fix: address PR #6 review — action pinning, wall render, AABB collision

Scorecard Pinned-Dependencies (github-advanced-security bot):
- Every GitHub Action pinned to commit SHA with the corresponding version
  tag in a trailing comment. Covers all six workflow files. This also
  bumps the actions to their current majors (checkout v6, setup-node v6,
  upload-artifact v7, pnpm/action-setup v6, codeql v4), obsoleting the
  open Dependabot PRs.

Gemini high-priority: WallLayerEntity O(N) scene-graph nodes
- Replaced per-tile Phaser.GameObjects.Rectangle with a single
  Phaser.Graphics fillRect batch. Turns 30x17-tile grids from hundreds of
  scene nodes into one.

Gemini high-priority: WallCollisionFeature point-based hit test
- Added PLAYER_SIZE_PX / PLAYER_HALF_EXTENT_PX constants.
- resolveMove now checks all four corners of the player's AABB, not just
  the center, eliminating the ghosting that let players sink half their
  size into a wall.
- Added a test that a center-point check would pass but the AABB check
  correctly rejects.
- Feature deps accept an optional playerHalfExtent override for tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: agjs

.github/workflows/arch-invariants.yml

@@ -10,7 +10,7 @@ jobs:
     name: grep-based banned patterns
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
       - name: no phaser imports in domain/
         run: |
           if grep -rnE "from ['\"]phaser" src/domain 2>/dev/null; then

.github/workflows/ci.yml

@@ -10,11 +10,11 @@ jobs:
     name: pnpm check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+      - uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.0
         with:
           version: 10.30.3
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: 22.22.0
           cache: pnpm
@@ -29,11 +29,11 @@ jobs:
     name: playwright smoke
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+      - uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.0
         with:
           version: 10.30.3
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: 22.22.0
           cache: pnpm

.github/workflows/codeql.yml

@@ -21,11 +21,11 @@ jobs:
       matrix:
         language: [javascript-typescript]
     steps:
-      - uses: actions/checkout@v5
-      - uses: github/codeql-action/init@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+      - uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.0.0
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.0.0
         with:
           category: '/language:${{ matrix.language }}'

.github/workflows/deploy-pages.yml

@@ -18,22 +18,22 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+      - uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.0
         with:
           version: 10.30.3
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: 22.22.0
           cache: pnpm
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
         id: pages
       - run: pnpm install --frozen-lockfile
       - name: build with public base path
         env:
           VITE_BASE_PATH: ${{ steps.pages.outputs.base_path }}
         run: pnpm build
-      - uses: actions/upload-pages-artifact@v4
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: ./dist
 
@@ -44,5 +44,5 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/deploy-pages@v4
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.0
         id: deployment

.github/workflows/release-please.yml

@@ -13,7 +13,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.0
         with:
           config-file: .github/release-please-config.json
           manifest-file: .github/.release-please-manifest.json

.github/workflows/security.yml

@@ -12,11 +12,11 @@ jobs:
     name: pnpm audit (production)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
+      - uses: pnpm/action-setup@903f9c1a6ebcba6cf41d87230be49611ac97822e # v6.0.0
         with:
           version: 10.30.3
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: 22.22.0
           cache: pnpm
@@ -35,19 +35,19 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.0
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@v2.4.3
+      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
           publish_results: true
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
         with:
           name: scorecard-results
           path: scorecard-results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.0.0
         with:
           sarif_file: scorecard-results.sarif

src/domain/player/Player.constants.ts

@@ -1,2 +1,4 @@
 export const PLAYER_SPEED_PX_PER_SEC = 220;
 export const PLAYER_START_POSITION = { x: 100, y: 100 } as const;
+export const PLAYER_SIZE_PX = 24;
+export const PLAYER_HALF_EXTENT_PX = PLAYER_SIZE_PX / 2;

src/domain/player/index.ts

@@ -2,4 +2,9 @@ export type { PlayerState } from './Player.types.js';
 export { createPlayer } from './Player.model.js';
 export { applyMoveIntent } from './Player.behavior.js';
 export type { MoveIntent } from './Player.behavior.js';
-export { PLAYER_SPEED_PX_PER_SEC, PLAYER_START_POSITION } from './Player.constants.js';
+export {
+  PLAYER_SPEED_PX_PER_SEC,
+  PLAYER_START_POSITION,
+  PLAYER_SIZE_PX,
+  PLAYER_HALF_EXTENT_PX,
+} from './Player.constants.js';

src/features/wall-collision/WallCollisionFeature.test.ts

@@ -11,28 +11,28 @@ const lookup = (types: readonly TileTypeDescriptor[]): TileTypeLookup => {
 };
 
 const tileTypes = lookup([
-  { id: 'empty', solid: false, destructible: false, displayColor: '#000' },
+  { id: 'empty', solid: false, destructible: false, displayColor: '#000000' },
   { id: 'brick', solid: true, destructible: true, displayColor: '#b35a1b' },
 ]);
 
 describe('WallCollisionFeature.resolveMove', () => {
   it('passes through a move that does not collide', () => {
     const grid = createGrid({ cols: 4, rows: 4, tileSize: 32 });
-    const feature = createWallCollisionFeature({ grid, tileTypes });
+    const feature = createWallCollisionFeature({ grid, tileTypes, playerHalfExtent: 12 });
     const prev = { ...createPlayer(), position: { x: 16, y: 16 } };
     const tent = { ...prev, position: { x: 48, y: 16 } };
     expect(feature.resolveMove(prev, tent)).toEqual(tent);
   });
 
   it('fully reverts when neither X-only nor Y-only can slide past walls', () => {
-    // Block the target tile and both adjacent single-axis slide destinations.
+    // Block the target tile and both single-axis slide destinations.
     let grid = createGrid({ cols: 4, rows: 4, tileSize: 32 });
     grid = setTile(grid, { col: 2, row: 2 }, 'brick');
     grid = setTile(grid, { col: 2, row: 1 }, 'brick'); // blocks X-only slide
     grid = setTile(grid, { col: 1, row: 2 }, 'brick'); // blocks Y-only slide
 
-    const feature = createWallCollisionFeature({ grid, tileTypes });
-    const prev = { ...createPlayer(), position: { x: 60, y: 60 } };
+    const feature = createWallCollisionFeature({ grid, tileTypes, playerHalfExtent: 12 });
+    const prev = { ...createPlayer(), position: { x: 50, y: 50 } };
     const tent = { ...prev, position: { x: 80, y: 80 }, velocity: { x: 100, y: 100 } };
     const resolved = feature.resolveMove(prev, tent);
     expect(resolved.position).toEqual(prev.position);
@@ -46,13 +46,30 @@ describe('WallCollisionFeature.resolveMove', () => {
       { col: 1, row: 2 },
       'brick',
     );
-    const feature = createWallCollisionFeature({ grid, tileTypes });
-    const prev = { ...createPlayer(), position: { x: 36, y: 48 } }; // in (col 1, row 1)
+    const feature = createWallCollisionFeature({ grid, tileTypes, playerHalfExtent: 12 });
+    const prev = { ...createPlayer(), position: { x: 36, y: 48 } };
     const tent = { ...prev, position: { x: 48, y: 68 }, velocity: { x: 100, y: 100 } };
     const resolved = feature.resolveMove(prev, tent);
-    // X advanced, Y reverted
     expect(resolved.position.x).toBe(48);
     expect(resolved.position.y).toBe(48);
     expect(resolved.velocity).toEqual({ x: 100, y: 0 });
   });
+
+  it('AABB catches a corner overlap that a center-point check would miss', () => {
+    // Wall at (col 2, row 1). world bounds x[64,96), y[32,64).
+    // Tent position (60, 50) has its center in (col 1, row 1) (empty),
+    // but its top-right corner (71, 38) is inside the wall.
+    const grid = setTile(
+      createGrid({ cols: 4, rows: 4, tileSize: 32 }),
+      { col: 2, row: 1 },
+      'brick',
+    );
+    const feature = createWallCollisionFeature({ grid, tileTypes, playerHalfExtent: 12 });
+    const prev = { ...createPlayer(), position: { x: 40, y: 50 } };
+    const tent = { ...prev, position: { x: 60, y: 50 }, velocity: { x: 100, y: 0 } };
+    const resolved = feature.resolveMove(prev, tent);
+    // X motion blocked because the top-right corner would enter the wall.
+    // Y motion was zero anyway; the move is fully rejected.
+    expect(resolved.position).toEqual(prev.position);
+  });
 });

src/features/wall-collision/WallCollisionFeature.ts

@@ -1,51 +1,68 @@
 import { worldToGrid, type GridState } from '@domain/grid';
-import type { PlayerState } from '@domain/player';
+import { PLAYER_HALF_EXTENT_PX, type PlayerState } from '@domain/player';
 import { isBlocked, type TileTypeLookup } from '@domain/wall';
 
 export interface IWallCollisionFeatureDeps {
   readonly grid: GridState;
   readonly tileTypes: TileTypeLookup;
+  /**
+   * Half the player's AABB extent on each axis, in world pixels.
+   * Collision is checked against the four corners of the player's bounding box
+   * rather than its center — a point-based check would let the player sink
+   * up to half its size into a wall before registering a hit.
+   */
+  readonly playerHalfExtent?: number;
 }
 
 export interface IWallCollisionFeature {
   /**
-   * Resolves a tentative move. If the tentative position would place the
-   * player inside a solid tile, the position is reverted axis-by-axis so
-   * the player can slide along a wall rather than sticking to it.
+   * Resolves a tentative move. If the tentative AABB intersects a solid tile,
+   * the position is reverted axis-by-axis so the player slides along a wall
+   * rather than sticking.
    */
   resolveMove: (previous: PlayerState, tentative: PlayerState) => PlayerState;
 }
 
 export const createWallCollisionFeature = (
   deps: IWallCollisionFeatureDeps,
 ): IWallCollisionFeature => {
-  const hitsWall = (p: PlayerState): boolean =>
-    isBlocked(deps.grid, worldToGrid(deps.grid, p.position), deps.tileTypes);
+  const halfExtent = deps.playerHalfExtent ?? PLAYER_HALF_EXTENT_PX;
+
+  const hitsWall = (p: PlayerState): boolean => {
+    const { x, y } = p.position;
+    const corners: ReadonlyArray<readonly [number, number]> = [
+      [x - halfExtent, y - halfExtent],
+      [x + halfExtent - 1, y - halfExtent],
+      [x - halfExtent, y + halfExtent - 1],
+      [x + halfExtent - 1, y + halfExtent - 1],
+    ];
+    for (const [cx, cy] of corners) {
+      if (isBlocked(deps.grid, worldToGrid(deps.grid, { x: cx, y: cy }), deps.tileTypes)) {
+        return true;
+      }
+    }
+    return false;
+  };
 
   return {
     resolveMove(previous, tentative) {
       if (!hitsWall(tentative)) {
         return tentative;
       }
-      // Try X-only, then Y-only, so movement slides along walls.
       const xOnly: PlayerState = {
         ...tentative,
         position: { x: tentative.position.x, y: previous.position.y },
       };
-
       if (!hitsWall(xOnly)) {
         return { ...xOnly, velocity: { x: tentative.velocity.x, y: 0 } };
       }
-
       const yOnly: PlayerState = {
         ...tentative,
         position: { x: previous.position.x, y: tentative.position.y },
       };
-
       if (!hitsWall(yOnly)) {
         return { ...yOnly, velocity: { x: 0, y: tentative.velocity.y } };
       }
-
       return { ...previous, velocity: { x: 0, y: 0 } };
     },
   };