From 3bc090d211e6bfe8f30fd4adcf6f1614b59da7fe Mon Sep 17 00:00:00 2001 From: valgulnecron <39313199+ValgulNecron@users.noreply.github.com> Date: Wed, 22 Jul 2026 22:02:56 +0200 Subject: [PATCH 1/2] chore: bump modules submodule (hermetic image pinning) Picks up gameplane-module#35, the companion to the docs landed in #178: - every module's default image is pinned by digest, so a server binary can no longer change underneath a user on pod restart with no version bump - eight games gain a real spec.versions list instead of only "whatever latest is"; floating tags survive only as a labelled, explicit choice - validate.py enforces the pinning rule on any OCI registry, and a monthly workflow refreshes the pins This closes the "hermetic module images" production-readiness item that docs/roadmap.md tracks, and makes docs/module-authoring.md's new "Pinning images by digest" section describe what the modules actually do. Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com> --- modules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules b/modules index 1cd8c779f..f2247c25e 160000 --- a/modules +++ b/modules @@ -1 +1 @@ -Subproject commit 1cd8c779f181048f9e64ad3cc9cbe89d20f46693 +Subproject commit f2247c25e195388eaaaa2a538afad2ff6537caa3 From 03094760839c1aab21795fee31cbd0a650fd8f59 Mon Sep 17 00:00:00 2001 From: valgulnecron <39313199+ValgulNecron@users.noreply.github.com> Date: Wed, 22 Jul 2026 22:03:51 +0200 Subject: [PATCH 2/2] docs: mark hermetic module images shipped The pointer bump in the previous commit is what actually closed this item, so move it from "wanted for v1" into the shipped list and drop it from the README's open-items sentence. Placed at the end of the shipped section rather than next to the idle entry to stay clear of the section PR #179 inserts in that spot. Signed-off-by: valgulnecron <39313199+ValgulNecron@users.noreply.github.com> --- README.md | 7 +++---- docs/roadmap.md | 24 +++++++++++++++--------- 2 files changed, 18 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 2463d1bdd..6b3ea6579 100644 --- a/README.md +++ b/README.md @@ -49,10 +49,9 @@ server says so on its Overview rather than leaving you guessing. Before you rely on it, know that: - A handful of production-readiness items are still open: a documented - backup/restore drill against a real restic repository, upgrade testing - across minor versions, and pinning the shipped modules' floating `latest` - image tags. None of these are code gaps — see - [`docs/roadmap.md`](docs/roadmap.md) for the full, current list. + backup/restore drill runbook, upgrade testing across minor versions, and + resource-limit guidance sized from real workloads. None of these are code + gaps — see [`docs/roadmap.md`](docs/roadmap.md) for the full, current list. [`docs/roadmap.md`](docs/roadmap.md) tracks everything that stands between beta and a v1 GA. diff --git a/docs/roadmap.md b/docs/roadmap.md index d95512cfc..da4f4d556 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -111,6 +111,21 @@ into the chart for module verification), and the `release` and digest with the provisioned `COSIGN_PRIVATE_KEY`. See [Signing official bundles](module-authoring.md#signing-official-bundles). +### Hermetic module images (gameplane-module#35, docs in #178) + +Every shipped module's default image is now pinned by digest, so a server +binary can no longer change underneath a user on pod restart with no version +bump or changelog. This was not hypothetical: `terraria-latest` moved from +Terraria 1.4.4.9 to 1.4.5.6, changing the network protocol version and +breaking the e2e Terraria bot. + +Eight games also gained a real `spec.versions` list, so a floating tag now +survives only where drift is the user's explicit, labelled choice. The +module repo's `validate.py` enforces the rule (`spec.image` and any +`default: true` entry are an error if unpinned, with a `# gameplane:floating` +opt-out), and a monthly workflow refreshes the pins. Authoring rules live in +[Pinning images by digest](module-authoring.md#pinning-images-by-digest). + --- ## Blocking v1 @@ -134,15 +149,6 @@ production-readiness hardening below — tracked items, not code gaps. caveat (Helm never updates CRDs on `helm upgrade`; see [Helm CRD caveat](install.md#helm-crd-caveat)). - Resource-limit guidance sized from real workloads rather than defaults. -- Hermetic module images: the shipped game modules pin floating upstream tags - (`terraria-latest`, `tmodloader-latest`), meaning a server binary can change - underneath a user on pod restart with no version bump or changelog. This is not - hypothetical: `terraria-latest` moved from Terraria 1.4.4.9 to 1.4.5.6, - changing the network protocol version and breaking the e2e Terraria bot. The - fix is to pin explicit image tags for the default image, and keep a floating - "latest" entry only in `spec.versions` where drift is the user's explicit, - labelled choice. Changes live in the `gameplane-module` repo with a submodule - pointer bump here. ### Wake-on-connect for idle auto-sleep