Add MineLights 2.4.0 (#136)

* Added MineLights 0.1.0

* Updated MineLights to 0.1.1

* Updated MineLights to 0.1.2

* Updated MineLights registry package to 2.3.8.5

* Updated MineLights registry package to 2.4.0

* Updated MineLights registry package for reviewed server

* Updated MineLights source revision

* Updated MineLights source revision

* Updated MineLights source revision

* Updated MineLights source revision

* Updated MineLights source revision

* Update MineLights 2.4.0 submission

* Update signed MineLights 2.4.0 package

* Clarify MineLights Horizon listing

* Clarify MineLights download notices

* Refresh MineLights 2.4.0 Horizon package

* Update MineLights 2.4.0 source revision

* Refresh signed MineLights 2.4.0 Horizon package

* Remove unreviewed MineLights versions from submission

* minelights: keep the icon in the registry, add categories

The registry requires icons/<id>.png and one to three categories. The icon
is assets/icon.png from MineLights@246c37d (128x128).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Horizon agent <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>

.github/workflows/native-compat.yml

@@ -0,0 +1,103 @@
+# Native mods on the newest Nightly, as players' launchers build them (scripts/native_compat.py):
+# - on a pull request, each new native-mod version, applied together with the most downloaded native mods
+#   and compiled (`cargo check`); its support modules' names against every registry mod's;
+# - every day after the Nightly, every native mod's newest version, applied, then the rest compiled
+#   (`cargo check`): the ones horizon-mixins refuses alone and the ones whose own code doesn't compile go
+#   to the `native-health` release, which publish adds to the index (`broken_on`) so the launcher warns
+#   before an install.
+# The check compiles the submission, whose crates may have build scripts: it runs with a token that can
+# only read, and main's script, never the pull request's.
+name: native-compat
+on:
+  pull_request:
+    branches: [main]
+    paths: ["mods/*.toml"]
+  schedule:
+    - cron: "40 18 * * *"
+  workflow_dispatch:
+    inputs:
+      horizon:
+        description: "Horizon commit, or `latest` (the newest Nightly)"
+        default: latest
+      upload:
+        description: "Publish the result (native-health release); `false` for a trial run"
+        default: "true"
+permissions:
+  contents: read
+concurrency:
+  group: native-compat-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+env:
+  # The Rust the launcher builds native mods with (Horizon's launcher/src/rust_toolchain.rs).
+  RUST: "1.99.1"
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          path: base
+      - uses: actions/checkout@v4
+        with:
+          path: head
+          persist-credentials: false
+      - name: Does it change a native mod?
+        id: native
+        run: |
+          if [ -n "$(python3 base/scripts/native_compat.py new base head)" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.native.outputs.changed == 'true'
+        run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - if: steps.native.outputs.changed == 'true'
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      - if: steps.native.outputs.changed == 'true'
+        name: On the newest Nightly, with the popular native mods
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          set -o pipefail
+          python3 base/scripts/native_compat.py check base head | tee -a "$GITHUB_STEP_SUMMARY"
+  health:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    # Each mod horizon-mixins refuses costs one more apply of the whole set.
+    timeout-minutes: 300
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: python3 -m unittest discover -s scripts -p 'test_*.py'
+      - run: rustup toolchain install $RUST --profile minimal && rustup default $RUST
+      - run: sudo apt-get update && sudo apt-get install -y libasound2-dev libudev-dev pkg-config
+      # Yesterday's dependencies, checked, and horizon-mixins: only Horizon's own crates and the mods compile again.
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            native/target/compat/cargo
+            native/target/horizon-mixins
+          key: native-health-${{ env.RUST }}-${{ github.run_id }}
+          restore-keys: native-health-${{ env.RUST }}-
+      - name: Every native mod's newest version on the newest Nightly
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          HORIZON: ${{ inputs.horizon || 'latest' }}
+        run: |
+          set -o pipefail
+          python3 scripts/native_compat.py health --horizon "$HORIZON" --out native-health.json | tee -a "$GITHUB_STEP_SUMMARY"
+      - name: Keep it for publish
+        if: inputs.upload != 'false'
+        run: |
+          gh release view native-health >/dev/null 2>&1 \
+            || gh release create native-health --prerelease --title "Native mods' health" \
+                 --notes "native-health.json: the native mods that don't apply on the newest Nightly (native-compat.yml). publish adds them to the index as broken_on."
+          gh release upload native-health native-health.json --clobber

.github/workflows/native.yml

@@ -78,7 +78,9 @@ jobs:
           names = zipfile.ZipFile(path).namelist()
           manifest = json.loads(zipfile.ZipFile(path).read("horizon-native.json"))
           assert manifest["hooks"] >= 1, manifest
-          assert all(n == "horizon-native.json" or (n.startswith(f"mixins/{manifest['id']}/") and n.endswith((".rs", ".toml"))) for n in names), names
+          bundle = f"mixins/{manifest['id']}/"
+          assert all(n == "horizon-native.json" or n == bundle + "LICENSE" or (n.startswith(bundle) and n.endswith((".rs", ".toml"))) for n in names), names
+          assert bundle + "LICENSE" in names, "the mod's LICENSE travels in its package"
           print(path, manifest)
           PY
       - uses: actions/upload-artifact@v4

.github/workflows/publish.yml

@@ -1,9 +1,9 @@
 # Merging publishes: each new version's file becomes a release asset
-# (<id>-<version>/<file>), then index.json and the icons go to GitHub Pages
-# (https://horizon-rust.github.io/horizon-mods/index.json), which the launcher and
+# (<id>-<version>/<file>), then index.json, the icons and the screenshots go to GitHub
+# Pages (https://horizon-rust.github.io/horizon-mods/index.json), which the launcher and
 # playhorizon.dev/mods read. Nothing is published if any entry fails its checks.
-# Every hour it runs again to refresh each project's `downloads`: GitHub's
-# download counts of its release assets.
+# Every hour it runs again to refresh each project's `downloads` (GitHub's download
+# counts of its release assets) and `stars` (its source repository's GitHub stars).
 name: publish
 on:
   push:
@@ -73,9 +73,48 @@ jobs:
               | if $n > 0 then .downloads = $n else . end)' site/index.json > index.counted.json
           mv index.counted.json site/index.json
           jq -r '.projects[] | "\(.id) \(.downloads // 0)"' site/index.json
+      - name: GitHub stars
+        run: |
+          # A project's stars are its source repository's (owner/repo of a
+          # https://github.com/ source, a folder of it or .git included), asked
+          # once per repository. One that can't be read is left out, not zero.
+          jq -r '.projects[].source // empty' site/index.json \
+            | sed -nE 's#^https://github\.com/([A-Za-z0-9-]+)/([A-Za-z0-9._-]+).*#\1/\2#p' \
+            | sed -E 's/\.git$//' | tr 'A-Z' 'a-z' | sort -u \
+            | while read -r repo; do
+                n="$(gh api "repos/$repo" --jq .stargazers_count 2>/dev/null)" || continue
+                echo "{\"key\": \"$repo\", \"value\": $n}"
+              done | jq -s from_entries > stars.json
+          jq --slurpfile stars stars.json '
+            .projects |= map(
+              (first((.source // "") | ascii_downcase
+                | capture("^https://github[.]com/(?<r>[a-z0-9-]+/[a-z0-9._-]+)").r
+                | sub("[.]git$"; "")) // "") as $r
+              | ($stars[0][$r] // 0) as $n
+              | if $n > 0 then .stars = $n else . end)' site/index.json > index.starred.json
+          mv index.starred.json site/index.json
+          jq -r '.projects[] | "\(.id) \(.stars // 0)"' site/index.json
+      - name: Native mods that don't apply on the newest Nightly
+        run: |
+          # native-compat.yml's daily health: the version each names gets `broken_on`, the Horizon
+          # commit horizon-mixins refused it on and its code, so the launcher warns before an install.
+          if gh release download native-health --pattern native-health.json --dir health 2>/dev/null; then
+            jq --slurpfile h health/native-health.json '
+              $h[0] as $health
+              | .projects |= map(. as $p | .versions |= map(
+                  ($health.broken[$p.id] // null) as $b
+                  | if $b != null and $b.version == .version
+                    then .broken_on = [{horizon: $health.horizon, code: $b.code}] else . end))' \
+              site/index.json > index.health.json
+            mv index.health.json site/index.json
+            jq -r '.projects[] | select(.versions[0].broken_on) | "\(.id) \(.versions[0].version): \(.versions[0].broken_on[0].code)"' site/index.json
+          fi
       - name: The site
         run: |
           cp -R icons site/icons
+          # Screenshots are served beside the icons: the index lists them at
+          # <site>screenshots/<id>/<name>.
+          if [ -d screenshots ]; then cp -R screenshots site/screenshots; fi
           cat > site/index.html <<'HTML'
           <!doctype html><meta charset="utf-8"><title>Horizon mods</title>
           <meta http-equiv="refresh" content="0; url=https://playhorizon.dev/mods">

MOD-POLICY.md

@@ -36,6 +36,21 @@ Submitting a project, through the form or a pull request, means you confirm that
 You alone are responsible for what you publish and for any claim about it. The Horizon project may refuse, hide or
 remove any project, at any time, without having to give a reason.
 
+## Licences reviewers can read
+
+Reviewers read a project's source before each version is listed; that is how they check it holds nothing harmful.
+They may only read source under a licence that lets them, so a new project, and every new version of a listed one,
+needs source under one of:
+
+- MIT, MIT-0, BSD-2-Clause, BSD-3-Clause, 0BSD, Apache-2.0, ISC, zlib, Unlicense or CC0-1.0;
+- or any licence, with a written grant from its authors that lets the Horizon reviewers read the source to review it
+  (say so in the pull request, with a link to the grant).
+
+Source under GPL, LGPL, MPL or all rights reserved, without such a grant, can't be reviewed, so it can't be listed or
+updated. The projects already listed under other licences when this rule was written (classic_zoom,
+distant_horizons, fly_speed, serverify) stay listed as they are; their next version needs a licence above or a
+grant. A port also has to follow promise 2 above.
+
 ## Copyright and takedowns
 
 If a project in this registry uses your work without your permission:

README.md

@@ -11,15 +11,16 @@ with no file, network or clock access, and can only do what their page lists.
 Native source mods (`.hnmod`, kind `native-mod`) are built into an isolated game by
 a launcher with native-mod support. They run with the player’s account permissions.
 Their bundles pin the exact Horizon and Horizon Mixins revisions used for the build.
-Other revisions have not been validated. Registry checks inspect the source bundle without
-executing native code; reviewers must also examine the source and pinned-build
-validation. Publishing these requires the native-mod changes to `cargo-horizon-mod`
+Other revisions have not been validated. Registry checks inspect the source bundle and compile it
+on the newest Nightly with the most downloaded native mods (in a job whose token
+can only read) without running it; reviewers must also examine the source and
+pinned-build validation. Publishing these requires the native-mod changes to `cargo-horizon-mod`
 and the launcher to have shipped first.
 
 **Who is responsible.** Except the projects marked Official (made by the Horizon project), everything here is made and
 owned by its own authors, not by the Horizon project or its maintainers. A listing is not an endorsement. See the
-[mod policy](MOD-POLICY.md): what authors promise when they submit (ports of other mods included) and how to have
-a project taken down.
+[mod policy](MOD-POLICY.md): what authors promise when they submit (ports of other mods included), the licences
+whose source reviewers can read, and how to have a project taken down.
 
 ## Submit
 
@@ -41,8 +42,9 @@ cargo install --git https://github.com/horizon-rust/horizon cargo-horizon-mod
 cargo horizon-mod check target/horizon-mod/my_mod.hmod
 ```
 
-**Updates** come the same way: the form adds a version to your entry. Only an entry's `owners` publish its updates
-without a reviewer's extra look. A published file never changes: publish a new version.
+**Updates** come the same way: the form adds a version to your entry, and a reviewer reads it before it is
+published. Only an entry's `owners` can add versions, and every version of a native mod is reviewed, owner or
+not: its code runs with the player's account permissions. A published file never changes: publish a new version.
 
 **Signing** is optional and recommended: put your [minisign](https://jedisct1.github.io/minisign/) public key in your
 entry, and every later version must be signed with it, so nobody else can publish an update in your name.
@@ -64,6 +66,7 @@ why.
 | `.github/workflows/check.yml` | A pull request's checks |
 | `.github/workflows/publish.yml` | On merge: releases, then `index.json` on Pages |
 | `.github/workflows/cleanup.yml` | Weekly: staging files nobody needs any more |
+| `.github/workflows/native-compat.yml` | Native mods on the newest Nightly, as the launcher builds them: a pull request's new version applied and compiled with the most downloaded native mods, its module names against every mod's; daily, every mod's newest version, the ones that don't apply marked `broken_on` in the index (`scripts/native_compat.py`) |
 | `.github/workflows/native.yml` | Horizon's native mods: each changed one's tests, `.hnmod` and game check, all of them together, and weekly on the newest Nightly |
 | `native/<name>/` | Horizon's own native mods (Zoom, FPS Counter, Keystrokes, Minimap, Recipes, Coordinates HUD): the source of their `.hnmod` files |
 | `native/tools/` | Shared by them: apply on Horizon, check, build, package, prove (`native/tools/native.py`) |
@@ -82,7 +85,8 @@ The index: `https://horizon-rust.github.io/horizon-mods/index.json`.
 [horizon-mixins](https://github.com/horizon-rust/horizon-mixins) bundles on Horizon's native hook points
 ([docs/native-mods.md](https://github.com/horizon-rust/horizon/blob/main/docs/native-mods.md)). Each folder keeps the
 history of the repository it came from. A mod builds on any Horizon whose hook points are at least the version its
-`compatibility.json` names; `horizon_revision` is the commit it was last tested on.
+`compatibility.json` names; `horizon_revision` is the commit it was last tested on. `smp` and `voicechat-server`
+are server mods, built into the official server's engine (see their READMEs).
 
 ```sh
 python3 native/tools/native.py check zoom          # apply on the tested Horizon and cargo check the game