Add compliance validation pipeline for imported game catalog

[aqplemine]

Motivation

• Ensure imported game assets include clear licensing/attribution metadata and block content that lacks redistribution rights or has blocked licenses.
• Prevent inclusion of potentially malicious or credential-bearing source URLs by enforcing an allowlist and detecting suspicious hosts.
• Make compliance checks part of CI and catalog builds so problems are discovered early and a human can review/approve unclear cases.

Description

• Add scripts/validate/validate_catalog.py to validate required fields (id, title, source_url, source_license, source_license_status, attribution_required, redistribution_rights), capture source_license and attribution_required, detect duplicate ids, and reject blocked license states.
• Require manual_approval=true for entries with redistribution_rights of unknown or missing, otherwise block them.
• Implement host/domain allowlist (DEFAULT_ALLOWLIST_HOSTS) and suspicious host detection (punycode, known shorteners, malware/phish patterns, IP-literals, credential-in-URL) that block offending source_urls.
• Generate a markdown report at data/reports/compliance-report.md summarizing totals and issues for each run.
• Add scripts/validate/build_catalog.py as a simple wrapper to run the validator during catalog builds.
• Add a GitHub Actions workflow .github/workflows/compliance-validation.yml to run validation on push/pull_request against main and a baseline data/catalog/imported-games.json file for the validator entrypoint.

Testing

• Ran python scripts/validate/build_catalog.py which executed the validator and printed: Compliance validation passed (0 entries). and wrote the report, indicating success.
• Ran python scripts/validate/validate_catalog.py data/catalog/imported-games.json --report-path data/reports/compliance-report.md which also succeeded and generated data/reports/compliance-report.md.
• CI workflow file was added (.github/workflows/compliance-validation.yml) to enforce the same checks on push/PR (workflow not executed here).

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
omg-central	Ready	Preview, Comment	Apr 22, 2026 5:04am