Cicd deployment workflow fails with 404 on godot checksum download

[ikostan]

---

name: Default Pull Request Template
about: Suggesting changes to SkyLockAssault
title: ''
labels: ''
assignees: ''

Description

What does this PR do? (e.g., "Fixes player jump physics in level 2" or "Adds
new enemy AI script")

Related Issue

Closes #ISSUE_NUMBER (if applicable)

Changes

• List key changes here (e.g., "Updated Jump.gd to use Godot 4.4's new Tween
  system")
• Any breaking changes? (e.g., "Deprecated old signal; migrate to new one")

Testing

• Ran the game in Godot v4.5 editor—describe what you tested (e.g., "Jump
  works on Win10 with 60 FPS")
• Any new unit tests added? (Link to test scene if yes)
• Screenshots/GIFs if UI-related: (Attach below)

Checklist

• Code follows Godot style guide (e.g., snake_case for variables)
• No console errors in editor/output
• Ready for review!

Additional Notes

Anything else? (e.g., "Tested on Win10 64-bit; needs Linux validation")

Summary by Sourcery

CI:

• Update the checksum file URL in the GitHub deployment workflow to point to the correct Godot 4.6.3 SHA256SUMS resource.

Summary by CodeRabbit

• Chores
  • Updated deployment verification process to use consolidated checksum configuration for improved release integrity
  • Streamlined development environment tooling setup

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the CI/CD deployment workflow to point the Godot checksum download to the correct 4.6.3 stable SHA256SUMS file, fixing 404 errors during deployment. The Godot project file is included in the PR but has no visible changes in the provided diff.

Flow diagram for updated Godot checksum download in CI workflow

flowchart LR
    GHA[GitHub Actions deploy_to_itch job]
    EXE[Download EXE zip]
    TPL[Download export templates]
    SUMS[Download SHA256SUMS.txt]
    VERIFY[Verify EXE with checksum]

    GHA --> EXE
    GHA --> TPL
    GHA --> SUMS
    SUMS --> VERIFY

    %% Updated URL now points to SHA256SUMS.txt in 4.6.3-stable release
    SUMS:::updated

    classDef updated fill:#d1e8ff,stroke:#4a90e2,color:#000;

Loading

File-Level Changes

Change	Details	Files
Fix Godot checksum download URL in CI/CD deployment workflow to resolve 404 failures.	Update the checksum URL variable to reference the generic SHA256SUMS.txt file for the 4.6.3-stable release instead of the version-prefixed checksum file name. Keep executable and export template URLs unchanged to continue using Godot 4.6.3-stable artifacts.	.github/workflows/deploy_to_itch.yml
Include project.godot in the PR (no functional changes apparent in the provided diff).	No concrete modifications were visible, but the project configuration file is part of the PR and should be checked in the full diff for unintended edits or metadata changes.	project.godot

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#755	Update the Deploy to itch.io CI workflow so that CHECKSUM_URL points to the correct non-versioned Godot checksum file (.../4.6.3-stable/SHA256SUMS.txt) instead of the incorrectly versioned filename.	✅
#755	Restore successful execution of the Download and Verify Godot Binaries step in the deployment workflow by preventing the 404 error when downloading the checksum file.	✅

Possibly linked issues

• #[BUG] CI/CD deployment workflow fails with 404 on Godot checksum download: PR updates CHECKSUM_URL to the non-versioned SHA256SUMS.txt file, directly fixing the described CI 404 failure.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Warning

Review limit reached

@ikostan, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 56 minutes and 47 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 0d53630d-0be6-4ad0-a721-0428f36bebef

📥 Commits

Reviewing files that changed from the base of the PR and between 8ba287f and a2d0d6e.

📒 Files selected for processing (1)

• .github/workflows/deploy_to_itch.yml

📝 Walkthrough

Walkthrough

The deploy workflow's CHECKSUM_URL is updated to reference the consolidated SHA256SUMS.txt file instead of a version-named file. Separately, project.godot removes the gdUnit4 plugin and enables only the gut plugin.

Changes

Deploy Workflow and Project Config Fixes

Layer / File(s)	Summary
Fix CHECKSUM_URL in deploy workflow .github/workflows/deploy_to_itch.yml	CHECKSUM_URL is changed to point to SHA256SUMS.txt instead of the prior version-specific Godot_v4.6.3-stable_SHA256SUMS.txt, correcting the file fetched for sha256sum --check verification.
Switch enabled editor plugin project.godot	The editor_plugins enabled list drops res://addons/gdUnit4/plugin.cfg and retains only res://addons/gut/plugin.cfg.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• [BUG] CI/CD deployment workflow fails with 404 on Godot checksum download #755: The updated CHECKSUM_URL directly resolves the 404 error reported when the workflow failed to fetch the Godot checksum file using the incorrect version-specific filename.

Possibly related PRs

• ikostan/SkyLockAssault#654: Also modifies the deploy workflow's SHA-256 integrity verification step for Godot binary downloads, making it directly related to this checksum URL fix.

Suggested labels

bug

Poem

🐇 A typo in the checksum path,
The workflow stumbled, blocked its bath!
Now SHA256SUMS.txt leads the way,
And gut replaces gdUnit today.
Hop hop, the pipeline's clear to play! 🎮

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description is an empty template with only a summary added at the end; critical sections like Description, Related Issue, and Changes are not filled out with actual information.	Complete the Description section explaining what the PR does, fill in Related Issue if applicable, list the actual changes made, and document testing performed in the template sections.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main issue being fixed: a CI/CD deployment workflow failure caused by a 404 error on the Godot checksum download.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cicd-deployment-workflow-fails-with-404-on-godot-checksum-download

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sourcery-ai]

Hey - I've left some high level feedback:

• The Godot version string (4.6.3-stable) is duplicated across EXE_URL, TEMPLATE_URL, and CHECKSUM_URL—consider extracting it into a single variable to reduce the chance of future mismatches when upgrading versions.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The Godot version string (`4.6.3-stable`) is duplicated across EXE_URL, TEMPLATE_URL, and CHECKSUM_URL—consider extracting it into a single variable to reduce the chance of future mismatches when upgrading versions.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 0b48ebb...a2d0d6e on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Jun 17, 2026 4:47a.m.	Review ↗
JavaScript		Jun 17, 2026 4:47a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[ikostan]

• The Godot version string (4.6.3-stable) is duplicated across EXE_URL, TEMPLATE_URL, and CHECKSUM_URL—consider extracting it into a single variable to reduce the chance of future mismatches when upgrading versions.

Centralizing the Godot version string into a single workflow-level environment variable eliminates a lot of redundant noise.

By doing this, the next time you need to bump the engine version, you only have to change a single line at the top of the file instead of updating five different hardcoded strings spread across multiple steps.