Production Release: 4 features, 5 fixes, 1 refactor, 1 chore → Main

.github/workflows/ci-security.yml

@@ -7,8 +7,11 @@ on:
             - main
     pull_request:
         branches:
+            - dev
             - staging
             - main
+    schedule:
+        - cron: '30 6 * * 1'
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
@@ -31,6 +34,7 @@ jobs:
                 language:
                     - javascript-typescript
                     - python
+                    - rust
 
         steps:
             - name: Checkout
@@ -40,6 +44,7 @@ jobs:
               uses: github/codeql-action/init@v4
               with:
                   languages: ${{ matrix.language }}
+                  queries: security-and-quality
 
             - name: Auto-build
               uses: github/codeql-action/autobuild@v4
@@ -48,3 +53,22 @@ jobs:
               uses: github/codeql-action/analyze@v4
               with:
                   category: /language:${{ matrix.language }}
+
+    dependency-review:
+        name: Dependency Review
+        runs-on: ubuntu-latest
+        if: github.event_name == 'pull_request'
+        timeout-minutes: 10
+        permissions:
+            contents: read
+            pull-requests: write
+
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v6
+
+            - name: Dependency Review
+              uses: actions/dependency-review-action@v4
+              with:
+                  fail-on-severity: high
+                  comment-summary-in-pr: always

apps/kube/discordsh/manifest/deployment.yaml

@@ -20,7 +20,7 @@ spec:
       serviceAccountName: discordsh-sa
       containers:
       - name: discordsh
-        image: ghcr.io/kbve/discordsh:0.1.8
+        image: ghcr.io/kbve/discordsh:0.1.9
         imagePullPolicy: Always
         ports:
         - name: http

apps/mc/Dockerfile

@@ -11,28 +11,56 @@ RUN rustup component add rustfmt
 FROM chef AS planner
 RUN cargo chef prepare --recipe-path recipe.json
 
-# --- Pumpkin: cook dependencies (cached until Cargo.toml/lock changes) ---
-FROM chef AS builder
+# --- Cook: compile third-party deps (cached until Cargo.toml/lock changes) ---
+FROM chef AS deps
 COPY --from=planner /pumpkin/recipe.json recipe.json
 RUN --mount=type=cache,target=/usr/local/cargo/git/db \
     --mount=type=cache,target=/usr/local/cargo/registry/ \
     cargo chef cook --release --recipe-path recipe.json
 
-# Build Pumpkin server (only recompiles changed source, deps are cached)
-COPY ./pumpkin /pumpkin
+# --- Foundation: leaf + data crates (rarely change, cached aggressively) ---
+#     cargo-chef cook strips workspace.lints, so restore the real manifests.
+#     Full workspace build ensures feature unification is correct.
+FROM deps AS foundation
+COPY ./pumpkin/Cargo.toml /pumpkin/Cargo.toml
+COPY ./pumpkin/Cargo.lock /pumpkin/Cargo.lock
+COPY ./pumpkin/pumpkin-nbt /pumpkin/pumpkin-nbt
+COPY ./pumpkin/pumpkin-api-macros /pumpkin/pumpkin-api-macros
+COPY ./pumpkin/pumpkin-util /pumpkin/pumpkin-util
+COPY ./pumpkin/pumpkin-data /pumpkin/pumpkin-data
+COPY ./pumpkin/pumpkin-macros /pumpkin/pumpkin-macros
+COPY ./pumpkin/pumpkin-config /pumpkin/pumpkin-config
+RUN --mount=type=cache,target=/usr/local/cargo/git/db \
+    --mount=type=cache,target=/usr/local/cargo/registry/ \
+    cargo build --release
+
+# --- Core: engine crates (protocol, world, inventory) ---
+FROM foundation AS core
+COPY ./pumpkin/pumpkin-world /pumpkin/pumpkin-world
+COPY ./pumpkin/pumpkin-protocol /pumpkin/pumpkin-protocol
+COPY ./pumpkin/pumpkin-inventory /pumpkin/pumpkin-inventory
+RUN --mount=type=cache,target=/usr/local/cargo/git/db \
+    --mount=type=cache,target=/usr/local/cargo/registry/ \
+    cargo build --release
+
+# --- Pumpkin: build server (parallel with plugin) ---
+FROM core AS builder
+COPY ./pumpkin/pumpkin /pumpkin/pumpkin
 RUN --mount=type=cache,target=/usr/local/cargo/git/db \
     --mount=type=cache,target=/usr/local/cargo/registry/ \
     cargo build --release && cp target/release/pumpkin ./pumpkin.release
 
-# Build plugins (path deps to pumpkin crates, use mount cache)
+# --- Plugin: build (parallel with pumpkin, reuses all pre-compiled crates) ---
+FROM core AS plugin-builder
+COPY ./pumpkin/pumpkin /pumpkin/pumpkin
 COPY ./plugins /plugins
-RUN --mount=type=cache,sharing=private,target=/plugins/kbve-mc-plugin/target \
-    --mount=type=cache,target=/usr/local/cargo/git/db \
+ENV CARGO_TARGET_DIR=/pumpkin/target
+RUN --mount=type=cache,target=/usr/local/cargo/git/db \
     --mount=type=cache,target=/usr/local/cargo/registry/ \
     cargo build --release --manifest-path /plugins/kbve-mc-plugin/Cargo.toml \
     && mkdir -p /built-plugins \
-    && cp /plugins/kbve-mc-plugin/target/release/libkbve_mc_plugin.so /built-plugins/ 2>/dev/null \
-    || cp /plugins/kbve-mc-plugin/target/release/libkbve_mc_plugin.dylib /built-plugins/ 2>/dev/null \
+    && cp /pumpkin/target/release/libkbve_mc_plugin.so /built-plugins/ 2>/dev/null \
+    || cp /pumpkin/target/release/libkbve_mc_plugin.dylib /built-plugins/ 2>/dev/null \
     || true
 
 # --- Resource pack ---
@@ -47,7 +75,7 @@ RUN SHA1=$(sha1sum /kbve-resource-pack.zip | awk '{print $1}') && \
 FROM alpine:3.23
 
 COPY --from=builder /pumpkin/pumpkin.release /bin/pumpkin
-COPY --from=builder /built-plugins/ /pumpkin/plugins/
+COPY --from=plugin-builder /built-plugins/ /pumpkin/plugins/
 
 WORKDIR /pumpkin
 

apps/mc/data/resource-pack/assets/kbve/blockstates/rust_stone.json

@@ -0,0 +1,7 @@
+{
+	"variants": {
+		"": {
+			"model": "kbve:block/rust_stone"
+		}
+	}
+}

apps/mc/data/resource-pack/assets/kbve/items/kbve_coin.json

@@ -1,6 +1,6 @@
 {
 	"model": {
 		"type": "minecraft:model",
-		"model": "kbve:item/kbve_coin"
+		"model": "kbve:item/rewards/kbve_coin"
 	}
 }

apps/mc/data/resource-pack/assets/kbve/items/kbve_scythe.json

@@ -0,0 +1,6 @@
+{
+	"model": {
+		"type": "minecraft:model",
+		"model": "kbve:item/weapons/kbve_scythe"
+	}
+}

apps/mc/data/resource-pack/assets/kbve/items/kbve_sword.json

@@ -1,6 +1,6 @@
 {
 	"model": {
 		"type": "minecraft:model",
-		"model": "kbve:item/kbve_sword"
+		"model": "kbve:item/weapons/kbve_sword"
 	}
 }

apps/mc/data/resource-pack/assets/kbve/items/rust_stone.json

@@ -0,0 +1,6 @@
+{
+	"model": {
+		"type": "minecraft:model",
+		"model": "kbve:block/rust_stone"
+	}
+}

apps/mc/data/resource-pack/assets/kbve/items/spartan_shield.json

@@ -0,0 +1,6 @@
+{
+	"model": {
+		"type": "minecraft:model",
+		"model": "kbve:item/weapons/spartan_shield"
+	}
+}

apps/mc/data/resource-pack/assets/kbve/models/block/rust_stone.json

@@ -0,0 +1,6 @@
+{
+	"parent": "minecraft:block/cube_all",
+	"textures": {
+		"all": "kbve:block/rust_stone"
+	}
+}

apps/mc/data/resource-pack/assets/kbve/models/item/kbve_coin.json → apps/mc/data/resource-pack/assets/kbve/models/item/rewards/kbve_coin.json

@@ -1,6 +1,6 @@
 {
 	"parent": "minecraft:item/generated",
 	"textures": {
-		"layer0": "kbve:item/kbve_coin"
+		"layer0": "kbve:item/rewards/kbve_coin"
 	}
 }

apps/mc/data/resource-pack/assets/kbve/models/item/weapons/kbve_scythe.json

@@ -0,0 +1,6 @@
+{
+	"parent": "minecraft:item/handheld",
+	"textures": {
+		"layer0": "kbve:item/weapons/kbve_scythe"
+	}
+}

apps/mc/data/resource-pack/assets/kbve/models/item/kbve_sword.json → apps/mc/data/resource-pack/assets/kbve/models/item/weapons/kbve_sword.json

@@ -1,6 +1,6 @@
 {
 	"parent": "minecraft:item/handheld",
 	"textures": {
-		"layer0": "kbve:item/kbve_sword"
+		"layer0": "kbve:item/weapons/kbve_sword"
 	}
 }

apps/mc/data/resource-pack/assets/kbve/models/item/weapons/spartan_shield.json

@@ -0,0 +1,6 @@
+{
+	"parent": "minecraft:item/generated",
+	"textures": {
+		"layer0": "kbve:item/weapons/spartan_shield"
+	}
+}

apps/mc/data/resource-pack/pack.mcmeta

@@ -1,6 +1,6 @@
 {
   "pack": {
     "pack_format": 46,
-    "description": "KBVE Custom Items - Coin & Sword"
+    "description": "KBVE Custom Assets - Weapons, Rewards & Blocks"
   }
 }

apps/mc/mc-e2e/e2e/resource-pack.spec.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+
+const MC_HOST = process.env['MC_HOST'] ?? '127.0.0.1';
+const PACK_PORT = Number(process.env['MC_PACK_PORT'] ?? 8080);
+const PACK_PATH = '/kbve-resource-pack.zip';
+
+describe('MC Resource Pack HTTP Server', () => {
+	it('should serve the resource pack as a ZIP file', async () => {
+		const url = `http://${MC_HOST}:${PACK_PORT}${PACK_PATH}`;
+		const res = await fetch(url);
+
+		expect(res.ok).toBe(true);
+		expect(res.status).toBe(200);
+
+		const contentType = res.headers.get('content-type');
+		expect(contentType).toContain('application/zip');
+
+		const body = await res.arrayBuffer();
+		expect(body.byteLength).toBeGreaterThan(0);
+
+		// Validate ZIP magic bytes (PK\x03\x04)
+		const header = new Uint8Array(body, 0, 4);
+		expect(header[0]).toBe(0x50); // P
+		expect(header[1]).toBe(0x4b); // K
+		expect(header[2]).toBe(0x03);
+		expect(header[3]).toBe(0x04);
+	});
+
+	it('should return 404 for unknown paths', async () => {
+		const url = `http://${MC_HOST}:${PACK_PORT}/nonexistent`;
+		const res = await fetch(url);
+
+		expect(res.ok).toBe(false);
+	});
+});

apps/mc/mc-e2e/project.json

@@ -5,16 +5,21 @@
 	"sourceRoot": "apps/mc/mc-e2e/e2e",
 	"implicitDependencies": ["mc"],
 	"targets": {
+		"test": {
+			"executor": "nx:noop",
+			"cache": false
+		},
 		"e2e": {
 			"executor": "nx:run-commands",
 			"cache": false,
 			"options": {
 				"commands": [
 					"docker rm -f mc-e2e-test 2>/dev/null || true",
-					"docker run -d --name mc-e2e-test -p 25565:25565 kbve/mc:local",
-					"npx vitest run --config apps/mc/mc-e2e/vitest.config.ts; EC=$?; docker rm -f mc-e2e-test 2>/dev/null || true; exit $EC"
+					"docker run -d --name mc-e2e-test -p 25565:25565 -p 8080:8080 kbve/mc:local",
+					"npx vitest run; EC=$?; docker rm -f mc-e2e-test 2>/dev/null || true; exit $EC"
 				],
-				"parallel": false
+				"parallel": false,
+				"cwd": "apps/mc/mc-e2e"
 			}
 		}
 	},

apps/mc/mc-e2e/vitest.config.ts

@@ -2,7 +2,7 @@ import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
 	test: {
-		include: ['apps/mc/mc-e2e/e2e/**/*.spec.ts'],
+		include: ['e2e/**/*.spec.ts'],
 		testTimeout: 30_000,
 		hookTimeout: 60_000,
 	},

apps/mc/plugins/kbve-mc-plugin/Cargo.toml

@@ -15,6 +15,8 @@ pumpkin-api-macros = { path = "../../pumpkin/pumpkin-api-macros" }
 pumpkin-macros = { path = "../../pumpkin/pumpkin-macros" }
 pumpkin-util = { path = "../../pumpkin/pumpkin-util" }
 pumpkin-data = { path = "../../pumpkin/pumpkin-data" }
+pumpkin-protocol = { path = "../../pumpkin/pumpkin-protocol" }
 pumpkin-world = { path = "../../pumpkin/pumpkin-world" }
 tokio = { version = "1", features = ["rt-multi-thread"] }
 axum = "0.8"
+dashmap = "6"