⚡ Tool for Addon Devs: Test Custom Cordova Plugins & Build C3 with Capacitor Engine (No Whitelist)

Hi everyone,

I want to share a free, open-source utility I built to assist Construct 3 addon developers and those dealing with complex Cordova dependencies.

As we know, the official Construct 3 Build Service is excellent, but for security reasons, it maintains a strict whitelist for Cordova plugins. If you are developing a new C3 Addon that uses a custom Cordova plugin, you typically need to:

• Test locally (which might work fine because you have full control).
• Submit a whitelist request to Scirra on GitHub.
• Wait for review.

The Problem

Sometimes, a plugin works locally but fails in a strict Cloud Build environment (due to hook permission scripts, specific Gradle versions, Kotlin incompatibilities, or AndroidX conflicts). If this happens after you requested a whitelist, it wastes the Scirra team's time reviewing a broken plugin.

The Solution: Public Builder (Beta)

I created a Public, No-Sign-In build runner that has NO Whitelist restrictions.

👉 public.swaplab.net

How it helps the C3 Community:

You can use this to "Stress Test" your C3 exported project with your custom plugins in a real Cloud Environment (GitHub Actions Standard Runner).

1. Export C3 project as "Cordova Project".
2. Zip and upload to the Public Builder.
3. If it builds successfully here, it is highly likely to be "Cloud Safe".
4. Then, you can confidently submit your whitelist request to Scirra's Bug Tracker.

📺 Video Proof: Construct 3 AdMob via Capacitor Engine

Does it actually work? Here is a step-by-step video demonstrating a Construct 3 project (with AdMob Cordova plugin) being built using the Modern Capacitor Engine on the public builder:

Video Highlights:

• Export: Construct 3 → Cordova Project.
• Engine: capacitor-build-android-engine (Yes, it automatically wraps your C3/Cordova project!).
• Result: Running AdMob Ads on the Emulator.

💰 Sell Addons with Confidence

For those creating paid addons for the Construct 3 Asset Store, this tool is your safety net.

By verifying that your addon compiles correctly in a standard Linux/Docker cloud environment (similar to the official service) before listing it, you ensure your customers receive a robust product. This minimizes support tickets regarding "Build Errors" and helps you maintain a high reputation as a seller.

🔧 Tech Stack & Transparency

This runs on 100% Open Source infrastructure. You can watch the build queue and verify the workflows here:

• Public Runner: swaplab-engine/public-build-swaplab-engine
• Limits: Unlimited usage, strictly generates Debug APKs for testing.
• Privacy: Zero-retention. Files are deleted immediately after the build job triggers.

⚡ Supported Engines for C3

When you upload your

Cordova Project

Haha, thanks Ashley! I know, on paper, "Remote Code Execution as a Service" sounds like a sysadmin's nightmare. 😂

That is exactly why we spent months designing the security architecture before opening this public door. Just to clarify how we handle the "Oof" factor:

1. Total Isolation (Air-gapped Logic)

The Public Runners (GitHub Actions) are physically separated from our Private/Production infrastructure. Even if the public instance melts down or gets compromised, it touches nothing else.

2. "Blind" Orchestrator & Clean Images

Our security relies on a rigorous chain of custody:

• Clean Images: The Docker images used are public (GHCR) and contain zero baked-in secrets.
• No Local Secrets: Our backend (`server.js`) is stateless and has no `.env` file with credentials.
• Just-in-Time Access: If a key is ever needed, the container asks the Server -> the Server asks a Cloudflare Worker -> the Worker retrieves it from the encrypted Secrets Store.

Credentials exist in memory only for the millisecond they are needed, never stored on disk.

3. Abuse Prevention

We have strict hard-limits on CPU usage, execution time (to prevent crypto-mining), and network egress. We actually just successfully mitigated a DDoS attempt on December 11th with zero downtime, so the Cloudflare WAF or super bot fight mode is doing its job well so far.

It is a calculated risk, but I really wanted to give Addon Devs a way to test "Cloud Compatibility" for their plugins without bothering your team with whitelist requests for broken plugins, or just for testing.

Fingers crossed! 🤞