Restore encryption logic and finalize secure CI/CD pipelines by ikostan · Pull Request #596 · ikostan/SkyLockAssault

ikostan · 2026-05-06T05:16:01Z

name: Default Pull Request Template
about: Suggesting changes to SkyLockAssault
title: ''
labels: ''
assignees: ''

Description

Here is the accurate summary of the Git/GitHub catastrophe that forced us to do all of this reconstruction:

The Branch Pointer Rollback (The Vanishing Act)

The reason your last two PRs suddenly disappeared is that a destructive version control operation occurred on your repository—most likely a bad merge resolution, an accidental git reset, or a force push. This operation grabbed the pointer for your main branch and forcibly dragged it backward in time to an older commit.

The Orphaned Commits

When that pointer was moved backward, the commits containing your two merged PRs (which held the initial encryption pipeline work) were completely severed from the active timeline. The code wasn't permanently deleted from GitHub's servers—as evidenced by the old GitHub Actions runs and the Git Reflog—but it became "orphaned." Because the commits were no longer part of the active branch history, the code simply vanished from your working directory.

Why We Had to Rebuild Everything Today

Because the branch was rolled back, your project was thrown into a fractured state. The active codebase reverted to a state before the encryption was fully stabilized, causing the singletons to fall out of sync. We had to do all of this painstaking work today to manually resurrect that orphaned logic, re-integrate the safe_load_config and ensure_encryption_key methods across globals.gd, settings.gd, and audio_manager.gd, and patch the CI/CD failsafes so the game could actually read its own save files again.

Related Issue

Closes #ISSUE_NUMBER (if applicable)

Changes

List key changes here (e.g., "Updated Jump.gd to use Godot 4.4's new Tween
system")
Any breaking changes? (e.g., "Deprecated old signal; migrate to new one")

Testing

Ran the game in Godot v4.5 editor—describe what you tested (e.g., "Jump
works on Win10 with 60 FPS")
Any new unit tests added? (Link to test scene if yes)
Screenshots/GIFs if UI-related: (Attach below)

Checklist

Code follows Godot style guide (e.g., snake_case for variables)
No console errors in editor/output
Ready for review!

Additional Notes

Anything else? (e.g., "Tested on Win10 64-bit; needs Linux validation")

sourcery-ai

Sorry @ikostan, your pull request is larger than the review limit of 150000 diff characters

coderabbitai · 2026-05-06T05:16:09Z

Important

Review skipped

Too many files!

This PR contains 187 files, which is 37 over the limit of 150.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: ea05d954-85b5-4b44-a741-9ce681e44423

📥 Commits

Reviewing files that changed from the base of the PR and between 3daf561 and 876d8fd.

⛔ Files ignored due to path filters (1)

files/sounds/sfx/slider.wav is excluded by !**/*.wav

📒 Files selected for processing (187)

.all-contributorsrc
.github/scripts/inject_salt.sh
.github/workflows/browser_test.yml
.github/workflows/deploy_to_itch.yml
.github/workflows/lint_test_deploy.yml
.github/workflows/lint_test_on_pull.yml
.gitignore
Dockerfile
README.md
config_resources/default_settings.tres
files/docs/Development_Guide.md
files/docs/Platforms_for_Web_Deployment_Guide.md
files/docs/howto_inspect_the_files_saved_by_a_Godot_web_export.md
files/docs/milestones/17/PART_1_Implement_a_dedicated_slider_wav_soundeffect that triggers_only_during_manual_slider_adjustments.md
files/docs/milestones/17/PART_2_Implement_encryption_key_management_for_config_files.md
files/sounds/sfx/slider.wav.import
project.godot
requirements.txt
scenes/Player.tscn
scenes/advanced_settings.tscn
scenes/audio_settings.tscn
scenes/bullet.tscn
scenes/gameplay_settings.tscn
scenes/key_mapping_menu.tscn
scenes/loading_screen.tscn
scenes/main_menu.tscn
scenes/main_scene.tscn
scenes/options_menu.tscn
scenes/pause_menu.tscn
scenes/splash_screen.tscn
scenes/volume_controls/master_volume_control.tscn
scenes/volume_controls/music_volume_control.tscn
scenes/volume_controls/sfx_menu_volume_control.tscn
scenes/volume_controls/sfx_rotors_volume_control.tscn
scenes/volume_controls/sfx_volume_control.tscn
scenes/volume_controls/sfx_weapon_volume_control.tscn
scenes/weapon.tscn
scripts/core/game_paths.gd
scripts/core/game_paths.gd.uid
scripts/core/globals.gd
scripts/core/globals.gd.uid
scripts/core/main_scene.gd
scripts/core/main_scene.gd.uid
scripts/core/settings.gd
scripts/core/settings.gd.uid
scripts/entities/bullet.gd
scripts/entities/bullet.gd.uid
scripts/entities/player.gd
scripts/entities/player.gd.uid
scripts/entities/weapon.gd
scripts/entities/weapon.gd.uid
scripts/managers/audio_manager.gd
scripts/managers/audio_manager.gd.uid
scripts/managers/parallax_manager.gd
scripts/managers/parallax_manager.gd.uid
scripts/managers/resource_preloader.gd
scripts/managers/resource_preloader.gd.uid
scripts/resources/audio_constants.gd
scripts/resources/audio_constants.gd.uid
scripts/resources/game_settings_resource.gd
scripts/resources/game_settings_resource.gd.uid
scripts/system/JavaScriptBridgeWrapper.gd
scripts/system/JavaScriptBridgeWrapper.gd.uid
scripts/system/OSWrapper.gd
scripts/system/OSWrapper.gd.uid
scripts/system/audio_web_bridge.gd
scripts/system/audio_web_bridge.gd.uid
scripts/ui/components/input_remap_button.gd
scripts/ui/components/input_remap_button.gd.uid
scripts/ui/components/volume_slider.gd
scripts/ui/components/volume_slider.gd.uid
scripts/ui/hud.gd
scripts/ui/hud.gd.uid
scripts/ui/menus/advanced_settings.gd
scripts/ui/menus/advanced_settings.gd.uid
scripts/ui/menus/audio_settings.gd
scripts/ui/menus/audio_settings.gd.uid
scripts/ui/menus/gameplay_settings.gd
scripts/ui/menus/gameplay_settings.gd.uid
scripts/ui/menus/key_mapping.gd
scripts/ui/menus/key_mapping.gd.uid
scripts/ui/menus/main_menu.gd
scripts/ui/menus/main_menu.gd.uid
scripts/ui/menus/options_menu.gd
scripts/ui/menus/options_menu.gd.uid
scripts/ui/menus/pause_menu.gd
scripts/ui/menus/pause_menu.gd.uid
scripts/ui/screens/loading_screen.gd
scripts/ui/screens/loading_screen.gd.uid
scripts/ui/screens/splash_screen.gd
scripts/ui/screens/splash_screen.gd.uid
scripts/volume_slider.gd
test/gdunit4/test_audio_manager.gd
test/gdunit4/test_difficulty.gd
test/gdunit4/test_difficulty_integration.gd
test/gdunit4/test_globals.gd
test/gdunit4/test_helpers.gd
test/gdunit4/test_player.gd
test/gdunit4/test_settings.gd
test/gdunit4/test_settings_persistence.gd
test/gdunit4/test_volume_slider.gd
test/gut/gut_test_helper.gd
test/gut/test_audio_reset_button.gd
test/gut/test_audio_sync_decoupling.gd
test/gut/test_audio_sync_decoupling.gd.uid
test/gut/test_audio_web_bridge.gd
test/gut/test_audio_web_bridge_dom_sync.gd
test/gut/test_audio_web_bridge_dom_sync.gd.uid
test/gut/test_basic_save_load_without_other_settings.gd
test/gut/test_blank_key_labels_on_missing_config.gd
test/gut/test_combined_multi_manager_loads.gd
test/gut/test_decor_layer_transformations.gd
test/gut/test_decor_layer_transformations.gd.uid
test/gut/test_deduplication_on_device_switch.gd
test/gut/test_deduplication_on_load.gd
test/gut/test_deduplication_on_migration.gd
test/gut/test_deduplication_on_rapid_remap.gd
test/gut/test_deduplication_on_remap.gd
test/gut/test_deduplication_on_reset.gd
test/gut/test_deduplication_on_save_load_cycle.gd
test/gut/test_encryption_failsafe.gd
test/gut/test_encryption_failsafe.gd.uid
test/gut/test_encryption_logging.gd
test/gut/test_encryption_logging.gd.uid
test/gut/test_error_edge_cases.gd
test/gut/test_fuel_additional_edge_cases.gd
test/gut/test_fuel_integration.gd
test/gut/test_fuel_persistence_integration.gd
test/gut/test_full_encryption_workflow.gd
test/gut/test_full_encryption_workflow.gd.uid
test/gut/test_game_settings_resource.gd
test/gut/test_gameplay_settings_js.gd
test/gut/test_gameplay_settings_lifecycle.gd
test/gut/test_gameplay_settings_ui.gd
test/gut/test_get_pause_binding_label_for_device.gd
test/gut/test_globals_resource.gd
test/gut/test_hud.gd
test/gut/test_input_remap_button.gd
test/gut/test_input_remap_button_device_aware.gd
test/gut/test_input_remap_ec.gd
test/gut/test_integration_key_mapping.gd
test/gut/test_key_mapping_menu.gd
test/gut/test_key_mapping_menu_device_aware.gd
test/gut/test_main_scene_orphan_nodes.gd
test/gut/test_main_scene_orphan_nodes.gd.uid
test/gut/test_main_scene_parallax_and_performance.gd
test/gut/test_main_scene_parallax_and_performance.gd.uid
test/gut/test_manual_duplicate_load.gd
test/gut/test_master_volume_control_and_music.gd
test/gut/test_parallax_manager.gd
test/gut/test_parallax_manager.gd.uid
test/gut/test_pause_menu.gd
test/gut/test_player_fuel_logic.gd
test/gut/test_player_lifecycle.gd
test/gut/test_player_movement_signals.gd
test/gut/test_preserve_other_sections.gd
test/gut/test_reset_scenarios.gd
test/gut/test_settings_ec.gd
test/gut/test_settings_migration.gd
test/gut/test_settings_migration.gd.uid
test/gut/test_settings_observer.gd
test/gut/test_settings_unbound_scenarios.gd
test/gut/test_sfx_rotor_volume_control.gd
test/gut/test_sfx_volume_control.gd
test/gut/test_sfx_weapon_volume_control.gd
test/gut/test_version_display.gd
test/gut/test_volume_slider.gd
test/gut/test_volume_slider.gd.uid
tests/audio_flow_test.py
tests/back_flow_test.py
tests/difficulty_flow_test.py
tests/load_main_menu_test.py
tests/navigation_to_audio_test.py
tests/no_error_logs_test.py
tests/reset_audio_flow_test.py
tests/validate_clean_load_test.py
tests/volume_sliders_mutes_test.py
workspace/__init__.py
workspace/run_browser_tests.sh
workspace/run_gdlint.sh
workspace/run_gdunit4_unit_tests.sh
workspace/run_gut_unit_tests.sh
workspace/run_markdown_lint.sh
workspace/run_pipeline.sh
workspace/run_unit_tests.sh
workspace/run_yaml_lint.sh
workspace/scan_project.py

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix-encryption-pipeline

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

deepsource-io · 2026-05-06T05:17:23Z

DeepSource Code Review

We reviewed changes in 3daf561...876d8fd on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		May 8, 2026 3:10a.m.	Review ↗
JavaScript		May 8, 2026 3:10a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

Delete a large set of legacy GDScript files and their .uid counterparts from the scripts/ directory. Removed items include JavaScriptBridgeWrapper, OSWrapper, advanced_settings, audio_constants, audio_manager, audio_settings, audio_web_bridge, HUD/menu/player/gameplay-related scripts, resource_preloader and other related autoload/singleton scripts to clean up obsolete UI/audio/web-bridge code in preparation for refactor or replacement.

Adds a new GUT test suite (test_full_encryption_workflow.gd) that exercises the complete Settings encryption workflow: fresh install encryption/save/load, plaintext fallback and migration, mixed-systems concurrent writes, restart behavior after migration, and corrupted file handling. Tests isolate filesystem state at user://test_encryption_workflow.cfg and use per-test setup/teardown to backup/restore ProjectSettings salt, clear Globals' cached key, and swap Globals.settings to avoid polluting global state. Also adds the corresponding test .uid file.

Enhance encryption-related logging across Globals and Settings: add detailed, emoji-prefixed error/debug messages for save/load/encryption key operations, surface decryption failures, plaintext migration warnings, and confirm cached key generation. Ensure use of the centralized ensure_encryption_key helper when saving, and add logging in ensure_encryption_key itself. Add GUT tests (test_encryption_logging.gd + uid) to exercise the new logging branches (key generation, missing config, successful encrypt/decrypt, plaintext load, and save failures). These changes make encryption issues easier to diagnose during development and CI runs.

Add a project setting placeholder for 'game/security/save_salt' and harden the encryption key generation: if the salt is empty, _get_encryption_key now logs a warning and aborts to plaintext (returns empty) to avoid silent weak-key fallbacks. Adjust the production guard to crash only on the dev_fallback_salt while still allowing automated/browser-driven tests. Add GUT tests (test_encryption_failsafe.gd + .uid) that verify the salt property is registered, that missing salt triggers the plaintext fallback, and that a valid salt results in an encrypted save; tests also isolate ProjectSettings and clear the cached encryption key during setup/teardown.

Create workspace package (workspace/__init__.py) and move various CI/test/lint scripts into the workspace/ directory. Renamed/moved: run_browser_tests.sh, run_gdlint.sh, run_gdunit4_unit_tests.sh, run_gut_unit_tests.sh, run_markdown_lint.sh, run_pipeline.sh, run_unit_tests.sh, and run_yaml_lint.sh to consolidate tooling and improve project organization.

Call Globals.set_test_encryption_key() in several GUT tests and add explicit loading flags to prevent auto-saves during test setup. Modified tests: test_combined_multi_manager_loads.gd, test_globals_resource.gd, test_preserve_other_sections.gd, and test_settings_observer.gd. This ensures the empty project salt is overridden with a valid test key so Globals._save_settings uses encryption (avoiding plaintext fallback) and prevents test actions/signals from triggering unintended saves to production files.

This commit fixes the style issues introduced in c4c52e0 according to the output from Black and isort. Details: #596

Add *.pyc to .gitignore and adjust tests to tolerate known encryption fallback messages. audio_flow_test now ignores logs containing 'encryption aborted' when checking for unexpected warnings. difficulty_flow_test accepts either an encrypted save log or a plaintext fallback message and improves related assertion messages to avoid false failures on WebGL/plaintext fallbacks.

This commit fixes the style issues introduced in e73a4b5 according to the output from Black and isort. Details: #596

This commit fixes the style issues introduced in 2f07621 according to the output from Black and isort. Details: #596

Add a new how-to document explaining how to locate and read the virtual file system created by Godot web exports (Emscripten IDBFS / IndexedDB) and include a JavaScript snippet to extract file bytes in Chrome DevTools. Also update README to link to the new guide so users can inspect saved files and verify contents before and after encryption.

This commit fixes the style issues introduced in 4af856d according to the output from Black and isort. Details: #596

Add two Milestone 17 docs describing UI audio and config encryption work. Part 1 documents a dedicated, rate-limited slider SFX and centralized AudioManager.play_sfx with stream caching and an AudioStreamPlayer pool; it also details VolumeSlider hardening (interaction guards, programmatic update API, delta/rate gating, invalid-bus protection) and extensive GUT/GdUnit4 test updates to prevent feedback loops and flaky CI. Part 2 documents centralized encryption key management in Globals (deterministic per-device key with test/web overrides), safe encrypted ConfigFile load/save with legacy plaintext migration, CI injection of a PRODUCTION_SALT, and broad test/tooling adjustments to validate migration and preserve unrelated config sections. Both files summarize added tests, CI/deploy changes, and migration/backward-compatibility safeguards.

…SkyLockAssault into fix-encryption-pipeline

Add two Milestone 17 documentation files: Part 1 describes audio/UI changes including a dedicated slider SFX, AudioManager pooling/caching, VolumeSlider hardening and test-suite updates; Part 2 documents centralized encryption key management for config files, plaintext→encrypted migration, CI salt injection and test adaptations. Remove the older duplicate milestone doc files.

Apply markdown style and linting fixes across documentation and the lint runner. Changes include: normalize list markers and spacing, remove trailing/extra blank lines, reflow wrapped lines for readability, convert an inline image to a reference-style link, and standardize table formatting in milestone docs. Also tweak README milestone wording for clarity. Minor shell script formatting added to workspace/run_markdown_lint.sh to improve readability. These edits are purely stylistic to satisfy markdownlint and improve docs consistency.

Cosmetic cleanup across docs and scripts: standardize list markers (replace leading '+' list markers with '-'), fix blank-line/whitespace inconsistencies, and tidy minor punctuation/spacing in README and several docs. Also add a small readability newline in workspace/run_markdown_lint.sh. No functional changes.

…ers_only_during_manual_slider_adjustments.md

Add a new script .github/scripts/inject_salt.sh that injects security/save_salt into Godot project files, properly escaping backslashes and quotes and handling presence/absence of the [game] section. Update .github/workflows/lint_test_deploy.yml to run a CI job that exercises the shared script, and make browser functional tests depend on it. Update tests/ci/test_salt_injection.py to call the shared bash script instead of using an inline AWK blob, simplify the test flow, and adjust expected output for the escaped salt. This centralizes salt injection logic and makes CI/tests use the same implementation.

Clarify escaping behavior in .github/scripts/inject_salt.sh (suggest using printf %q or careful sed and explicitly escape backslashes and quotes). Update tests/ci/test_salt_injection.py to match the real Action script path, use a raw Python string for the complex secret, capture subprocess output and handle FileNotFoundError, and print stderr on script failures. Add additional integration tests to cover injecting into an existing [game] section (ensuring correct insertion order) and overwriting an existing salt, improve failure messages, and ensure cleanup of the dummy file.

Refactor .github/scripts/inject_salt.sh to read the salt from the SALT environment variable and use TARGET_FILE for the input path; the AWK logic was reformatted but retains the same behavior (inject or overwrite security/save_salt in the [game] section, or append the section). Remove the stale dummy.godot fixture. Update tests/ci/test_salt_injection.py to run the AWK logic directly from Python (embed the AWK script), properly escape the test secret, load it via env, and add multiple test cases (no [game] section, existing [game] with following section, and overwrite existing salt). Also improve error messaging for missing awk and ensure temp-file replace/cleanup.

Restore encryption logic and finalize secure CI/CD pipelines

97115d9

ikostan added this to the Milestone 17: Save File Security, Encryption Migration, Audio Feedback System & UI Sound Integration Stabilization milestone May 6, 2026

ikostan self-assigned this May 6, 2026

ikostan added bug Something isn't working enhancement New feature or request deployment CI/CD labels May 6, 2026

ikostan added this to Sky Lock Assault Project May 6, 2026

ikostan added github actions Pull requests that update GitHub Actions code github_actions Pull requests that update GitHub Actions code security labels May 6, 2026

sourcery-ai Bot reviewed May 6, 2026

View reviewed changes

ikostan moved this to In Progress in Sky Lock Assault Project May 6, 2026

ikostan linked an issue May 6, 2026 that may be closed by this pull request

[BUG] Web Export Strips Injected CI Salt, Causing Plaintext Save Failsafe #594

Closed

ikostan and others added 14 commits May 5, 2026 22:27

Update deploy_to_itch.yml

eae58b7

Create scan_project.py

15e698e

Update .gitignore

fa56ba9

style: format code with Black and isort

c043055

This commit fixes the style issues introduced in c4c52e0 according to the output from Black and isort. Details: #596

Update test_error_edge_cases.gd

6a43571

Update test_globals.gd

f47a524

style: format code with Black and isort

e6b3a3c

This commit fixes the style issues introduced in e73a4b5 according to the output from Black and isort. Details: #596

ikostan and others added 20 commits May 7, 2026 16:52

Update reset_audio_flow_test.py

2f07621

style: format code with Black and isort

f517460

This commit fixes the style issues introduced in 2f07621 according to the output from Black and isort. Details: #596

Update howto_inspect_the_files_saved_by_a_Godot_web_export.md

55b42eb

Update reset_audio_flow_test.py

e7f1512

Update howto_inspect_the_files_saved_by_a_Godot_web_export.md

4af856d

style: format code with Black and isort

1304ae6

This commit fixes the style issues introduced in 4af856d according to the output from Black and isort. Details: #596

Merge branch 'fix-encryption-pipeline' of https://github.com/ikostan/…

9a22072

…SkyLockAssault into fix-encryption-pipeline

Update PART_2_Implement_encryption_key_management_for_config_files.md

ba337cd

Update PART_1_Implement_a_dedicated_slider_wav_soundeffect that trigg…

498261b

…ers_only_during_manual_slider_adjustments.md

Update PART_1_Implement_a_dedicated_slider_wav_soundeffect that trigg…

633ab72

…ers_only_during_manual_slider_adjustments.md

Update PART_2_Implement_encryption_key_management_for_config_files.md

203cf6b

Update lint_test_on_pull.yml

2e686b1

ikostan merged commit 0328958 into main May 8, 2026
12 of 13 checks passed

github-project-automation Bot moved this from In Progress to Done in Sky Lock Assault Project May 8, 2026

ikostan deleted the fix-encryption-pipeline branch May 16, 2026 20:10

Navigation Menu

Uh oh!

Restore encryption logic and finalize secure CI/CD pipelines - #596

Restore encryption logic and finalize secure CI/CD pipelines#596
ikostan merged 35 commits into
mainfrom
fix-encryption-pipeline

ikostan commented May 6, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

coderabbitai Bot commented May 6, 2026 •

edited

Loading

Review skipped

Uh oh!

deepsource-io Bot commented May 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ikostan commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

name: Default Pull Request Template about: Suggesting changes to SkyLockAssault title: '' labels: '' assignees: ''

Description

Related Issue

Changes

Testing

Checklist

Additional Notes

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

deepsource-io Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ikostan commented May 6, 2026 •

edited

Loading

name: Default Pull Request Template
about: Suggesting changes to SkyLockAssault
title: ''
labels: ''
assignees: ''

coderabbitai Bot commented May 6, 2026 •

edited

Loading

deepsource-io Bot commented May 6, 2026 •

edited

Loading