fix: pin the store's images to the release tag they were reviewed at

[MuhammedResulBilkil]

Closes the one open thread on PluginDatabase#213 — the review flagged that thumbnail and splash_image pointed at master.

Why the submodule pin doesn't already cover this

Millennium's schema requires an absolute URL for both fields, so they can't be repository-relative paths. The store fetches them when someone opens the listing, not when the plugin is reviewed. On a branch ref the image a reviewer approved and the image a user is shown are free to differ, indefinitely, without anything changing in the submodule the database pins.

Why this isn't a hardcoded tag

Hardcoding v1.0.1 would fight semantic-release, which owns the version field, and would add a release step to forget. Instead sync-version.ts rewrites the ref alongside the version it already writes, in the same prepare step.

The chicken-and-egg it looks like it has isn't real: @semantic-release/git commits plugin.json during prepare and semantic-release tags that commit, so the tag these URLs name is the tag they're committed under, and assets/ exists there. Verified by simulating a release locally:

$ tsx scripts/sync-version.ts 1.0.1
updated package.json to 1.0.1
updated plugin.json to 1.0.1
package.json and plugin.json agree on 1.0.1, images pinned to v1.0.1

  thumbnail    .../cs2tracker-extension/v1.0.1/assets/thumbnail.png
  splash_image .../cs2tracker-extension/v1.0.1/assets/splash.png
  $schema      .../Millennium/main/src/system/plugin-schema.json   <- untouched

Guards

--check, which CI already runs, gains the matching assertion. A hand-edit back onto a branch ref now fails the build rather than surfacing in the store listing:

sync-version: plugin.json "thumbnail" is pinned to "master", not "v1.0.0"

$schema is deliberately excluded — it tracks Millennium's main so editor hints follow the schema as it changes. That exclusion is asserted in the tests, so widening the rule to "every raw URL in the manifest" can't freeze it by accident.

repinAssetUrl throws rather than passing a URL through unchanged. The schema names Imgur as an acceptable host, so an unparseable URL is plausible, and silently returning it would leave a mutable image in a released manifest while reporting success.

Verification

• 260 tests pass (18 files), up from 250 — 10 new in tests/store-image-pins.test.ts
• tsc --noEmit clean on both tsconfig.json and scripts/tsconfig.json
• sync-version.ts --check passes against the committed tree
• All five asset URLs return 200 at the v1.0.0 tag, so the pin resolves today

After merge

Merging cuts v1.0.1, which re-pins both URLs to v1.0.1. The submodule in the PluginDatabase fork then needs bumping to that tag so the listing ships the pinned manifest.

[github-actions]

🎉 This PR is included in version 1.0.1 🎉

The release is available on:

• v1.0.1
• GitHub release

Your semantic-release bot 📦🚀