The upload/download-artifact steps added in the previous commit were pinned
to @v4, which declares `runs.using: node20` and would emit the same Node 20
deprecation warning this repo is trying to clear.
Verified against upstream action.yml rather than release notes, which are
misleading here: download-artifact v5 and v6 are still node20 despite v6
being labeled a breaking "supports Node v24" release. node24 begins at
download-artifact v7 and upload-artifact v6.
upload@v4 -> v7, download@v4 -> v8 (current majors, both node24). Checked
that every input we pass still exists, and that the intervening breaking
changes do not apply: v5's path change affects downloads by artifact-id
(we download by name), v7 upload's `archive` defaults to true (we upload a
directory), and v8 download's `digest-mismatch: error` default is desirable.
PRs from forks receive a read-only GITHUB_TOKEN for pull_request events
regardless of the workflow's `permissions:` block, so the comment step in
test.yml failed with 403 "Resource not accessible by integration" and took
the whole job down with it. Every fork PR was red despite the test run
itself succeeding.
Split the reporting: test.yml now renders the comment body and uploads it
as an artifact, and a new pr-comment.yml posts it via workflow_run, which
runs in the base repo context with a writable token.
The render step interpolates tool output from env vars in the shell rather
than through Actions expression substitution, so tool output can no longer
inject workflow syntax. pr-comment.yml never checks out or executes PR code,
re-validates the PR number as numeric, and passes the body via body-path.
Also mirrors the report to $GITHUB_STEP_SUMMARY so it stays visible if the
follow-up workflow does not run, and fixes the empty "Updated:" timestamp
(github.event.head_commit.timestamp is unset on pull_request events).
LiveView event handlers were trusting client-supplied record IDs without
verifying they belong to the user's current map/user scope. A logged-in
user could push another map's record UUID over the LV socket and act on
it. Affected handlers:
- cancel-subscription / edit-subscription / update_subscription
(cancel or upgrade any map's paid subscription by ID)
- characters_live.ex "delete"
(soft-delete any user's character and null their user_id)
- cancel_ping
(cross-map rally-ping cancellation broadcast)
- deleteSystemComment
(cross-map comment deletion)
- update_passage_mass
(cross-map wormhole passage mass corruption)
- updateCharacterTracking
(untrack another user's character on a shared map)
Also fixes a related numeric-trust bug in subscribe/update_subscription
where `period`, `characters_limit`, and `hubs_limit` were parsed without
bounds, allowing `period: "-1"` to produce a back-dated subscription
with a negative price.
Adds WandererAppWeb.HandlerAuth with focused helpers each handler now
routes through, plus 26 regression tests covering both the IDOR auth
checks and the bounded-int parsers.
- fix(config): Set default database hostname to `localhost` in `dev.exs` and `test.exs`
- fix(config): Add `DB_HOST` environment variable override for dev and test environments to `runtime.exs`
Dmitry Popov