chore: improve engineering excellence

[KevinTCoughlin]

Summary

• address high-confidence correctness, security, reliability, and maintainability gaps found during an engineering-excellence audit
• strengthen automated validation, CI/CD safety, documentation, and developer experience where applicable
• incorporate fixes from an independent regression review of the complete patch

Validation

• repository-specific tests, linters, builds, and static checks passed where supported by the local platform
• final git diff --check passed

Hardware-, platform-, or live-infrastructure-dependent checks are documented in the changed project guidance where applicable.

[Copilot]

Pull request overview

This PR hardens the CS Server container stack by tightening startup input validation, improving operational safety (health checks, permissions), and expanding automated regression coverage to prevent configuration-driven failures and unsafe runtime behavior.

Changes:

• Add regression tests for entrypoint.sh validation and Compose rendering; wire them into just check and CI.
• Harden runtime behavior: stricter env-var validation, safer FIFO location/permissions, and health checks for Compose/Quadlet.
• Improve supply-chain and repo hygiene: stop piping curl | tar, bundle default maps from docs/, and tighten GitHub Actions permissions/conditions.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/entrypoint_test.sh	Adds regression tests for entrypoint validation and exit-status propagation.
tests/compose_test.sh	Adds Compose config rendering assertions (NOMASTER).
README.md	Updates docs for bundled maps, validation behavior, health checks, and restore guidance.
quadlet/scoutzknivez.container	Adds network-online dependency and container health check.
plugins/amxmodx/AQS.ini	Changes AQS defaults (disable “skip existing info” and SQL).
justfile	Adds just test and includes tests in just check; hardens FIFO RCON write path.
install.sh	Hardens installer defaults (umask/permissions) and updates Quadlet unit (network-online + health check).
entrypoint.sh	Adds env-var validation, moves FIFO into private runtime dir, improves shutdown + exit status behavior.
CONTRIBUTING.md	Updates contributor commands to include tests.
Containerfile	Avoids `curl
compose.yml	Adds NOMASTER env and Compose healthcheck.
CLAUDE.md	Updates FIFO path documentation.
.github/workflows/nightly.yml	Makes SARIF upload conditional on Trivy step success (with step id).
.github/workflows/friday-dust2.yml	Adds explicit minimal contents: read permissions.
.github/workflows/docker.yml	Expands path filters to include .containerignore and bundled maps.
.github/workflows/ci.yml	Runs the new regression tests in CI.
.github/copilot-instructions.md	Updates FIFO path documentation.
.env.example	Documents MAPCYCLE and NOMASTER env vars.
.containerignore	Allows bundling only map artifacts from docs/cstrike/maps/ into build context.

Suppressed comments (1)

entrypoint.sh:151

• script is no longer run with -q, so it will emit its start/stop banner to stdout/stderr, adding noise to container logs and potentially confusing log-based monitoring. Re-add quiet mode while keeping -e so the exit status is propagated.

printf -v HLDS_COMMAND '%q ' "${HLDS_ARGS[@]}"

script -eqfc "${HLDS_COMMAND}" /dev/null < "${FIFO}" &
SCRIPT_PID=$!

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.