fix: unblock beta compile and gate releases on test success (#1103)

* fix: align CaptureComposited with renamed Project*-folder API

PR #1040 added CaptureComposited referencing the old Assets-folder names
(CaptureFromCameraToAssetsFolder, AssetsRelativePath) and called
PrepareCaptureResult without the now-required folderOverride argument.
Renames into the Project* equivalents; same fix at the call sites in
ManageScene.cs.

Closes #1100

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci: gate releases on test success and trigger tests on PRs

Beta-release was publishing to PyPI in parallel with Unity Tests, so
broken commits could ship if Unity tests failed (as happened with #1100
on 9.6.9-beta.5). Make publish/version-bump jobs depend on the test
jobs in both beta-release.yml and release.yml. The whole release halts
before any irreversible commit/tag/push if either test job fails.

Also extends the test workflows to fire on PRs so failures are caught
before merge:
- python-tests: pull_request trigger; runs on every PR (no secrets).
- unity-tests: pull_request_target [labeled] trigger gated on the
  safe-to-test label and on the PR being from a fork. Maintainers
  apply the label after reviewing the diff; the workflow then runs
  with UNITY_LICENSE in scope against the PR head SHA. Re-pushed
  commits do NOT auto-trigger; maintainer must remove and re-apply
  the label to re-run after additional review.

In-repo PRs continue to be tested via the existing push trigger, so
no labeling friction for collaborator branches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(screenshot): propagate folderOverride to composited and specific-camera paths

Two pre-existing inconsistencies surfaced by CodeRabbit on #1103:

1. CaptureComposited dropped the caller's output_folder by hardcoding
   folderOverride: null in PrepareCaptureResult and the camera fallbacks.
   Adds the parameter to CaptureComposited's signature and plumbs it
   through both fallback paths.

2. The targetCamera and includeImage-in-play paths in ManageScene's
   game_view screenshot did not resolve cmd.outputFolder, so a request
   that selected a specific camera would always write to the default
   folder. Resolve via ScreenshotPreferences.Resolve as the other paths
   already do, and gate AssetDatabase.ImportAsset on IsUnderAssets so
   non-Assets folders don't trigger a futile import.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* ci(unity-tests): harden pull_request_target and gate artifact upload

Address CodeRabbit security review on #1103:

- persist-credentials: false on the checkout step, so GITHUB_TOKEN is
  not written to disk and cannot be read by subsequent steps running
  PR-controlled code.
- Explicit permissions: contents: read on the testAllModes job, scoping
  the workflow's token down from the default read/write set.
- Skip upload-artifact when the main test step was skipped (e.g.,
  because the preceding domain-reload step failed without
  continue-on-error). Avoids the noisy "No files were found" error
  on top of an already-failed run.

The label-gated trigger plus these mitigations narrow the blast radius
of the pull_request_target + checkout-PR-head pattern. The remaining
trust boundary is the maintainer review before applying safe-to-test;
documenting the review checklist (especially TestProjects/UnityMCPTests
diffs) is a follow-up.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: dsarno

.github/workflows/beta-release.yml

@@ -13,9 +13,21 @@ on:
       - "MCPForUnity/**"
 
 jobs:
+  unity_tests:
+    name: Unity tests gate
+    if: github.actor != 'github-actions[bot]'
+    uses: ./.github/workflows/unity-tests.yml
+    secrets: inherit
+
+  python_tests:
+    name: Python tests gate
+    if: github.actor != 'github-actions[bot]'
+    uses: ./.github/workflows/python-tests.yml
+
   update_unity_beta_version:
     name: Update Unity package to beta version
     runs-on: ubuntu-latest
+    needs: [unity_tests, python_tests]
     # Avoid running when the workflow's own automation merges the PR
     # created by this workflow (prevents a version-bump loop).
     if: github.actor != 'github-actions[bot]'
@@ -143,6 +155,7 @@ jobs:
   publish_pypi_prerelease:
     name: Publish beta to PyPI (pre-release)
     runs-on: ubuntu-latest
+    needs: [unity_tests, python_tests]
     # Avoid double-publish when the bot merges the version bump PR
     if: github.actor != 'github-actions[bot]'
     environment:

.github/workflows/python-tests.yml

@@ -6,7 +6,19 @@ on:
     paths:
       - Server/**
       - .github/workflows/python-tests.yml
+  pull_request:
+    branches: [main, beta]
+    paths:
+      - Server/**
+      - .github/workflows/python-tests.yml
   workflow_dispatch: {}
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to test (defaults to the triggering ref)."
+        type: string
+        required: false
+        default: ""
 
 jobs:
   test:
@@ -15,6 +27,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4

.github/workflows/release.yml

@@ -19,9 +19,23 @@ on:
         required: true
 
 jobs:
+  unity_tests:
+    name: Unity tests gate
+    uses: ./.github/workflows/unity-tests.yml
+    with:
+      ref: beta
+    secrets: inherit
+
+  python_tests:
+    name: Python tests gate
+    uses: ./.github/workflows/python-tests.yml
+    with:
+      ref: beta
+
   bump:
     name: Bump version, tag, and create release
     runs-on: ubuntu-latest
+    needs: [unity_tests, python_tests]
     permissions:
       contents: write
       pull-requests: write

.github/workflows/unity-tests.yml

@@ -2,17 +2,41 @@ name: Unity Tests
 
 on:
   workflow_dispatch: {}
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to test (defaults to the triggering ref)."
+        type: string
+        required: false
+        default: ""
   push:
     branches: ["**"]
     paths:
       - TestProjects/UnityMCPTests/**
       - MCPForUnity/Editor/**
       - .github/workflows/unity-tests.yml
+  # Fork PRs: maintainer applies the 'safe-to-test' label after reviewing
+  # the diff. The workflow runs with UNITY_LICENSE in scope against the
+  # PR's head SHA. Re-pushed commits do NOT auto-trigger — maintainer must
+  # remove and re-apply the label to re-run after additional review.
+  pull_request_target:
+    types: [labeled]
+    branches: [main, beta]
+    paths:
+      - TestProjects/UnityMCPTests/**
+      - MCPForUnity/Editor/**
+      - .github/workflows/unity-tests.yml
 
 jobs:
   testAllModes:
     name: Test in ${{ matrix.testMode }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    if: >
+      github.event_name != 'pull_request_target' ||
+      (github.event.pull_request.head.repo.full_name != github.repository &&
+       github.event.label.name == 'safe-to-test')
     strategy:
       fail-fast: false
       matrix:
@@ -27,6 +51,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           lfs: true
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.ref }}
+          persist-credentials: false
 
       - name: Detect Unity license secrets
         id: detect
@@ -107,7 +133,7 @@ jobs:
           fi
 
       - uses: actions/upload-artifact@v4
-        if: always() && steps.detect.outputs.unity_ok == 'true'
+        if: always() && steps.detect.outputs.unity_ok == 'true' && steps.tests.outcome != 'skipped'
         with:
           name: Test results for ${{ matrix.testMode }}
           path: ${{ steps.tests.outputs.artifactsPath }}

MCPForUnity/Editor/Tools/ManageScene.cs

@@ -598,26 +598,32 @@ private static object CaptureScreenshot(SceneCommand cmd)
                 {
                     if (!Application.isBatchMode) EnsureGameView();
 
-                    ScreenshotCaptureResult result = ScreenshotUtility.CaptureFromCameraToAssetsFolder(
+                    string folderOverride = ScreenshotPreferences.Resolve(cmd.outputFolder);
+                    ScreenshotCaptureResult result = ScreenshotUtility.CaptureFromCameraToProjectFolder(
                         targetCamera, fileName, resolvedSuperSize, ensureUniqueFileName: true,
-                        includeImage: includeImage, maxResolution: maxResolution);
+                        includeImage: includeImage, maxResolution: maxResolution,
+                        folderOverride: folderOverride);
 
-                    AssetDatabase.ImportAsset(result.AssetsRelativePath, ImportAssetOptions.ForceSynchronousImport);
-                    string message = $"Screenshot captured to '{result.AssetsRelativePath}' (camera: {targetCamera.name}).";
+                    if (ScreenshotUtility.IsUnderAssets(result.ProjectRelativePath))
+                        AssetDatabase.ImportAsset(result.ProjectRelativePath, ImportAssetOptions.ForceSynchronousImport);
+                    string message = $"Screenshot captured to '{result.ProjectRelativePath}' (camera: {targetCamera.name}).";
                     return new SuccessResponse(message, BuildScreenshotResponseData(result, targetCamera.name, includeImage));
                 }
 
                 if (includeImage && Application.isPlaying)
                 {
                     if (!Application.isBatchMode) EnsureGameView();
 
+                    string folderOverride = ScreenshotPreferences.Resolve(cmd.outputFolder);
                     ScreenshotCaptureResult result = ScreenshotUtility.CaptureComposited(
                         fileName, resolvedSuperSize, ensureUniqueFileName: true,
-                        includeImage: true, maxResolution: maxResolution);
+                        includeImage: true, maxResolution: maxResolution,
+                        folderOverride: folderOverride);
 
-                    AssetDatabase.ImportAsset(result.AssetsRelativePath, ImportAssetOptions.ForceSynchronousImport);
+                    if (ScreenshotUtility.IsUnderAssets(result.ProjectRelativePath))
+                        AssetDatabase.ImportAsset(result.ProjectRelativePath, ImportAssetOptions.ForceSynchronousImport);
                     string cameraName = Camera.main != null ? Camera.main.name : "composited";
-                    string message = $"Screenshot captured to '{result.AssetsRelativePath}' (camera: {cameraName}).";
+                    string message = $"Screenshot captured to '{result.ProjectRelativePath}' (camera: {cameraName}).";
                     return new SuccessResponse(message, BuildScreenshotResponseData(result, cameraName, includeImage: true));
                 }
 
@@ -747,7 +753,7 @@ private static Dictionary<string, object> BuildScreenshotResponseData(
         {
             var data = new Dictionary<string, object>
             {
-                { "path", result.AssetsRelativePath },
+                { "path", result.ProjectRelativePath },
                 { "fullPath", result.FullPath },
                 { "superSize", result.SuperSize },
                 { "isAsync", false },

MCPForUnity/Runtime/Helpers/ScreenshotUtility.cs

@@ -246,18 +246,20 @@ public static ScreenshotCaptureResult CaptureComposited(
             int superSize = 1,
             bool ensureUniqueFileName = true,
             bool includeImage = false,
-            int maxResolution = 0)
+            int maxResolution = 0,
+            string folderOverride = null)
         {
             if (!IsScreenCaptureModuleAvailable)
             {
                 var fallbackCamera = FindAvailableCamera();
                 if (fallbackCamera != null)
-                    return CaptureFromCameraToAssetsFolder(fallbackCamera, fileName, superSize, ensureUniqueFileName, includeImage, maxResolution);
+                    return CaptureFromCameraToProjectFolder(fallbackCamera, fileName, superSize, ensureUniqueFileName,
+                        includeImage, maxResolution, folderOverride: folderOverride);
 
                 throw new InvalidOperationException("ScreenCapture module is unavailable and no fallback camera found.");
             }
 
-            ScreenshotCaptureResult result = PrepareCaptureResult(fileName, superSize, ensureUniqueFileName, isAsync: false);
+            ScreenshotCaptureResult result = PrepareCaptureResult(fileName, superSize, ensureUniqueFileName, folderOverride: folderOverride, isAsync: false);
             Texture2D tex = null;
             Texture2D downscaled = null;
             string imageBase64 = null;
@@ -270,7 +272,8 @@ public static ScreenshotCaptureResult CaptureComposited(
                     // Fallback to camera-based if ScreenCapture fails
                     var cam = FindAvailableCamera();
                     if (cam != null)
-                        return CaptureFromCameraToAssetsFolder(cam, fileName, superSize, ensureUniqueFileName, includeImage, maxResolution);
+                        return CaptureFromCameraToProjectFolder(cam, fileName, superSize, ensureUniqueFileName,
+                            includeImage, maxResolution, folderOverride: folderOverride);
                     throw new InvalidOperationException("ScreenCapture.CaptureScreenshotAsTexture returned null and no fallback camera available.");
                 }
 
@@ -308,7 +311,7 @@ public static ScreenshotCaptureResult CaptureComposited(
             if (includeImage && imageBase64 != null)
             {
                 return new ScreenshotCaptureResult(
-                    result.FullPath, result.AssetsRelativePath, result.SuperSize, false,
+                    result.FullPath, result.ProjectRelativePath, result.SuperSize, false,
                     imageBase64, imgW, imgH);
             }
             return result;