Pre-review: Starlight .star distribution and immutable catalog requests

[mangataw]

Hi! I am preparing Steam Game Name Zh for a future PluginDatabase submission and would like to confirm two distribution details before opening a formal PR.

Review branch: https://github.com/mangataw/SteamGameName/tree/codex/docs-millennium-menu-race

Project context

• Windows-only Millennium 3.4+ plugin
• Lua backend, built with Starlight 1.1.3
• Produces one verified, unsigned steam-game-name-zh.star
• Uses the current official PluginTemplate layout with millennium.toml
• No credentials, telemetry, custom binaries, or uploaded Steam-library/search data
• Bundles a validated 692-entry AppID-to-Simplified-Chinese display catalog

1. Intended Starlight distribution path

Using these baselines:

• PluginTemplate: af0a07c7c90de902333ab5268e53ac1bf73bed36
• PluginDatabase: 97403bdb67bce6650734bf8d1963989af59d3b46

the official template contains millennium.toml and no root plugin.json, while PluginDatabase's scripts/build/prepare-dist.sh still exits when plugin.json is absent. Running that script unchanged after a successful Starlight build reproduced:

plugin.json was not found. It is required for plugins to have.

What is the intended PluginDatabase submission and distribution path for a Starlight .star plugin? Should we wait for the database pipeline to support the current template, or is there a maintainer-approved compatibility manifest/layout?

We will not add a guessed legacy manifest.

2. Immutable same-commit catalog request

Each release embeds the complete catalog and can conditionally request the same JSON file from GitHub Raw, pinned to the full 40-character commit SHA that built that release:

https://raw.githubusercontent.com/mangataw/SteamGameName/<full-release-commit-sha>/data/translations.zh-CN.json

Later changes to main cannot affect an existing release. The URL is build-time fixed and cannot be changed by users or downloaded content. Requests use TLS, do not follow redirects, time out after 8 seconds, and send no Steam ID, library, search, settings, or telemetry data. Responses are size-limited and validated as non-executable Schema v1 AppID/name data; invalid responses never replace the bundled catalog or last valid cache.

Is this immutable, data-only, same-commit request acceptable for PluginDatabase review, or must the plugin use only its bundled copy with no network request? Any catalog update will require a new plugin release and PluginDatabase commit-pointer update.

This is only a pre-review question; no PluginDatabase submission PR has been opened yet. Thanks for any guidance.