feat: preflight-validate every module against its image's real OCI config

.github/workflows/validate.yml

@@ -0,0 +1,40 @@
+name: validate modules
+
+# Preflight-checks every modules/<name>/template.yaml against the ACTUAL
+# OCI image config of the image(s) it declares, catching the bug classes
+# that have shipped broken before (see validate.py's module docstring for
+# the full rule list and the historical bugs each one repros). Runs on
+# every PR and on pushes to main so a template change is checked before it
+# ever reaches a real cluster.
+#
+# Network access to Docker Hub is required (the validator resolves each
+# declared image's manifest + config blob anonymously). A registry that
+# can't be reached is reported as a WARN by the script itself, not a hard
+# failure — so a real transient network blip degrades to "couldn't
+# verify", not a red build. Only a confirmed problem (missing image,
+# missing spec.command, missing security.runAsUser, a mount that shadows
+# the image's own launcher, ...) fails the job.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install PyYAML
+        run: pip install --disable-pip-version-check --user pyyaml
+
+      - name: Run module preflight validator
+        run: python3 validate.py

cs2/module.yaml

@@ -1,7 +1,7 @@
 apiVersion: gameplane.local/module/v1
 name: cs2
 displayName: Counter-Strike 2
-version: 1.0.0
+version: 1.0.1
 game: cs2
 summary: Counter-Strike 2 dedicated server (joedwards32/CS2) with Source RCON and a Metamod/CS# plugins volume.
 homepage: https://www.counter-strike.net/cs2

cs2/template.yaml

@@ -22,7 +22,7 @@ metadata:
 spec:
   displayName: Counter-Strike 2
   game: cs2
-  version: 1.0.0
+  version: 1.0.1
   accentColor: "#f4a900"
   description: |
     Counter-Strike 2 dedicated server using
@@ -32,6 +32,21 @@ spec:
 
   image: joedwards32/cs2:latest
 
+  # REQUIRED. The image config declares User "1000:1000" — it starts as a
+  # non-root user with no root step to self-chown, so a fresh PVC is EACCES
+  # without fsGroup. And overriding runAsUser drops $HOME (it normally comes
+  # from the image's USER directive), which SteamCMD needs — it resolves
+  # "$HOME/Steam" to "//Steam" and dies. Both are required together; fixing
+  # only one just moves the failure. Caught by validate.py before first boot.
+  env:
+    - name: HOME
+      value: /home/steam
+
+  security:
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+
   ports:
     - name: game
       containerPort: 27015