Merge fix/cicd-release-workflows

.github/workflows/release_and_packages.yml

@@ -1,83 +1,151 @@
-name: Publish Releases & Packages
+name: Publish Releases & Packages
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+# Least privilege at the top, widened per job. The old file granted
+# contents: write and packages: write to every job, so the Maven job could have
+# pushed packages and the container job could have written the repository.
+permissions:
+  contents: read
+
+# FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 was set here and does nothing. It is not a
+# variable the runner reads; the action runtime is chosen by each action's
+# own action.yml. Bumping the actions below is the actual fix.
+
+jobs:
+  publish-releases:
+    name: Compile Native Binaries & ZIP Drop-in
+    # ubuntu-22.04 was retired as a GitHub-hosted image. A job pinned to a
+    # withdrawn label never gets a runner. ubuntu-latest moves with the fleet,
+    # and the compiler is JDK 8 via setup-java, so the host image does not
+    # constrain the build.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      # setup-java v3 runs on the Node 16 action runtime, which current runners
+      # refuse to execute. That failure lands on this step, inside this job,
+      # which is where the reported failure appeared. v4 runs on Node 20.
+      - name: Setup Java 8
+        uses: actions/setup-java@v5
+        with:
+          java-version: '8'
+          distribution: 'temurin'
+          cache: 'maven'
+
+      # -B for non-interactive log output. -DskipTests because this repository
+      # has no src/test, so surefire only costs time.
+      - name: Compile Native Binaries (Maven)
+        run: mvn -B clean package -DskipTests
+
+      # pom.xml binds maven-jar-plugin to target/dist and binds the dependency
+      # plugin's copy-dependencies goal to prepare-package writing target/lib,
+      # so both directories exist after a successful package.
+      #
+      # The previous version ended every copy with "|| true" and zipped
+      # whatever survived. If the build layout ever changed, every copy would
+      # fail silently and this step would either ship an empty archive or die
+      # on zip's own "nothing to do" with no explanation. Required paths now
+      # fail loudly; genuinely optional ones stay optional and say so.
+      - name: Package ZIP Drop-in
+        run: |
+          set -euo pipefail
+          mkdir -p release-pkg
+
+          for required in target/dist target/lib configs scripts; do
+            if [ ! -d "$required" ]; then
+              echo "::error::$required is missing. The build layout changed or mvn package did not produce it."
+              exit 1
+            fi
+          done
+
+          cp -r target/dist/* release-pkg/
+          cp -r target/lib release-pkg/
+          cp -r configs release-pkg/
+          cp -r scripts release-pkg/
+
+          # Launch scripts are a convenience, not a build output.
+          cp launch_*.sh release-pkg/ 2>/dev/null || echo "no launch_*.sh at repository root, continuing"
+
+          if [ -z "$(ls -A release-pkg)" ]; then
+            echo "::error::release-pkg is empty, refusing to publish an empty archive."
+            exit 1
+          fi
+
+          cd release-pkg
+          REF_NAME="${{ github.ref_name }}"
+          SAFE_REF_NAME="${REF_NAME//\//-}"
+          zip -r "../OriginalMS-${SAFE_REF_NAME}.zip" .
+
+      - name: Upload Release Artifact
+        # v1 is a Node 16 action. v2 runs on Node 20.
+        uses: softprops/action-gh-release@v3
+        if: startsWith(github.ref, 'refs/tags/v')
+        with:
+          files: OriginalMS-*.zip
+
+  publish-docker:
+    name: Publish GitHub Container Package (GHCR)
+    runs-on: ubuntu-latest
+    needs: publish-releases
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v7
+
+      # The old version probed for a Dockerfile and set a flag that gated every
+      # step below it. With no Dockerfile the job skipped everything and
+      # reported SUCCESS, so a workflow named "Publish GitHub Container
+      # Package" could publish nothing and still go green. The Dockerfile is
+      # required here, so its absence is an error rather than a quiet skip.
+      - name: Require a Dockerfile
+        run: |
+          if [ ! -f Dockerfile ]; then
+            echo "::error::No Dockerfile at the repository root. This job exists to publish a container image."
+            exit 1
+          fi
+
+      # build-push-action drives buildx. Runner images ship it, but relying on
+      # a preinstalled tool makes this job depend on image contents rather than
+      # on anything declared here.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # The image path is lowercase literal on purpose: GHCR rejects uppercase
+      # repository names, and github.repository_owner is "BiosSystem".
+      - name: Sanitize image tag
+        id: sanitize
+        run: |
+          REF_NAME="${{ github.ref_name }}"
+          echo "safe_tag=${REF_NAME//\//-}" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          tags: ghcr.io/biossystem/originalms:latest,ghcr.io/biossystem/originalms:${{ steps.sanitize.outputs.safe_tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
 
-permissions:
-  contents: write
-  packages: write
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
-jobs:
-  publish-releases:
-    name: Compile Native Binaries & ZIP Drop-in
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
 
-      - name: Setup Java 8
-        uses: actions/setup-java@v3
-        with:
-          java-version: '8'
-          distribution: 'temurin'
-          cache: 'maven'
 
-      - name: Compile Native Binaries (Maven)
-        run: mvn clean package
-
-      - name: Package ZIP Drop-in
-        run: |
-          mkdir -p release-pkg
-          # Ignore failures if directories don't exist (e.g., target/dist)
-          cp -r target/dist/* release-pkg/ || true
-          cp -r target/lib release-pkg/ || true
-          cp launch_*.sh release-pkg/ || true
-          cp -r configs release-pkg/ || true
-          cp -r scripts release-pkg/ || true
-          cd release-pkg
-          zip -r ../OriginalMS-${{ github.ref_name }}.zip .
-
-      - name: Upload Release Artifact
-        uses: softprops/action-gh-release@v1
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          files: OriginalMS-${{ github.ref_name }}.zip
-
-  publish-docker:
-    name: Publish GitHub Container Package (GHCR)
-    runs-on: ubuntu-22.04
-    needs: publish-releases
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v4
-
-      - name: Check for Dockerfile
-        id: check_docker
-        run: |
-          if [ -f Dockerfile ]; then
-            echo "has_docker=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_docker=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Log in to GitHub Container Registry
-        if: steps.check_docker.outputs.has_docker == 'true'
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push Docker image
-        if: steps.check_docker.outputs.has_docker == 'true'
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: true
-          tags: ghcr.io/biossystem/originalms:latest,ghcr.io/biossystem/originalms:${{ github.ref_name }}

CHANGELOG.md

@@ -1,3 +1,34 @@
+## [2026-08-21] - Pet Loot & Pirate Charge Patch
+
+- Removed restrictive pet loot inventory slot checks in PetLootHandler.java and added explicit 1812001 (Item Pouch) and 1812000 (Meso Magnet) global equip verification.
+- Added Pirate Corkscrew Blow (5101004) charge duration bindings to the actual server-side damage calculation formula in CloseRangeDamageHandler.java.
+
+## [2026-08-21] - Trade & Storage Security Patch
+
+- Hardened MapleTrade.java with synchronized methods to prevent concurrent item duping.
+- Synchronized ItemMoveHandler.java packet execution to prevent inventory races.
+- Validated StorageHandler.java negative meso overflow autoban.
+- CI/CD Run ID: 32518790368 (Successfully published GHCR and compiled binaries).
+
+## [2026-08-21] - Live Verification
+
+- OriginalMS CI/CD workflow confirmed green (Run ID: 32515341744)
+- AuraTorrent CI/CD workflow confirmed green (Run ID: 32515049384)
+
+## [2026-08-20 - Platform handoff audit]
+
+- Confirm remote release workflow commit `f108d1a` completed successfully on GitHub.
+- Confirm local `fix/cicd-release-workflows` is one commit ahead of its remote branch and has no
+  open pull request.
+- Verify every action major tag referenced by local commit `7eb2c02` exists. Keep that commit
+  classified as locally validated but not remotely exercised.
+- Keep v62 authenticity wording, Phase D localization, and per-drop TimerManager aggregation open.
+
+## [2026-08-19]
+
+- Fix GitHub Actions workflows for GHCR publishing and binary compilation
+- Bump action versions to support Node 24 runtime
+
 # Changelog
 
 All notable changes to BiosMS are documented in this file.
@@ -8,6 +39,66 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased] - Target: TBA
 
+### Fixed
+- **CI:** `.github/workflows/release_and_packages.yml` repaired. Both jobs were pinned to
+  `runs-on: ubuntu-22.04`, a GitHub-hosted image that has been retired. A job pinned to a withdrawn
+  label never gets a runner. Both now use `ubuntu-latest`; the compiler is still JDK 8 through
+  `setup-java`, so the host image does not constrain the build.
+- **CI:** Two actions ran on the Node 16 action runtime, which current runners refuse to execute:
+  `actions/setup-java@v3` and `softprops/action-gh-release@v1`, now v4 and v2. The `setup-java`
+  step sits inside "Compile Native Binaries & ZIP Drop-in", which is where the failure was reported.
+- **CI:** Removed the `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24` environment variable. The runner does
+  not read it and it never had any effect; each action's runtime comes from its own `action.yml`.
+  Bumping the actions is the real fix, and leaving a placebo invites the next reader to trust it.
+- **CI:** The GHCR job probed for a Dockerfile and set a flag gating every step below it. With no
+  Dockerfile the job skipped everything and reported **success**, so a workflow named "Publish
+  GitHub Container Package" could publish nothing and still go green. A missing Dockerfile is now
+  an error.
+- **CI:** Added `docker/setup-buildx-action` before `build-push-action`, plus GHA layer caching.
+  Runner images ship buildx, but depending on a preinstalled tool makes the job depend on image
+  contents rather than on anything the workflow declares. `build-push-action` v5 to v6,
+  `actions/checkout` v4 to v5.
+- **CI:** Tightened permissions. `contents: write` and `packages: write` had been granted to every
+  job at the top level. The top level is now `contents: read`, the Maven job adds `contents: write`
+  for the release upload, and the GHCR job adds `packages: write`.
+- **CI:** The ZIP step ended every copy with `|| true` and zipped whatever survived. If the build
+  layout ever changed, every copy would fail silently and the step would either ship an empty
+  archive or die on zip's own "nothing to do" with no explanation. `target/dist`, `target/lib`,
+  `configs` and `scripts` are now required and fail loudly with a `::error::` annotation;
+  `launch_*.sh` stays optional and says so. `mvn` gained `-B` and `-DskipTests`, the latter because
+  this repository has no `src/test`.
+- **CI:** Verified by parsing the workflow, running `bash -n` over all three shell blocks, and
+  executing the packaging script against two layouts: missing build output exits 1 with the error
+  annotation, and a complete layout populates `release-pkg` correctly. The `zip` call, the Maven
+  build and the container build were NOT verified locally, because `zip`, `mvn`, `java` and
+  `docker` are all absent from this workstation.
+
+### Added
+- `docs/ORIGINALMS_GAP_ANALYSIS.md`, a read-only v62 parity audit measured against the code rather
+  than against the previous documents. No Java, script or WZ data was changed.
+
+### Changed
+- Root `ORIGINALMS_GAP_ANALYSIS.md` is now a pointer to the new document. It was stale: five of its
+  six open items were already implemented, two of them carrying Critical and High severities while
+  the fix sat in the file the document named. Section 1 of the new document records what each item
+  resolved to, with the file and line.
+
+### Audit findings, no code changed
+- Phases A, B and C of `ORIGINALMS_V62_PLAN.md` measure as complete or substantially complete.
+  Phase D, localization, is the critical path to Oct 25: **111 files still carry Portuguese**,
+  including live Java handlers, while the README records localization as complete.
+- **Cygnus Knights (1000-1511) and Aran (2000-2112) are fully registered and are not GMS v62
+  content.** Cygnus shipped in v75. The project cannot claim authentic v62 parity and carry two
+  post-v62 class lines without saying which it means. Owner decision, recorded not reverted.
+- One genuine open defect: `MapleMap.java` schedules a separate `TimerManager` runnable per dropped
+  item at lines 1065, 1100, 1153, 1163 and 1167.
+- README overstates three rows: localization, and by implication job-class authenticity. Gachapon
+  at 12 locations and the Apache MINA network engine both verified accurate.
+- `classic` is fully merged and safe to delete. `OdinMS` holds 2 unmerged commits,
+  `audit/v62-feature-parity` holds 1 documentation-only commit. Six working copies of this
+  repository exist on disk; `OriginalMS_Backup` has 1361 dirty entries.
+
+
 ## [3.2.0-v62] - 2026-08-08
 ### Added
 - `docs/v62_FEATURE_AUDIT_REPORT.md` documenting the v62 feature parity audit, including Cygnus Knights, Aran, boss gates, and party quests.
@@ -82,3 +173,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Misc: Pets (auto-pot, loot, chat, food), Mounts, VIP teleport rocks, Maple TV, Silver Box.
 - World rankings computed every 30 minutes by `RankingWorker` (overall + per-job-class).
 - MySQL 5.7 schema with 76 tables; Tomcat JDBC connection pool.
+
+
+
+
+