Prepare V1 release build, privacy, and backend hardening

.githooks/pre-commit

@@ -9,9 +9,8 @@
 
 echo "🔍 Running pre-commit checks..."
 
-# Run the CI command
-lune run ci
+# Run the same local checks as CI
+lute run lint && lute run analyze
 
-# Exit with the same code as the CI command
+# Exit with the same code as the checks
 exit $?
-

.github/workflows/analyze.yml

@@ -25,13 +25,16 @@ jobs:
       - name: 📋 Verify tools
         run: rokit list
 
-      - name: Run Lune setup
-        run: lune setup
+      - name: Run Lute setup
+        run: lute setup
 
       - name: 📦 Setup project
-        run: lune run setup
+        run: lute run setup
         env:
           ROBLOX_API_KEY: ${{ secrets.ROBLOX_API_KEY }}
 
+      - name: 🔎 Run lint
+        run: lute run lint
+
       - name: 🔎 Run static analysis
-        run: lune run ci
+        run: lute run analyze

.github/workflows/deploy.yml

@@ -22,7 +22,14 @@ jobs:
       - uses: arduino/setup-protoc@v3
 
       - name: Install worker-build and wasm-bindgen-cli
-        run: cargo install worker-build wasm-bindgen-cli
+        run: |
+          cargo install worker-build
+          cargo install wasm-bindgen-cli --version 0.2.125
+
+      - name: Test
+        run: |
+          cd backend
+          cargo test
 
       - name: Build
         run: |

.github/workflows/release-pr.yml

@@ -19,6 +19,12 @@ jobs:
       - name: 📥 Checkout repository
         uses: actions/checkout@v4
 
+      - name: 🔧 Install Rokit
+        uses: CompeyDev/setup-rokit@v0.1.2
+        with:
+          cache: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: ✅ Validate version
         run: |
           if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -33,14 +39,16 @@ jobs:
             echo "::error::Failed to update version in plugin/wally.toml"
             exit 1
           }
+          cd plugin
+          wally install
 
       - name: 🌿 Create branch and commit
         run: |
           BRANCH="release/v${{ inputs.version }}"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "$BRANCH"
-          git add plugin/wally.toml
+          git add plugin/wally.toml plugin/wally.lock
           git commit -m "release: v${{ inputs.version }}"
           git push -u origin "$BRANCH"
 

.github/workflows/release.yml

@@ -1,6 +1,17 @@
 name: 🚀 Release Plugin
 
 on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build and upload artifact without tagging or publishing"
+        required: true
+        type: boolean
+        default: true
+      version:
+        description: "Version to publish when dry_run is false, without the v prefix"
+        required: false
+        type: string
   pull_request:
     types: [closed]
     branches: [main]
@@ -11,21 +22,42 @@ permissions:
 jobs:
   release:
     if: >-
-      github.event.pull_request.merged == true &&
-      startsWith(github.event.pull_request.head.ref, 'release/v')
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event.pull_request.merged == true &&
+        startsWith(github.event.pull_request.head.ref, 'release/v')
+      )
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
     steps:
       - name: 🔍 Extract version
         id: meta
         run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            DRY_RUN="${{ inputs.dry_run }}"
+            VERSION="${{ inputs.version }}"
+
+            if [ "$DRY_RUN" = "true" ]; then
+              VERSION="${VERSION:-dry-run}"
+            elif ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "::error::Manual publish requires a semver version input like 1.2.3"
+              exit 1
+            fi
+
+            echo "dry_run=$DRY_RUN" >> "$GITHUB_OUTPUT"
+            echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           BRANCH="${{ github.event.pull_request.head.ref }}"
           VERSION="${BRANCH#release/v}"
           if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "::error::Could not parse version from branch '$BRANCH'"
             exit 1
           fi
+
+          echo "dry_run=false" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: 📥 Checkout repository
@@ -37,20 +69,62 @@ jobs:
           cache: true
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run Lune setup
-        run: lune setup
+      - name: 📋 Verify tools
+        run: rokit list
+
+      - name: Run Lute setup
+        run: lute setup
 
       - name: 📦 Setup project
-        run: lune run setup
+        run: lute run setup
         env:
           ROBLOX_API_KEY: ${{ secrets.ROBLOX_API_KEY }}
 
       - name: 🛠️ Build plugin
-        run: lune run build --release
+        run: |
+          lute run build \
+            --channel prod \
+            --target creator-store \
+            --output StudioActivity.rbxm \
+            --skip-reload \
+            --clean
         env:
+          API_HOST: activity.brooke.sh
           DISCORD_CLIENT_ID: ${{ secrets.DISCORD_CLIENT_ID }}
 
+      - name: ✅ Verify release artifact
+        run: |
+          test -f StudioActivity.rbxm
+          test -f plugin/build/prod/creator-store/src/BuildVars/BuildVars.json
+
+          forbidden="$(
+            {
+              find plugin/build/prod/creator-store -path '*/DevPackages/*' -print
+              find plugin/build/prod/creator-store -type f \( \
+                -name '*.test.lua*' -o \
+                -name '*.story.lua*' -o \
+                -name '*.storybook.lua*' -o \
+                -name 'jest.config.lua*' \
+              \) -print
+            } | sed -n '1,200p'
+          )"
+
+          if [ -n "$forbidden" ]; then
+            echo "::error::Release artifact contains forbidden files:"
+            echo "$forbidden"
+            exit 1
+          fi
+
+      - name: 📤 Upload dry-run artifact
+        if: steps.meta.outputs.dry_run == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: StudioActivity-dry-run
+          path: StudioActivity.rbxm
+          if-no-files-found: error
+
       - name: 🔖 Tag release
+        if: steps.meta.outputs.dry_run != 'true'
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           git config user.name "github-actions[bot]"
@@ -59,6 +133,7 @@ jobs:
           git push origin "v$VERSION"
 
       - name: 🚀 Publish GitHub Release
+        if: steps.meta.outputs.dry_run != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

.github/workflows/test.yml

@@ -29,16 +29,32 @@ jobs:
       - name: 📋 Verify tools
         run: rokit list
 
-      - name: Run runtime setup
-        run: |
-          lune setup
-          lute setup
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: wasm32-unknown-unknown
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: backend -> target
+
+      - uses: arduino/setup-protoc@v3
+
+      - name: Install wasm-bindgen test runner
+        run: cargo install wasm-bindgen-cli --version 0.2.125
+
+      - name: Run Lute setup
+        run: lute setup
 
       - name: 📦 Setup project
-        run: lune run setup
+        run: lute run setup
         env:
           ROBLOX_API_KEY: ${{ secrets.ROBLOX_API_KEY }}
 
+      - name: 🧪 Run backend tests
+        run: |
+          cd backend
+          cargo test
+
       - name: 🔎 Run tests
         run: lute run test
         env:

.luaurc

@@ -1,7 +1,6 @@
 {
 	"languageMode": "strict",
 	"aliases": {
-		"lune": "~/.lune/.typedefs/0.10.4/",
 		"lint": "~/.lute/typedefs/1.0.0/lint",
 		"lute": "~/.lute/typedefs/1.0.0/lute",
 		"std": "~/.lute/typedefs/1.0.0/std",