Update Lootable Bodies for Minecraft 1.13.2

.github/scripts/test_release_workflow.py

@@ -17,6 +17,9 @@
              ['original-110', 'released-110', 'original-111', 'recovery-110',
               'released-111', 'original-112', 'recovery-111', 'via111-110']
              for stamps in ['normal', 'stamps']]
+MATRIX113 = MATRIX112 + [origin + ' / ' + stamps for origin in
+             ['released-112', 'recovery-112', 'via112-110', 'via112-111']
+             for stamps in ['normal', 'stamps']]
 MATRIX = [origin + ' / ' + stamps for origin in
           ['original-110', 'released-110', 'original-111', 'recovery-110']
           for stamps in ['normal', 'stamps']]
@@ -49,15 +52,17 @@ def validate(self, minecraft, names=None, mutation=None, release_exists=False, w
         suffix, branch, forge = {
             '1.10.2': ('110021', '1.10.2', '12.18.3.2511'),
             '1.11.2': ('111021', '1.11.2-dev', '13.20.1.2588'),
-            '1.12.2': ('112021', 'master-1.12', '14.23.5.2859')}[minecraft]
+            '1.12.2': ('112021', 'master-1.12', '14.23.5.2859'),
+            '1.13.2': ('113021', 'master-1.13.2', '25.0.223')}[minecraft]
         version = '2.4.2.' + suffix
         values = dict(minecraft_version=minecraft, forge_version=forge, loader_name='forge', loader_code='1',
             java_version='8', java_toolchain_version='8.0.502+7', gradle_java_version='17', mod_id='lootablebodies',
             mod_artifact='LootableBodies', mod_group='zone.moddev.mc.lootablebodies', mod_license='LGPL-2.1-only',
             curseforge_project_id='240968', mod_version=version)
         if mutation:
             values.update(mutation)
-        checks = CORE + {'1.11.2': MATRIX, '1.12.2': MATRIX112}.get(minecraft, []) if names is None else names
+        checks = CORE + {'1.11.2': MATRIX, '1.12.2': MATRIX112,
+                         '1.13.2': MATRIX113 + ['Validate release workflow']}.get(minecraft, []) if names is None else names
         def command(args, **options):
             if args[0] == 'git':
                 return SHA + '\n'
@@ -81,15 +86,15 @@ def existing(args, **options):
             exec(compile(code, 'release-preflight', 'exec'), {})
 
     def test_routes_all_supported_versions(self):
-        for suffix, minecraft, branch in [('110021', '1.10.2', '1.10.2'), ('111021', '1.11.2', '1.11.2-dev'), ('112021', '1.12.2', 'master-1.12')]:
+        for suffix, minecraft, branch in [('110021', '1.10.2', '1.10.2'), ('111021', '1.11.2', '1.11.2-dev'), ('112021', '1.12.2', 'master-1.12'), ('113021', '1.13.2', 'master-1.13.2')]:
             with self.subTest(minecraft=minecraft):
                 status, values = self.select('2.4.2.' + suffix)
                 self.assertEqual(0, status)
                 self.assertEqual(minecraft, values['minecraft_version'])
                 self.assertEqual(branch, values['source_branch'])
 
     def test_invalid_versions_are_rejected(self):
-        for version in ['2.4.2', '2.4.2.113021', '02.4.2.111021', '2.4.2.111021;exit 0']:
+        for version in ['2.4.2', '2.4.2.114041', '02.4.2.111021', '2.4.2.111021;exit 0']:
             with self.subTest(version=version):
                 self.assertNotEqual(0, self.select(version)[0])
 
@@ -120,6 +125,24 @@ def test_112_requires_an_independent_audit_of_its_exact_artifact(self):
         with self.assertRaises(SystemExit):
             self.validate('1.12.2', audit_success=False)
 
+    def test_113_requires_every_upgrade_case_and_workflow_validation(self):
+        self.validate('1.13.2')
+        required = MATRIX113 + ['Validate release workflow']
+        for missing in required:
+            with self.subTest(missing=missing), self.assertRaises(SystemExit):
+                self.validate('1.13.2', names=CORE + [name for name in required if name != missing])
+
+    def test_113_requires_an_independent_audit_of_its_exact_artifact(self):
+        with self.assertRaises(SystemExit):
+            self.validate('1.13.2', audit_success=False)
+
+    def test_113_audit_receives_the_registered_shared_ci_completion(self):
+        # GitHub registers this shared workflow under its default-branch name,
+        # even when the run uses another Minecraft branch's workflow contents.
+        audit = WORKFLOW.with_name('artifact-audit-1.13.yml').read_text(encoding='utf-8')
+        event_names = audit.split('workflows: [', 1)[1].split(']', 1)[0].split(',')
+        self.assertIn('LootableBodies 1.12 CI', [name.strip() for name in event_names])
+
     def test_identity_changes_are_rejected(self):
         for mutation in [{'mod_id': 'other'}, {'minecraft_version': '1.10.2'}, {'mod_license': 'CC0-1.0'}]:
             with self.subTest(mutation=mutation), self.assertRaises(SystemExit):

.github/workflows/artifact-audit-1.13.yml

@@ -0,0 +1,64 @@
+name: Audit LootableBodies 1.13 artifacts
+run-name: Audit 1.13.2 artifacts from ${{ github.event.workflow_run.head_sha }}
+
+on:
+  workflow_run:
+    workflows: [LootableBodies 1.12 CI, LootableBodies 1.13 CI]
+    types: [completed]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  audit:
+    # Pull-request merge trees are audited inside CI. Push artifacts use the
+    # workflow run's exact head SHA, which is also their declared artifact name.
+    if: >-
+      github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' &&
+      (github.event.workflow_run.head_branch == 'master-1.13.2')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '25.0.3+9.0.LTS'
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '8.0.502+7'
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: '17.0.1+12'
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: LootableBodies-1.13.2-${{ github.event.workflow_run.head_sha }}
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+          path: downloaded
+      - name: Require exact inputs and assemble an immutable audit bundle
+        run: |
+          set -euo pipefail
+          mkdir audited
+          for name in LootableBodies-2.4.4.113021.jar LootableBodies-2.4.4.113021-sources.jar LootableBodies-2.4.4.113021-javadoc.jar; do
+            test -s "downloaded/build/libs/$name"
+            cp "downloaded/build/libs/$name" audited/
+          done
+          test -s downloaded/build/release/SHA256SUMS
+          test -s downloaded/build/publications/mavenJava/pom-default.xml
+          test -s downloaded/CHANGELOG.txt
+          cp downloaded/build/release/SHA256SUMS audited/
+          cp downloaded/build/publications/mavenJava/pom-default.xml audited/LootableBodies-2.4.4.113021.pom
+          cp downloaded/CHANGELOG.txt audited/
+      - name: Audit original bytes without recompiling the jars
+        env:
+          LOOTABLEBODIES_JAVA8_HOME: ${{ env.JAVA_HOME_8_X64 }}
+          LOOTABLEBODIES_MAVENIZER_JAVA_HOME: ${{ env.JAVA_HOME_25_X64 }}
+        run: |
+          chmod +x ./gradlew
+          ./gradlew verifyPreparedReleaseArtifacts -PpreparedReleaseDir=audited --no-daemon