on any OCI registry (spec.image and any default: true entry are an error if unpinned, with a # gameplane:floating opt-out), and a monthly workflow refreshes the pins.

Docs: this closes the "Hermetic module images" production-readiness item, so it moves into docs/roadmap.md's shipped list and drops out of the README's open-items sentence. The new shipped section is deliberately placed at the end of that list rather than next to the idle entry, to stay clear of the section #179 inserts in the same spot.

🤖 Generated with Claude Code

Picks up gameplane-module#35, the companion to the docs landed in #178:

- every module's default image is pinned by digest, so a server binary can
  no longer change underneath a user on pod restart with no version bump
- eight games gain a real spec.versions list instead of only "whatever
  latest is"; floating tags survive only as a labelled, explicit choice
- validate.py enforces the pinning rule on any OCI registry, and a monthly
  workflow refreshes the pins

This closes the "hermetic module images" production-readiness item that
docs/roadmap.md tracks, and makes docs/module-authoring.md's new
"Pinning images by digest" section describe what the modules actually do.

Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com>
The pointer bump in the previous commit is what actually closed this item,
so move it from "wanted for v1" into the shipped list and drop it from the
README's open-items sentence.

Placed at the end of the shipped section rather than next to the idle entry
to stay clear of the section PR #179 inserts in that spot.

Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com>
@ValgulNecron
ValgulNecron merged commit 76f8d53 into main Jul 22, 2026
13 checks passed
@ValgulNecron
ValgulNecron deleted the chore/bump-modules-pinning branch July 22, 2026 21:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant