ci: centralize Unity enrollment lifecycle - #316
Conversation
|
Cursor (@cursor) review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
Cursor (@cursor) review |
1ce4d3a to
1882f54
Compare
|
Cursor (@cursor) review |
|
Cursor (@cursor) review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
1 issue from previous review remains unresolved.
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 268cb55. Configure here.
|
Cursor (@cursor) review |
|
Copilot review |
…iation' into codex/issue-305-enrollment-remediation # Conflicts: # .github/workflows/perf-numbers.yml # .github/workflows/release.yml # .github/workflows/unity-benchmarks.yml # .github/workflows/unity-tests.yml
|
Final timeout-budget correction is now on head 9f0cdf1. All five licensed lock windows use 900-minute job caps, every step through the cleanup gate has a positive cap, acquire remains 305/300, and the positional policy validator requires at least 60 minutes beyond the summed lifecycle. It rejects duplicate-name, unnamed, inserted-cleanup, and bare-dash YAML bypasses. The merged head also gates licensed work on successful editor provisioning and keeps the renamed heartbeat test in static CI. Local verification: Node 406/406, workflow contracts 17/17, heartbeat 37/37, validate:all, spelling, Actionlint, Yamllint, pre-commit, and two independent zero-finding adversarial audits. JavaScript LOC is 17,488/17,500. Cursor (@cursor) review |
|
Copilot review |
|
Cursor (@cursor) review |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 3f28a5e. Configure here.
|
The validation-only correction is now complete on head 98fc555. The runner administrator manually reinstalled Unity 6000.3.16f1 with Windows IL2CPP support; workflows remain read-only validators. The final progress record now documents the unsupported in-place module attempt and the host-side bounded reinstall path. Local formatting, metadata validation, hooks, and diff checks pass.\n\n@cursor review\n@copilot review |
## Summary - record ruleset 17663217 as requiring exactly CI Success and Unity CI Success - retain the 14 individual static contexts only as migration history - record PR #316, the exact trusted audit result, and the remaining second-runner host repair in session progress ## Validation - npx prettier --write docs/runbooks/required-checks.md progress/session-178-unity-validation-only.md - npx markdownlint-cli2 docs/runbooks/required-checks.md - npx cspell --no-progress --no-summary docs/runbooks/required-checks.md progress/session-178-unity-validation-only.md - npm run validate:docs:strict - npm run validate:all - pre-commit run --files docs/runbooks/required-checks.md progress/session-178-unity-validation-only.md progress/session-178-unity-validation-only.md.meta - git diff --check Closes #310 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only updates to runbook and session progress; no workflow, ruleset, or application code changes. > > **Overview** > Updates **required-checks** runbook and session **178** progress to match production: ruleset `17663217` now requires only **`CI Success`** and **`Unity CI Success`** (live **2026-07-30**), with PR **#316** cited as verification. > > The runbook drops interim “15 individual contexts” guidance and the “aggregate not yet live” note. The 14 static job names are kept under **Retired Individual Static Contexts** for migration history and `CI Success` dependency audits, not for branch protection. The aggregate switch section is marked **DONE** with preserved conditions/bypass actors; fragile-check wording now states branch protection requires only **`CI Success`**. > > Session progress replaces open PR/host-repair steps with **delivery evidence**: merge commits, all nine Unity matrix cells green (including `6000.3.16f1` standalone IL2CPP), and trusted org audit run `30587754261` with zero DxMessaging findings on the merged default-branch commit. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 62dfa58. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
Closes #305.
Summary
Verification
npm test- 406 passed, 0 failedscripts/__tests__/test-unity-editor-heartbeat.ps1- 37 passed, 0 failednpm run validate:all- passed, including analyzer and package validationnpm run validate:docs:strict- passedgit diff --check- passedProvisioning evidence
The failed Unity 6000.3 standalone retry emitted 7,029 unchanged 50-percent progress lines over 1,800 seconds. That proves an unchanged progress triple is not a valid liveness signal; it does not prove that the install would have completed or that termination caused the later partial editor and directory lock. The new guard treats every stdout/stderr line as activity, uses monotonic timing, confirms direct-child exit, tests descendant cleanup and second-reap attribution, and suppresses retries whenever tree termination is not safely confirmed.
Screenshot evidence
The retained session note records desktop-independent RenderTexture staging for the real Monitor and Inspector. The Monitor path was diagnostic-free; Inspector still emits an IMGUI cursor diagnostic. Both proofs are dark-theme RGBA staging artifacts, not accepted Personal/light RGB24 documentation replacements. The remaining screenshot work is explicitly tracked in the note and manifest.
Note
High Risk
Changes touch the two-seat Unity serial lifecycle, organization build-lock integration, and the release publish gate—any misclassification or validation mismatch can block all Unity jobs or ship a bad release.
Overview
This PR restructures Unity CI so workflows no longer install or repair editors or host prerequisites; they only validate manually provisioned installs under
RUNNER_TOOL_CACHE/u6-v3viaensure-editor.ps1 -RequireHealthyExisting, with diagnostics undereditor-validationinstead ofprovisioning.License return and cleanup move from the removed repo-local
return-unity-licensecomposite to the organization build-lock repo (new pin0ce3dce…): return → classify evidence → release lock → require confirmed cleanup.run-ci-tests.ps1and export scripts gain-LicenseReturnOwner Centralso seat return aligns with that path.Workflow shape changes include static Unity version matrices (dropping dynamic
matrix-configjobs), runner preflight renamed to registration checks, stricter step timeouts andmax-parallel: 1on several legs, and new aggregate jobs (perf-unity-success,release-checks-success, etc.). Release no longer runs on tag push; operators manually dispatchrelease.ymlon the tag afterrelease-tag.ymlpushes it. Removed:unity-gameci-experiment.yml, weekly schedules,mainbranch triggers, and CI-owned-docs-only matrix skipping.Host prereqs and runner bootstrap become detect-only audits (no auto-install from Actions). Dependabot’s GitHub Actions scope is simplified after deleting the local return action.
Reviewed by Cursor Bugbot for commit 98fc555. Bugbot is set up for automated code reviews on this repo. Configure here.