Give gem push a named credentials key

The push prompted for credentials and then died with "404 page not found". Both are the same fault: RubyGems normalizes the keys in ~/.gem/credentials — dots become __ and a trailing slash is appended — so a key written as the host URL can never match the --host value. Finding no key, gem push falls back to signing in against the RubyGems sign_in endpoint, which Gitea does not implement; that is the 404. A named key is stored verbatim and is matched by --key, so the lookup succeeds. Verified against Gem::ConfigFile with both formats. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Point the release pipeline at the engines org
2026-08-16 11:11:17 +02:00 · 2026-08-16 10:39:40 +02:00 · 2026-08-15 21:33:27 +02:00 · 2026-08-11 00:01:14 +02:00 · 2026-08-10 23:58:27 +02:00 · 2026-08-10 11:30:06 +02:00
105 changed files with 4322 additions and 1595 deletions
@@ -1,10 +1,10 @@
 # Read-only split mirror: a libs/ruby/warp_engine alkönyvtárat kitükrözi a
-# tools/warp_engine repóba (fejlesztés itt, a monorepóban történik; a tükör
+# engines/warp_engine repóba (fejlesztés itt, a monorepóban történik; a tükör
 # csak publikálásra való). Tag-elt release (warp_engine-v*) esetén a gem a
 # Forgejo rubygems registry-be is felmegy.
 #
 # Szükséges Woodpecker secret: forge_token — Forgejo access token
-# repository:write (tools/warp_engine) és package:write joggal.
+# repository:write (engines/warp_engine) és package:write joggal.

 when:
  - event: push
@@ -32,7 +32,7 @@ steps:
      - git subtree split --prefix=libs/ruby/warp_engine HEAD -b warp-engine-split
      # a secretbe másolt token végén lehet sortörés — levágjuk
      - TOKEN="$$(printf '%s' "$${FORGE_TOKEN}" | tr -d '[:space:]')"
-      - git push --force "https://ci:$${TOKEN}@git.teletypegames.org/tools/warp_engine.git" warp-engine-split:master
+      - git push --force "https://ci:$${TOKEN}@git.teletypegames.org/engines/warp_engine.git" warp-engine-split:master
    when:
      - event: push
        branch: master
@@ -48,10 +48,15 @@ steps:
      - gem build warp_engine.gemspec
      - mkdir -p ~/.gem
      - TOKEN="$$(printf '%s' "$${FORGE_TOKEN}" | tr -d '[:space:]')"
+      # Nevesített kulcs, nem a hoszt-URL: a RubyGems a credentials fájl
+      # kulcsait normalizálja (a pontokból __ lesz, záró perjelet kap), így egy
+      # URL-kulcs sosem egyezik a --host értékével. Ilyenkor a gem push
+      # bejelentkezni próbál a RubyGems sign_in végpontján, amit a Gitea nem
+      # ismer — ez adta a "404 page not found"-ot.
      - |
-        printf -- '---\n:https://git.teletypegames.org/api/packages/tools/rubygems: Bearer %s\n' "$${TOKEN}" > ~/.gem/credentials
+        printf -- '---\n:gitea: Bearer %s\n' "$${TOKEN}" > ~/.gem/credentials
      - chmod 600 ~/.gem/credentials
-      - gem push --host https://git.teletypegames.org/api/packages/tools/rubygems warp_engine-*.gem
+      - gem push --key gitea --host https://git.teletypegames.org/api/packages/engines/rubygems warp_engine-*.gem
    when:
      - event: tag
        ref: refs/tags/warp_engine-v*
@@ -1,7 +1,7 @@
 PATH
  remote: ../libs/ruby/warp_engine
  specs:
-    warp_engine (0.1.0)
+    warp_engine (0.2.0)
      apipie-rails
      blueprinter
      rails (>= 8.0)
@@ -10,31 +10,31 @@ PATH
 GEM
  remote: https://rubygems.org/
  specs:
-    action_text-trix (2.1.18)
+    action_text-trix (2.1.19)
      railties
-    actioncable (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
-    actionmailer (8.1.3)
-      actionpack (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
-    actionpack (8.1.3)
-      actionview (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
@@ -42,21 +42,21 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actiontext (8.1.3)
+    actiontext (8.1.3.1)
      action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (8.1.3)
-      activesupport (= 8.1.3)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activeadmin (3.5.1)
+    activeadmin (3.5.2)
      arbre (~> 1.2, >= 1.2.1)
      csv
      formtastic (>= 3.1)
@@ -68,22 +68,22 @@ GEM
      ransack (>= 4.0)
    activeadmin_blaze_theme (1.1.0)
      activeadmin (>= 2.0, < 4)
-    activejob (8.1.3)
-      activesupport (= 8.1.3)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.3.6)
-    activemodel (8.1.3)
-      activesupport (= 8.1.3)
-    activerecord (8.1.3)
-      activemodel (= 8.1.3)
-      activesupport (= 8.1.3)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      timeout (>= 0.4.0)
-    activestorage (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activesupport (= 8.1.3)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      marcel (~> 1.0)
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -107,18 +107,18 @@ GEM
    bcrypt (3.1.22)
    bigdecimal (4.1.2)
    blueprinter (1.3.0)
-    bootsnap (1.24.3)
-      msgpack (~> 1.2)
+    bootsnap (1.25.0)
+      msgpack (~> 1.5)
    builder (3.3.0)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
    connection_pool (3.0.2)
-    crass (1.0.6)
-    csv (3.3.5)
+    crass (1.0.7)
+    csv (3.3.6)
    date (3.5.1)
    debug (1.11.1)
      irb (~> 1.10)
      reline (>= 0.3.8)
-    devise (5.0.3)
+    devise (5.0.4)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 7.0)
@@ -126,7 +126,7 @@ GEM
      warden (~> 1.2.3)
    diff-lcs (1.6.2)
    drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.7)
    erubi (1.13.1)
    factory_bot (6.6.0)
      activesupport (>= 6.1.0)
@@ -138,19 +138,19 @@ GEM
    formtastic (6.0.0)
      actionpack (>= 7.2.0)
    formtastic_i18n (0.7.0)
-    globalid (1.3.0)
+    globalid (1.4.0)
      activesupport (>= 6.1)
    has_scope (0.9.0)
      actionpack (>= 7.0)
      activesupport (>= 7.0)
-    i18n (1.14.8)
+    i18n (1.15.2)
      concurrent-ruby (~> 1.0)
    inherited_resources (1.14.0)
      actionpack (>= 6.0)
      has_scope (>= 0.6)
      railties (>= 6.0)
      responders (>= 2)
-    io-console (0.8.2)
+    io-console (0.9.1)
    irb (1.18.0)
      pp (>= 0.6.0)
      prism (>= 1.3.0)
@@ -160,7 +160,7 @@ GEM
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    json (2.19.5)
+    json (2.21.2)
    kaminari (1.2.2)
      activesupport (>= 4.1.0)
      kaminari-actionview (= 1.2.2)
@@ -173,27 +173,27 @@ GEM
      activerecord
      kaminari-core (= 1.2.2)
    kaminari-core (1.2.2)
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
    lint_roller (1.1.0)
    logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
      logger
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
    mini_mime (1.1.5)
    minitest (6.0.6)
      drb (~> 2.0)
      prism (~> 1.5)
-    msgpack (1.8.0)
+    msgpack (1.8.4)
    mysql2 (0.5.7)
      bigdecimal
-    net-imap (0.6.4)
+    net-imap (0.6.6)
      date
      net-protocol
    net-pop (0.1.2)
@@ -203,23 +203,20 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
    orm_adapter (0.5.0)
-    parallel (1.28.0)
-    parser (3.3.11.1)
+    parallel (2.1.0)
+    parser (3.3.12.0)
      ast (~> 2.4.1)
      racc
-    pp (0.6.3)
+    pp (0.6.4)
      prettyprint
    prettyprint (0.2.0)
    prism (1.9.0)
-    psych (5.3.1)
-      date
-      stringio
-    puma (8.0.1)
+    puma (8.0.2)
      nio4r (~> 2.0)
    racc (1.8.1)
    rack (3.2.6)
@@ -230,30 +227,30 @@ GEM
      rack (>= 1.3)
    rackup (2.3.1)
      rack (>= 3)
-    rails (8.1.3)
-      actioncable (= 8.1.3)
-      actionmailbox (= 8.1.3)
-      actionmailer (= 8.1.3)
-      actionpack (= 8.1.3)
-      actiontext (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activemodel (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      bundler (>= 1.15.0)
-      railties (= 8.1.3)
+      railties (= 8.1.3.1)
    rails-dom-testing (2.3.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -266,12 +263,17 @@ GEM
      activerecord (>= 7.2)
      activesupport (>= 7.2)
      i18n
-    rdoc (7.2.0)
+    rbs (4.1.2)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
      erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
      tsort
    regexp_parser (2.12.0)
-    reline (0.6.3)
+    reline (0.7.0)
      io-console (~> 0.5)
    responders (3.2.0)
      actionpack (>= 7.0)
@@ -296,7 +298,7 @@ GEM
    rspec-support (3.13.7)
    rss (0.3.3)
      rexml
-    rubocop (1.86.1)
+    rubocop (1.89.0)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -307,14 +309,14 @@ GEM
      rubocop-ast (>= 1.49.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
      parser (>= 3.3.7.2)
      prism (~> 1.7)
    rubocop-performance (1.26.1)
      lint_roller (~> 1.1)
      rubocop (>= 1.75.0, < 2.0)
      rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.34.3)
+    rubocop-rails (2.36.0)
      activesupport (>= 4.2.0)
      lint_roller (~> 1.1)
      rack (>= 1.1)
@@ -346,9 +348,8 @@ GEM
      actionpack (>= 6.1)
      activesupport (>= 6.1)
      sprockets (>= 3.0.0)
-    stringio (3.2.0)
    thor (1.5.0)
-    tilt (2.7.0)
+    tilt (2.8.0)
    timeout (0.6.1)
    tsort (0.2.0)
    tzinfo (2.0.6)
@@ -360,11 +361,11 @@ GEM
    useragent (0.16.11)
    warden (1.2.9)
      rack (>= 2.0.9)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.3)

 PLATFORMS
  arm64-darwin-22
@@ -10,20 +10,27 @@ Rails.application.config.to_prepare do

    # Woodpecker configuration extension (/build/config): the served platforms
    # and their builder images. An image bump is one line here, rolled out to
-    # every repo by the deploy. tic80 can be added once the tic80-builder image
-    # (lua+luacheck+ldoc toolchain) exists in the tic80-tools repo.
+    # every repo by the deploy.
    c.ci_platforms = {
-      "godot"      => { builder: "git.teletypegames.org/internal/godot-builder:4.6" },
+      "godot"      => { builder: "git.teletypegames.org/internal/godot-builder:4.7.1" },
      "phaser"     => { builder: "git.teletypegames.org/internal/phaser-builder:latest" },
      "love"       => { builder: "git.teletypegames.org/internal/love-builder:latest" },
      "bevy"       => { builder: "git.teletypegames.org/internal/bevy-builder:latest" },
      "c64"        => { builder: "git.teletypegames.org/internal/c64-builder:latest" },
-      "ebitengine" => { builder: "git.teletypegames.org/internal/ebitengine-builder:latest" }
-      # "tic80"    => { builder: "git.teletypegames.org/internal/tic80-builder:latest",
-      #                 exporter: "git.teletypegames.org/internal/tic80pro:latest" }
+      "ebitengine" => { builder: "git.teletypegames.org/internal/ebitengine-builder:latest" },
+      "tic80"      => { builder: "git.teletypegames.org/internal/tic80pro:latest" }
    }
+    # Explicit URL: request.base_url would yield http:// behind the host nginx
+    # (no X-Forwarded-Proto reaches Rails), and the resulting 301 makes the
+    # pipeline's curl steps silently no-op.
+    c.ci_update_server = "https://teletypegames.org"
    c.ci_extension_public_key_url = "https://ci.teletypegames.org/api/signature/public-key"

+    # Woodpecker CI management (repo sync, secret provisioning, pipeline control)
+    c.woodpecker_url        = ENV["WOODPECKER_URL"]        # e.g. "https://ci.teletypegames.org"
+    c.woodpecker_api_token  = ENV["WOODPECKER_API_TOKEN"]  # Woodpecker PAT with admin access
+    c.woodpecker_repo_owner = ENV["WOODPECKER_REPO_OWNER"] # forge org (e.g. "games")
+
    c.image_owners = [
      {
        label: "member",
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
+ActiveRecord::Schema[8.1].define(version: 2026_08_06_000002) do
  create_table "admin_users", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", null: false
    t.datetime "deleted_at", precision: 3
@@ -196,6 +196,24 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
    t.index ["image_id"], name: "index_members_on_image_id"
  end

+  create_table "pipelines", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.boolean "active", default: true, null: false
+    t.datetime "created_at", precision: 3
+    t.datetime "deleted_at", precision: 3
+    t.datetime "last_pipeline_at", precision: 3
+    t.string "last_pipeline_status", limit: 32
+    t.string "platform", limit: 32, null: false
+    t.string "repo_name", limit: 128, null: false
+    t.string "repo_owner", limit: 128, null: false
+    t.bigint "software_id", unsigned: true
+    t.datetime "updated_at", precision: 3
+    t.bigint "woodpecker_repo_id", null: false, unsigned: true
+    t.index ["deleted_at"], name: "idx_pipelines_deleted"
+    t.index ["repo_owner", "repo_name"], name: "idx_pipelines_owner_name", unique: true
+    t.index ["software_id"], name: "idx_pipelines_software"
+    t.index ["woodpecker_repo_id"], name: "idx_pipelines_wp_id", unique: true
+  end
+
  create_table "platform_links", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", precision: 3
    t.datetime "deleted_at", precision: 3
@@ -267,6 +285,7 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
  add_foreign_key "downloads", "releases", name: "fk_downloads_release", on_delete: :nullify
  add_foreign_key "external_links", "softwares", name: "fk_softwares_external_links", on_delete: :cascade
  add_foreign_key "members", "images"
+  add_foreign_key "pipelines", "softwares", name: "fk_pipelines_software", on_delete: :nullify
  add_foreign_key "release_assets", "releases", name: "fk_releases_release_assets", on_delete: :cascade
  add_foreign_key "releases", "softwares", name: "fk_softwares_releases", on_delete: :cascade
  add_foreign_key "software_images", "images"
@@ -197,6 +197,24 @@ export default {
    title: 'Build Matrix',
    subtitle: 'Which engines build for which platforms.',
  },
+  batocera: {
+    title: 'Batocera Store',
+    subtitle: 'Our catalog, straight on your retro box.',
+    lead: 'ttg-batocera-store puts our catalog on Batocera, the plug-and-play retro gaming distribution. It pulls our games into the box\'s ROM folders together with box art and EmulationStation metadata, and can be re-run any time from the Ports menu to pick up new releases. Python 3 standard library only — nothing to install alongside it.',
+    repo: 'Git repository',
+    docs: 'Documentation',
+    batoceraProject: 'Batocera project',
+    installTitle: 'Install',
+    installDesc: 'Run this over SSH on the Batocera box. It installs the client, writes the config, creates the Ports entry and runs the first sync.',
+    installNote: 'Then restart EmulationStation so the games show up:',
+    useTitle: 'Use it',
+    useDesc: 'On the device: Ports ▸ "Teletype Games Store". Over SSH the client has a small CLI:',
+    platformsTitle: 'What it installs',
+    platformsDesc: 'A catalog platform is installable when its release asset boots directly on a Batocera system. Other platforms ship web and desktop builds instead, so they are not mapped.',
+    engineTitle: 'Run your own store',
+    engineDesc: 'Nothing here is specific to us. Our store is just a config file on top of warp-engine-batocera-store, an open engine that works with any WarpEngine-based site: point it at your own catalog, give it a name and a ROM subfolder of its own, and your games land on a Batocera box the same way. Several stores can live side by side on one machine without touching each other\'s games.',
+    copy: 'Copy',
+  },
  code: {
    title: 'Codebase',
    subtitle: 'Explore our collection of open-source projects, study our source code, and contribute to our independent game development tools.',
@@ -197,6 +197,24 @@ export default {
    title: 'Build mátrix',
    subtitle: 'Melyik engine melyik platformra fordít.',
  },
+  batocera: {
+    title: 'Batocera Store',
+    subtitle: 'A katalógusunk közvetlenül a retró gépeden.',
+    lead: 'A ttg-batocera-store a katalógusunkat teszi fel a Batocerára, a plug-and-play retró gamer disztribúcióra. A játékainkat a gép ROM mappáiba tölti le, borítóképpel és EmulationStation metaadatokkal együtt, és a Ports menüből bármikor újrafuttatható az új kiadásokért. Csak a Python 3 alapkönyvtárát használja — nem kell mellé semmit telepíteni.',
+    repo: 'Git tároló',
+    docs: 'Dokumentáció',
+    batoceraProject: 'Batocera projekt',
+    installTitle: 'Telepítés',
+    installDesc: 'Futtasd ezt SSH-n a Batocera gépen. Telepíti a klienst, kiírja a konfigurációt, létrehozza a Ports bejegyzést és lefuttatja az első szinkront.',
+    installNote: 'Utána indítsd újra az EmulationStationt, hogy megjelenjenek a játékok:',
+    useTitle: 'Használat',
+    useDesc: 'A gépen: Ports ▸ „Teletype Games Store”. SSH-n keresztül egy egyszerű CLI áll rendelkezésre:',
+    platformsTitle: 'Mit telepít',
+    platformsDesc: 'Egy katalógus-platform akkor telepíthető, ha a kiadás fájlja közvetlenül elindul egy Batocera rendszeren. A többi platform webes és asztali buildeket ad, ezért nincsenek leképezve.',
+    engineTitle: 'Csinálj saját store-t',
+    engineDesc: 'Itt semmi sem ránk van szabva. A mi store-unk csak egy konfigurációs fájl a warp-engine-batocera-store fölött, ami bármilyen WarpEngine alapú oldallal működik: állítsd a saját katalógusodra, adj neki nevet és saját ROM almappát, és a játékaid ugyanígy kerülnek fel egy Batocera gépre. Egy gépen több store is megfér egymás mellett anélkül, hogy egymás játékaihoz nyúlnának.',
+    copy: 'Másolás',
+  },
  code: {
    title: 'Kódbázis',
    subtitle: 'Fedezd fel nyílt forráskódú projektek gyűjteményét, tanulmányozd forráskódunkat, és járulj hozzá független játékfejlesztő eszközeinkhez.',
@@ -0,0 +1,201 @@
+<template>
+  <header class="hero-section-gradient from-emerald-700 to-teal-800 py-16">
+    <div class="hero-container">
+      <h1 class="hero-title">{{ t('batocera.title') }}</h1>
+      <p class="hero-subtitle text-emerald-50">{{ t('batocera.subtitle') }}</p>
+    </div>
+  </header>
+
+  <main class="main-container py-12 px-4 mt-0">
+    <div class="bat-panel">
+      <p class="bat-lead">{{ t('batocera.lead') }}</p>
+
+      <div class="bat-links">
+        <a :href="REPO_URL" target="_blank" rel="noopener noreferrer" class="bat-link bat-link-dark">
+          <i class="fa-solid fa-code-branch"></i> {{ t('batocera.repo') }}
+        </a>
+        <a :href="WIKI_URL" target="_blank" rel="noopener noreferrer" class="bat-link bat-link-indigo">
+          <i class="fa-solid fa-book"></i> {{ t('batocera.docs') }}
+        </a>
+        <a :href="BATOCERA_URL" target="_blank" rel="noopener noreferrer" class="bat-link bat-link-emerald">
+          <i class="fa-solid fa-tv"></i> {{ t('batocera.batoceraProject') }}
+        </a>
+      </div>
+    </div>
+
+    <section class="bat-section">
+      <h2 class="bat-section-title">
+        <span class="bat-step">1</span> {{ t('batocera.installTitle') }}
+      </h2>
+      <p class="bat-section-desc">{{ t('batocera.installDesc') }}</p>
+      <div class="bat-code">
+        <pre><code>{{ INSTALL_CMD }}</code></pre>
+        <button class="bat-copy" :title="t('batocera.copy')" @click="copy(INSTALL_CMD)">
+          <i :class="copied === INSTALL_CMD ? 'fa-solid fa-check' : 'fa-regular fa-copy'"></i>
+        </button>
+      </div>
+      <p class="bat-note">{{ t('batocera.installNote') }}</p>
+      <div class="bat-code">
+        <pre><code>{{ RESTART_CMD }}</code></pre>
+        <button class="bat-copy" :title="t('batocera.copy')" @click="copy(RESTART_CMD)">
+          <i :class="copied === RESTART_CMD ? 'fa-solid fa-check' : 'fa-regular fa-copy'"></i>
+        </button>
+      </div>
+    </section>
+
+    <section class="bat-section">
+      <h2 class="bat-section-title">
+        <span class="bat-step">2</span> {{ t('batocera.useTitle') }}
+      </h2>
+      <p class="bat-section-desc">{{ t('batocera.useDesc') }}</p>
+      <div class="bat-code">
+        <pre><code>{{ CLI_SNIPPET }}</code></pre>
+        <button class="bat-copy" :title="t('batocera.copy')" @click="copy(CLI_SNIPPET)">
+          <i :class="copied === CLI_SNIPPET ? 'fa-solid fa-check' : 'fa-regular fa-copy'"></i>
+        </button>
+      </div>
+    </section>
+
+    <section class="bat-section">
+      <h2 class="bat-section-title">{{ t('batocera.platformsTitle') }}</h2>
+      <p class="bat-section-desc">{{ t('batocera.platformsDesc') }}</p>
+      <ul class="bat-platforms">
+        <li v-for="p in platforms" :key="p.platform" class="bat-platform">
+          <i :class="p.icon" class="bat-platform-icon"></i>
+          <span class="bat-platform-name">{{ p.label }}</span>
+          <code class="bat-platform-ext">{{ p.ext }}</code>
+        </li>
+      </ul>
+    </section>
+
+    <section class="bat-section bat-engine">
+      <h2 class="bat-section-title">
+        <i class="fa-solid fa-cubes bat-engine-icon"></i> {{ t('batocera.engineTitle') }}
+      </h2>
+      <p class="bat-section-desc">{{ t('batocera.engineDesc') }}</p>
+      <a :href="ENGINE_URL" target="_blank" rel="noopener noreferrer" class="bat-link bat-link-slate">
+        <i class="fa-solid fa-code-branch"></i> warp-engine-batocera-store
+      </a>
+    </section>
+
+    <div class="bat-back">
+      <RouterLink to="/catalog" class="bat-back-link">{{ t('catalogShow.back') }}</RouterLink>
+    </div>
+  </main>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue'
+import { RouterLink } from 'vue-router'
+import { useI18n } from 'vue-i18n'
+import { CONFIG } from '../../lib/config'
+
+const { t } = useI18n()
+
+const FORGE = 'https://git.teletypegames.org/tools'
+const REPO_URL = `${FORGE}/ttg-batocera-store`
+// The store is only a config; the client itself is a reusable engine that runs
+// against any WarpEngine site, so it gets its own repository and its own link.
+const ENGINE_URL = `${FORGE}/warp-engine-batocera-store`
+const WIKI_URL = `${CONFIG.wikiBase}/others/ttg-batocera-store`
+const BATOCERA_URL = 'https://batocera.org'
+
+// The installer is served straight from the forge, so this one line is the
+// whole install on a Batocera box.
+const INSTALL_CMD = `curl -fsSL ${REPO_URL}/raw/branch/master/install.sh | bash`
+const RESTART_CMD = 'batocera-es-swissknife --restart'
+const STORE_CLI = '/userdata/system/batocera-store/ttg-store'
+const CLI_SNIPPET = [
+  `${STORE_CLI} list      # compatible catalog entries`,
+  `${STORE_CLI} sync      # download everything new`,
+  `${STORE_CLI} remove c64demo`,
+].join('\n')
+
+const platforms = [
+  { platform: 'c64', label: 'Commodore 64 (VICE)', ext: '.prg', icon: 'fa-solid fa-floppy-disk' },
+  { platform: 'tic80', label: 'TIC-80', ext: '.tic', icon: 'fa-solid fa-tv' },
+]
+
+const copied = ref('')
+
+async function copy(text: string) {
+  try {
+    await navigator.clipboard.writeText(text)
+    copied.value = text
+    setTimeout(() => { if (copied.value === text) copied.value = '' }, 2000)
+  } catch {
+    // Clipboard API needs a secure context — the command stays selectable anyway.
+  }
+}
+</script>
+
+<style scoped>
+.bat-panel {
+  @apply bg-white rounded-2xl shadow-xl border border-gray-100 p-6 md:p-8;
+}
+.bat-lead {
+  @apply text-gray-600 leading-relaxed mb-6;
+}
+.bat-links {
+  @apply flex flex-wrap gap-3;
+}
+.bat-link {
+  @apply inline-flex items-center gap-2 font-bold py-2.5 px-5 rounded-xl text-sm text-white transition-all active:scale-95;
+}
+.bat-link-dark { @apply bg-slate-800 hover:bg-slate-900 shadow-lg shadow-slate-800/20; }
+.bat-link-slate { @apply bg-slate-600 hover:bg-slate-700 shadow-lg shadow-slate-600/20; }
+.bat-link-indigo { @apply bg-indigo-600 hover:bg-indigo-700 shadow-lg shadow-indigo-600/20; }
+.bat-link-emerald { @apply bg-emerald-600 hover:bg-emerald-700 shadow-lg shadow-emerald-600/20; }
+
+.bat-section {
+  @apply bg-white rounded-2xl shadow-xl border border-gray-100 p-6 md:p-8 mt-6;
+}
+.bat-section-title {
+  @apply flex items-center gap-3 text-xl font-bold text-gray-900 mb-2;
+}
+.bat-step {
+  @apply inline-flex items-center justify-center w-7 h-7 rounded-full bg-emerald-100 text-emerald-700 text-sm font-bold;
+}
+.bat-section-desc {
+  @apply text-gray-600 mb-4;
+}
+.bat-note {
+  @apply text-gray-600 mt-4 mb-3 text-sm;
+}
+.bat-code {
+  @apply relative bg-gray-900 text-gray-100 rounded-xl overflow-x-auto;
+}
+.bat-code pre {
+  @apply p-4 pr-14 font-mono text-sm leading-relaxed;
+}
+.bat-copy {
+  @apply absolute top-2 right-2 w-9 h-9 rounded-lg bg-gray-800 text-gray-300 hover:bg-gray-700 hover:text-white transition-colors;
+}
+.bat-engine {
+  @apply bg-gray-50;
+}
+.bat-engine-icon {
+  @apply text-gray-400 text-lg;
+}
+.bat-platforms {
+  @apply grid grid-cols-1 sm:grid-cols-2 gap-3;
+}
+.bat-platform {
+  @apply flex items-center gap-3 bg-gray-50 border border-gray-100 rounded-xl px-4 py-3;
+}
+.bat-platform-icon {
+  @apply text-gray-400;
+}
+.bat-platform-name {
+  @apply font-medium text-gray-800 flex-grow;
+}
+.bat-platform-ext {
+  @apply font-mono text-xs text-purple-600 bg-purple-50 px-2 py-0.5 rounded;
+}
+.bat-back {
+  @apply mt-8 text-center;
+}
+.bat-back-link {
+  @apply text-gray-400 hover:text-gray-600 text-sm font-medium transition-colors;
+}
+</style>
@@ -66,6 +66,10 @@
      <RouterLink to="/builds" class="builds-link">
        <i class="fa-solid fa-table-cells"></i> {{ t('builds.title') }}
      </RouterLink>
+      <span class="builds-link-sep">|</span>
+      <RouterLink to="/batocera" class="builds-link">
+        <i class="fa-solid fa-gamepad"></i> {{ t('batocera.title') }}
+      </RouterLink>
    </div>
  </main>
 </template>
@@ -162,9 +166,12 @@ onMounted(() => store.fetch())
  @apply text-xs text-gray-400 font-medium ml-1;
 }
 .builds-link-row {
-  @apply text-center mt-10;
+  @apply flex flex-wrap items-center justify-center gap-3 mt-10;
 }
 .builds-link {
  @apply text-sm text-gray-400 hover:text-purple-600 font-medium transition-colors;
 }
+.builds-link-sep {
+  @apply text-gray-200 text-sm;
+}
 </style>
@@ -33,7 +33,7 @@
      </div>

      <div v-else class="engine-list">
-        <article v-for="(page, index) in enginePages" :key="page.id" class="engine-card group">
+        <article v-for="({ page, digest }, index) in cards" :key="page.id" class="engine-card group">
          <div class="engine-card-index">{{ String(index + 1).padStart(2, '0') }}</div>

          <div class="engine-card-body">
@@ -42,7 +42,21 @@
            </h2>

            <p v-if="page.description" class="engine-card-desc">{{ page.description }}</p>
-            <p v-if="page.content" class="engine-card-preview">{{ getCleanPreview(page.content) }}</p>
+            <p v-if="digest.intro" class="engine-card-preview">{{ digest.intro }}</p>
+            <p v-else-if="page.content" class="engine-card-preview">{{ getCleanPreview(page.content) }}</p>
+
+            <section v-if="digest.highlights.length" class="engine-highlights">
+              <h3 v-if="digest.highlightsTitle" class="engine-highlights-title">{{ digest.highlightsTitle }}</h3>
+              <ul class="engine-highlights-grid">
+                <li v-for="(item, i) in digest.highlights" :key="i" class="engine-highlight">
+                  <span class="engine-highlight-icon"><i class="fa-solid fa-check"></i></span>
+                  <p class="engine-highlight-body">
+                    <strong v-if="item.title" class="engine-highlight-lead">{{ item.title }}</strong>
+                    <template v-if="item.title && item.text"> — </template>{{ item.text }}
+                  </p>
+                </li>
+              </ul>
+            </section>

            <div class="engine-card-actions">
              <a :href="exploreUrl(page)" target="_blank" rel="noopener" class="engine-explore-btn">
@@ -62,11 +76,11 @@
 </template>

 <script setup lang="ts">
-import { onMounted } from 'vue'
+import { computed, onMounted } from 'vue'
 import { storeToRefs } from 'pinia'
 import { useI18n } from 'vue-i18n'
 import { WIKI_BASE } from '../../api/wiki.api'
-import { useEnginesStore } from '../../stores/engines.store'
+import { useEnginesStore, getEngineDigest } from '../../stores/engines.store'
 import type { WikiPageWithContent } from '../../lib/interfaces/wiki.interface'
 import SkeletonCard from '../../components/SkeletonCard.vue'

@@ -76,6 +90,10 @@ const store = useEnginesStore()
 const { pages: enginePages, loading, error } = storeToRefs(store)
 const { getCleanPreview } = store

+const cards = computed(() =>
+  enginePages.value.map((page) => ({ page, digest: getEngineDigest(page.content) })),
+)
+
 // Explore points at the engine's git repository (from wiki metadata);
 // pages without one fall back to their wiki page.
 const exploreUrl = (page: WikiPageWithContent): string =>
@@ -135,6 +153,27 @@ onMounted(() => store.fetch())
 .engine-card-preview {
  @apply text-base text-slate-400 leading-relaxed mb-8 max-w-3xl;
 }
+.engine-highlights {
+  @apply mb-10;
+}
+.engine-highlights-title {
+  @apply text-xs font-bold uppercase tracking-[0.2em] text-emerald-400 mb-5;
+}
+.engine-highlights-grid {
+  @apply grid md:grid-cols-2 gap-x-10 gap-y-4 max-w-4xl;
+}
+.engine-highlight {
+  @apply flex items-start gap-3;
+}
+.engine-highlight-icon {
+  @apply mt-1 flex h-5 w-5 flex-none items-center justify-center rounded-md bg-emerald-500/15 text-emerald-400 text-[10px];
+}
+.engine-highlight-body {
+  @apply text-sm text-slate-400 leading-relaxed;
+}
+.engine-highlight-lead {
+  @apply text-white font-semibold;
+}
 .engine-card-actions {
  @apply flex flex-wrap items-center gap-6;
 }
@@ -0,0 +1,5 @@
+import type { RouteRecordRaw } from 'vue-router'
+
+export const batoceraRouter: RouteRecordRaw[] = [
+  { path: '/batocera', name: 'batoceraIndex', component: () => import('../page/batocera/BatoceraIndexPage.vue') },
+]
@@ -8,6 +8,7 @@ import { enginesRouter } from './engines.router'
 import { howtosRouter } from './howtos.router'
 import { teamRouter } from './team.router'
 import { buildsRouter } from './builds.router'
+import { batoceraRouter } from './batocera.router'

 export const router = createRouter({
  history: createWebHistory(),
@@ -21,6 +22,7 @@ export const router = createRouter({
    ...howtosRouter,
    ...teamRouter,
    ...buildsRouter,
+    ...batoceraRouter,
  ],
  scrollBehavior() {
    return { top: 0 }
@@ -0,0 +1,79 @@
+import { describe, it, expect } from 'vitest'
+import { getEngineDigest } from '../engines.store'
+
+// Generic markdown in the shape every engine-tagged wiki page must follow:
+// intro paragraph, then "What You Get" as the first heading with bullets.
+// Dummy text only — real content always comes from the wiki at runtime.
+const SAMPLE_MARKDOWN = `
+> Example Engine is a **sample** framework that turns markdown into landing cards.
+
+# What You Get
+
+- **First feature**: some \`inline code\` — with a longer explanation.
+- **Second feature**: a [link](https://example.org) inside the text.
+- Plain bullet without a bold lead.
+
+# Later Section
+
+- **Not picked up**: a list under a later heading.
+`
+
+describe('getEngineDigest', () => {
+  it('extracts the intro from the leading blockquote with inline markdown stripped', () => {
+    const digest = getEngineDigest(SAMPLE_MARKDOWN)
+    expect(digest.intro).toBe(
+      'Example Engine is a sample framework that turns markdown into landing cards.',
+    )
+  })
+
+  it('takes the What You Get heading as the highlights title', () => {
+    expect(getEngineDigest(SAMPLE_MARKDOWN).highlightsTitle).toBe('What You Get')
+  })
+
+  it('parses bold-lead bullets into title and text', () => {
+    const [first, second] = getEngineDigest(SAMPLE_MARKDOWN).highlights
+    expect(first).toEqual({
+      title: 'First feature',
+      text: 'some inline code — with a longer explanation.',
+    })
+    expect(second).toEqual({
+      title: 'Second feature',
+      text: 'a link inside the text.',
+    })
+  })
+
+  it('keeps bullets without a bold lead as plain text', () => {
+    const third = getEngineDigest(SAMPLE_MARKDOWN).highlights[2]
+    expect(third).toEqual({ title: '', text: 'Plain bullet without a bold lead.' })
+  })
+
+  it('stops at the heading after the What You Get section', () => {
+    expect(getEngineDigest(SAMPLE_MARKDOWN).highlights).toHaveLength(3)
+  })
+
+  it('matches the heading case-insensitively', () => {
+    const digest = getEngineDigest('# WHAT you get\n- **A**: b.')
+    expect(digest.highlights).toEqual([{ title: 'A', text: 'b.' }])
+  })
+
+  it('yields no highlights when the first heading is not What You Get', () => {
+    const digest = getEngineDigest('Intro line.\n\n# Features\n- **A**: b.\n\n# What You Get\n- **C**: d.')
+    expect(digest.intro).toBe('Intro line.')
+    expect(digest.highlights).toEqual([])
+  })
+
+  it('caps the highlights at six items', () => {
+    const many = '# What You Get\n' + Array.from({ length: 9 }, (_, i) => `- item ${i}`).join('\n')
+    expect(getEngineDigest(many).highlights).toHaveLength(6)
+  })
+
+  it('uses the first paragraph as intro when there is no blockquote', () => {
+    const digest = getEngineDigest('Just a plain paragraph.\n\n---\n\n# What You Get\n- one')
+    expect(digest.intro).toBe('Just a plain paragraph.')
+    expect(digest.highlights).toEqual([{ title: '', text: 'one' }])
+  })
+
+  it('returns an empty digest for empty content', () => {
+    expect(getEngineDigest('')).toEqual({ intro: '', highlightsTitle: '', highlights: [] })
+  })
+})
@@ -4,6 +4,75 @@ import wikiApi from '../api/wiki.api'
 import { useLoadable } from '../composables/useLoadable'
 import type { WikiPageWithContent } from '../lib/interfaces/wiki.interface'

+export interface EngineHighlight {
+  title: string
+  text: string
+}
+
+// Landing-page digest of a wiki engine page. Convention: every engine-tagged
+// page opens with an intro paragraph, then a "What You Get" heading as its
+// first heading, with the feature bullets underneath.
+export interface EngineDigest {
+  intro: string
+  highlightsTitle: string
+  highlights: EngineHighlight[]
+}
+
+const HIGHLIGHTS_HEADING = 'what you get'
+const MAX_HIGHLIGHTS = 6
+
+// Inline markdown (links, bold, code) stripped so the text reads as plain prose.
+function stripInline(md: string): string {
+  return md
+    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+    .replace(/\*\*([^*]+)\*\*/g, '$1')
+    .replace(/[*_`]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+export function getEngineDigest(content: string): EngineDigest {
+  const digest: EngineDigest = { intro: '', highlightsTitle: '', highlights: [] }
+  let inHighlights = false
+
+  for (const raw of (content || '').split('\n')) {
+    const line = raw.trim()
+    if (!line || /^([-*_])\1{2,}$/.test(line)) continue
+
+    const heading = line.match(/^#{1,6}\s+(.*)$/)
+    if (heading) {
+      // The section ends at the next heading; and if the page's first heading
+      // is not "What You Get", it doesn't follow the convention — no highlights.
+      if (inHighlights) break
+      const title = stripInline(heading[1])
+      if (title.toLowerCase() !== HIGHLIGHTS_HEADING) break
+      inHighlights = true
+      digest.highlightsTitle = title
+      continue
+    }
+
+    if (inHighlights) {
+      const bullet = line.match(/^[-*]\s+(.*)$/)
+      if (!bullet) continue
+      const lead = bullet[1].match(/^\*\*([^*]+)\*\*\s*[:—–-]?\s*(.*)$/)
+      digest.highlights.push(
+        lead
+          ? { title: stripInline(lead[1]), text: stripInline(lead[2]) }
+          : { title: '', text: stripInline(bullet[1]) },
+      )
+      continue
+    }
+
+    // First prose line (paragraph or blockquote) before the heading is the intro.
+    if (!digest.intro) {
+      digest.intro = stripInline(line.replace(/^>\s*/, ''))
+    }
+  }
+
+  digest.highlights = digest.highlights.slice(0, MAX_HIGHLIGHTS)
+  return digest
+}
+
 export const useEnginesStore = defineStore('engines', () => {
  const pages = ref<WikiPageWithContent[]>([])
  const { loading, error, withCache, invalidate } = useLoadable()
@@ -19,5 +88,5 @@ export const useEnginesStore = defineStore('engines', () => {
    return content.replace(/[#*`_[\]()>|-]/g, '').replace(/\s+/g, ' ').trim().slice(0, 260) + '...'
  }

-  return { pages, loading, error, fetch, getCleanPreview, invalidate }
+  return { pages, loading, error, fetch, getCleanPreview, getEngineDigest, invalidate }
 })
@@ -54,6 +54,10 @@ services:
      WOODPECKER_GITEA_SECRET: ${GITEA_CLIENT_SECRET}
      WOODPECKER_SERVER_ADDR: ":8000"
      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      # Global configuration extension: every pipeline start asks the update
+      # server for the config; non-marker repos fall back to their own YAML (204).
+      WOODPECKER_CONFIG_EXTENSION_ENDPOINT: "https://${WEBAPP_DOMAIN}/build/config"
+      WOODPECKER_ADMIN: mr.zero
    volumes:
      - ./data/woodpecker:/var/lib/woodpecker
    labels:
@@ -162,6 +166,9 @@ services:
      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@teletype.hu}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-password123}
      - WIKI_GRAV_URL=${WIKI_GRAV_URL:-https://wiki.teletypegames.org}
+      - WOODPECKER_URL=${WOODPECKER_URL:-http://woodpecker-server:8000}
+      - WOODPECKER_API_TOKEN=${WOODPECKER_API_TOKEN:-}
+      - WOODPECKER_REPO_OWNER=${WOODPECKER_REPO_OWNER:-}
    depends_on:
      mysql:
        condition: service_healthy
@@ -2,3 +2,4 @@ log/
 spec/dummy/log/
 spec/dummy/tmp/
 Gemfile.lock
+.bundle/
@@ -8,5 +8,6 @@ group :development, :test do
  gem "rspec-rails", "~> 7.0"
  gem "factory_bot_rails"
  gem "shoulda-matchers", "~> 6.0"
+  gem "webmock", "~> 3.0"
  gem "debug", platforms: %i[mri windows]
 end
@@ -18,6 +18,12 @@ Repository: `https://git.teletypegames.org/tools/warp_engine`
  box: TIC-80, Ebitengine, LÖVE, C64, Godot, Bevy, Phaser. Authenticated by
  a shared secret or by per-owner database tokens with expiry and scopes
  (`ApplicationToken`, managed in the admin).
+- **Pluggable storage**: artifacts are served through a storage adapter
+  (`:local` by default); a host can serve them from an object store without
+  patching the engine.
+- **Publish events**: every published release emits
+  `ActiveSupport::Notifications` (`warp_engine.publish`), so hosts can react
+  to new builds without model callbacks.
 - **Public JSON API**: catalog listing, highlighted title, per-platform build
  matrix, image serving, download tracking, and a static file server for
  web-playable builds.
@@ -26,6 +32,10 @@ Repository: `https://git.teletypegames.org/tools/warp_engine`
  image library with orphan cleanup, a file manager with a picker mode, and
  download statistics. Without ActiveAdmin the engine runs headless
  (API + updater only).
+- **Woodpecker CI management (optional)**: with a Woodpecker API token
+  configured, the admin also gains repo sync, per-repo pipeline history
+  with manual triggers, and automatic provisioning of application tokens
+  as Woodpecker secrets.

 ## Requirements

@@ -283,7 +293,99 @@ Configuration: `ci_platforms` maps platform names to builder images
 an empty map (default) disables the feature. Set the Woodpecker side with
 `WOODPECKER_CONFIG_EXTENSION_ENDPOINT=https://your-host/build/config` (or
 per-repo in Settings → Extensions). Templates live in
-`lib/warp_engine/ci_templates/*.yaml.erb`.
+`app/services/warp_engine/platforms/<platform>/pipeline.yaml.erb`.
+
+## Woodpecker CI management
+
+Beyond serving pipeline configs, WarpEngine can drive the Woodpecker REST API
+itself. Set `woodpecker_url` and `woodpecker_api_token` — while either is nil
+(the default), every management feature stays inactive and the admin pages
+hide themselves:
+
+```ruby
+c.woodpecker_url        = ENV["WOODPECKER_URL"]        # e.g. "https://ci.example.org"
+c.woodpecker_api_token  = ENV["WOODPECKER_API_TOKEN"]  # PAT of a Woodpecker *instance admin*
+c.woodpecker_repo_owner = ENV["WOODPECKER_REPO_OWNER"] # forge org the game repos live under
+```
+
+What it unlocks (all surfaced in the admin):
+
+- **Repo sync** (*Pipelines → Sync from Woodpecker*): mirrors the Woodpecker
+  repo list into `Pipeline` records, auto-matching each repo to a catalog
+  `Software` by name; repos that disappear from Woodpecker are deactivated.
+  Platform and software links are editable by hand afterwards.
+- **Pipeline history**: each entry on the *Pipelines* page lists its recent
+  runs with a manual *Trigger* action; the newest run refreshes the cached
+  last-pipeline status shown on the Pipelines index. The software's admin
+  page links to its pipelines from the Quick Links sidebar.
+- **Secret provisioning**: database application tokens are pushed to the
+  repos as the `application_token` Woodpecker secret — creating a token
+  provisions it to its owner's repos (unrestricted tokens to all active
+  repos), deleting a token removes the secret, and *Rotate* creates a
+  replacement token, provisions it everywhere and revokes the old one in a
+  single step.
+
+The API token must belong to a Woodpecker **instance admin** — listing the
+server's repos is an admin-only endpoint (anything less yields
+`403 User not authorized`). Add the user to `WOODPECKER_ADMIN` on the
+Woodpecker server, then log out and back in: the admin flag is written to
+the user record at login, a server restart alone is not enough.
+
+## Storage
+
+Build artifacts are served through a storage adapter. The default is the
+local filesystem under `file_container_path` — byte for byte the behaviour
+the engine always had:
+
+```ruby
+c.storage_adapter = :local   # default
+```
+
+A host that keeps its artifacts elsewhere (an object store behind a CDN, for
+example) can plug in its own object instead of patching the engine. The
+contract is three methods:
+
+```ruby
+class MyObjectStore
+  def file?(relative_path)      = ...   # true/false
+  def directory?(relative_path) = ...   # true/false
+
+  # Return a WarpEngine::Storage::Location:
+  #   Location.file(absolute_path)  — the engine will send_file it
+  #   Location.redirect(url)        — the engine will redirect (signed URL)
+  def locate(relative_path, filename: nil, expires_in: nil) = ...
+end
+
+c.storage_adapter = MyObjectStore.new
+```
+
+`GET /api/download` and `GET /file/*` both go through the adapter, so a
+signing adapter turns them into redirects without any further change.
+`WarpEngine::DownloadService#create` still returns an absolute path (and
+`nil` when there is none), so existing callers keep working;
+`#locate` is the new entry point that can also hand back a redirect.
+
+**Serving only.** Ingestion — `POST /build/upload`, archive extraction and
+the admin file manager — still writes to the local disk. A remote adapter
+needs its own upload path today.
+
+## Publish events
+
+Publishing a release emits an `ActiveSupport::Notifications` event, so a host
+can react to a new build without hanging a callback on the models:
+
+```ruby
+ActiveSupport::Notifications.subscribe("warp_engine.publish") do |*, payload|
+  payload[:software]  # WarpEngine::Software
+  payload[:release]   # WarpEngine::Release
+  payload[:platform]  # "godot"
+  payload[:name]      # "mygame"
+  payload[:version]   # "1.2.0"
+end
+```
+
+Hosts that must support older engine versions can feature-detect with
+`WarpEngine.respond_to?(:instruments_publish?) && WarpEngine.instruments_publish?`.

 ## Public API

@@ -2,7 +2,7 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
  actions :index, :show, :new, :create, :edit, :update, :destroy
  permit_params :name, :owner_id, :expires_at, :scopes_string, :unrestricted

-  menu priority: 9, label: "🎟️ App Tokens"
+  menu parent: "🌀 WarpEngine", priority: 9, label: "🎟️ App Tokens"

  config.sort_order = "created_at_desc"
  config.batch_actions = false
@@ -52,6 +52,25 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
    f.actions
  end

+  action_item :rotate, only: :show do
+    if WarpEngine.woodpecker_configured?
+      link_to "Rotate Token", rotate_admin_application_token_path(resource),
+              method: :post, data: { confirm: "This will revoke the current token, create a new one, and push it to Woodpecker. Continue?" }
+    end
+  end
+
+  member_action :rotate, method: :post do
+    result = WarpEngine::SecretSyncService.new.rotate(resource)
+    if result[:rotated]
+      session[:warp_engine_plain_token] = result[:new_token].plain_token
+      redirect_to resource_path(result[:new_token]),
+        notice: "Token rotated and synced to #{result.dig(:sync_result, :synced)&.size || 0} pipeline(s)"
+    else
+      redirect_to resource_path(resource),
+        alert: "Rotation failed: #{result[:reason]}"
+    end
+  end
+
  show do
    if (plain = controller.instance_variable_get(:@plain_token))
      panel "⚠️ Token — shown only once, copy it now!" do
@@ -80,6 +99,19 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
      create! do |success, _failure|
        success.html do
          session[:warp_engine_plain_token] = resource.plain_token
+
+          if WarpEngine.woodpecker_configured?
+            service = WarpEngine::SecretSyncService.new
+            pipelines = service.pipelines_for_token(resource)
+            if pipelines.any?
+              result = service.provision(resource.plain_token, pipelines: pipelines)
+              flash[:notice] = "Token created and synced to #{result[:synced].size} pipeline(s)."
+              if result[:failed].any?
+                flash[:alert] = "Failed to sync to #{result[:failed].size} pipeline(s)."
+              end
+            end
+          end
+
          redirect_to resource_path(resource) and return
        end
      end
@@ -90,10 +122,12 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
      show!
    end

-    # Revoke = soft delete, audit-nyommal.
    def destroy
+      if WarpEngine.woodpecker_configured?
+        WarpEngine::SecretSyncService.new.deprovision(resource)
+      end
      resource.revoke!
-      redirect_to collection_path, notice: "Token revoked."
+      redirect_to collection_path, notice: "Token revoked and Woodpecker secrets cleaned up."
    end
  end
 end
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::Download, as: "Download" do
  actions :index, :show

-  menu priority: 7, label: "📊 Download Stats"
+  menu parent: "🌀 WarpEngine", priority: 7, label: "📊 Download Stats"

  scope :all, default: true
  scope("Today")         { |scope| scope.where("downloads.created_at >= ?", Date.current.beginning_of_day) }
@@ -1,5 +1,5 @@
 ActiveAdmin.register_page "Files" do
-  menu priority: 6, label: "📁 Files"
+  menu parent: "🌀 WarpEngine", priority: 6, label: "📁 Files"

  content do
    service = WarpEngine::FileManagerService.new
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::Image, as: "Image" do
  permit_params :file_upload

-  menu priority: 5, label: "🖼️ Images"
+  menu parent: "🌀 WarpEngine", priority: 5, label: "🖼️ Images"

  # SoftwareImage a natív használó; a hoston regisztrált image_owners
  # (WarpEngine.config) további használókat adhat hozzá (pl. TTG Member).
@@ -0,0 +1,126 @@
+ActiveAdmin.register WarpEngine::Pipeline, as: "Pipeline" do
+  actions :index, :show, :edit, :update
+
+  menu parent: "🌀 WarpEngine", priority: 10, label: "🚀 Pipelines"
+
+  config.sort_order = "repo_name_asc"
+  config.batch_actions = false
+
+  scope :all, default: true
+  scope("Active")   { |s| s.where(active: true) }
+  scope("Inactive") { |s| s.where(active: false) }
+
+  WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each do |p|
+    scope(p.capitalize) { |s| s.where(platform: p) }
+  end
+
+  index do
+    id_column
+    column :repo_owner
+    column :repo_name
+    column :platform
+    column("Software") { |r| r.software ? link_to(r.software.title, admin_software_path(r.software)) : "-" }
+    column(:active) { |r| status_tag(r.active ? "active" : "inactive", class: r.active ? "yes" : "no") }
+    column("Pipeline") { |r|
+      if r.last_pipeline_status
+        status_tag r.last_pipeline_status,
+                   class: r.last_pipeline_status == "success" ? "yes" : "no"
+      else
+        "-"
+      end
+    }
+    column :last_pipeline_at
+    actions defaults: true do |pipeline|
+      if pipeline.active && WarpEngine.woodpecker_configured?
+        item "Trigger", trigger_admin_pipeline_path(pipeline), method: :post, class: "member_link"
+      end
+    end
+  end
+
+  filter :repo_name
+  filter :platform, as: :select, collection: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS
+  filter :active
+
+  form do |f|
+    f.inputs do
+      f.input :platform, as: :select, collection: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS
+      f.input :software_id, as: :select,
+              collection: WarpEngine::Software.order(:title).map { |s| [ s.title, s.id ] },
+              include_blank: "- none -"
+    end
+    f.actions
+  end
+
+  sidebar "Details", only: :show do
+    attributes_table_for resource do
+      row :id
+      row :woodpecker_repo_id
+      row :repo_owner
+      row :repo_name
+      row :platform
+      row("Software") { |r| r.software ? link_to(r.software.title, admin_software_path(r.software)) : "-" }
+      row(:active) { |r| status_tag(r.active ? "active" : "inactive", class: r.active ? "yes" : "no") }
+      row :last_pipeline_status
+      row :last_pipeline_at
+      row :created_at
+      row :updated_at
+    end
+  end
+
+  show do
+    panel "Pipelines" do
+      if !WarpEngine.woodpecker_configured?
+        para "Woodpecker is not configured. Set woodpecker_url and woodpecker_api_token in the WarpEngine initializer.",
+             style: "color:#999;"
+      elsif !resource.active
+        para "This repository is inactive.", style: "color:#999;"
+      else
+        begin
+          pipelines = WarpEngine::PipelineService.new.list_pipelines(resource, page: 1)
+          if pipelines.is_a?(Array) && pipelines.any?
+            table_for pipelines.first(10) do
+              column("Number") { |p| p["number"] }
+              column("Status") { |p| status_tag p["status"], class: p["status"] == "success" ? "yes" : "no" }
+              column("Branch") { |p| p["branch"] }
+              column("Message") { |p| p["message"]&.truncate(60) }
+              # Woodpecker returns unix epoch seconds in "created"
+              column("Created") { |p| p["created"] ? Time.zone.at(p["created"]).strftime("%Y-%m-%d %H:%M") : "-" }
+            end
+          else
+            para "No pipelines found.", style: "color:#999;"
+          end
+        rescue => e
+          para "Error fetching pipelines: #{e.message}", style: "color:red;"
+        end
+      end
+    end
+  end
+
+  member_action :trigger, method: :post do
+    pipeline = WarpEngine::Pipeline.find(params[:id])
+    WarpEngine::PipelineService.new.trigger(pipeline)
+    redirect_to resource_path(pipeline), notice: "Pipeline triggered for #{pipeline.full_name}"
+  rescue => e
+    redirect_to resource_path(pipeline), alert: "Trigger failed: #{e.message}"
+  end
+
+  collection_action :sync, method: :post do
+    result = WarpEngine::PipelineSyncService.new.sync_all
+    redirect_to collection_path,
+      notice: "Synced: #{result[:created].size} new, #{result[:updated].size} updated, #{result[:deactivated].size} deactivated"
+  rescue => e
+    redirect_to collection_path, alert: "Sync failed: #{e.message}"
+  end
+
+  action_item :sync_repos, only: :index do
+    if WarpEngine.woodpecker_configured?
+      link_to "Sync from Woodpecker", sync_admin_pipelines_path, method: :post
+    end
+  end
+
+  controller do
+    def scoped_collection
+      super.includes(:software)
+    end
+  end
+end
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::PlatformLink, as: "Platform Link" do
  permit_params :name, :url, :platform, :position

-  menu priority: 5, label: "🔗 Platform Links"
+  menu parent: "🌀 WarpEngine", priority: 5, label: "🔗 Platform Links"

  config.sort_order = "platform_asc"

@@ -6,7 +6,7 @@ ActiveAdmin.register WarpEngine::Software, as: "Software" do
                releases_attributes: [ :id, :version, :_destroy,
                                       { release_assets_attributes: [ :id, :kind, :path, :_destroy ] } ]

-  menu priority: 2, label: "🎮 Softwares"
+  menu parent: "🌀 WarpEngine", priority: 2, label: "🎮 Softwares"

  actions :all, except: [ :edit ]

@@ -52,6 +52,15 @@ ActiveAdmin.register WarpEngine::Software, as: "Software" do
        text_node "View on site"
      end
    end
+
+    if resource.pipeline
+      div style: "margin-bottom:8px;" do
+        a href: admin_pipeline_path(resource.pipeline), style: "display:inline-flex;align-items:center;gap:6px;font-weight:bold;color:#5850ec;" do
+          span "🚀", style: "font-size:16px;"
+          text_node "Pipelines"
+        end
+      end
+    end
  end

  sidebar "Download Statistics", only: :show do
@@ -0,0 +1,74 @@
+module WarpEngine
+  module Api
+    class CiController < ApiController
+      include UpdateAuthentication
+
+      before_action :require_woodpecker!
+
+      resource_description do
+        short "CI pipeline management"
+      end
+
+      api :GET, "/api/ci/pipelines", "List active pipelines"
+      returns code: 200, desc: "JSON array of tracked pipelines"
+      error code: 503, desc: "Woodpecker not configured"
+      def pipelines
+        records = Pipeline.active.includes(:software)
+        render json: records.map { |p| pipeline_json(p) }
+      end
+
+      api :GET, "/api/ci/pipelines/:id/status", "Get a pipeline with its latest run"
+      param :id, :number, required: true, desc: "Pipeline id"
+      returns code: 200, desc: "JSON with pipeline and latest run data"
+      error code: 503, desc: "Woodpecker not configured"
+      def status
+        pipeline = Pipeline.find(params[:id])
+        latest_run = begin
+          PipelineService.new.pipeline_detail(pipeline, "latest")
+        rescue WoodpeckerClient::ApiError
+          nil
+        end
+        render json: { pipeline: pipeline_json(pipeline), latest_run: latest_run }
+      end
+
+      api :POST, "/api/ci/pipelines/:id/trigger", "Trigger a pipeline"
+      header "X-Update-Secret", "Shared secret or application token (update scope)", required: true
+      param :id, :number, required: true, desc: "Pipeline id"
+      param :branch, String, required: false, desc: "Branch to build (default: main)"
+      returns code: 200, desc: "JSON with triggered run data"
+      error code: 401, desc: "Invalid secret"
+      error code: 503, desc: "Woodpecker not configured"
+      def trigger
+        unless update_authorized?(required_scope: ApplicationToken::UPDATE_SCOPE)
+          return render json: { error: "Unauthorized" }, status: :unauthorized
+        end
+
+        pipeline = Pipeline.find(params[:id])
+        result = PipelineService.new.trigger(pipeline, branch: params[:branch] || "main")
+        render json: { triggered: true, pipeline: result }
+      end
+
+      private
+
+      def require_woodpecker!
+        return if WarpEngine.woodpecker_configured?
+
+        render json: { error: "Woodpecker not configured" }, status: :service_unavailable
+      end
+
+      def pipeline_json(pipeline)
+        {
+          id: pipeline.id,
+          woodpecker_repo_id: pipeline.woodpecker_repo_id,
+          repo_owner: pipeline.repo_owner,
+          repo_name: pipeline.repo_name,
+          platform: pipeline.platform,
+          active: pipeline.active,
+          software_name: pipeline.software&.name,
+          last_pipeline_status: pipeline.last_pipeline_status,
+          last_pipeline_at: pipeline.last_pipeline_at
+        }
+      end
+    end
+  end
+end
@@ -8,23 +8,26 @@ module WarpEngine
    api :GET, "/api/download", "Download a file by path"
    param :path, String, required: true, desc: "File path to download"
    returns code: 200, desc: "File binary data"
+    returns code: 302, desc: "Redirect to the storage location (non-local storage adapter)"
    error code: 400, desc: "Path is blank"
    error code: 404, desc: "File not found"
    def show
      path = params[:path]
      return render(json: { error: "Path is required" }, status: :bad_request) if path.blank?

-      full_path = WarpEngine::DownloadService.new.create(
+      location = WarpEngine::DownloadService.new.locate(
        path: path,
        ip: request.remote_ip,
        user_agent: request.user_agent,
        referer: request.referer
      )

-      if full_path
-        send_file full_path, disposition: "attachment", type: resolve_mime(full_path)
-      else
+      if location.nil?
        render json: { error: "Not found" }, status: :not_found
+      elsif location.redirect?
+        redirect_to location.url, allow_other_host: true
+      else
+        send_file location.path, disposition: "attachment", type: resolve_mime(location.path)
      end
    end
  end
@@ -29,13 +29,13 @@ module WarpEngine
          return render json: { error: "Forbidden" }, status: :forbidden
        end

-        input = WarpEngine::UpdateInputDto.new(
+        input = WarpEngine::PublishInputDto.new(
          platform: params[:platform],
          name:     params[:name],
          version:  params[:version]
        )

-        WarpEngine::UpdateService.new.update(input)
+        WarpEngine::PublishService.new.publish(input)
        claim_software_ownership(params[:name])

        render json: { published: true, name: params[:name], platform: params[:platform], version: params[:version] }
@@ -1,5 +1,5 @@
 module WarpEngine
-  UpdateInputDto = Struct.new(:platform, :name, :version, keyword_init: true) do
+  PublishInputDto = Struct.new(:platform, :name, :version, keyword_init: true) do
    def initialize(platform:, name:, version: nil)
      super
    end
@@ -0,0 +1,8 @@
+module WarpEngine
+  class ApplicationJob < ActiveJob::Base
+    retry_on WoodpeckerClient::ConnectionError, wait: 30.seconds, attempts: 3
+    discard_on WoodpeckerClient::ApiError do |job, error|
+      Rails.logger.error("[#{job.class.name}] discarded: #{error.message}")
+    end
+  end
+end
@@ -0,0 +1,9 @@
+module WarpEngine
+  class PipelineSyncJob < ApplicationJob
+    queue_as :default
+
+    def perform
+      PipelineSyncService.new.sync_all
+    end
+  end
+end
@@ -0,0 +1,36 @@
+module WarpEngine
+  class Pipeline < ApplicationRecord
+    self.table_name = "pipelines"
+
+    # Repos synced from Woodpecker without a matching Software land here
+    # until a platform is assigned by hand.
+    UNKNOWN_PLATFORM = "unknown".freeze
+
+    belongs_to :software, class_name: "WarpEngine::Software", optional: true
+
+    default_scope { where(deleted_at: nil) }
+
+    validates :woodpecker_repo_id, presence: true, uniqueness: true
+    validates :repo_owner, presence: true
+    validates :repo_name, presence: true
+    validates :platform, presence: true,
+              inclusion: { in: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS + [ UNKNOWN_PLATFORM ] }
+
+    scope :active, -> { where(active: true) }
+
+    def full_name
+      "#{repo_owner}/#{repo_name}"
+    end
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[active created_at deleted_at id last_pipeline_at last_pipeline_status
+         platform repo_name repo_owner software_id woodpecker_repo_id]
+    end
+
+    def self.ransackable_associations(auth_object = nil)
+      %w[software]
+    end
+
+    ActiveSupport.run_load_hooks(:warp_engine_pipeline, self)
+  end
+end
@@ -11,6 +11,7 @@ module WarpEngine
    has_many :releases, foreign_key: :software_id
    has_many :downloads, through: :releases
    has_many :external_links, foreign_key: :software_id
+    has_one :pipeline, foreign_key: :software_id

    accepts_nested_attributes_for :software_images, allow_destroy: true
    accepts_nested_attributes_for :external_links, allow_destroy: true
@@ -2,7 +2,7 @@ require "zip"
 require "fileutils"

 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module ArchiveExtraction
      private

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildCartridge
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildDocs
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildLinuxX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacArm64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacUniversal
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildSource
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWeb
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWinX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWinX86
        extend ActiveSupport::Concern
@@ -1,7 +1,7 @@
 require "json"

 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module MetadataParsing
      METADATA_KEYS = %i[name title author desc site repo license].freeze

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module SoftwarePersistence
      private

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Updatable
      extend ActiveSupport::Concern
      include ArchiveExtraction
@@ -9,7 +9,7 @@ module WarpEngine
      class_methods do
        def platform(value = nil)
          @platform = value if value
-          @platform ||= name.demodulize.delete_suffix("Service").downcase
+          @platform ||= name.deconstantize.demodulize.downcase
        end

        def label(value = nil)
@@ -2,7 +2,7 @@ module WarpEngine
  class BuildsService
    def index
      platforms = WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each_with_object({}) do |platform, hash|
-        service_class = "WarpEngine::SoftwareUpdater::#{platform.camelize}Service".constantize
+        service_class = "WarpEngine::Platforms::#{platform.camelize}::Service".constantize
        hash[platform] = {
          label: service_class.label,
          kinds: service_class.expected_kinds
@@ -16,7 +16,7 @@ module WarpEngine

    def show(name)
      software = WarpEngine::Software.find_by!(name: name)
-      service_class = "WarpEngine::SoftwareUpdater::#{software.platform.camelize}Service".constantize
+      service_class = "WarpEngine::Platforms::#{software.platform.camelize}::Service".constantize
      expected = service_class.expected_kinds

      releases = software.releases.includes(:release_assets).order(updated_at: :desc)
@@ -2,8 +2,8 @@ require "erb"

 module WarpEngine
  # Renders the /build/config platform templates: the pipeline logic lives in
-  # lib/warp_engine/ci_templates/<platform>.yaml.erb, the per-platform builder
-  # images come from WarpEngine.config.ci_platforms.
+  # app/services/warp_engine/platforms/<platform>/pipeline.yaml.erb, the
+  # per-platform builder images come from WarpEngine.config.ci_platforms.
  class CiConfigService
    PLATFORM_FORMAT = /\A[a-z0-9_-]+\z/

@@ -15,7 +15,7 @@ module WarpEngine
      spec = platform_spec(platform)
      return nil if spec.nil?

-      path = templates_dir.join("#{platform}.yaml.erb")
+      path = templates_dir.join(platform, "pipeline.yaml.erb")
      return nil unless path.exist?

      ERB.new(path.read, trim_mode: "-").result_with_hash(
@@ -34,7 +34,7 @@ module WarpEngine
    end

    def templates_dir
-      WarpEngine::Engine.root.join("lib", "warp_engine", "ci_templates")
+      WarpEngine::Engine.root.join("app", "services", "warp_engine", "platforms")
    end
  end
 end
@@ -1,13 +1,17 @@
 require "openssl"
 require "base64"
 require "net/http"
+require "digest"

 module WarpEngine
-  # Verifies the httpsig signature of Woodpecker configuration-extension
-  # requests (draft-cavage http-signatures, ed25519). The server sends the
-  # signed header list in the Signature header — typically "(request-target) date".
+  # Verifies the signature of Woodpecker configuration-extension requests.
+  # Woodpecker 3.x signs with RFC 9421 HTTP message signatures (ed25519, via
+  # yaronf/httpsign): Signature-Input + Signature + Content-Digest headers,
+  # covered components "@request-target" and "content-digest". Older versions
+  # used draft-cavage http-signatures (a single Signature header) — kept as a
+  # fallback.
  class CiSignatureVerifier
-    SIGNATURE_PARAM = /(\w+)="([^"]*)"/
+    CAVAGE_PARAM = /(\w+)="([^"]*)"/

    @key_cache = {}
    @key_mutex = Mutex.new
@@ -36,14 +40,12 @@ module WarpEngine
        return false
      end

-      params = signature_params
-      return false if params.nil? || params["signature"].blank?
-
-      signing_string = build_signing_string(params.fetch("headers", "date"))
-      return false if signing_string.nil?
-
      key = OpenSSL::PKey.read(pem)
-      key.verify(nil, Base64.decode64(params["signature"]), signing_string)
+      if @request.headers["Signature-Input"].present?
+        rfc9421_valid?(key)
+      else
+        cavage_valid?(key)
+      end
    rescue OpenSSL::PKey::PKeyError, ArgumentError => e
      Rails.logger.error("[CiSignatureVerifier] #{e.class}: #{e.message}")
      false
@@ -62,8 +64,70 @@ module WarpEngine
      nil
    end

+    # --- RFC 9421 ---
+
+    def rfc9421_valid?(key)
+      input = @request.headers["Signature-Input"].to_s
+      match = input.match(/\A\s*([\w.-]+)=(\(.*)\z/m)
+      return false if match.nil?
+
+      label, inner = match[1], match[2]
+      components = inner[/\((.*?)\)/m, 1].to_s.scan(/"([^"]*)"/).flatten
+      return false if components.empty?
+
+      signature = @request.headers["Signature"].to_s[/#{Regexp.escape(label)}=:([A-Za-z0-9+\/=]+):/, 1]
+      return false if signature.blank?
+      return false unless content_digest_valid?(components)
+
+      lines = components.map do |component|
+        value = component_value(component)
+        return false if value.nil?
+        %("#{component}": #{value})
+      end
+      lines << %("@signature-params": #{inner})
+
+      key.verify(nil, Base64.decode64(signature), lines.join("\n"))
+    end
+
+    def component_value(name)
+      case name
+      when "@request-target" then @request.fullpath
+      when "@method"         then @request.request_method
+      when "@target-uri"     then @request.original_url
+      when "@authority"      then @request.host_with_port
+      when "@path"           then @request.path
+      when "@query"          then "?#{@request.query_string}"
+      when /\A@/             then nil
+      else @request.headers[name]
+      end
+    end
+
+    # When content-digest is a covered component, the body itself must match
+    # the digest header — this is what ties the signature to the payload.
+    def content_digest_valid?(components)
+      return true unless components.include?("content-digest")
+
+      digest = @request.headers["Content-Digest"].to_s[/sha-256=:([A-Za-z0-9+\/=]+):/, 1]
+      return false if digest.blank?
+
+      expected = Digest::SHA256.base64digest(@request.raw_post)
+      ActiveSupport::SecurityUtils.secure_compare(digest, expected)
+    end
+
+    # --- draft-cavage fallback ---
+
+    def cavage_valid?(key)
+      params = cavage_params
+      return false if params.nil? || params["signature"].blank?
+
+      signing_string = cavage_signing_string(params.fetch("headers", "date"))
+      return false if signing_string.nil?
+
+      key.verify(nil, Base64.decode64(params["signature"]), signing_string)
+    end
+
    # Parameters of the Signature header (or the "Authorization: Signature ..." form).
-    def signature_params
+    def cavage_params
      header = @request.headers["Signature"].presence
      if header.nil?
        auth = @request.headers["Authorization"].to_s
@@ -71,10 +135,10 @@ module WarpEngine
      end
      return nil if header.blank?

-      header.scan(SIGNATURE_PARAM).to_h
+      header.scan(CAVAGE_PARAM).to_h
    end

-    def build_signing_string(headers_list)
+    def cavage_signing_string(headers_list)
      lines = headers_list.split(" ").map do |name|
        if name == "(request-target)"
          "(request-target): #{@request.request_method.downcase} #{@request.fullpath}"
@@ -9,26 +9,45 @@ module WarpEngine
      Pathname.new(container_base).realpath
    end

-    def create(path:, ip:, user_agent:, referer:)
-      sanitized = path.to_s
-      base_path = self.class.base_path
-      full_path = base_path.join(sanitized).realpath
-      return nil unless full_path.to_s.start_with?(base_path.to_s)
-      return nil unless File.file?(full_path)
+    # A letöltés helyét adja vissza (fájl vagy aláírt URL) és naplózza a
+    # letöltést. A hely feloldása a storage adapteren megy — alapból :local,
+    # tehát változatlanul lemezről.
+    def locate(path:, ip:, user_agent:, referer:)
+      relative = path.to_s
+      return nil unless storage.file?(relative)

-      escaped = sanitized.gsub("%", "\\%").gsub("_", "\\_")
-      asset = WarpEngine::ReleaseAsset.find_by(path: File.join(self.class.container_base, sanitized)) ||
+      log_download(relative, ip: ip, user_agent: user_agent, referer: referer)
+
+      storage.locate(relative, filename: File.basename(relative))
+    end
+
+    # Visszafelé kompatibilis felület: az abszolút fájlútvonalat adja vissza
+    # (vagy nil-t). Nem lemezes adapternél nincs útvonal — ott a #locate való.
+    def create(path:, ip:, user_agent:, referer:)
+      location = locate(path: path, ip: ip, user_agent: user_agent, referer: referer)
+      return nil if location.nil?
+
+      location.file? ? location.path : nil
+    end
+
+    private
+
+    def storage
+      WarpEngine.storage
+    end
+
+    def log_download(relative, ip:, user_agent:, referer:)
+      escaped = relative.gsub("%", "\\%").gsub("_", "\\_")
+      asset = WarpEngine::ReleaseAsset.find_by(path: File.join(self.class.container_base, relative)) ||
              WarpEngine::ReleaseAsset.where("path LIKE ?", "%#{escaped}%").first

      WarpEngine::Download.create!(
-        file_path: sanitized,
+        file_path: relative,
        release: asset&.release,
        ip_address: ip,
        user_agent: user_agent&.truncate(500),
        referer: referer&.truncate(500)
      )
-
-      full_path
    end
  end
 end
@@ -5,31 +5,32 @@ module WarpEngine
      Pathname.new(WarpEngine.config.file_container_path).realpath
    end

+    # A fájlok helyét a storage adapter adja (alapból :local, azaz a lemez) —
+    # így a host az objektumtárból is kiszolgálhat anélkül, hogy az engine-t
+    # patchelné. Lásd WarpEngine::Storage.
    def show(input)
-      full_path = base_path.join(input.path.to_s)
-      return FileResultDto.not_found unless safe_path?(full_path)
+      relative = input.path.to_s

-      if File.directory?(full_path)
-        index_path = full_path.join("index.html")
-        return FileResultDto.not_found unless File.file?(index_path)
-        return FileResultDto.redirect("/file/#{input.path.to_s.chomp("/")}/index.html")
+      if storage.directory?(relative)
+        index = File.join(relative.chomp("/"), "index.html")
+        return FileResultDto.not_found unless storage.file?(index)
+
+        return FileResultDto.redirect("/file/#{index}")
      end

-      if File.file?(full_path)
-        FileResultDto.file(full_path)
-      else
-        FileResultDto.not_found
-      end
+      return FileResultDto.not_found unless storage.file?(relative)
+
+      to_result(storage.locate(relative, filename: File.basename(relative)))
    end

    private

-    def base_path
-      @base_path ||= self.class.base_path
+    def storage
+      WarpEngine.storage
    end

-    def safe_path?(path)
-      File.exist?(path) && Pathname.new(path).realpath.to_s.start_with?(base_path.to_s)
+    def to_result(location)
+      location.redirect? ? FileResultDto.redirect(location.url) : FileResultDto.file(location.path)
    end
  end
 end
@@ -0,0 +1,35 @@
+module WarpEngine
+  class PipelineService
+    def initialize(client: WoodpeckerClient.new)
+      @client = client
+    end
+
+    def trigger(pipeline, branch: "main")
+      @client.trigger_pipeline(pipeline.woodpecker_repo_id, branch: branch)
+    end
+
+    # Fetches one page of a pipeline's runs; the newest one refreshes the
+    # cached last_pipeline_* columns (Pipelines index and the CI API).
+    def list_pipelines(pipeline, page: 1)
+      runs = @client.list_pipelines(pipeline.woodpecker_repo_id, page: page)
+      refresh_last_pipeline(pipeline, runs.first) if page == 1 && runs.is_a?(Array)
+      runs
+    end
+
+    def pipeline_detail(pipeline, number)
+      @client.get_pipeline(pipeline.woodpecker_repo_id, number)
+    end
+
+    private
+
+    # Woodpecker returns unix epoch seconds in "created".
+    def refresh_last_pipeline(pipeline, run)
+      return unless run && pipeline.persisted?
+
+      pipeline.update_columns(
+        last_pipeline_status: run["status"],
+        last_pipeline_at:     run["created"] ? Time.zone.at(run["created"]) : nil
+      )
+    end
+  end
+end
@@ -0,0 +1,73 @@
+module WarpEngine
+  class PipelineSyncService
+    def initialize(client: WoodpeckerClient.new)
+      @client = client
+    end
+
+    def sync_all
+      remote_repos = @client.list_repos
+      results = { created: [], updated: [], deactivated: [] }
+      remote_ids = remote_repos.map { |r| r["id"] }
+
+      remote_repos.each do |remote|
+        record = Pipeline.unscoped.find_or_initialize_by(
+          woodpecker_repo_id: remote["id"]
+        )
+
+        was_new = record.new_record?
+        record.assign_attributes(
+          repo_name:  remote["name"],
+          repo_owner: remote["owner"],
+          active:     remote["active"],
+          deleted_at: nil
+        )
+
+        if record.platform.blank? || record.platform == Pipeline::UNKNOWN_PLATFORM
+          sw = Software.find_by(name: remote["name"])
+          record.platform = sw&.platform || Pipeline::UNKNOWN_PLATFORM
+          record.software = sw if sw
+        end
+
+        next unless record.save
+
+        results[was_new ? :created : :updated] << record
+      end
+
+      Pipeline.where.not(woodpecker_repo_id: remote_ids).find_each do |orphan|
+        orphan.update!(active: false) if orphan.active?
+        results[:deactivated] << orphan
+      end
+
+      results
+    end
+
+    def activate(repo_id)
+      @client.activate_repo(repo_id)
+      sync_single(repo_id)
+    end
+
+    def deactivate(repo_id)
+      @client.deactivate_repo(repo_id)
+      record = Pipeline.find_by!(woodpecker_repo_id: repo_id)
+      record.update!(active: false)
+    end
+
+    private
+
+    def sync_single(repo_id)
+      remote = @client.get_repo(repo_id)
+      record = Pipeline.unscoped.find_or_initialize_by(woodpecker_repo_id: repo_id)
+      record.assign_attributes(
+        repo_name: remote["name"], repo_owner: remote["owner"],
+        active: remote["active"], deleted_at: nil
+      )
+      if record.platform.blank?
+        sw = Software.find_by(name: remote["name"])
+        record.platform = sw&.platform || Pipeline::UNKNOWN_PLATFORM
+        record.software = sw if sw
+      end
+      record.save!
+      record
+    end
+  end
+end
@@ -0,0 +1,14 @@
+module WarpEngine
+  module Platforms
+    module Bevy
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+
+        label "Bevy"
+      end
+    end
+  end
+end
@@ -0,0 +1,14 @@
+module WarpEngine
+  module Platforms
+    module C64
+      class Service
+        include Updatable
+        include Builds::BuildCartridge
+
+        label "C64"
+
+        def cartridge_ext = ".prg"
+      end
+    end
+  end
+end
@@ -0,0 +1,17 @@
+module WarpEngine
+  module Platforms
+    module Ebitengine
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX86
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildMacX64
+        include Builds::BuildMacArm64
+
+        label "Ebitengine"
+      end
+    end
+  end
+end
@@ -0,0 +1,16 @@
+module WarpEngine
+  module Platforms
+    module Godot
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX86
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildMacUniversal
+
+        label "Godot"
+      end
+    end
+  end
+end
@@ -0,0 +1,15 @@
+module WarpEngine
+  module Platforms
+    module Love
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildMacUniversal
+
+        label "LÖVE"
+      end
+    end
+  end
+end
@@ -0,0 +1,12 @@
+module WarpEngine
+  module Platforms
+    module Phaser
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+
+        label "Phaser"
+      end
+    end
+  end
+end
@@ -17,8 +17,12 @@ steps:
        echo $VERSION > .version

  - name: lint
-    image: <%= builder %>
+    image: alpine
    commands:
+      - apk add --no-cache lua5.4 lua5.4-dev luarocks gcc musl-dev
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
+      - ln -sf /usr/bin/luarocks-5.4 /usr/bin/luarocks
+      - luarocks install luacheck
      - |
        echo "==> Merging..."
        rm -f /tmp/_lint_combined.lua /tmp/_lint_map.txt
@@ -83,8 +87,10 @@ steps:
        rm -f /tmp/_lint_combined.lua /tmp/_lint_map.txt

  - name: minify
-    image: <%= builder %>
+    image: alpine
    commands:
+      - apk add --no-cache lua5.4 curl
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
      - |
        rm -f <%= name %>.lua
        sed 's/\r$//' <%= name %>.inc | while read f; do
@@ -97,8 +103,12 @@ steps:
        lua minify.lua minify <%= name %>.original.lua > <%= name %>.lua

  - name: docs
-    image: <%= builder %>
+    image: alpine
    commands:
+      - apk add --no-cache lua5.4 lua5.4-dev luarocks gcc musl-dev zip
+      - ln -sf /usr/bin/lua5.4 /usr/bin/lua
+      - ln -sf /usr/bin/luarocks-5.4 /usr/bin/luarocks
+      - luarocks install ldoc
      - |
        VERSION=$(cat .version)
        echo "==> Generating docs from <%= name %>.original.lua"
@@ -109,7 +119,7 @@ steps:
        echo "==> Docs zip created"

  - name: export
-    image: <%= exporter %>
+    image: <%= builder %>
    environment:
      XDG_RUNTIME_DIR: /tmp
    commands:
@@ -128,7 +138,7 @@ steps:
        ls -lh <%= name %>-$VERSION.* <%= name %>.tic <%= name %>.html.zip 2>/dev/null || true

  - name: binaries
-    image: <%= exporter %>
+    image: <%= builder %>
    environment:
      XDG_RUNTIME_DIR: /tmp
    commands:
@@ -0,0 +1,40 @@
+module WarpEngine
+  module Platforms
+    module Tic80
+      class Service
+        include Updatable
+        include Builds::BuildCartridge
+        include Builds::BuildSource
+        include Builds::BuildWeb
+        include Builds::BuildDocs
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildMacX64
+
+        label "TIC-80"
+
+        def cartridge_ext = ".tic"
+        def source_ext = ".lua"
+
+        private
+
+        def parse_metadata(versioned)
+          parse_lua_metadata(full_path("#{versioned}.lua"))
+        end
+
+        def parse_lua_metadata(source_path)
+          metadata = {}
+          File.foreach(source_path) do |line|
+            break unless line.start_with?("--")
+            parts = line[2..].split(":", 2)
+            next if parts.length != 2
+            key   = parts[0].strip.downcase.to_sym
+            value = parts[1].strip
+            metadata[key] = value
+          end
+          metadata.slice(*MetadataParsing::METADATA_KEYS)
+        end
+      end
+    end
+  end
+end
@@ -0,0 +1,31 @@
+module WarpEngine
+  class PublishService
+    # Az esemény neve, amit a host lehallgathat. A payload:
+    #   platform: String, name: String, version: String,
+    #   software: WarpEngine::Software, release: WarpEngine::Release
+    NOTIFICATION = "warp_engine.publish".freeze
+
+    def publish(input)
+      unless WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.include?(input.platform)
+        raise ArgumentError, "Unsupported platform: #{input.platform}"
+      end
+
+      release = "WarpEngine::Platforms::#{input.platform.camelize}::Service".constantize
+                .new.update(input.name, input.version)
+
+      # A publikálás az egyetlen pont, ahol új build kerül a katalógusba —
+      # a host innen tud rá reagálni (értesítés, feed, csatorna-előléptetés)
+      # anélkül, hogy modell-callbackre kellene kapaszkodnia.
+      ActiveSupport::Notifications.instrument(
+        NOTIFICATION,
+        platform: input.platform,
+        name:     input.name,
+        version:  input.version,
+        software: release.respond_to?(:software) ? release.software : nil,
+        release:  release
+      )
+
+      release
+    end
+  end
+end
@@ -0,0 +1,80 @@
+module WarpEngine
+  class SecretSyncService
+    SECRET_NAME = "application_token".freeze
+
+    def initialize(client: WoodpeckerClient.new)
+      @client = client
+    end
+
+    def provision(plain_token, pipelines:)
+      results = { synced: [], failed: [] }
+
+      pipelines.each do |pipeline|
+        if secret_exists?(pipeline.woodpecker_repo_id)
+          @client.update_secret(pipeline.woodpecker_repo_id, SECRET_NAME, value: plain_token)
+        else
+          @client.create_secret(pipeline.woodpecker_repo_id, name: SECRET_NAME, value: plain_token)
+        end
+        results[:synced] << pipeline
+      rescue WoodpeckerClient::ApiError, WoodpeckerClient::ConnectionError => e
+        Rails.logger.error("[SecretSyncService] failed for #{pipeline.full_name}: #{e.message}")
+        results[:failed] << { pipeline: pipeline, error: e.message }
+      end
+
+      results
+    end
+
+    def deprovision(application_token)
+      pipelines_for_token(application_token).each do |pipeline|
+        @client.delete_secret(pipeline.woodpecker_repo_id, SECRET_NAME)
+      rescue WoodpeckerClient::ApiError => e
+        Rails.logger.warn("[SecretSyncService] delete failed for #{pipeline.full_name}: #{e.message}")
+      end
+    end
+
+    def rotate(application_token)
+      pipelines = pipelines_for_token(application_token)
+      return { rotated: false, reason: "no pipelines" } if pipelines.empty?
+
+      new_token = ApplicationToken.create!(
+        name:         "#{application_token.name} (rotated #{Date.current})",
+        owner_id:     application_token.owner_id,
+        owner_type:   application_token.owner_type,
+        scopes:       application_token.scopes,
+        expires_at:   application_token.expires_at,
+        unrestricted: application_token.unrestricted?
+      )
+
+      result = provision(new_token.plain_token, pipelines: pipelines)
+
+      if result[:synced].any?
+        application_token.revoke!
+        { rotated: true, new_token: new_token, sync_result: result }
+      else
+        new_token.revoke!
+        { rotated: false, reason: "all pipelines failed", sync_result: result }
+      end
+    end
+
+    def pipelines_for_token(application_token)
+      if application_token.unrestricted?
+        Pipeline.active.to_a
+      else
+        software_ids = Software.where(
+          owner_type: application_token.owner_type,
+          owner_id:   application_token.owner_id
+        ).pluck(:id)
+        Pipeline.active.where(software_id: software_ids).to_a
+      end
+    end
+
+    private
+
+    def secret_exists?(repo_id)
+      secrets = @client.list_secrets(repo_id)
+      secrets.any? { |s| s["name"] == SECRET_NAME }
+    rescue WoodpeckerClient::ApiError
+      false
+    end
+  end
+end
@@ -1,12 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class BevyService
-      include Updatable
-      include Builds::BuildWeb
-      include Builds::BuildWinX64
-      include Builds::BuildLinuxX64
-
-      label "Bevy"
-    end
-  end
-end
@@ -1,12 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class C64Service
-      include Updatable
-      include Builds::BuildCartridge
-
-      label "C64"
-
-      def cartridge_ext = ".prg"
-    end
-  end
-end
@@ -1,15 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class EbitengineService
-      include Updatable
-      include Builds::BuildWeb
-      include Builds::BuildWinX86
-      include Builds::BuildWinX64
-      include Builds::BuildLinuxX64
-      include Builds::BuildMacX64
-      include Builds::BuildMacArm64
-
-      label "Ebitengine"
-    end
-  end
-end
@@ -1,14 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class GodotService
-      include Updatable
-      include Builds::BuildWeb
-      include Builds::BuildWinX86
-      include Builds::BuildWinX64
-      include Builds::BuildLinuxX64
-      include Builds::BuildMacUniversal
-
-      label "Godot"
-    end
-  end
-end
@@ -1,13 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class LoveService
-      include Updatable
-      include Builds::BuildWeb
-      include Builds::BuildWinX64
-      include Builds::BuildLinuxX64
-      include Builds::BuildMacUniversal
-
-      label "LÖVE"
-    end
-  end
-end
@@ -1,10 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class PhaserService
-      include Updatable
-      include Builds::BuildWeb
-
-      label "Phaser"
-    end
-  end
-end
@@ -1,38 +0,0 @@
-module WarpEngine
-  module SoftwareUpdater
-    class Tic80Service
-      include Updatable
-      include Builds::BuildCartridge
-      include Builds::BuildSource
-      include Builds::BuildWeb
-      include Builds::BuildDocs
-      include Builds::BuildWinX64
-      include Builds::BuildLinuxX64
-      include Builds::BuildMacX64
-
-      label "TIC-80"
-
-      def cartridge_ext = ".tic"
-      def source_ext = ".lua"
-
-      private
-
-      def parse_metadata(versioned)
-        parse_lua_metadata(full_path("#{versioned}.lua"))
-      end
-
-      def parse_lua_metadata(source_path)
-        metadata = {}
-        File.foreach(source_path) do |line|
-          break unless line.start_with?("--")
-          parts = line[2..].split(":", 2)
-          next if parts.length != 2
-          key   = parts[0].strip.downcase.to_sym
-          value = parts[1].strip
-          metadata[key] = value
-        end
-        metadata.slice(*MetadataParsing::METADATA_KEYS)
-      end
-    end
-  end
-end
@@ -1,11 +0,0 @@
-module WarpEngine
-  class UpdateService
-    def update(input)
-      unless WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.include?(input.platform)
-        raise ArgumentError, "Unsupported platform: #{input.platform}"
-      end
-
-      "WarpEngine::SoftwareUpdater::#{input.platform.camelize}Service".constantize.new.update(input.name, input.version)
-    end
-  end
-end
@@ -0,0 +1,160 @@
+require "net/http"
+require "json"
+require "uri"
+
+module WarpEngine
+  class WoodpeckerClient
+    class ApiError < StandardError
+      attr_reader :status, :body
+
+      def initialize(message, status:, body: nil)
+        super(message)
+        @status = status
+        @body = body
+      end
+    end
+
+    class ConnectionError < StandardError; end
+
+    def initialize(base_url: nil, token: nil)
+      @base_url = (base_url || WarpEngine.config.woodpecker_url).to_s.chomp("/")
+      @token    = token || WarpEngine.config.woodpecker_api_token
+    end
+
+    # --- Repos ---
+
+    def list_repos
+      get("/api/repos")
+    end
+
+    def get_repo(repo_id)
+      get("/api/repos/#{repo_id}")
+    end
+
+    def activate_repo(repo_id)
+      post("/api/repos", body: { id: repo_id })
+    end
+
+    def deactivate_repo(repo_id)
+      delete("/api/repos/#{repo_id}")
+    end
+
+    # --- Secrets ---
+
+    def list_secrets(repo_id)
+      get("/api/repos/#{repo_id}/secrets")
+    end
+
+    def create_secret(repo_id, name:, value:, events: %w[push tag deployment])
+      post("/api/repos/#{repo_id}/secrets",
+           body: { name: name, value: value, events: events })
+    end
+
+    def update_secret(repo_id, secret_name, value:)
+      patch("/api/repos/#{repo_id}/secrets/#{secret_name}",
+            body: { value: value })
+    end
+
+    def delete_secret(repo_id, secret_name)
+      delete("/api/repos/#{repo_id}/secrets/#{secret_name}")
+    end
+
+    # --- Pipelines ---
+
+    def list_pipelines(repo_id, page: 1, per_page: 25)
+      get("/api/repos/#{repo_id}/pipelines",
+          params: { page: page, perPage: per_page })
+    end
+
+    def latest_pipeline(repo_id)
+      get("/api/repos/#{repo_id}/pipelines/latest")
+    end
+
+    def get_pipeline(repo_id, number)
+      get("/api/repos/#{repo_id}/pipelines/#{number}")
+    end
+
+    def trigger_pipeline(repo_id, branch: "main")
+      post("/api/repos/#{repo_id}/pipelines",
+           body: { branch: branch })
+    end
+
+    private
+
+    def get(path, params: {})
+      uri = build_uri(path, params)
+      request = Net::HTTP::Get.new(uri)
+      execute(uri, request)
+    end
+
+    def post(path, body: {})
+      uri = build_uri(path)
+      request = Net::HTTP::Post.new(uri)
+      request.body = body.to_json
+      request.content_type = "application/json"
+      execute(uri, request)
+    end
+
+    def patch(path, body: {})
+      uri = build_uri(path)
+      request = Net::HTTP::Patch.new(uri)
+      request.body = body.to_json
+      request.content_type = "application/json"
+      execute(uri, request)
+    end
+
+    def delete(path)
+      uri = build_uri(path)
+      request = Net::HTTP::Delete.new(uri)
+      execute(uri, request)
+    end
+
+    def build_uri(path, params = {})
+      uri = URI.parse("#{@base_url}#{path}")
+      uri.query = URI.encode_www_form(params) if params.any?
+      uri
+    end
+
+    def execute(uri, request)
+      request["Authorization"] = "Bearer #{@token}"
+      request["Accept"] = "application/json"
+
+      response = Net::HTTP.start(uri.hostname, uri.port,
+                                  use_ssl: uri.scheme == "https",
+                                  open_timeout: 10,
+                                  read_timeout: 30) do |http|
+        http.request(request)
+      end
+
+      handle_response(uri, response)
+    rescue Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Net::OpenTimeout,
+           Net::ReadTimeout, SocketError => e
+      raise ConnectionError, "Cannot reach Woodpecker at #{@base_url}: #{e.message}"
+    end
+
+    def handle_response(uri, response)
+      case response
+      when Net::HTTPSuccess, Net::HTTPNoContent
+        return nil if response.body.blank?
+        begin
+          JSON.parse(response.body)
+        rescue JSON::ParserError
+          # A wrong path falls through to the Woodpecker SPA, which answers
+          # 200 with index.html — surface that as an API error, not a parse one.
+          raise ApiError.new(
+            "Expected JSON from #{uri.path} but got: #{response.body.truncate(80)}",
+            status: response.code.to_i, body: response.body
+          )
+        end
+      when Net::HTTPNotFound
+        raise ApiError.new("Not found: #{uri.path}", status: 404, body: response.body)
+      else
+        raise ApiError.new(
+          "Woodpecker API error #{response.code}: #{response.body&.truncate(200)}",
+          status: response.code.to_i,
+          body: response.body
+        )
+      end
+    end
+  end
+end
@@ -6,6 +6,10 @@ WarpEngine::Engine.routes.draw do
    get "download",               to: "downloads#show"
    get "builds",                 to: "builds#index"
    get "softwares/:name/builds", to: "software_builds#show"
+
+    get  "ci/pipelines",             to: "ci#pipelines"
+    get  "ci/pipelines/:id/status",  to: "ci#status"
+    post "ci/pipelines/:id/trigger", to: "ci#trigger"
  end

  post "build/upload",  to: "build/uploads#create"
@@ -0,0 +1,27 @@
+class CreateCiRepositories < ActiveRecord::Migration[8.1]
+  def change
+    create_table :ci_repositories, id: { type: :bigint, unsigned: true },
+                                    charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci" do |t|
+      t.bigint  :woodpecker_repo_id, null: false, unsigned: true
+      t.string  :repo_owner, limit: 128, null: false
+      t.string  :repo_name, limit: 128, null: false
+      t.string  :platform, limit: 32, null: false
+      t.bigint  :software_id, unsigned: true
+      t.boolean :active, default: true, null: false
+      t.string  :last_pipeline_status, limit: 32
+      t.datetime :last_pipeline_at, precision: 3
+      t.datetime :deleted_at, precision: 3
+      t.timestamps precision: 3, null: true
+
+      t.index :woodpecker_repo_id, unique: true, name: "idx_ci_repos_wp_id"
+      t.index :software_id, name: "idx_ci_repos_software"
+      t.index [ :repo_owner, :repo_name ], unique: true, name: "idx_ci_repos_owner_name"
+      t.index :deleted_at, name: "idx_ci_repos_deleted"
+    end
+
+    add_foreign_key :ci_repositories, :softwares,
+                    column: :software_id,
+                    name: "fk_ci_repos_software",
+                    on_delete: :nullify
+  end
+end
@@ -0,0 +1,15 @@
+class RenameCiRepositoriesToPipelines < ActiveRecord::Migration[8.1]
+  def change
+    rename_table :ci_repositories, :pipelines
+
+    rename_index :pipelines, "idx_ci_repos_deleted",    "idx_pipelines_deleted"
+    rename_index :pipelines, "idx_ci_repos_owner_name", "idx_pipelines_owner_name"
+    rename_index :pipelines, "idx_ci_repos_software",   "idx_pipelines_software"
+    rename_index :pipelines, "idx_ci_repos_wp_id",      "idx_pipelines_wp_id"
+
+    remove_foreign_key :pipelines, :softwares,
+                       column: :software_id, name: "fk_ci_repos_software", on_delete: :nullify
+    add_foreign_key :pipelines, :softwares,
+                    column: :software_id, name: "fk_pipelines_software", on_delete: :nullify
+  end
+end
@@ -18,3 +18,9 @@ WOODPECKER_AGENT_SECRET=example-agent-secret
 # http://woodpecker:8000/authorize — required before the ci profile starts.
 WOODPECKER_GITEA_CLIENT=
 WOODPECKER_GITEA_SECRET=
+
+# Woodpecker management (repo sync, secret provisioning, pipeline control).
+# Generate a PAT in Woodpecker: profile → Personal Token.
+WOODPECKER_URL=http://woodpecker:8000
+WOODPECKER_API_TOKEN=
+WOODPECKER_REPO_OWNER=
@@ -39,6 +39,9 @@ services:
      UPDATE_SECRET: ${UPDATE_SECRET:-example-update-secret}
      FILE_CONTAINER_PATH: /softwares
      IMAGE_CONTAINER_PATH: /images
+      WOODPECKER_URL: ${WOODPECKER_URL:-}
+      WOODPECKER_API_TOKEN: ${WOODPECKER_API_TOKEN:-}
+      WOODPECKER_REPO_OWNER: ${WOODPECKER_REPO_OWNER:-}
    depends_on:
      mysql:
        condition: service_healthy
@@ -29,6 +29,12 @@ Rails.application.config.to_prepare do
    # c.ci_extension_public_key_url = "https://ci.example.org/api/signature/public-key"
    # c.ci_update_server = nil # nil: the request base_url

+    # Woodpecker CI management — repo sync, secret provisioning, pipeline control.
+    # All three must be set for the management features to activate.
+    # c.woodpecker_url        = ENV["WOODPECKER_URL"]        # e.g. "https://ci.example.org"
+    # c.woodpecker_api_token  = ENV["WOODPECKER_API_TOKEN"]  # Woodpecker PAT with admin access
+    # c.woodpecker_repo_owner = ENV["WOODPECKER_REPO_OWNER"] # forge org/user (e.g. "games")
+
    # Size cap in bytes for /build/upload (and the admin file manager, default: 500MB).
    # c.max_upload_size = 500 * 1024 * 1024

@@ -1,8 +1,15 @@
+# Az engine ActiveJob-ra épülő jobot szállít (PipelineSyncJob), ezért a
+# framework betöltése a mi dolgunk: a host application.rb-je nem feltétlenül
+# require-öli az active_job/railtie-t, és eager loadnál (production) a
+# WarpEngine::ApplicationJob különben uninitialized constant-tal elszáll.
+require "active_job/railtie"
+
 require "blueprinter"
 require "apipie-rails"

 require "warp_engine/version"
 require "warp_engine/configuration"
+require "warp_engine/storage"

 module WarpEngine
  # A tábláink prefix nélküliek (softwares, releases, ...) — az isolate_namespace
@@ -19,6 +26,22 @@ module WarpEngine
  def self.configure
    yield(config)
  end
+
+  def self.woodpecker_configured?
+    config.woodpecker_url.present? && config.woodpecker_api_token.present?
+  end
+
+  # A host innen tudja, hogy a publikálás ActiveSupport::Notifications-t szór
+  # ("warp_engine.publish"), és nem kell modell-callbackre kapaszkodnia.
+  # Régebbi engine-verziókon a metódus nem létezik, ezért a hívó oldalon
+  # respond_to?-val kérdezendő.
+  def self.instruments_publish?
+    true
+  end
+
+  def self.storage
+    Storage.adapter
+  end
 end

 require "warp_engine/engine"
@@ -9,6 +9,12 @@ module WarpEngine
    #   :database — only WarpEngine::ApplicationToken is accepted, the shared secret is not
    # application_token_owner_class: class name of the mandatory token owner
    # (e.g. "AdminUser"); nil makes :database mode reject every request.
+    # storage_adapter: where build artifacts are served from.
+    #   :local (default) — the local filesystem under file_container_path,
+    #                      byte for byte the previous behaviour;
+    #   any object       — must answer file?/directory?/locate, see
+    #                      WarpEngine::Storage. Serving only: uploads and
+    #                      archive extraction still write to the local disk.
    # max_upload_size: file size cap in bytes for /build/upload (and the admin file manager).
    # enforce_software_ownership: when true, a DB token may only upload/publish
    # its own owner's softwares (unrestricted tokens are exempt).
@@ -20,6 +26,9 @@ module WarpEngine
    #   PEM, or a URL to fetch it from (e.g. https://ci.../api/signature/public-key).
    #   With neither set, POST /build/config rejects every request.
    # ci_update_server: server URL written into the upload/publish steps; nil → the request's base_url.
+    # woodpecker_url / woodpecker_api_token / woodpecker_repo_owner:
+    #   Woodpecker CI management (repo sync, secret provisioning, pipeline control).
+    #   All nil → the management features are inactive.
    attr_accessor :file_container_path,
                  :image_container_path,
                  :update_secret,
@@ -31,7 +40,11 @@ module WarpEngine
                  :ci_extension_public_key,
                  :ci_extension_public_key_url,
                  :ci_update_server,
-                  :image_owners
+                  :woodpecker_url,
+                  :woodpecker_api_token,
+                  :woodpecker_repo_owner,
+                  :image_owners,
+                  :storage_adapter

    def initialize
      @file_container_path           = ENV.fetch("FILE_CONTAINER_PATH", "/softwares")
@@ -45,7 +58,11 @@ module WarpEngine
      @ci_extension_public_key       = nil
      @ci_extension_public_key_url   = nil
      @ci_update_server              = nil
+      @woodpecker_url                = ENV["WOODPECKER_URL"]
+      @woodpecker_api_token          = ENV["WOODPECKER_API_TOKEN"]
+      @woodpecker_repo_owner         = ENV["WOODPECKER_REPO_OWNER"]
      @image_owners                  = []
+      @storage_adapter               = :local
    end
  end
 end
@@ -0,0 +1,92 @@
+module WarpEngine
+  # Where the artifacts physically live.
+  #
+  # Until now every path in the engine was a local filesystem path. This module
+  # is the seam a host needs to serve builds from somewhere else (an object
+  # store behind a CDN, for example) without patching the engine.
+  #
+  # The default adapter is :local and behaves exactly as before - same paths,
+  # same traversal protection, same File.file? checks.
+  #
+  # A custom adapter is any object answering to this contract:
+  #
+  #   file?(relative_path)       -> true/false
+  #   directory?(relative_path)  -> true/false
+  #   locate(relative_path, filename: nil, expires_in: nil) -> Location
+  #
+  # It is set on the configuration:
+  #
+  #   c.storage_adapter = MyObjectStore.new   # or :local (default)
+  #
+  # NOTE: ingestion (build/upload, archive extraction, the admin file manager)
+  # still writes to the local filesystem. A remote adapter therefore needs its
+  # own upload path today; the serving side is what this seam covers.
+  module Storage
+    Location = Struct.new(:kind, :path, :url, keyword_init: true) do
+      def file? = kind == :file
+      def redirect? = kind == :redirect
+
+      def self.file(path) = new(kind: :file, path: path)
+      def self.redirect(url) = new(kind: :redirect, url: url)
+    end
+
+    # The local filesystem, rooted at config.file_container_path.
+    class LocalAdapter
+      def base_path
+        Pathname.new(WarpEngine.config.file_container_path)
+      end
+
+      def absolute_path(relative_path)
+        base_path.join(relative_path.to_s)
+      end
+
+      def file?(relative_path)
+        path = absolute_path(relative_path)
+        File.file?(path) && inside_base?(path)
+      end
+
+      def directory?(relative_path)
+        path = absolute_path(relative_path)
+        File.directory?(path) && inside_base?(path)
+      end
+
+      # expires_in is part of the contract for signing adapters; the local
+      # filesystem has nothing to sign, so it is ignored here.
+      def locate(relative_path, filename: nil, expires_in: nil)
+        Location.file(absolute_path(relative_path).to_s)
+      end
+
+      private
+
+      # Path traversal guard: the resolved path must stay under the container.
+      def inside_base?(path)
+        root = base_path.realpath.to_s
+        Pathname.new(path).realpath.to_s.start_with?(root)
+      rescue Errno::ENOENT
+        false
+      end
+    end
+
+    class << self
+      def adapter
+        configured = WarpEngine.config.storage_adapter
+
+        case configured
+        when nil, :local, "local" then local_adapter
+        else configured
+        end
+      end
+
+      def local? = adapter.is_a?(LocalAdapter)
+
+      def local_adapter
+        @local_adapter ||= LocalAdapter.new
+      end
+
+      # Tests and hosts that swap the configuration at runtime.
+      def reset!
+        @local_adapter = nil
+      end
+    end
+  end
+end
@@ -1,3 +1,3 @@
 module WarpEngine
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
+ActiveRecord::Schema[8.1].define(version: 2026_08_06_000002) do
  create_table "application_tokens", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", precision: 3
    t.datetime "deleted_at", precision: 3
@@ -64,6 +64,24 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
    t.index ["deleted_at"], name: "idx_images_deleted_at"
  end

+  create_table "pipelines", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.boolean "active", default: true, null: false
+    t.datetime "created_at", precision: 3
+    t.datetime "deleted_at", precision: 3
+    t.datetime "last_pipeline_at", precision: 3
+    t.string "last_pipeline_status", limit: 32
+    t.string "platform", limit: 32, null: false
+    t.string "repo_name", limit: 128, null: false
+    t.string "repo_owner", limit: 128, null: false
+    t.bigint "software_id", unsigned: true
+    t.datetime "updated_at", precision: 3
+    t.bigint "woodpecker_repo_id", null: false, unsigned: true
+    t.index ["deleted_at"], name: "idx_pipelines_deleted"
+    t.index ["repo_owner", "repo_name"], name: "idx_pipelines_owner_name", unique: true
+    t.index ["software_id"], name: "idx_pipelines_software"
+    t.index ["woodpecker_repo_id"], name: "idx_pipelines_wp_id", unique: true
+  end
+
  create_table "platform_links", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", precision: 3
    t.datetime "deleted_at", precision: 3
@@ -139,6 +157,7 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do

  add_foreign_key "downloads", "releases", name: "fk_downloads_release", on_delete: :nullify
  add_foreign_key "external_links", "softwares", name: "fk_softwares_external_links", on_delete: :cascade
+  add_foreign_key "pipelines", "softwares", name: "fk_pipelines_software", on_delete: :nullify
  add_foreign_key "release_assets", "releases", name: "fk_releases_release_assets", on_delete: :cascade
  add_foreign_key "releases", "softwares", name: "fk_softwares_releases", on_delete: :cascade
  add_foreign_key "software_images", "images"
@@ -0,0 +1,17 @@
+FactoryBot.define do
+  factory :pipeline, class: "WarpEngine::Pipeline" do
+    sequence(:woodpecker_repo_id) { |n| n }
+    repo_owner { "testorg" }
+    sequence(:repo_name) { |n| "game-#{n}" }
+    platform { "tic80" }
+    active { true }
+
+    trait :with_software do
+      association :software
+    end
+
+    trait :inactive do
+      active { false }
+    end
+  end
+end
@@ -0,0 +1,59 @@
+require "rails_helper"
+require "tmpdir"
+
+RSpec.describe WarpEngine::Storage do
+  let(:tmpdir) { Dir.mktmpdir }
+
+  before do
+    allow(WarpEngine.config).to receive(:file_container_path).and_return(tmpdir)
+    WarpEngine::Storage.reset!
+  end
+
+  after { FileUtils.rm_rf(tmpdir) }
+
+  describe ".adapter" do
+    it "defaults to the local filesystem" do
+      allow(WarpEngine.config).to receive(:storage_adapter).and_return(:local)
+
+      expect(described_class.adapter).to be_a(described_class::LocalAdapter)
+      expect(described_class).to be_local
+    end
+
+    it "returns whatever object the host configured" do
+      custom = Object.new
+      allow(WarpEngine.config).to receive(:storage_adapter).and_return(custom)
+
+      expect(described_class.adapter).to eq(custom)
+      expect(described_class).not_to be_local
+    end
+  end
+
+  describe described_class::LocalAdapter do
+    subject(:adapter) { described_class.new }
+
+    before { File.write(File.join(tmpdir, "game-1.0.zip"), "zip") }
+
+    it "sees files and directories under the container" do
+      FileUtils.mkdir_p(File.join(tmpdir, "game-1.0"))
+
+      expect(adapter.file?("game-1.0.zip")).to be(true)
+      expect(adapter.directory?("game-1.0")).to be(true)
+      expect(adapter.file?("missing.zip")).to be(false)
+    end
+
+    # The path traversal guard has to survive the move behind the adapter.
+    it "refuses paths escaping the container" do
+      outside = File.join(Dir.mktmpdir, "secret.txt")
+      File.write(outside, "nope")
+
+      expect(adapter.file?("../#{File.basename(File.dirname(outside))}/secret.txt")).to be(false)
+    end
+
+    it "locates a file as an absolute path" do
+      location = adapter.locate("game-1.0.zip")
+
+      expect(location).to be_file
+      expect(location.path).to eq(File.join(tmpdir, "game-1.0.zip"))
+    end
+  end
+end
@@ -0,0 +1,62 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::Pipeline do
+  describe "validations" do
+    subject { build(:pipeline) }
+
+    it { is_expected.to validate_presence_of(:woodpecker_repo_id) }
+    it { is_expected.to validate_uniqueness_of(:woodpecker_repo_id) }
+    it { is_expected.to validate_presence_of(:repo_owner) }
+    it { is_expected.to validate_presence_of(:repo_name) }
+    it { is_expected.to validate_presence_of(:platform) }
+
+    it "rejects unsupported platforms" do
+      repo = build(:pipeline, platform: "amiga")
+      expect(repo).not_to be_valid
+      expect(repo.errors[:platform]).to be_present
+    end
+
+    WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each do |p|
+      it "accepts #{p}" do
+        repo = build(:pipeline, platform: p)
+        expect(repo).to be_valid
+      end
+    end
+
+    it "accepts the unknown placeholder platform" do
+      repo = build(:pipeline, platform: WarpEngine::Pipeline::UNKNOWN_PLATFORM)
+      expect(repo).to be_valid
+    end
+  end
+
+  describe "#full_name" do
+    it "returns owner/name" do
+      repo = build(:pipeline, repo_owner: "games", repo_name: "mygame")
+      expect(repo.full_name).to eq("games/mygame")
+    end
+  end
+
+  describe "default_scope" do
+    it "excludes soft-deleted records" do
+      repo = create(:pipeline)
+      repo.update_column(:deleted_at, Time.current)
+
+      expect(described_class.all).not_to include(repo)
+      expect(described_class.unscoped).to include(repo)
+    end
+  end
+
+  describe ".active" do
+    it "returns only active repos" do
+      active = create(:pipeline, active: true)
+      inactive = create(:pipeline, active: false)
+
+      expect(described_class.active).to include(active)
+      expect(described_class.active).not_to include(inactive)
+    end
+  end
+
+  describe "associations" do
+    it { is_expected.to belong_to(:software).optional }
+  end
+end
@@ -15,7 +15,26 @@ RSpec.describe "Build configs endpoint", type: :request do
    allow(WarpEngine.config).to receive(:ci_extension_public_key).and_return(signing_key.public_to_pem)
  end

-  def signed_headers(method: "post", path: "/build/config")
+  # Woodpecker 3.x-style RFC 9421 signature over @request-target + content-digest.
+  def signed_headers(body, path: "/build/config", digest_body: nil)
+    digest = "sha-256=:#{Digest::SHA256.base64digest(digest_body || body)}:"
+    inner = %{("@request-target" "content-digest");created=#{Time.now.to_i};alg="ed25519"}
+    base = [
+      %("@request-target": #{path}),
+      %("content-digest": #{digest}),
+      %("@signature-params": #{inner})
+    ].join("\n")
+    signature = Base64.strict_encode64(signing_key.sign(nil, base))
+    {
+      "Content-Digest" => digest,
+      "Signature-Input" => "woodpecker-ci-extensions=#{inner}",
+      "Signature" => "woodpecker-ci-extensions=:#{signature}:",
+      "Content-Type" => "application/json"
+    }
+  end
+
+  # Legacy draft-cavage signature (single Signature header).
+  def cavage_signed_headers(method: "post", path: "/build/config")
    date = Time.now.httpdate
    signing_string = "(request-target): #{method} #{path}\ndate: #{date}"
    signature = Base64.strict_encode64(signing_key.sign(nil, signing_string))
@@ -68,8 +87,8 @@ RSpec.describe "Build configs endpoint", type: :request do

  describe "POST /build/config" do
    it "returns the rendered pipeline for a marker config" do
-      post "/build/config", params: extension_payload("platform: godot\n"),
-                            headers: signed_headers
+      payload = extension_payload("platform: godot\n")
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response).to have_http_status(:ok)
      configs = response.parsed_body["configs"]
@@ -81,8 +100,8 @@ RSpec.describe "Build configs endpoint", type: :request do
    end

    it "uses the marker's name override instead of the repo name" do
-      post "/build/config", params: extension_payload("platform: godot\nname: othername\n"),
-                            headers: signed_headers
+      payload = extension_payload("platform: godot\nname: othername\n")
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response.parsed_body["configs"].first["data"]).to include("othername")
      expect(response.parsed_body["configs"].first["data"]).not_to include("mygame")
@@ -92,40 +111,55 @@ RSpec.describe "Build configs endpoint", type: :request do
      payload = { repo: { name: "mygame" },
                  configs: [ { name: ".woodpecker.yaml", data: "platform: godot\n" } ] }.to_json

-      post "/build/config", params: payload, headers: signed_headers
+      post "/build/config", params: payload, headers: signed_headers(payload)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it "accepts a legacy draft-cavage signed request" do
+      payload = extension_payload("platform: godot\n")
+      post "/build/config", params: payload, headers: cavage_signed_headers

      expect(response).to have_http_status(:ok)
    end

    it "returns 204 for a non-marker config" do
-      full_pipeline = "steps:\n  - name: build\n    image: alpine\n"
-
-      post "/build/config", params: extension_payload(full_pipeline),
-                            headers: signed_headers
+      payload = extension_payload("steps:\n  - name: build\n    image: alpine\n")
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response).to have_http_status(:no_content)
    end

    it "returns 204 when no configuration is sent" do
-      post "/build/config", params: { repo: { name: "mygame" } }.to_json,
-                            headers: signed_headers
+      payload = { repo: { name: "mygame" } }.to_json
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response).to have_http_status(:no_content)
    end

    it "returns 422 for a marker with an unknown platform" do
-      post "/build/config", params: extension_payload("platform: amiga\n"),
-                            headers: signed_headers
+      payload = extension_payload("platform: amiga\n")
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response).to have_http_status(:unprocessable_entity)
    end

    it "rejects a request with an invalid signature" do
-      headers = signed_headers
+      payload = extension_payload("platform: godot\n")
+      headers = signed_headers(payload)
      other_key = OpenSSL::PKey.generate_key("ed25519")
      allow(WarpEngine.config).to receive(:ci_extension_public_key).and_return(other_key.public_to_pem)

-      post "/build/config", params: extension_payload("platform: godot\n"), headers: headers
+      post "/build/config", params: payload, headers: headers
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it "rejects a request whose body does not match the signed content-digest" do
+      payload = extension_payload("platform: godot\n")
+      tampered = signed_headers(payload, digest_body: "something else")
+
+      post "/build/config", params: payload, headers: tampered

      expect(response).to have_http_status(:forbidden)
    end
@@ -141,8 +175,8 @@ RSpec.describe "Build configs endpoint", type: :request do
      allow(WarpEngine.config).to receive(:ci_extension_public_key).and_return(nil)
      allow(WarpEngine.config).to receive(:ci_extension_public_key_url).and_return(nil)

-      post "/build/config", params: extension_payload("platform: godot\n"),
-                            headers: signed_headers
+      payload = extension_payload("platform: godot\n")
+      post "/build/config", params: payload, headers: signed_headers(payload)

      expect(response).to have_http_status(:forbidden)
    end
@@ -150,11 +184,11 @@ RSpec.describe "Build configs endpoint", type: :request do

  describe "shipped templates" do
    it "renders every template to valid YAML with non-empty steps" do
-      templates = Dir[WarpEngine::Engine.root.join("lib/warp_engine/ci_templates/*.yaml.erb")]
+      templates = Dir[WarpEngine::Engine.root.join("app/services/warp_engine/platforms/*/pipeline.yaml.erb")]
      expect(templates).not_to be_empty

      templates.each do |path|
-        platform = File.basename(path, ".yaml.erb")
+        platform = File.basename(File.dirname(path))
        allow(WarpEngine.config).to receive(:ci_platforms).and_return(
          platform => { builder: "registry.example/builder:1", exporter: "registry.example/exporter:1" }
        )
@@ -6,8 +6,8 @@ RSpec.describe "POST /build/publish", type: :request do
  end

  def stub_updater
-    updater = instance_double(WarpEngine::SoftwareUpdater::Tic80Service)
-    allow(WarpEngine::SoftwareUpdater::Tic80Service).to receive(:new).and_return(updater)
+    updater = instance_double(WarpEngine::Platforms::Tic80::Service)
+    allow(WarpEngine::Platforms::Tic80::Service).to receive(:new).and_return(updater)
    allow(updater).to receive(:update)
    updater
  end
@@ -0,0 +1,71 @@
+require "rails_helper"
+
+RSpec.describe "CI API", type: :request do
+  before do
+    allow(WarpEngine.config).to receive(:woodpecker_url).and_return("https://ci.test")
+    allow(WarpEngine.config).to receive(:woodpecker_api_token).and_return("wp-token")
+    allow(WarpEngine.config).to receive(:update_secret).and_return("s3cret")
+  end
+
+  describe "GET /api/ci/pipelines" do
+    it "returns active repos" do
+      repo = create(:pipeline, repo_name: "mygame", platform: "tic80")
+
+      get "/api/ci/pipelines"
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json.size).to eq(1)
+      expect(json.first["repo_name"]).to eq("mygame")
+    end
+
+    it "returns 503 when woodpecker not configured" do
+      allow(WarpEngine.config).to receive(:woodpecker_url).and_return(nil)
+
+      get "/api/ci/pipelines"
+
+      expect(response).to have_http_status(:service_unavailable)
+    end
+  end
+
+  describe "GET /api/ci/pipelines/:id/status" do
+    it "returns repo with pipeline status" do
+      repo = create(:pipeline, repo_owner: "org", repo_name: "game")
+      client = instance_double(WarpEngine::WoodpeckerClient)
+      allow(WarpEngine::WoodpeckerClient).to receive(:new).and_return(client)
+      allow(client).to receive(:get_pipeline)
+        .and_return({ "number" => 1, "status" => "success" })
+
+      get "/api/ci/pipelines/#{repo.id}/status"
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json["pipeline"]["repo_name"]).to eq("game")
+    end
+  end
+
+  describe "POST /api/ci/pipelines/:id/trigger" do
+    it "requires authentication" do
+      repo = create(:pipeline)
+
+      post "/api/ci/pipelines/#{repo.id}/trigger"
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it "triggers a pipeline with valid secret" do
+      repo = create(:pipeline, repo_owner: "org", repo_name: "game")
+      client = instance_double(WarpEngine::WoodpeckerClient)
+      allow(WarpEngine::WoodpeckerClient).to receive(:new).and_return(client)
+      allow(client).to receive(:trigger_pipeline)
+        .and_return({ "number" => 7, "status" => "pending" })
+
+      post "/api/ci/pipelines/#{repo.id}/trigger",
+           headers: { "X-Update-Secret" => "s3cret" }
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json["triggered"]).to be true
+    end
+  end
+end
@@ -0,0 +1,55 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::PipelineService do
+  let(:client) { instance_double(WarpEngine::WoodpeckerClient) }
+  let(:service) { described_class.new(client: client) }
+
+  describe "#trigger" do
+    it "delegates to client" do
+      repo = build(:pipeline, repo_owner: "org", repo_name: "game")
+      allow(client).to receive(:trigger_pipeline).and_return({ "number" => 6 })
+
+      result = service.trigger(repo, branch: "main")
+
+      expect(result["number"]).to eq(6)
+      expect(client).to have_received(:trigger_pipeline).with(repo.woodpecker_repo_id, branch: "main")
+    end
+  end
+
+  describe "#list_pipelines" do
+    it "returns paginated pipelines and refreshes the repo's cached last pipeline" do
+      repo = create(:pipeline, repo_owner: "org", repo_name: "game")
+      pipelines = [
+        { "number" => 2, "status" => "failure", "created" => 1_754_500_000 },
+        { "number" => 1, "status" => "success", "created" => 1_754_400_000 }
+      ]
+      allow(client).to receive(:list_pipelines).with(repo.woodpecker_repo_id, page: 1).and_return(pipelines)
+
+      expect(service.list_pipelines(repo)).to eq(pipelines)
+
+      repo.reload
+      expect(repo.last_pipeline_status).to eq("failure")
+      expect(repo.last_pipeline_at).to eq(Time.zone.at(1_754_500_000))
+    end
+
+    it "does not touch the cache on later pages" do
+      repo = create(:pipeline, repo_owner: "org", repo_name: "game",
+                    last_pipeline_status: "success")
+      allow(client).to receive(:list_pipelines).with(repo.woodpecker_repo_id, page: 2)
+        .and_return([{ "number" => 1, "status" => "failure", "created" => 1_754_400_000 }])
+
+      service.list_pipelines(repo, page: 2)
+
+      expect(repo.reload.last_pipeline_status).to eq("success")
+    end
+
+    it "leaves the cache alone when the repo has no pipelines" do
+      repo = create(:pipeline, repo_owner: "org", repo_name: "game",
+                    last_pipeline_status: "success")
+      allow(client).to receive(:list_pipelines).and_return([])
+
+      expect(service.list_pipelines(repo)).to eq([])
+      expect(repo.reload.last_pipeline_status).to eq("success")
+    end
+  end
+end
@@ -0,0 +1,81 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::PipelineSyncService do
+  let(:client) { instance_double(WarpEngine::WoodpeckerClient) }
+  let(:service) { described_class.new(client: client) }
+
+  describe "#sync_all" do
+    it "creates new Pipeline records from Woodpecker" do
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "mygame", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:created].size).to eq(1)
+      repo = result[:created].first
+      expect(repo.repo_name).to eq("mygame")
+      expect(repo.repo_owner).to eq("org")
+      expect(repo.active).to be true
+    end
+
+    it "updates existing records" do
+      existing = create(:pipeline, woodpecker_repo_id: 1, repo_name: "old", platform: "tic80")
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "newname", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:updated].size).to eq(1)
+      expect(existing.reload.repo_name).to eq("newname")
+    end
+
+    it "deactivates repos missing from Woodpecker" do
+      orphan = create(:pipeline, woodpecker_repo_id: 99, active: true)
+      allow(client).to receive(:list_repos).and_return([])
+
+      result = service.sync_all
+
+      expect(result[:deactivated]).to include(orphan)
+      expect(orphan.reload.active).to be false
+    end
+
+    it "auto-detects platform from matching Software" do
+      create(:software, name: "mygame", platform: "godot")
+      allow(client).to receive(:list_repos).and_return([
+        { "id" => 1, "name" => "mygame", "owner" => "org", "active" => true }
+      ])
+
+      result = service.sync_all
+
+      expect(result[:created].first.platform).to eq("godot")
+      expect(result[:created].first.software).to be_present
+    end
+  end
+
+  describe "#activate" do
+    it "calls client and syncs the repo" do
+      allow(client).to receive(:activate_repo).with(42)
+      allow(client).to receive(:get_repo).with(42).and_return(
+        { "id" => 42, "name" => "game", "owner" => "org", "active" => true }
+      )
+
+      repo = service.activate(42)
+
+      expect(repo.woodpecker_repo_id).to eq(42)
+      expect(repo.active).to be true
+    end
+  end
+
+  describe "#deactivate" do
+    it "calls client and marks repo inactive" do
+      repo = create(:pipeline, woodpecker_repo_id: 42, active: true)
+      allow(client).to receive(:deactivate_repo).with(42)
+
+      service.deactivate(42)
+
+      expect(repo.reload.active).to be false
+    end
+  end
+end
@@ -1,7 +1,7 @@
 require "rails_helper"
 require "zip"

-RSpec.describe WarpEngine::SoftwareUpdater::Tic80Service do
+RSpec.describe WarpEngine::Platforms::Tic80::Service do
  let(:tmpdir) { Dir.mktmpdir }
  let(:name) { "spectic" }
  let(:version) { "9.9" }
@@ -0,0 +1,92 @@
+require "rails_helper"
+
+RSpec.describe WarpEngine::PublishService do
+  describe "#publish" do
+    it "raises ArgumentError for unsupported platform" do
+      input = WarpEngine::PublishInputDto.new(platform: "unknown", name: "game", version: "1.0")
+
+      expect { described_class.new.publish(input) }.to raise_error(ArgumentError, /Unsupported platform/)
+    end
+
+    it "routes to correct platform service" do
+      input = WarpEngine::PublishInputDto.new(platform: "tic80", name: "game", version: "1.0")
+      mock_service = instance_double(WarpEngine::Platforms::Tic80::Service)
+
+      allow(WarpEngine::Platforms::Tic80::Service).to receive(:new).and_return(mock_service)
+      allow(mock_service).to receive(:update)
+
+      described_class.new.publish(input)
+
+      expect(mock_service).to have_received(:update).with("game", "1.0")
+    end
+
+    it "routes godot platform to Godot::Service" do
+      input = WarpEngine::PublishInputDto.new(platform: "godot", name: "game", version: "1.0")
+      mock_service = instance_double(WarpEngine::Platforms::Godot::Service)
+
+      allow(WarpEngine::Platforms::Godot::Service).to receive(:new).and_return(mock_service)
+      allow(mock_service).to receive(:update)
+
+      described_class.new.publish(input)
+
+      expect(mock_service).to have_received(:update).with("game", "1.0")
+    end
+
+    it "routes bevy platform to Bevy::Service" do
+      input = WarpEngine::PublishInputDto.new(platform: "bevy", name: "game", version: "1.0")
+      mock_service = instance_double(WarpEngine::Platforms::Bevy::Service)
+
+      allow(WarpEngine::Platforms::Bevy::Service).to receive(:new).and_return(mock_service)
+      allow(mock_service).to receive(:update)
+
+      described_class.new.publish(input)
+
+      expect(mock_service).to have_received(:update).with("game", "1.0")
+    end
+
+    it "routes phaser platform to Phaser::Service" do
+      input = WarpEngine::PublishInputDto.new(platform: "phaser", name: "game", version: "1.0")
+      mock_service = instance_double(WarpEngine::Platforms::Phaser::Service)
+
+      allow(WarpEngine::Platforms::Phaser::Service).to receive(:new).and_return(mock_service)
+      allow(mock_service).to receive(:update)
+
+      described_class.new.publish(input)
+
+      expect(mock_service).to have_received(:update).with("game", "1.0")
+    end
+    describe "instrumentation" do
+      let(:input) { WarpEngine::PublishInputDto.new(platform: "tic80", name: "game", version: "1.0") }
+      let(:release) { WarpEngine::Release.new(version: "1.0") }
+
+      before do
+        mock_service = instance_double(WarpEngine::Platforms::Tic80::Service, update: release)
+        allow(WarpEngine::Platforms::Tic80::Service).to receive(:new).and_return(mock_service)
+      end
+
+      # The host reacts to a new build through this event instead of hanging a
+      # callback on the Release model.
+      it "emits warp_engine.publish with the release in the payload" do
+        payloads = []
+        ActiveSupport::Notifications.subscribe(described_class::NOTIFICATION) do |*, payload|
+          payloads << payload
+        end
+
+        described_class.new.publish(input)
+
+        expect(payloads.size).to eq(1)
+        expect(payloads.first).to include(platform: "tic80", name: "game", version: "1.0", release: release)
+      ensure
+        ActiveSupport::Notifications.unsubscribe(described_class::NOTIFICATION)
+      end
+
+      it "returns the release" do
+        expect(described_class.new.publish(input)).to eq(release)
+      end
+
+      it "advertises the feature so older hosts can feature-detect" do
+        expect(WarpEngine.instruments_publish?).to be(true)
+      end
+    end
+  end
+end
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
mr.zeroandClaude Opus 5	2b62070557	Give gem push a named credentials key ci/woodpecker/tag/woodpecker Pipeline was successful Details The push prompted for credentials and then died with "404 page not found". Both are the same fault: RubyGems normalizes the keys in ~/.gem/credentials — dots become __ and a trailing slash is appended — so a key written as the host URL can never match the --host value. Finding no key, gem push falls back to signing in against the RubyGems sign_in endpoint, which Gitea does not implement; that is the 404. A named key is stored verbatim and is matched by --key, so the lookup succeeds. Verified against Gem::ConfigFile with both formats. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 11:11:17 +02:00
mr.zeroandClaude Opus 5	d11610b6c7	Point the release pipeline at the engines org ci/woodpecker/push/woodpecker Pipeline was successful Details ci/woodpecker/tag/woodpecker Pipeline failed Details The publishing pipeline was already complete — subtree split to the mirror, gem build and push on a warp_engine-v* tag — but it had never been triggered, and after the org reorganization three of its targets were stale: the mirror push URL and the rubygems registry namespace (twice). The gemspec's allowed_push_host has to match the --host that `gem push` receives, so it now carries the full registry URL rather than the bare forge host, plus source and documentation links. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-16 10:39:40 +02:00
mr.zeroandClaude Opus 5	9cbb909f08	Point the batocera page at ttg-batocera-store The client was split into a reusable engine and a store definition, so the page is now about our store: new repo and wiki links, the CLI path the installer actually writes, and a closing section pointing at warp-engine-batocera-store for anyone who wants a store of their own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-15 21:33:27 +02:00
mr.zero	2d750a4ce7	remove matrix link from batocera page	2026-08-11 00:01:14 +02:00
mr.zero	0a7e2d14e2	batocera store	2026-08-10 23:58:27 +02:00
mr.zero	763a092640	warp_engine: load ActiveJob itself so production eager load works ci/woodpecker/push/woodpecker Pipeline was successful Details The engine ships an ActiveJob based job (PipelineSyncJob), but a host's application.rb does not necessarily require active_job/railtie - apps/api does not. With eager loading off (development, test) nothing noticed; in production WarpEngine::ApplicationJob blew up with "uninitialized constant WarpEngine::ActiveJob", which is exactly what `rails zeitwerk:check` in RAILS_ENV=production reported. An engine that ships jobs has to pull in the framework it needs, so lib/warp_engine.rb requires the railtie. Pre-existing on 0.1.0 as well; found while verifying that the 0.2.0 changes do not break the portal. All three api-test steps are green now. apps/api Gemfile.lock follows the 0.1.0 -> 0.2.0 path gem bump.	2026-08-10 11:30:06 +02:00
mr.zero	ec43d2ae46	warp_engine 0.2.0: pluggable storage adapter and publish notifications ci/woodpecker/push/woodpecker Pipeline was successful Details Two seams the hosts needed, both backward compatible. Storage: artifacts are served through WarpEngine::Storage.adapter instead of raw filesystem calls. The default :local adapter keeps the previous behaviour byte for byte, including the path traversal guard. A host can now set config.storage_adapter to any object answering file?/directory?/locate and serve builds from an object store - FileService and /api/download both honour a Location.redirect, so a signing adapter turns them into redirects. DownloadService#create still returns an absolute path (nil when missing) for existing callers; #locate is the new entry point that can also return a redirect. Ingestion (upload, extraction, file manager) stays local for now. Publish: PublishService emits ActiveSupport::Notifications ("warp_engine.publish") with platform/name/version/software/release, so hosts can react to a new build without hanging callbacks on the models. WarpEngine.instruments_publish? lets a host feature-detect and keep its fallback for older engine versions.	2026-08-10 11:16:17 +02:00
mr.zero	afd1fe50c4	package upgrades	2026-08-09 17:57:08 +02:00
mr.zero	254d339656	warp_engine: CiRepository -> Pipeline rename everywhere, ci_ service prefixes dropped, unknown platform allowed ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 19:46:06 +02:00
mr.zero	9b89550766	warp_engine admin: CI Dashboard removed, Pipelines page with details sidebar, badge and Created fixes ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 19:32:50 +02:00
mr.zero	712fdbc97b	fixes ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 19:23:04 +02:00
mr.zero	23bbccd2b1	engines digest: require What You Get as first heading	2026-08-06 19:03:16 +02:00
mr.zero	d82bb6f468	EnginesIndexPage digests	2026-08-06 18:19:40 +02:00
mr.zero	a0ced02345	readme: woodpecker ci management ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 16:31:28 +02:00
mr.zero	546201c886	WarpEngine dropdown emoji ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 16:23:52 +02:00
mr.zero	c853cfadbc	WarpEngine dropdown	2026-08-06 16:22:17 +02:00
Zsolt Tasnadi	b1139a43bc	wp admin to compose	2026-08-06 16:05:07 +02:00
mr.zero	bae6fc06a6	pipeline fix	2026-08-06 16:04:50 +02:00
mr.zero	731b267aa1	wp config fix 2	2026-08-06 15:05:55 +02:00
mr.zero	508e869080	wp config fix	2026-08-06 14:08:18 +02:00
mr.zero	435d22b71d	wp config	2026-08-06 14:04:42 +02:00
Zsolt Tasnadi	f499b7f2af	schema update	2026-08-06 14:00:13 +02:00
mr.zero	267a13b600	woodpecker integration	2026-08-06 13:58:58 +02:00
mr.zeroandClaude Opus 4.6	b530dcd50d	Update README template path to match platform directory structure ci/woodpecker/push/woodpecker Pipeline was successful Details Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-08-06 10:34:06 +02:00
mr.zero	068c4db3f8	platform files refact ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 10:00:34 +02:00
mr.zero	565c086a0d	Pin the pipeline update server URL: base_url is http behind the host nginx	2026-08-06 08:58:18 +02:00
mr.zero	dd69dd79ab	Register the config extension endpoint globally on the Woodpecker server	2026-08-06 08:26:10 +02:00
mr.zero	fd0b64850f	Serve the tic80 pipeline on the existing tic80pro image ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 08:16:47 +02:00
mr.zero	61ad1a87f2	godot builder image version update	2026-08-06 07:59:07 +02:00
mr.zero	7c9c8ff510	Verify RFC 9421 signatures on the Woodpecker config endpoint ci/woodpecker/push/woodpecker Pipeline was successful Details	2026-08-06 07:24:47 +02:00