[dispatcharr-ranked-matchups] Bump to 1.19.0

[Jacob-Lasky]

Metadata-only bump for dispatcharr-ranked-matchups: 1.17.0 → 1.19.0.

Release: https://github.com/Jacob-Lasky/dispatcharr_ranked_matchups/releases/tag/v1.19.0

source_type, source_url, author, license and description are unchanged.

Pre-flight against validate.sh

check	result
version strict semver	1.19.0
version greater than published	1.19.0 > 1.17.0
required fields (name, version, description)	present
source_url HTTPS + {version} placeholder	unchanged, both hold
resolved source_url returns 200	verified, HTTP 200
author matches PR author	Jacob-Lasky

The release asset was downloaded after publishing and confirmed byte-identical (sha256 14100eff4527addb…) to the local build, with the required snake_case top-level folder dispatcharr_ranked_matchups/ so intra-plugin imports resolve on install.

What's in 1.19.0

• Fixed a user-reported mis-match: tennis and golf events were matching a darts channel, because a tournament title's last token (Open, Championship, Masters, Prix) was treated as a keyword strong enough to match on its own. Measured over 22,137 real channel and stream names, Championship alone matched 383 of them. Removing the wildcard also recovered correct matches.
• Fixed MLS importance reading ~0 all season, caused by the season sweep clamping itself to a 7-day window while the simulator needs the whole season. Nonzero importance went from 9/18 to 18/18 games. The same change collapsed a ~300-request season fetch into 1.
• Added a second per-matchup logo source (game-thumbs, MIT) for the leagues TheSportsDB never indexed a graphic for, plus 27 team-name aliases derived from that API's own team lists. On a live slate this took curated channels from 6 with a real matchup image to 23 of 23, with nothing falling back to a generic league badge. New optional setting for the base URL; blank disables the tier.
• Added league badges for field-event sports (F1, NASCAR, PGA, UFC, ATP, WTA, boxing), which can never earn a head-to-head composite.

Full notes in the release. Tests: 3,654 → 3,769, zero failures, zero skips.

[dispatcharr-plugins-bot]

Plugin Validation Results

Modified plugins: 1

Plugin: dispatcharr-ranked-matchups

Never miss a good game. Scores every upcoming game across 37 leagues, tours and competitions (20 of them soccer, plus NFL, NBA, MLB, NHL, NCAA, UFC, boxing, tennis, golf and motorsport), then builds a Top Matchups group holding only the ones worth watching and shows why each game ranked where it did in its EPG description.

Source Repository

Check	Status	Details
Required fields	✅	All required fields present
Release artifact	✅	Artifact reachable at resolved URL
Maintainers	✅	Jacob-Lasky
License	✅	MIT - MIT License
Permission	✅	You have permission to modify this plugin
Version	✅	1.19.1
Version bump	✅	1.17.0 → 1.19.1

View release v1.19.1 on GitHub · Compare v1.17.0...v1.19.1

---

🎉 All validation checks passed!

This PR modifies 1 plugin(s) and all checks have passed.

[Jacob-Lasky]

Updated to 1.20.0, which supersedes the 1.19.x bumps on this PR. Two changes since the first push, both prompted by this PR's own checks and review:

1. The CodeQL finding is fixed (1.19.1). py/clear-text-logging-sensitive-data was correct: TheSportsDB carries its API key as a URL path segment, so the composed URL was key-bearing and was being logged through a project-local redactor that CodeQL cannot see. Nothing leaked — the redactor worked — but a sanitiser an analyser can't verify is indistinguishable from none. The helper now takes a static endpoint label ("searchevents" / "lookupleague") and logs that, so the key has no path to a log call at all.

2. The game-thumbs logo tier is now opt-in and off by default (1.20.0). 1.19.0 defaulted its base URL to a third-party public instance, which opted every installation into a service that then sees which fixtures the user curates. That was a default rather than a choice, so the default is now blank, which disables the tier and issues no third-party request at all. Self-hosting (ghcr.io/sethwv/game-thumbs) is the documented way to enable it.

The clamav-scan failure on the previous run was infrastructure, not the plugin — it died in Set up job on 429 Too Many Requests while downloading actions/create-github-app-token, before scanning anything. Should clear on a re-run.

Artifact for the new version verified: resolved source_url returns 200 across repeated probes and the downloaded zip is byte-identical to the local build (sha256 cc62033105fcba3a…), with the required snake_case top-level folder.

[Jacob-Lasky]

Heads up: I think this one is stuck on something on your side rather than on the PR.

All the individual checks pass on the latest commit: validate-plugin, codeql-analyze, clamav-scan and validate-title. I also pulled the fragment artifact that the report job reads, and every row in it is green:

Required fields ✅   Release artifact ✅   Maintainers ✅
License ✅ MIT       Permission ✅         Version ✅ 1.20.0
Version bump ✅ 1.17.0 → 1.20.0

But report still ends with Plugin validation failed at its "Fail workflow if any plugin failed" step. Its own env in that same job reads CODEQL_RESULT: success, CLAMAV_RESULT: success, TITLE_VALID: true, OUTSIDE_VIOLATION: false.

• Run: https://github.com/Dispatcharr/Plugins/actions/runs/32050550473
• Fragment artifact: https://github.com/Dispatcharr/Plugins/actions/runs/32050550473/artifacts/9294527523

Earlier runs on this PR did fail for real, so it may just be picking up a stale signal from those. The first run caught a genuine CodeQL finding in my plugin (py/clear-text-logging-sensitive-data), which I fixed in 1.19.1, and a clamav-scan that died in Set up job on a 429 while downloading actions/create-github-app-token. Both are green now.

Happy to push an empty commit to trigger a fresh run, or to change anything on my side. Just say what would help.