PolyhydraGames.Streaming.Interfaces 4.0.0.9

Api.Streaming

Streaming contracts, Postgres runtime wiring, SQL migration/reference code, and test harnesses for Polyhydra Games.

Tags

• api
• api-streaming
• dotnet
• streaming
• docs
• database

Related Repos

• Api.CDN
• Api.GameServerInterop
• Api.VideoGames
• Api.RetroAchievements

Repo Shape

• Interfaces/ contract project
• SQL/ migration/reference SQL Server implementation and scripts
• Postgres/ active PostgreSQL implementation
• Migration/ database migration tooling
• Test/ unit tests and integration harness

Current Focus

• keep the active runtime on Postgres
• preserve contract names for downstream consumers
• keep the migration and rebuild docs current

Useful Commands

dotnet test StreamingAPI.sln
dotnet test Test/Integration/PolyhydraGames.Streaming.IntegrationTests.csproj

The default test path is portable to an Api.Streaming checkout and retains the portable repository-owned Migration, SQL contract, and Postgres resolver/factory tests. Live inventory verification and the specific legacy SQL/Postgres tests that directly import Channel Cheevos types are deliberately opt-in and require the parity environment:

dotnet test StreamingAPI.sln -p:EnableChannelCheevosParity=true

Configuration and secret handling

Tracked configuration is intentionally non-secret. Copy the variable names from .env.example into protected deployment or local environment configuration; nested ASP.NET configuration keys use double underscores, for example ConnectionStrings__PostgresDev. The Test/appsettings.json values are deterministic local-only fixture values and must not be promoted to a deployed environment.

Data-protection keys and test-result output are generated runtime artifacts and are ignored by Git. Run scripts/scan-secrets.sh before publishing changes; the same Gitleaks check runs on pull requests and pushes to main.

Pull-request validation uses only GitHub-hosted runners, read-only repository access, and public NuGet restore. Before checkout, it installs the parser from an ephemeral, exact version-and-hash-pinned requirement; it then checks out the immutable pull-request head SHA and runs the verifier and its tests in Python isolated mode so checkout-local modules cannot shadow the trusted parser. Private runners and package credentials are limited to the trusted main container workflow; scripts/verify-ci-trust-policy.py structurally parses both workflows and enforces exact event, permission, action, checkout, runner, credential, and artifact-ingress boundaries.

ci.yml's own "Verify CI trust policy" step runs from the pull request's own checkout, so a PR could in principle edit the verifier (or the workflow files it reads) alongside itself and make that check pass trivially -- it is fast local feedback, not the authoritative enforcement. .github/workflows/trust-policy-gate.yml is that enforcement: triggered on pull_request_target, it checks out the verifier from the trusted main branch (never the PR head), fetches the PR's workflow files read-only through the GitHub API via CI_WORKFLOW_PATH/CONTAINER_WORKFLOW_PATH, and validates that text without ever executing anything from the PR.

Publishing

interfaces-publish.yml runs on pushes to main and manual dispatches. Its package job checks out the source, restores, builds, tests, and packs exactly one PolyhydraGames.Streaming.Interfaces package. It sets the version to <VersionPrefix>.<github.run_number> and checks that this version is newer than the latest version listed by nuget.org. The package crosses to publish-nuget-org through the run-scoped Actions cache. Only publish-nuget-org receives id-token: write; that job has no checkout and uses NuGet Trusted Publishing with GitHub OIDC to push the exact package file. The workflow uses two separate self-hosted runner roles: package uses nuget-api-streaming, while publish-nuget-org and publish-mirrors use nuget-api-streaming-publish. The publish-only runner is provisioned by lancer1977/homelab-gitops#1028 and #1029. This keeps the host receiving the OIDC token away from build and test code, so compromised build code cannot persist on or reach the token-bearing host. All three publishing jobs install .NET 10.0.x in-job using pinned actions. package and publish-mirrors use ${{ runner.tool_cache }}/dotnet; the OIDC-enabled publish-nuget-org uses the fresh per-job ${{ runner.temp }}/dotnet location. Both publish jobs first clear the retained self-hosted workspace and then restore only the run-scoped package cache. The NuGet version guard uses isolated Python (python3 -I) before OIDC login. The optional GitHub Packages mirror push runs after nuget.org publishing in a non-OIDC job from the same cache. Its result does not affect the primary nuget.org publication. Pull requests never publish. If several green default-branch runs queue in a burst, GitHub may coalesce pending runs; the newest green commit of a burst is published.

Configure a nuget.org Trusted Publishing policy with owner lancer1977, repository lancer1977/Api.Streaming, and workflow file interfaces-publish.yml.

Documentation

• Docs index
• Migration runbook
• Docs Index
• Feature Index
• Roadmap Index