Skip to content

fix: CI workflow audit - repair bugs, remove dead config, consolidate shared logic#9314

Draft
mikhail-dcl wants to merge 3 commits into
devfrom
refactor/ci-shared-actions
Draft

fix: CI workflow audit - repair bugs, remove dead config, consolidate shared logic#9314
mikhail-dcl wants to merge 3 commits into
devfrom
refactor/ci-shared-actions

Conversation

@mikhail-dcl

@mikhail-dcl mikhail-dcl commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Pull Request Description

What does this PR change?

Full CI pipeline audit in three commits (supersedes #9312 and #9313).

1. Bug fixes

  • test.yml watchdog never ran — if without always() is wrapped in an implicit success() (verified on live runs); the gate now actually fails when lint/tests fail
  • Any label added mid-run (bots add new-dependency, claude-approved, no QA needed) cancelled in-flight test runs; cancellation and job conditions now mirror build-unitycloud.yml
  • test.yml push/merge_group only worked via null == false coercion; event conditions are now explicit (keeps the dev-push warning-baseline path alive)
  • enforce-group-approvals counted approvals later superseded by "request changes"; only each reviewer's latest state-changing review counts now
  • PR badge-comment workflows matched the first bot comment of any kind and could overwrite the warning-ratchet / ext-contribution comments; scoped to the badge body
  • test-performance Library cache key was constant — the first-ever entry was served forever; now hashFiles-based like test.yml
  • auto-sync-main-to-dev failed on every push while a sync PR was open; build-game-ci-image push trigger built malformed tags; dead githubToken env and no-op merge_group trigger removed

2. Dead-config cleanup

  • Dropped triggers no job can handle (workflow_dispatch ×6, pull_request_review_comment), the phantom matrix.target in pr-closure, the "null" version written to latest.json, the never-matching workflow_run path entry and dev-pointing target_commitish in build-release-main-page, an unneeded contents: write, ~35 lines of commented-out steps, and misleading contracts (commit_sha "required", full_version carrying short_version)

3. Consolidation (net −145 lines)

  • New composites: unity-image (was ×3 with diverging GHCR login/seed logic), unity-lfs-ssh (was ×3; drops one hardcoded-host-keys copy), load-prompt (was ×3)
  • New shared scripts: scripts/ci/s3-build-path.sh (S3 path format was ×4 — drift silently breaks download links), claude-review-comments.js (now paginates; single-page copies could miss the verdict), rerun-failed-enforce-approvals.sh
  • Merged the two release→latest.json workflows (now authenticated, no aws-cli container) and the two AI issue workflows into issue-triage.yml

Flagged, not changed: build-unitycloud declares 12 workflow_dispatch inputs vs GitHub's documented max of 10 — worth one manual dispatch test; the Dependency Security Review MEDIUM pending dead-end stays as-is by maintainer decision.

Validation: actionlint clean on all touched files, bash -n / node --check on new scripts.

Test Instructions

CI-only change — nothing to run in the client.

Steps (standard run): N/A

Prerequisites

  • None

Test Steps

  1. This PR's own Unity Test run exercises the new composites (image resolution, LFS/SSH)
  2. Add an unrelated label while tests run → the run must not be cancelled
  3. After the build completes, the badge comment's S3 links must resolve (path now comes from the shared script)
  4. Comment @claude review → status/comment behavior unchanged

Quality Checklist

  • Changes have been tested locally (actionlint, bash -n, node --check; watchdog bug verified against run history)
  • Documentation has been updated (if required) — inline comments
  • Performance impact has been considered — fewer cancelled/redundant CI runs
  • For SDK features: Test scene is included — N/A

🤖 Generated with Claude Code

mikhail-dcl and others added 3 commits July 7, 2026 11:49
@mikhail-dcl @claude
fix: repair CI workflow bugs found in pipeline audit
af8a68e 
- test.yml: watchdog gate never ran (implicit success() wrapping); any
  label add cancelled in-flight test runs; push/merge_group only passed
  via null==false coercion - make event conditions explicit
- build-unitycloud.yml: drop dead merge_group trigger (prebuild never
  handled the event, so queue runs skipped every job)
- auto-sync-main-to-dev.yml: don't fail when a sync PR is already open;
  fix dangling line continuation
- enforce-group-approvals.yml: count only each reviewer's latest
  state-changing review so superseded approvals don't satisfy the gate
- pr-comment-*.yml: scope find-comment to the build badge comment so it
  can't overwrite other bot comments
- test-performance.yml: Library cache key was constant (immutable cache
  pinned the first-ever entry forever); align with test.yml
- test.yml/test-performance.yml: remove githubToken that referenced a
  never-defined env var
- build-game-ci-image.yml: remove push trigger (inputs are empty on
  push, producing a malformed image tag)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@mikhail-dcl @claude
chore: remove dead CI config and fix misleading contracts
4460089 
- drop workflow_dispatch triggers no job can handle (claude-pr-review,
  claude-pr-review-require, enforce-group-approvals, auto-assign,
  pr-comment-artifact-url, pr-comment-warnings) and the unhandled
  pull_request_review_comment trigger in claude-pr-review
- pr-closure.yml: remove TARGET env - there is no matrix in this job and
  build.py --delete derives targets from BRANCH_NAME
- on-delete-release.yml: don't write version "null" to latest.json when
  the last release is deleted
- build-release-main-page.yml: remove workflow_run entry that matches by
  file path (matching is by name only), drop target_commitish pointing
  at the dev head, trim unused job outputs
- build-unitycloud.yml: remove defaults on required workflow_call inputs
  (never used); document the check names shared with test.yml
- test.yml: delete long-dead commented-out lint steps; document check
  names referenced by build-unitycloud.yml skip statuses
- close-inactive-issues.yml: drop contents:write - actions/stale does
  not need it
- version action: commit_sha is optional (falls back to GITHUB_SHA);
  callers already rely on that
- build-profile-nightly.yml: rename misleading full_version output that
  actually carried short_version

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@mikhail-dcl @claude
refactor: consolidate duplicated CI logic into shared actions and scr…
e9c7395 
…ipts

- .github/actions/unity-image: Unity version read + image tag composition
  + GHCR login + pull-or-seed, previously triplicated across test.yml
  (lint and test jobs) and test-performance.yml with three diverging
  login/seed implementations; adopts the strict miss detection and falls
  back to Docker Hub without seeding on transient GHCR errors
- .github/actions/unity-lfs-ssh: LFS list/cache/pull + ssh-agent +
  known_hosts (from the meta API, replacing one hardcoded-keys copy),
  previously triplicated in the same three jobs
- scripts/ci/s3-build-path.sh: single source of the event->prefix map
  and S3 destination format, previously quadruplicated across
  build-unitycloud, pr-comment-artifact-url, visual-regression and
  create-release-branch (drift there silently breaks download links)
- .github/actions/load-prompt: base-SHA prompt loading used by both
  claude-pr-review jobs and dependency-security-review
- .github/scripts/claude-review-comments.js: shared fetch/filter/
  minimize helpers for the three Claude marker-comment status steps
  (also upgrades two copies from a single-page listComments to paginate)
- .github/scripts/rerun-failed-enforce-approvals.sh: shared by
  claude-pr-review and enforce-group-approvals; both now get the
  in-progress guard and the same search depth
- test-performance.yml now uses the existing setup-docker-disk action
  instead of an inline copy of its docker data-root move
- test.yml: drop csharp-lint-reports upload (same files already
  uploaded as inspect-code-reports; no consumers); remove the
  /tmp/ssh-unity and /tmp/unity-home prep steps whose only consumers
  were the commented-out docker steps deleted earlier
- merge s3-latest-release + on-delete-release into one idempotent
  release->latest.json workflow (resolve current latest, write it)
- merge issue-deduplication + auto-label-issues into issue-triage.yml
  with a task choice input for manual dispatch
- annotate the fix/chore title regex with keep-in-sync notes across its
  three copies

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@mikhail-dcl
mikhail-dcl requested review from a team as code owners July 7, 2026 09:06
@github-actions

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

badge

Build skipped — no changes detected under Explorer/.

@mikhail-dcl mikhail-dcl changed the title refactor: consolidate duplicated CI logic into shared actions and scripts fix: CI workflow audit - repair bugs, remove dead config, consolidate shared logic Jul 7, 2026
@mikhail-dcl
mikhail-dcl changed the base branch from chore/ci-workflow-cleanup to dev July 7, 2026 09:37
This was referenced Jul 7, 2026
Closed
Closed
@mikhail-dcl
mikhail-dcl marked this pull request as draft July 7, 2026 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@DafGreco DafGreco Awaiting requested review from DafGreco
@alejandro-jimenez-dcl alejandro-jimenez-dcl Awaiting requested review from alejandro-jimenez-dcl
@lorenzo-ranciaffi lorenzo-ranciaffi Awaiting requested review from lorenzo-ranciaffi

At least 1 approving review is required to merge this pull request.

Assignees

@mikhail-dcl mikhail-dcl

Labels

new-dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mikhail-dcl