WarpEngine 0.7.0: a képtár és a CI is a hoszté, adapteren keresztül

Két dolog volt beépítve az engine-be, ami nem az övé.

A **képtár** eddig `WarpEngine::Image` volt, pedig a modell teljesen általános:
a teletypegames-ben a tagok arcképét is ez hordozza, nem csak a katalógus
borítóit. Az `Image` modell, a feltöltött fájlok, az `/api/image/:id` végpont
és az admin oldal ezért átkerült a hosztba, az engine pedig adapteren szól
hozzá (`WarpEngine::Images`): `url_for` adja a katalógus JSON `imageUrl`-jét,
`select_options` a software-form képválasztóját, `build_from_upload` a
"tölts fel új képet" ágat. Az alapértelmezés az `Image` osztály, tehát a
default útvonal bitre a régi. A `SoftwareImage` (a katalógus-kapcsolat)
maradt az engine-ben, és **az `images` tábla nem mozdult**: az engine csak
abbahagyta a létrehozását, a generátor írja meg hoszt-kódként.

A **CI** eddig végig Woodpecker volt: kliens, aláírás-ellenőrzés,
pipeline-receptek, repo-szinkron, secret-kiosztás. Mindez egy adapter mögé
került (`WarpEngine.ci`), a Woodpecker-implementáció pedig az engine-ben
maradt `WarpEngine::CI::Woodpecker` néven — kliens, adapter, httpsig-ellenőrző
és a platformonkénti pipeline-receptek, mert a YAML-dialektus a szolgáltatóé.
Az engine saját kódja már nem nevez szolgáltatót: `CI::Repo` és `CI::Run`
értékeket kap, `CI::ConnectionError`/`ApiError`/`NotConfigured` hibákat dob, a
`Pipeline` pedig `remote_repo_id`-t ad a történelmi `woodpecker_repo_id`
kolumna fölött (a tábla itt sem mozdult). `c.ci_adapter = :none` azt jelenti,
hogy ez a hoszt nem buildel: az `/api/ci/*` 503, a `/build/config` elutasít,
az admin akciók elbújnak.

Mindkét seam a hoszt initializerében van kimondva, nem alapértelmezésre
hagyva — a hoszt megnevezi, mi a képtára és mi a CI-ja.

Törés a 0.6-hoz képest: `image_container_path`, `image_owners`,
`ci_platforms`, `ci_update_server`, `ci_extension_public_key(_url)`,
`woodpecker_url`, `woodpecker_api_token`, `woodpecker_repo_owner` és a
`WarpEngine.woodpecker_configured?` megszűnt; a helyük `c.image_class_name` /
`c.image_adapter` és `c.ci_adapter`. Az `/api/ci/*` `latest_run`/`trigger`
válasza a normalizált `CI::Run` alakot adja (number, status, branch, message,
createdAt, url), a `pipelines` lista pedig `repo_id`-t is közöl a megtartott
`woodpecker_repo_id` mellett.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/generators/warp_engine/install/install_generator.rb

@@ -17,6 +17,12 @@ module WarpEngine
         template "initializer.rb", "config/initializers/warp_engine.rb"
       end
 
+      def copy_image_library
+        template "image.rb", "app/models/image.rb"
+        template "images_controller.rb", "app/controllers/api/images_controller.rb"
+        migration_template "create_images.rb", "db/migrate/create_images.rb"
+      end
+
       def copy_migration
         migration_template "create_warp_engine_tables.rb", "db/migrate/create_warp_engine_tables.rb"
       end
@@ -27,7 +33,11 @@ module WarpEngine
           WarpEngine telepítve. Következő lépések:
             1. rails db:migrate
             2. mount WarpEngine::Engine => "/" a config/routes.rb végére
-            3. állítsd be a config/initializers/warp_engine.rb-t
+            3. a képkönyvtár a hosztod: a routes.rb-be
+               namespace :api do
+                 get "image/:id", to: "images#show"
+               end
+            4. állítsd be a config/initializers/warp_engine.rb-t
         MSG
       end
     end

lib/generators/warp_engine/install/templates/create_images.rb

@@ -0,0 +1,12 @@
+class CreateImages < ActiveRecord::Migration[8.0]
+  def change
+    create_table :images do |t|
+      t.string :filename, null: false
+      t.string :original_filename, null: false
+      t.string :content_type, default: "application/octet-stream", null: false
+      t.datetime :deleted_at, precision: 3
+      t.timestamps
+      t.index :deleted_at
+    end
+  end
+end

lib/generators/warp_engine/install/templates/create_warp_engine_tables.rb

@@ -60,21 +60,13 @@ class CreateWarpEngineTables < ActiveRecord::Migration[8.0]
       t.index :deleted_at
     end
 
-    create_table :images do |t|
-      t.string :filename, null: false
-      t.string :original_filename, null: false
-      t.string :content_type, default: "application/octet-stream", null: false
-      t.datetime :deleted_at, precision: 3
-      t.timestamps
-      t.index :deleted_at
-    end
-
     create_table :software_images do |t|
       t.references :software, null: false, foreign_key: { on_delete: :cascade }
-      t.references :image, null: false, foreign_key: true, index: false
+      t.bigint :image_id, null: false
       t.boolean :is_default, default: false, null: false
       t.integer :position, default: 0, null: false
       t.timestamps
+      t.index :image_id
       t.index [ :software_id, :image_id ], unique: true
       t.index [ :software_id, :position ]
     end

lib/generators/warp_engine/install/templates/image.rb

@@ -0,0 +1,32 @@
+class Image < ApplicationRecord
+  def self.upload_path
+    ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
+  end
+
+  has_many :software_images, class_name: "WarpEngine::SoftwareImage", dependent: :restrict_with_error
+
+  default_scope { where(deleted_at: nil) }
+
+  attr_accessor :file_upload
+
+  before_save :process_upload, if: -> { file_upload.present? }
+
+  def self.ransackable_attributes(auth_object = nil)
+    %w[content_type created_at deleted_at filename id original_filename updated_at]
+  end
+
+  def file_path
+    File.join(self.class.upload_path, filename.to_s)
+  end
+
+  private
+
+  def process_upload
+    FileUtils.mkdir_p(self.class.upload_path)
+    self.original_filename = file_upload.original_filename
+    self.content_type      = file_upload.content_type.presence || "application/octet-stream"
+    ext                    = File.extname(file_upload.original_filename)
+    self.filename          = "#{SecureRandom.uuid}#{ext}"
+    IO.copy_stream(file_upload.to_io, file_path)
+  end
+end

lib/generators/warp_engine/install/templates/images_controller.rb

@@ -0,0 +1,16 @@
+module Api
+  class ImagesController < ActionController::API
+    rescue_from ActiveRecord::RecordNotFound do
+      render json: { error: "Not found" }, status: :not_found
+    end
+
+    rescue_from Errno::ENOENT do
+      render json: { error: "Not found" }, status: :not_found
+    end
+
+    def show
+      image = Image.find(params[:id])
+      send_file image.file_path, type: image.content_type, disposition: "inline"
+    end
+  end
+end

lib/generators/warp_engine/install/templates/initializer.rb

@@ -1,4 +1,17 @@
 Rails.application.config.to_prepare do
   WarpEngine.configure do |c|
+    c.file_container_path = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
+
+    c.update_secret = ENV["UPDATE_SECRET"]
+
+    c.image_class_name = "Image"
+
+    c.ci_adapter = WarpEngine::CI::Woodpecker::Adapter.new(
+      url:            ENV["WOODPECKER_URL"],
+      api_token:      ENV["WOODPECKER_API_TOKEN"],
+      repo_owner:     ENV["WOODPECKER_REPO_OWNER"],
+      public_key_url: ENV["WOODPECKER_PUBLIC_KEY_URL"],
+      platforms:      {}
+    )
   end
 end

lib/warp_engine.rb

@@ -7,6 +7,8 @@ require "warp_engine/version"
 require "warp_engine/configuration"
 require "warp_engine/storage"
 require "warp_engine/access"
+require "warp_engine/images"
+require "warp_engine/ci"
 
 module WarpEngine
 
@@ -22,10 +24,6 @@ module WarpEngine
     yield(config)
   end
 
-  def self.woodpecker_configured?
-    config.woodpecker_url.present? && config.woodpecker_api_token.present?
-  end
-
   def self.instruments_publish?
     true
   end
@@ -34,6 +32,14 @@ module WarpEngine
     Storage.adapter
   end
 
+  def self.images
+    Images.adapter
+  end
+
+  def self.ci
+    CI.adapter
+  end
+
   def self.access_policy
     AccessPolicy.current
   end

lib/warp_engine/ci.rb

@@ -0,0 +1,94 @@
+module WarpEngine
+
+  module CI
+    class Error < StandardError; end
+
+    class ConnectionError < Error; end
+
+    class NotConfigured < Error; end
+
+    class ApiError < Error
+      attr_reader :status, :body
+
+      def initialize(message, status: nil, body: nil)
+        super(message)
+        @status = status
+        @body   = body
+      end
+    end
+
+    Repo = Struct.new(:id, :name, :owner, :active, :raw, keyword_init: true) do
+      def active? = active ? true : false
+      def full_name = "#{owner}/#{name}"
+    end
+
+    Run = Struct.new(:number, :status, :branch, :message, :created_at, :url, :raw, keyword_init: true) do
+      def success? = status.to_s == "success"
+
+      def as_json(*)
+        {
+          number:    number,
+          status:    status,
+          branch:    branch,
+          message:   message,
+          createdAt: created_at&.utc&.iso8601,
+          url:       url
+        }
+      end
+    end
+
+    class Null
+      MESSAGE = "no CI adapter is configured (WarpEngine.config.ci_adapter)".freeze
+
+      def name = "none"
+      def configured? = false
+      def platforms = {}
+      def update_server = nil
+
+      def repos                              = raise(NotConfigured, MESSAGE)
+      def repo(_id)                          = raise(NotConfigured, MESSAGE)
+      def activate_repo(_id)                 = raise(NotConfigured, MESSAGE)
+      def deactivate_repo(_id)               = raise(NotConfigured, MESSAGE)
+      def runs(_repo_id, page: 1)            = raise(NotConfigured, MESSAGE)
+      def run(_repo_id, _number)             = raise(NotConfigured, MESSAGE)
+      def trigger(_repo_id, branch: nil)     = raise(NotConfigured, MESSAGE)
+      def secret_names(_repo_id)             = raise(NotConfigured, MESSAGE)
+      def secret_set(_repo_id, name:, value:) = raise(NotConfigured, MESSAGE)
+      def secret_delete(_repo_id, _name)     = raise(NotConfigured, MESSAGE)
+
+      def verify_config_request(_request) = false
+      def config_marker(_params) = nil
+      def pipeline_config(platform:, name:, update_server:) = nil
+      def config_response(platform:, config:) = {}
+    end
+
+    class << self
+      def adapter
+        configured = WarpEngine.config.ci_adapter
+
+        case configured
+        when nil, :woodpecker, "woodpecker" then woodpecker_adapter
+        when :none, "none", :null           then null_adapter
+        else configured
+        end
+      end
+
+      def woodpecker? = adapter.is_a?(Woodpecker::Adapter)
+
+      def woodpecker_adapter
+        @woodpecker_adapter ||= Woodpecker::Adapter.new
+      end
+
+      def null_adapter
+        @null_adapter ||= Null.new
+      end
+
+      def reset!
+        @woodpecker_adapter = nil
+        @null_adapter = nil
+      end
+    end
+  end
+end
+
+require "warp_engine/ci/woodpecker"

lib/warp_engine/ci/woodpecker.rb

@@ -0,0 +1,4 @@
+require "warp_engine/ci/woodpecker/client"
+require "warp_engine/ci/woodpecker/signature_verifier"
+require "warp_engine/ci/woodpecker/pipeline_config"
+require "warp_engine/ci/woodpecker/adapter"

lib/warp_engine/ci/woodpecker/adapter.rb

@@ -0,0 +1,146 @@
+module WarpEngine
+  module CI
+    module Woodpecker
+      class Adapter
+        SECRET_EVENTS = %w[push tag deployment].freeze
+
+        attr_reader :url, :repo_owner, :update_server
+
+        def initialize(url: ENV["WOODPECKER_URL"],
+                       api_token: ENV["WOODPECKER_API_TOKEN"],
+                       repo_owner: ENV["WOODPECKER_REPO_OWNER"],
+                       public_key: nil,
+                       public_key_url: nil,
+                       platforms: {},
+                       update_server: nil)
+          @url            = url.presence
+          @api_token      = api_token.presence
+          @repo_owner     = repo_owner.presence
+          @public_key     = public_key.presence
+          @public_key_url = public_key_url.presence
+          @update_server  = update_server.presence
+          @config         = PipelineConfig.new(platforms: platforms || {})
+        end
+
+        def name = "Woodpecker"
+
+        def configured? = @url.present? && @api_token.present?
+
+        def platforms = @config.platforms
+
+        def client
+          @client ||= Client.new(url: @url, token: @api_token)
+        end
+
+        def repos
+          Array(client.list_repos).map { |remote| to_repo(remote) }
+        end
+
+        def repo(repo_id)
+          to_repo(client.get_repo(repo_id))
+        end
+
+        def activate_repo(repo_id)
+          client.activate_repo(repo_id)
+          nil
+        end
+
+        def deactivate_repo(repo_id)
+          client.deactivate_repo(repo_id)
+          nil
+        end
+
+        def runs(repo_id, page: 1)
+          Array(client.list_pipelines(repo_id, page: page)).map { |run| to_run(run) }
+        end
+
+        def run(repo_id, number)
+          remote = if number.to_s == "latest"
+            client.latest_pipeline(repo_id)
+          else
+            client.get_pipeline(repo_id, number)
+          end
+          remote && to_run(remote)
+        end
+
+        def trigger(repo_id, branch: "main")
+          to_run(client.trigger_pipeline(repo_id, branch: branch || "main"))
+        end
+
+        def secret_names(repo_id)
+          Array(client.list_secrets(repo_id)).map { |secret| secret["name"] }
+        end
+
+        def secret_set(repo_id, name:, value:)
+          if secret_names(repo_id).include?(name)
+            client.update_secret(repo_id, name, value: value)
+          else
+            client.create_secret(repo_id, name: name, value: value, events: SECRET_EVENTS)
+          end
+          nil
+        end
+
+        def secret_delete(repo_id, name)
+          client.delete_secret(repo_id, name)
+          nil
+        end
+
+        def verify_config_request(request)
+          SignatureVerifier.new(request, public_key: @public_key, public_key_url: @public_key_url).valid?
+        end
+
+        def config_marker(params)
+          configs = params[:configuration].presence || params[:configs].presence || []
+          Array(configs).each do |config|
+            parsed = parse_marker(config[:data].to_s)
+            next unless parsed
+
+            return { platform: parsed["platform"].to_s,
+                     name:     parsed["name"].presence || params.dig(:repo, :name).to_s }
+          end
+          nil
+        end
+
+        def pipeline_config(platform:, name:, update_server:)
+          @config.render(platform: platform, name: name, update_server: update_server)
+        end
+
+        def config_response(platform:, config:)
+          { configs: [ { name: platform, data: config } ] }
+        end
+
+        private
+
+        def parse_marker(data)
+          parsed = begin
+            YAML.safe_load(data)
+          rescue Psych::Exception
+            nil
+          end
+          parsed if parsed.is_a?(Hash) && parsed.key?("platform")
+        end
+
+        def to_repo(remote)
+          return nil if remote.nil?
+
+          Repo.new(id: remote["id"], name: remote["name"], owner: remote["owner"],
+                   active: remote["active"], raw: remote)
+        end
+
+        def to_run(remote)
+          return nil if remote.nil?
+
+          Run.new(
+            number:     remote["number"],
+            status:     remote["status"],
+            branch:     remote["branch"],
+            message:    remote["message"],
+            created_at: remote["created"] ? Time.zone.at(remote["created"]) : nil,
+            url:        remote["forge_url"] || remote["link_url"],
+            raw:        remote
+          )
+        end
+      end
+    end
+  end
+end

lib/warp_engine/ci/woodpecker/client.rb

@@ -0,0 +1,143 @@
+require "net/http"
+require "json"
+require "uri"
+
+module WarpEngine
+  module CI
+    module Woodpecker
+      class Client
+        def initialize(url:, token:)
+          @base_url = url.to_s.chomp("/")
+          @token    = token
+        end
+
+        def list_repos
+          get("/api/repos")
+        end
+
+        def get_repo(repo_id)
+          get("/api/repos/#{repo_id}")
+        end
+
+        def activate_repo(repo_id)
+          post("/api/repos", body: { id: repo_id })
+        end
+
+        def deactivate_repo(repo_id)
+          delete("/api/repos/#{repo_id}")
+        end
+
+        def list_secrets(repo_id)
+          get("/api/repos/#{repo_id}/secrets")
+        end
+
+        def create_secret(repo_id, name:, value:, events: %w[push tag deployment])
+          post("/api/repos/#{repo_id}/secrets",
+               body: { name: name, value: value, events: events })
+        end
+
+        def update_secret(repo_id, secret_name, value:)
+          patch("/api/repos/#{repo_id}/secrets/#{secret_name}",
+                body: { value: value })
+        end
+
+        def delete_secret(repo_id, secret_name)
+          delete("/api/repos/#{repo_id}/secrets/#{secret_name}")
+        end
+
+        def list_pipelines(repo_id, page: 1, per_page: 25)
+          get("/api/repos/#{repo_id}/pipelines",
+              params: { page: page, perPage: per_page })
+        end
+
+        def latest_pipeline(repo_id)
+          get("/api/repos/#{repo_id}/pipelines/latest")
+        end
+
+        def get_pipeline(repo_id, number)
+          get("/api/repos/#{repo_id}/pipelines/#{number}")
+        end
+
+        def trigger_pipeline(repo_id, branch: "main")
+          post("/api/repos/#{repo_id}/pipelines",
+               body: { branch: branch })
+        end
+
+        private
+
+        def get(path, params: {})
+          uri = build_uri(path, params)
+          execute(uri, Net::HTTP::Get.new(uri))
+        end
+
+        def post(path, body: {})
+          uri = build_uri(path)
+          request = Net::HTTP::Post.new(uri)
+          request.body = body.to_json
+          request.content_type = "application/json"
+          execute(uri, request)
+        end
+
+        def patch(path, body: {})
+          uri = build_uri(path)
+          request = Net::HTTP::Patch.new(uri)
+          request.body = body.to_json
+          request.content_type = "application/json"
+          execute(uri, request)
+        end
+
+        def delete(path)
+          uri = build_uri(path)
+          execute(uri, Net::HTTP::Delete.new(uri))
+        end
+
+        def build_uri(path, params = {})
+          uri = URI.parse("#{@base_url}#{path}")
+          uri.query = URI.encode_www_form(params) if params.any?
+          uri
+        end
+
+        def execute(uri, request)
+          request["Authorization"] = "Bearer #{@token}"
+          request["Accept"] = "application/json"
+
+          response = Net::HTTP.start(uri.hostname, uri.port,
+                                     use_ssl: uri.scheme == "https",
+                                     open_timeout: 10,
+                                     read_timeout: 30) do |http|
+            http.request(request)
+          end
+
+          handle_response(uri, response)
+        rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Net::OpenTimeout,
+               Net::ReadTimeout, SocketError => e
+          raise CI::ConnectionError, "Cannot reach Woodpecker at #{@base_url}: #{e.message}"
+        end
+
+        def handle_response(uri, response)
+          case response
+          when Net::HTTPSuccess, Net::HTTPNoContent
+            return nil if response.body.blank?
+
+            begin
+              JSON.parse(response.body)
+            rescue JSON::ParserError
+              raise CI::ApiError.new(
+                "Expected JSON from #{uri.path} but got: #{response.body.truncate(80)}",
+                status: response.code.to_i, body: response.body
+              )
+            end
+          when Net::HTTPNotFound
+            raise CI::ApiError.new("Not found: #{uri.path}", status: 404, body: response.body)
+          else
+            raise CI::ApiError.new(
+              "Woodpecker API error #{response.code}: #{response.body&.truncate(200)}",
+              status: response.code.to_i,
+              body: response.body
+            )
+          end
+        end
+      end
+    end
+  end
+end

lib/warp_engine/ci/woodpecker/pipeline_config.rb

@@ -0,0 +1,42 @@
+require "erb"
+require "pathname"
+
+module WarpEngine
+  module CI
+    module Woodpecker
+      class PipelineConfig
+        PLATFORM_FORMAT = /\A[a-z0-9_-]+\z/
+
+        def initialize(platforms: {})
+          @platforms = platforms.to_h { |key, spec| [ key.to_s, spec.to_h.symbolize_keys ] }
+        end
+
+        def platforms
+          @platforms
+        end
+
+        def render(platform:, name:, update_server:)
+          platform = platform.to_s
+          return nil unless platform.match?(PLATFORM_FORMAT)
+
+          spec = @platforms[platform]
+          return nil if spec.nil?
+
+          path = self.class.templates_dir.join(platform, "pipeline.yaml.erb")
+          return nil unless path.exist?
+
+          ERB.new(path.read, trim_mode: "-").result_with_hash(
+            name:          name.to_s,
+            update_server: update_server.to_s,
+            builder:       spec[:builder],
+            exporter:      spec[:exporter]
+          )
+        end
+
+        def self.templates_dir
+          Pathname.new(__dir__).join("platforms")
+        end
+      end
+    end
+  end
+end

lib/warp_engine/ci/woodpecker/platforms/bevy/pipeline.yaml.erb

@@ -0,0 +1,112 @@
+# Generated pipeline — WarpEngine /build/config (platform: bevy, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        mkdir -p dist
+        cargo build --release --target wasm32-unknown-unknown
+        wasm-bindgen --target web --no-typescript \
+          --out-dir dist --out-name game target/wasm32-unknown-unknown/release/<%= name %>.wasm
+        echo "==> Downloading index.html"
+        curl -sSL https://git.teletypegames.org/tools/bevy-tools/raw/branch/master/web/index.html -o dist/index.html
+        echo "==> Packaging HTML/WASM for $VERSION"
+        zip -r "<%= name %>-$VERSION.html.zip" -j dist/game_bg.wasm dist/game.js dist/index.html
+        echo "==> Cleaning temporary files"
+        rm -f dist/game_bg.wasm dist/game.js dist/index.html
+
+  - name: binaries
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # Native binaries. linux-x64: glibc build in the debian-based builder
+        # image; win-x64: mingw-w64 cross-compile (x86_64-pc-windows-gnu).
+        # Mac needs osxcross, it is not built here.
+        # The zip gets the assets/ dir too if the project has one — bevy loads
+        # it at runtime, it is not embedded in the binary.
+        set -e
+        pack_binary() {
+          P_SLUG="$1"; P_BIN="$2"; P_NAME="$3"
+          PKG_DIR="<%= name %>-$VERSION-$P_SLUG"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          cp "$P_BIN" "$PKG_DIR/$P_NAME"
+          chmod +x "$PKG_DIR/$P_NAME"
+          if [ -d assets ]; then cp -r assets "$PKG_DIR/assets"; fi
+          zip -qr "$PKG_DIR.zip" "$PKG_DIR"
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        echo "==> Building linux-x64 binary"
+        cargo build --release
+        pack_binary "linux-x64" "target/release/<%= name %>" "<%= name %>"
+        echo "==> Building win-x64 binary"
+        CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=x86_64-w64-mingw32-gcc \
+          cargo build --release --target x86_64-pc-windows-gnu
+        pack_binary "win-x64" "target/x86_64-pc-windows-gnu/release/<%= name %>.exe" "<%= name %>.exe"
+        # linux-arm64: Raspberry Pi, Odroid, retro handhelds. pkg-config has to
+        # be told it may cross, and pointed at the arm64 .pc files, otherwise
+        # alsa-sys/libudev-sys pick up the host x86_64 libraries.
+        echo "==> Building linux-arm64 binary"
+        PKG_CONFIG_ALLOW_CROSS=1 \
+          PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig \
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
+          cargo build --release --target aarch64-unknown-linux-gnu
+        pack_binary "linux-arm64" "target/aarch64-unknown-linux-gnu/release/<%= name %>" "<%= name %>"
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        FILE="<%= name %>-$VERSION.html.zip"
+        META_SRC="metadata.json"
+        META_DST="<%= name %>-$VERSION.metadata.json"
+        cp $META_SRC $META_DST
+        BINS=""
+        for slug in win-x64 linux-x64 linux-arm64; do
+          [ -f "<%= name %>-$VERSION-$slug.zip" ] && BINS="$BINS <%= name %>-$VERSION-$slug.zip"
+        done
+        for f in $FILE $META_DST $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=bevy&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/c64/pipeline.yaml.erb

@@ -0,0 +1,59 @@
+# Generated pipeline — WarpEngine /build/config (platform: c64, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - |
+        VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' metadata.json | head -n 1)
+        if [ -z "$VERSION" ]; then
+          echo "ERROR: no \"version\" field in metadata.json!"
+          exit 1
+        fi
+        BRANCH=${CI_COMMIT_BRANCH:-${WOODPECKER_BRANCH}}
+        BRANCH=$(echo "$BRANCH" | tr '/' '-')
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ] && [ -n "$BRANCH" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    commands:
+      - |
+        VERSION=$(cat .version)
+        acme -f cbm -o <%= name %>.prg main.asm
+        echo "==> Creating versioned files for $VERSION"
+        cp <%= name %>.prg <%= name %>-$VERSION.prg
+        cp metadata.json <%= name %>-$VERSION.metadata.json
+        ls -lh <%= name %>-$VERSION.*
+
+  - name: artifact
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Uploading artifacts for version $VERSION"
+        for f in <%= name %>-$VERSION.prg <%= name %>-$VERSION.metadata.json; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Publishing version $VERSION"
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=c64&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/ebitengine/pipeline.yaml.erb

@@ -0,0 +1,101 @@
+# Generated pipeline — WarpEngine /build/config (platform: ebitengine, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        mkdir -p dist
+        GOOS=js GOARCH=wasm go build -o dist/game.wasm .
+        cp "$(go env GOROOT)/lib/wasm/wasm_exec.js" dist/wasm_exec.js
+        echo "==> Downloading index.html"
+        curl -sSL https://git.teletypegames.org/tools/ebitengine-tools/raw/branch/master/web/index.html -o dist/index.html
+        echo "==> Packaging HTML/WASM for $VERSION"
+        zip -r "<%= name %>-$VERSION.html.zip" -j dist/game.wasm dist/wasm_exec.js dist/index.html
+        echo "==> Cleaning temporary files"
+        rm -f dist/game.wasm dist/wasm_exec.js dist/index.html
+
+  - name: binaries
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # win-x86 / win-x64: pure Go cross-compile (Windowson nem kell cgo)
+        # linux-x64: cgo build, linux/amd64 hoston fut (builder image, X11/GL dev libekkel)
+        # helper: builds one target + zips it with a single root folder
+        # (unix zip keeps the executable bit)
+        binary_build() {
+          B_GOOS="$1"; B_GOARCH="$2"; B_CGO="$3"; B_EXT="$4"; B_TARGET="$5"; B_CC="$6"
+          PKG_DIR="<%= name %>-$VERSION-$B_TARGET"
+          echo "==> Building $PKG_DIR"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          # cgo cross-compile needs an explicit cross gcc; a native build must
+          # not see CC at all, otherwise go picks the wrong compiler
+          if [ -n "$B_CC" ]; then export CC="$B_CC"; else unset CC; fi
+          CGO_ENABLED=$B_CGO GOOS=$B_GOOS GOARCH=$B_GOARCH go build -o "$PKG_DIR/<%= name %>$B_EXT" .
+          if [ -f LICENSE ]; then cp LICENSE "$PKG_DIR/"; fi
+          if [ -f README.md ]; then cp README.md "$PKG_DIR/"; fi
+          zip -r "$PKG_DIR.zip" "$PKG_DIR" >/dev/null
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        # CI (linux builder) builds these four:
+        binary_build "windows" "386" "0" ".exe" "win-x86"
+        binary_build "windows" "amd64" "0" ".exe" "win-x64"
+        binary_build "linux" "amd64" "1" "" "linux-x64"
+        # linux-arm64: Raspberry Pi, Odroid, retro handhelds — cgo cross-build
+        # against the arm64 X11/GL/ALSA headers in the builder image
+        binary_build "linux" "arm64" "1" "" "linux-arm64" "aarch64-linux-gnu-gcc"
+
+  - name: artifact
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        FILE="<%= name %>-$VERSION.html.zip"
+        META_SRC="metadata.json"
+        META_DST="<%= name %>-$VERSION.metadata.json"
+        BINS=$(ls <%= name %>-$VERSION-*.zip 2>/dev/null || true)
+        cp $META_SRC $META_DST
+        for f in $FILE $META_DST $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=ebitengine&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/godot/pipeline.yaml.erb

@@ -0,0 +1,100 @@
+# Generated pipeline — WarpEngine /build/config (platform: godot, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    commands:
+      - |
+        VERSION=$(cat .version)
+        echo "==> Importing project"
+        godot --headless --import
+        echo "==> Exporting web build (Web preset)"
+        mkdir -p dist/web
+        godot --headless --export-release "Web" dist/web/index.html
+        echo "==> Packaging web build for $VERSION"
+        (cd dist/web && zip -r "../../<%= name %>-$VERSION.html.zip" .)
+        rm -rf dist/web
+      - |
+        VERSION=$(cat .version)
+        # exports a win/linux target + zips it with a single root folder
+        # (embed_pck makes the export a single executable)
+        binary_build() {
+          B_PRESET="$1"; B_EXT="$2"; B_TARGET="$3"
+          PKG_DIR="<%= name %>-$VERSION-$B_TARGET"
+          echo "==> Building $PKG_DIR"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          godot --headless --export-release "$B_PRESET" "$(pwd)/$PKG_DIR/<%= name %>$B_EXT"
+          if [ -f LICENSE ]; then cp LICENSE "$PKG_DIR/"; fi
+          if [ -f README.md ]; then cp README.md "$PKG_DIR/"; fi
+          zip -r "$PKG_DIR.zip" "$PKG_DIR" >/dev/null
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        # mac: from linux Godot can only export macOS into a .zip (holding the
+        # .app); repackage it to the root-folder convention (zip -ry keeps
+        # exec bits and symlinks)
+        binary_build_mac() {
+          B_PRESET="$1"; B_TARGET="$2"
+          PKG_DIR="<%= name %>-$VERSION-$B_TARGET"
+          echo "==> Building $PKG_DIR"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          godot --headless --export-release "$B_PRESET" "$(pwd)/$PKG_DIR/<%= name %>-mac-tmp.zip"
+          (cd "$PKG_DIR" && unzip -q "<%= name %>-mac-tmp.zip" && rm "<%= name %>-mac-tmp.zip")
+          if [ -f LICENSE ]; then cp LICENSE "$PKG_DIR/"; fi
+          if [ -f README.md ]; then cp README.md "$PKG_DIR/"; fi
+          zip -ry "$PKG_DIR.zip" "$PKG_DIR" >/dev/null
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        binary_build "Windows x86" ".exe" "win-x86"
+        binary_build "Windows x64" ".exe" "win-x64"
+        binary_build "Linux x64" "" "linux-x64"
+        binary_build_mac "Mac universal" "mac-universal"
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        cp metadata.json "<%= name %>-$VERSION.metadata.json"
+        BINS=$(ls <%= name %>-$VERSION-*.zip 2>/dev/null || true)
+        for f in "<%= name %>-$VERSION.html.zip" "<%= name %>-$VERSION.metadata.json" $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=godot&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/love/pipeline.yaml.erb

@@ -0,0 +1,174 @@
+# Generated pipeline — WarpEngine /build/config (platform: love, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: export
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        mkdir -p dist
+        echo "==> Building .love package"
+        zip -r dist/<%= name %>.love . \
+          --exclude "*.git*" \
+          --exclude "bin/*" \
+          --exclude "dist/*" \
+          --exclude "Makefile" \
+          --exclude ".version" \
+          --exclude "metadata.json" \
+          --exclude "*.zip"
+        mkdir -p dist/web
+        # The love-builder CI image pre-fetches love.js here; local builds
+        # fall back to GitHub.
+        if [ -f /opt/lovejs.zip ]; then
+          echo "==> Using cached love.js (/opt/lovejs.zip)"
+          cp /opt/lovejs.zip dist/lovejs.zip
+        else
+          echo "==> Downloading love.js (2dengine)"
+          curl -sSL https://github.com/2dengine/love.js/archive/refs/heads/master.zip -o dist/lovejs.zip
+        fi
+        unzip -o dist/lovejs.zip -d dist/lovejs-src
+        rm -f dist/lovejs.zip
+        echo "==> Assembling web bundle"
+        cp -r dist/lovejs-src/*/. dist/web/
+        rm -rf dist/lovejs-src
+        cp dist/<%= name %>.love dist/web/<%= name %>.love
+        echo "==> Patching player.js"
+        sed -i.bak "s|uri = 'nogame\.love'|uri = '<%= name %>.love'|g" dist/web/player.js && rm dist/web/player.js.bak
+        echo "==> Patching index.html"
+        sed -i.bak 's|<base href="/play/">|<base href="/file/<%= name %>-'"$VERSION"'/">|g' dist/web/index.html && rm dist/web/index.html.bak
+        echo "==> Web build ready in dist/web"
+        echo "==> Packaging Love2D for $VERSION"
+        zip -r <%= name %>-$VERSION.love.zip dist/<%= name %>.love
+        echo "==> Packaging web build for $VERSION"
+        (cd dist/web && zip -r ../../<%= name %>-$VERSION.html.zip .)
+        echo "==> Cleaning temporary files"
+        rm -f dist/<%= name %>.love
+        rm -rf dist/web
+
+  - name: binaries
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # The export step deleted the .love, rebuild it here (in make the
+        # binary-* targets' love prerequisite did the same).
+        mkdir -p dist
+        zip -r dist/<%= name %>.love . \
+          --exclude "*.git*" \
+          --exclude "bin/*" \
+          --exclude "dist/*" \
+          --exclude "Makefile" \
+          --exclude ".version" \
+          --exclude "metadata.json" \
+          --exclude "*.zip"
+        # The love-builder CI image pre-fetches the dist files to
+        # /opt/love-dist; local builds fall back to GitHub.
+        fetch_love() {
+          if [ -f "/opt/love-dist/$1" ]; then
+            echo "==> Using cached $1"
+            cp "/opt/love-dist/$1" "dist/$1"
+          elif [ ! -f "dist/$1" ]; then
+            echo "==> Downloading $1"
+            curl -sSL "https://github.com/love2d/love/releases/download/11.5/$1" -o "dist/$1"
+          fi
+        }
+        echo "==> Fusing windows binary"
+        fetch_love love-11.5-win64.zip
+        PKG_DIR="<%= name %>-$VERSION-win-x64"
+        rm -rf "$PKG_DIR" "$PKG_DIR.zip" dist/win64
+        unzip -q dist/love-11.5-win64.zip -d dist/win64
+        SRC=$(dirname $(find dist/win64 -name love.exe | head -n 1))
+        mkdir -p "$PKG_DIR"
+        cat "$SRC/love.exe" dist/<%= name %>.love > "$PKG_DIR/<%= name %>.exe"
+        cp "$SRC"/*.dll "$PKG_DIR/"
+        cp "$SRC/license.txt" "$PKG_DIR/" 2>/dev/null || true
+        zip -qr "$PKG_DIR.zip" "$PKG_DIR"
+        rm -rf "$PKG_DIR" dist/win64
+        echo "==> $PKG_DIR.zip kesz"
+        echo "==> Fusing macOS app bundle"
+        fetch_love love-11.5-macos.zip
+        PKG_DIR="<%= name %>-$VERSION-mac-universal"
+        rm -rf "$PKG_DIR" "$PKG_DIR.zip" dist/macos
+        unzip -q dist/love-11.5-macos.zip -d dist/macos
+        mkdir -p "$PKG_DIR"
+        mv dist/macos/love.app "$PKG_DIR/<%= name %>.app"
+        cp dist/<%= name %>.love "$PKG_DIR/<%= name %>.app/Contents/Resources/"
+        PLIST="$PKG_DIR/<%= name %>.app/Contents/Info.plist"
+        sed -i.bak "s|<string>LÖVE</string>|<string><%= name %></string>|g" "$PLIST" && rm "$PLIST.bak"
+        sed -i.bak "s|org\.love2d\.love|org.teletypegames.<%= name %>|g" "$PLIST" && rm "$PLIST.bak"
+        zip -qry "$PKG_DIR.zip" "$PKG_DIR"
+        rm -rf "$PKG_DIR" dist/macos
+        echo "==> $PKG_DIR.zip kesz"
+        # The AppImage runtime is glibc-dynamic and cannot run on alpine
+        # (musl), so we do not run the runtime: the offset is computed from
+        # readelf (shoff + shentsize*shnum) and the squashfs is extracted
+        # with unsquashfs -o.
+        echo "==> Fusing linux AppImage"
+        fetch_love love-11.5-x86_64.AppImage
+        PKG_DIR="<%= name %>-$VERSION-linux-x64"
+        APPIMAGE="dist/love-11.5-x86_64.AppImage"
+        rm -rf "$PKG_DIR" "$PKG_DIR.zip" squashfs-root dist/game.squashfs dist/runtime
+        OFFSET=$(readelf -h "$APPIMAGE" | awk '/Start of section headers/{o=$5} /Size of section headers/{s=$5} /Number of section headers/{n=$5} END{print o+s*n}')
+        unsquashfs -q -o $OFFSET -d squashfs-root "$APPIMAGE" >/dev/null
+        cat squashfs-root/bin/love dist/<%= name %>.love > squashfs-root/bin/love.fused
+        mv squashfs-root/bin/love.fused squashfs-root/bin/love
+        chmod +x squashfs-root/bin/love
+        mksquashfs squashfs-root dist/game.squashfs -root-owned -noappend -quiet -comp gzip
+        head -c $OFFSET "$APPIMAGE" > dist/runtime
+        mkdir -p "$PKG_DIR"
+        cat dist/runtime dist/game.squashfs > "$PKG_DIR/<%= name %>.AppImage"
+        chmod +x "$PKG_DIR/<%= name %>.AppImage"
+        zip -qr "$PKG_DIR.zip" "$PKG_DIR"
+        rm -rf "$PKG_DIR" squashfs-root dist/game.squashfs dist/runtime
+        echo "==> $PKG_DIR.zip kesz"
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        cp metadata.json "<%= name %>-$VERSION.metadata.json"
+        BINS=""
+        for slug in win-x64 mac-universal linux-x64; do
+          [ -f "<%= name %>-$VERSION-$slug.zip" ] && BINS="$BINS <%= name %>-$VERSION-$slug.zip"
+        done
+        for f in "<%= name %>-$VERSION.love.zip" "<%= name %>-$VERSION.html.zip" "<%= name %>-$VERSION.metadata.json" $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=love&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/phaser/pipeline.yaml.erb

@@ -0,0 +1,92 @@
+# Generated pipeline — WarpEngine /build/config (platform: phaser, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # Ketfele projektforma el egymas mellett: a sima JS (a forrasok
+        # osszefuzve, a Phaser CDN-rol) es a bundleres (Vite + TypeScript),
+        # ami maga allitja elo a kesz webes csomagot.
+        if [ -f package.json ] && grep -q '"build"' package.json; then
+          echo "==> Bundled project — npm ci && npm run build"
+          npm ci
+          npm run build
+          # A Vite kimenete onmagaban teljes: index.html + a beforgatott
+          # assetek. A vite.config base-enek relativnak kell lennie, mert a
+          # jatek a /file/<nev>-<verzio>/ alkonyvtarbol szolgal ki.
+          if [ ! -f dist/index.html ]; then
+            echo "ERROR: a build nem hagyott dist/index.html-t" >&2
+            exit 1
+          fi
+          echo "==> Packaging web build for $VERSION"
+          (cd dist && zip -r "../<%= name %>-$VERSION.html.zip" .)
+          echo "==> Cleaning temporary files"
+          rm -rf dist
+        else
+          echo "==> Checking JS syntax"
+          # A bundleres projektben nincs src/*.js, es a shell ilyenkor a
+          # mintat adja tovabb literalkent — a node MODULE_NOT_FOUND-dal
+          # szall el rajta.
+          for f in src/*.js; do [ -e "$f" ] || continue; node --check "$f"; done
+          mkdir -p dist/web
+          echo "==> Downloading Phaser 3.90.0"
+          curl -sSL https://cdn.jsdelivr.net/npm/phaser@3.90.0/dist/phaser.min.js -o dist/web/phaser.min.js
+          echo "==> Downloading index.html"
+          curl -sSL https://git.teletypegames.org/build/phaser-tools/raw/branch/master/web/index.html -o dist/web/index.html
+          echo "==> Bundling game sources"
+          cat src/*.js > dist/web/game.js
+          echo "==> Packaging web build for $VERSION"
+          (cd dist/web && zip -r "../../<%= name %>-$VERSION.html.zip" .)
+          echo "==> Cleaning temporary files"
+          rm -rf dist/web
+        fi
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        FILE="<%= name %>-$VERSION.html.zip"
+        META_SRC="metadata.json"
+        META_DST="<%= name %>-$VERSION.metadata.json"
+        cp $META_SRC $META_DST
+        for f in $FILE $META_DST; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=phaser&version=$VERSION"

lib/warp_engine/ci/woodpecker/platforms/tic80/pipeline.yaml.erb

@@ -0,0 +1,199 @@
+# Generated pipeline — WarpEngine /build/config (platform: tic80, name: <%= name %>)
+# The version comes from the source (inc/meta/meta.header.lua "-- version:"
+# comment) — WarpEngine parses tic80 metadata from the Lua header too, hence
+# no metadata.json.
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - |
+        VERSION=$(sed -n "s/^-- version: //p" inc/meta/meta.header.lua | head -n 1 | tr -d "[:space:]")
+        BRANCH=${CI_COMMIT_BRANCH:-${WOODPECKER_BRANCH}}
+        BRANCH=$(echo "$BRANCH" | tr '/' '-')
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ] && [ -n "$BRANCH" ]; then
+          VERSION=dev-$VERSION-$BRANCH
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: lint
+    image: alpine
+    commands:
+      - apk add --no-cache lua5.4 lua5.4-dev luarocks gcc musl-dev
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
+      - ln -sf /usr/bin/luarocks-5.4 /usr/bin/luarocks
+      - luarocks install luacheck
+      - |
+        echo "==> Merging..."
+        rm -f /tmp/_lint_combined.lua /tmp/_lint_map.txt
+        touch /tmp/_lint_combined.lua
+        line=1
+        while IFS= read -r f || [ -n "$f" ]; do
+          f=$(printf '%s' "$f" | tr -d '\r')
+          [ -z "$f" ] && continue
+          before=$(wc -l < /tmp/_lint_combined.lua)
+          cat "inc/$f" >> /tmp/_lint_combined.lua
+          printf '\n' >> /tmp/_lint_combined.lua
+          after=$(wc -l < /tmp/_lint_combined.lua)
+          linecount=$((after - before))
+          echo "$line $linecount inc/$f" >> /tmp/_lint_map.txt
+          line=$((line + linecount))
+        done < <%= name %>.inc
+        echo "==> luacheck..."
+        LINT_OUTPUT=$(luacheck --no-max-line-length /tmp/_lint_combined.lua 2>&1 | awk -v map=/tmp/_lint_map.txt '
+        BEGIN {
+            NR_map = 0;
+            while ((getline line < map) > 0) {
+                n = split(line, a, " ");
+                start[NR_map] = a[1]+0;
+                count[NR_map] = a[2]+0;
+                fname[NR_map] = a[3];
+                NR_map++;
+            }
+        }
+        /^[^:]+:[0-9]+:[0-9]+:/ {
+            colon1 = index($0, ":");
+            rest1  = substr($0, colon1+1);
+            colon2 = index(rest1, ":");
+            absline = substr(rest1, 1, colon2-1) + 0;
+            rest2  = substr(rest1, colon2+1);
+            colon3 = index(rest2, ":");
+            col    = substr(rest2, 1, colon3-1);
+            rest   = substr(rest2, colon3);
+            found  = 0;
+            for (i = 0; i < NR_map; i++) {
+                end_line = start[i] + count[i] -1;
+                if (absline >= start[i] && absline <= end_line) {
+                    relline = absline - start[i] + 1;
+                    print fname[i] ":" relline ":" col ":" rest;
+                    found = 1;
+                    break;
+                }
+            }
+            if (!found) print $0;
+            next;
+        }
+        { print }
+        ')
+        echo "$LINT_OUTPUT"
+        NUM_ISSUES=$(echo "$LINT_OUTPUT" | grep -cE "^[^:]+:[0-9]+:[0-9]+:" || true)
+        if [ "$NUM_ISSUES" -gt 0 ]; then
+          echo "Total: $NUM_ISSUES issue(s) found, commit aborted."
+          exit 1
+        else
+          echo "Checking /tmp/_lint_combined.lua                  OK"
+          echo "Total: 0 warnings / 0 errors in 1 file"
+        fi
+        rm -f /tmp/_lint_combined.lua /tmp/_lint_map.txt
+
+  - name: minify
+    image: alpine
+    commands:
+      - apk add --no-cache lua5.4 curl
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
+      - |
+        rm -f <%= name %>.lua
+        sed 's/\r$//' <%= name %>.inc | while read f; do
+          cat "inc/$f" >> <%= name %>.lua
+          echo "" >> <%= name %>.lua
+        done
+        test -f minify.lua || { echo "==> Downloading minify.lua"; curl -fsSL https://raw.githubusercontent.com/ztimar31/lua-minify-tic80/refs/heads/master/minify.lua -o minify.lua; }
+        echo "==> Minifying <%= name %>.lua"
+        cp <%= name %>.lua <%= name %>.original.lua
+        lua minify.lua minify <%= name %>.original.lua > <%= name %>.lua
+
+  - name: docs
+    image: alpine
+    commands:
+      - apk add --no-cache lua5.4 lua5.4-dev luarocks gcc musl-dev zip
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
+      - ln -sf /usr/bin/luarocks-5.4 /usr/bin/luarocks
+      - luarocks install ldoc
+      - |
+        VERSION=$(cat .version)
+        echo "==> Generating docs from <%= name %>.original.lua"
+        ldoc <%= name %>.original.lua -d docs
+        echo "==> Zipping docs for version $VERSION"
+        (cd docs && zip -r ../<%= name %>-$VERSION-docs.zip .)
+        cp <%= name %>-$VERSION-docs.zip <%= name %>-docs.zip
+        echo "==> Docs zip created"
+
+  - name: export
+    image: <%= builder %>
+    environment:
+      XDG_RUNTIME_DIR: /tmp
+    commands:
+      - |
+        VERSION=$(cat .version)
+        echo "==> Exporting HTML for version $VERSION"
+        tic80 --cli --skip --fs=. \
+          --cmd="load <%= name %>.lua & save <%= name %>-$VERSION & export html <%= name %>-$VERSION.html & exit"
+        if [ -f "<%= name %>-$VERSION.tic" ]; then
+          cp <%= name %>-$VERSION.tic <%= name %>.tic
+        fi
+        if [ -f "<%= name %>-$VERSION.html.zip" ]; then
+          cp <%= name %>-$VERSION.html.zip <%= name %>.html.zip
+        fi
+        echo "==> Generated files:"
+        ls -lh <%= name %>-$VERSION.* <%= name %>.tic <%= name %>.html.zip 2>/dev/null || true
+
+  - name: binaries
+    image: <%= builder %>
+    environment:
+      XDG_RUNTIME_DIR: /tmp
+    commands:
+      - |
+        VERSION=$(cat .version)
+        echo "==> Exporting native players for version $VERSION"
+        tic80 --cli --skip --fs=. \
+          --cmd="load <%= name %>.lua & export win <%= name %>-win & export linux <%= name %>-linux & export mac <%= name %>-mac & exit"
+        # unix zip preserves the executable bit
+        pack_binary() {
+          SLUG="$1"; SRC_FILE="$2"; DST_FILE="$3"
+          PKG_DIR="<%= name %>-$VERSION-$SLUG"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          mv "$SRC_FILE" "$PKG_DIR/$DST_FILE"
+          chmod +x "$PKG_DIR/$DST_FILE"
+          zip -r "$PKG_DIR.zip" "$PKG_DIR" >/dev/null
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        pack_binary win-x64 <%= name %>-win.exe <%= name %>.exe
+        pack_binary linux-x64 <%= name %>-linux <%= name %>
+        pack_binary mac-x64 <%= name %>-mac <%= name %>
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Uploading artifacts for version $VERSION"
+        cp <%= name %>.lua <%= name %>-$VERSION.lua
+        BINS=""
+        for slug in win-x64 linux-x64 mac-x64; do
+          [ -f "<%= name %>-$VERSION-$slug.zip" ] && BINS="$BINS <%= name %>-$VERSION-$slug.zip"
+        done
+        for f in <%= name %>-$VERSION.lua <%= name %>-$VERSION.tic <%= name %>-$VERSION.html.zip <%= name %>-$VERSION-docs.zip $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Publishing version $VERSION"
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=tic80&version=$VERSION"

lib/warp_engine/ci/woodpecker/signature_verifier.rb

@@ -0,0 +1,145 @@
+require "openssl"
+require "base64"
+require "net/http"
+require "digest"
+
+module WarpEngine
+  module CI
+    module Woodpecker
+      class SignatureVerifier
+        CAVAGE_PARAM = /(\w+)="([^"]*)"/
+
+        @key_cache = {}
+        @key_mutex = Mutex.new
+
+        class << self
+          def fetch_public_key(url)
+            @key_mutex.synchronize do
+              @key_cache[url] ||= Net::HTTP.get(URI.parse(url))
+            end
+          end
+
+          def reset_key_cache!
+            @key_mutex.synchronize { @key_cache = {} }
+          end
+        end
+
+        def initialize(request, public_key: nil, public_key_url: nil)
+          @request        = request
+          @public_key     = public_key
+          @public_key_url = public_key_url
+        end
+
+        def valid?
+          pem = public_key_pem
+          if pem.blank?
+            Rails.logger.error("[CI::Woodpecker] no public key configured — rejecting request")
+            return false
+          end
+
+          key = OpenSSL::PKey.read(pem)
+          if @request.headers["Signature-Input"].present?
+            rfc9421_valid?(key)
+          else
+            cavage_valid?(key)
+          end
+        rescue OpenSSL::PKey::PKeyError, ArgumentError => e
+          Rails.logger.error("[CI::Woodpecker] #{e.class}: #{e.message}")
+          false
+        end
+
+        private
+
+        def public_key_pem
+          return @public_key if @public_key.present?
+          return nil if @public_key_url.blank?
+
+          self.class.fetch_public_key(@public_key_url)
+        rescue StandardError => e
+          Rails.logger.error("[CI::Woodpecker] public key fetch failed: #{e.class}: #{e.message}")
+          nil
+        end
+
+        def rfc9421_valid?(key)
+          input = @request.headers["Signature-Input"].to_s
+          match = input.match(/\A\s*([\w.-]+)=(\(.*)\z/m)
+          return false if match.nil?
+
+          label, inner = match[1], match[2]
+          components = inner[/\((.*?)\)/m, 1].to_s.scan(/"([^"]*)"/).flatten
+          return false if components.empty?
+
+          signature = @request.headers["Signature"].to_s[/#{Regexp.escape(label)}=:([A-Za-z0-9+\/=]+):/, 1]
+          return false if signature.blank?
+          return false unless content_digest_valid?(components)
+
+          lines = components.map do |component|
+            value = component_value(component)
+            return false if value.nil?
+            %("#{component}": #{value})
+          end
+          lines << %("@signature-params": #{inner})
+
+          key.verify(nil, Base64.decode64(signature), lines.join("\n"))
+        end
+
+        def component_value(name)
+          case name
+          when "@request-target" then @request.fullpath
+          when "@method"         then @request.request_method
+          when "@target-uri"     then @request.original_url
+          when "@authority"      then @request.host_with_port
+          when "@path"           then @request.path
+          when "@query"          then "?#{@request.query_string}"
+          when /\A@/             then nil
+          else @request.headers[name]
+          end
+        end
+
+        def content_digest_valid?(components)
+          return true unless components.include?("content-digest")
+
+          digest = @request.headers["Content-Digest"].to_s[/sha-256=:([A-Za-z0-9+\/=]+):/, 1]
+          return false if digest.blank?
+
+          expected = Digest::SHA256.base64digest(@request.raw_post)
+          ActiveSupport::SecurityUtils.secure_compare(digest, expected)
+        end
+
+        def cavage_valid?(key)
+          params = cavage_params
+          return false if params.nil? || params["signature"].blank?
+
+          signing_string = cavage_signing_string(params.fetch("headers", "date"))
+          return false if signing_string.nil?
+
+          key.verify(nil, Base64.decode64(params["signature"]), signing_string)
+        end
+
+        def cavage_params
+          header = @request.headers["Signature"].presence
+          if header.nil?
+            auth = @request.headers["Authorization"].to_s
+            header = auth.delete_prefix("Signature ") if auth.start_with?("Signature ")
+          end
+          return nil if header.blank?
+
+          header.scan(CAVAGE_PARAM).to_h
+        end
+
+        def cavage_signing_string(headers_list)
+          lines = headers_list.split(" ").map do |name|
+            if name == "(request-target)"
+              "(request-target): #{@request.request_method.downcase} #{@request.fullpath}"
+            else
+              value = @request.headers[name]
+              return nil if value.nil?
+              "#{name.downcase}: #{value}"
+            end
+          end
+          lines.join("\n")
+        end
+      end
+    end
+  end
+end

lib/warp_engine/configuration.rb

@@ -2,20 +2,14 @@ module WarpEngine
   class Configuration
 
     attr_accessor :file_container_path,
-                  :image_container_path,
                   :update_secret,
                   :application_token_source,
                   :application_token_owner_class,
                   :max_upload_size,
                   :enforce_software_ownership,
-                  :ci_platforms,
-                  :ci_extension_public_key,
-                  :ci_extension_public_key_url,
-                  :ci_update_server,
-                  :woodpecker_url,
-                  :woodpecker_api_token,
-                  :woodpecker_repo_owner,
-                  :image_owners,
+                  :ci_adapter,
+                  :image_class_name,
+                  :image_adapter,
                   :storage_adapter,
                   :access_policy,
                   :access_token_owner_class,
@@ -26,20 +20,14 @@ module WarpEngine
 
     def initialize
       @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
-      @image_container_path          = ENV.fetch("IMAGE_CONTAINER_PATH", "/images")
       @update_secret                 = ENV["UPDATE_SECRET"]
       @application_token_source      = :env
       @application_token_owner_class = nil
       @max_upload_size               = 500 * 1024 * 1024
       @enforce_software_ownership    = false
-      @ci_platforms                  = {}
-      @ci_extension_public_key       = nil
-      @ci_extension_public_key_url   = nil
-      @ci_update_server              = nil
-      @woodpecker_url                = ENV["WOODPECKER_URL"]
-      @woodpecker_api_token          = ENV["WOODPECKER_API_TOKEN"]
-      @woodpecker_repo_owner         = ENV["WOODPECKER_REPO_OWNER"]
-      @image_owners                  = []
+      @ci_adapter                    = :woodpecker
+      @image_class_name              = "Image"
+      @image_adapter                 = nil
       @storage_adapter               = :local
       @access_policy                 = :open
       @access_token_owner_class      = nil

lib/warp_engine/images.rb

@@ -0,0 +1,68 @@
+module WarpEngine
+
+  module Images
+
+    class HostModel
+      URL_PREFIX = "/api/image".freeze
+
+      def model_name
+        WarpEngine.config.image_class_name
+      end
+
+      def model
+        model_name.to_s.constantize
+      end
+
+      def url_for(image_id)
+        image_id.present? ? "#{URL_PREFIX}/#{image_id}" : nil
+      end
+
+      def build_from_upload(upload)
+        model.new(file_upload: upload)
+      end
+
+      def label_for(record)
+        record.original_filename
+      end
+
+      def available?(record)
+        return true unless record.respond_to?(:file_path)
+
+        File.exist?(record.file_path.to_s)
+      end
+
+      def select_options
+        model.order(:original_filename).map { |record| [ label_for(record), record.id ] }
+      end
+    end
+
+    class << self
+      def adapter
+        configured = WarpEngine.config.image_adapter
+
+        case configured
+        when nil, :host_model, "host_model" then host_model_adapter
+        else configured
+        end
+      end
+
+      def host_model? = adapter.is_a?(HostModel)
+
+      def host_model_adapter
+        @host_model_adapter ||= HostModel.new
+      end
+
+      def reset!
+        @host_model_adapter = nil
+      end
+
+      def model_name = adapter.model_name
+      def model = adapter.model
+      def url_for(image_id) = adapter.url_for(image_id)
+      def build_from_upload(upload) = adapter.build_from_upload(upload)
+      def label_for(record) = adapter.label_for(record)
+      def available?(record) = adapter.available?(record)
+      def select_options = adapter.select_options
+    end
+  end
+end

lib/warp_engine/version.rb

@@ -1,5 +1,5 @@
 module WarpEngine
-  VERSION = "0.5.2"
+  VERSION = "0.7.0"
 
   VERSION_HEADER = "WarpEngine-Version".freeze
 end