Merge remote-tracking branch 'origin/dev' into feat/ci-windows-only-and-macos-only-flags

# Conflicts:
#	.github/workflows/build-unitycloud.yml

Author: NickKhalow

.github/workflows/build-unitycloud.yml

@@ -452,7 +452,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: prebuild
     if: needs.prebuild.outputs.should_build == 'true'
-    timeout-minutes: 360
+    # Safety ceiling around the 450m retry budget + surrounding steps.
+    timeout-minutes: 510
     strategy:
       fail-fast: false
       matrix:
@@ -477,21 +478,25 @@ jobs:
       - name: Execute Unity Cloud build
         uses: nick-fields/retry@v3
         with:
-          timeout_minutes: 180  # matches your GLOBAL_TIMEOUT = 10800s
+          # Wraps QUEUE_TIMEOUT (240m) + BUILD_TIMEOUT (180m) + buffer.
+          timeout_minutes: 450
           max_attempts: 2
           retry_on_exit_code: 99
           retry_wait_seconds: 30
           on_retry_command: |
-            echo "::warning::🔁 Unity Cloud Build retry triggered at $(date '+%Y-%m-%d %H:%M:%S')"
+            echo "::warning::🔁 Unity Cloud Build retry triggered at $(date '+%Y-%m-%d %H:%M:%S'). The next attempt will reattach to the persisted build if it is still in flight."
           command: |
             echo "🔧 Starting Unity Cloud Build attempt at $(date '+%Y-%m-%d %H:%M:%S')"
             python -u scripts/cloudbuild/build.py
         env:
           API_KEY: ${{ secrets.UNITY_CLOUD_API_KEY }}
           ORG_ID: ${{ secrets.UNITY_CLOUD_ORG_ID }}
           PROJECT_ID: ${{ secrets.UNITY_CLOUD_PROJECT_ID }}
-          POLL_TIME: 60  # Set the polling time in seconds
-          GLOBAL_TIMEOUT: 10800  # Set the global timeout in seconds (e.g., 3 hours)
+          POLL_TIME: 60
+          QUEUE_POLL_TIME: 120
+          STALE_POLL_THRESHOLD: 600
+          QUEUE_TIMEOUT: 14400
+          BUILD_TIMEOUT: 10800
           TARGET: t_${{ matrix.target }}
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
           COMMIT_SHA: ${{ needs.prebuild.outputs.commit_sha }}
@@ -833,14 +838,14 @@ jobs:
           path: shader_compilation_report.log
           if-no-files-found: warn
 
-      # Will run on cancel or timeout only
+      # Also runs on failure() so an outer-step timeout doesn't leave a Unity-side build holding a slot.
       - name: Cancel Unity Cloud build
-        if: ${{ cancelled() }}
+        if: ${{ cancelled() || failure() }}
         env:
           API_KEY: ${{ secrets.UNITY_CLOUD_API_KEY }}
           ORG_ID: ${{ secrets.UNITY_CLOUD_ORG_ID }}
           PROJECT_ID: ${{ secrets.UNITY_CLOUD_PROJECT_ID }}
-        run: python -u scripts/cloudbuild/build.py --cancel
+        run: python -u scripts/cloudbuild/build.py --cancel || true
 
   build-gate:
     name: Build Gate (Windows + macOS)

.github/workflows/claude-pr-review.yml

@@ -16,6 +16,9 @@ jobs:
       !contains(github.event.pull_request.labels.*.name, 'no review') &&
       !contains(github.event.pull_request.labels.*.name, 'auto-pr')
     runs-on: ubuntu-latest
+    concurrency:
+      group: claude-auto-review-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
     permissions:
       id-token: write
       contents: read
@@ -44,11 +47,12 @@ jobs:
                 f.filename === 'CODEOWNERS'
               );
               if (touchesSensitive) {
-                core.notice('Auto-review disabled: PR modifies .github/prompts, .github/workflows, or CODEOWNERS. Human review required.');
+                core.notice('Sensitive paths modified (.github/prompts, .github/workflows, or CODEOWNERS): Claude will review but not auto-approve. Human DEV review required; QA can still be waived if Claude reports QA_REQUIRED: NO.');
               }
             }
 
-            core.setOutput('is-auto-review', (isAutoReview && !touchesSensitive).toString());
+            core.setOutput('is-auto-review', isAutoReview.toString());
+            core.setOutput('touches-sensitive', touchesSensitive.toString());
 
       - name: Set status to pending
         if: steps.check-type.outputs.is-auto-review == 'true'
@@ -121,17 +125,18 @@ jobs:
         with:
           script: |
             const prNumber = ${{ github.event.pull_request.number }};
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const touchesSensitive = '${{ steps.check-type.outputs.touches-sensitive }}' === 'true';
 
             const comments = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: prNumber,
-              per_page: 100
+              owner, repo, issue_number: prNumber, per_page: 100
             });
 
-            const claudeComment = comments.data
-              .reverse()
-              .find(c => c.user?.login === 'claude[bot]');
+            const claudeComments = comments.data.filter(c =>
+              c.user?.login === 'claude[bot]' && c.body?.includes('REVIEW_RESULT:')
+            );
+            const claudeComment = claudeComments[claudeComments.length - 1];
 
             const output = claudeComment?.body ?? '';
             console.log('Claude comment preview:', output.slice(0, 300));
@@ -143,36 +148,82 @@ jobs:
             const hasReviewResult = output.includes('REVIEW_RESULT:');
             const passed = !failed && !errored;
 
-            if (passed && isSimple) {
-              const approvalBody = qaRequired
-                ? 'Auto-approved by Claude — simple fix/chore with no blocking issues. QA approval is still required.'
-                : 'Auto-approved by Claude — simple fix/chore with no blocking issues. No QA needed (non-runtime changes only).';
-
-              await github.rest.pulls.createReview({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: prNumber,
-                event: 'APPROVE',
-                body: approvalBody
-              });
-
-              const labels = ['claude-approved'];
-              if (!qaRequired) {
-                labels.push('no QA needed');
+            const reviews = await github.rest.pulls.listReviews({
+              owner, repo, pull_number: prNumber, per_page: 100
+            });
+            const ourApprovals = reviews.data.filter(r =>
+              r.user?.login === 'github-actions[bot]' && r.state === 'APPROVED'
+            );
+            const prLabels = (context.payload.pull_request.labels || []).map(l => l.name);
+            const COMPLEX_MARKER = '🔍 Claude reviewed this PR and found no blocking issues';
+            const SENSITIVE_MARKER = '🔒 Claude reviewed this PR — sensitive paths modified';
+
+            const canAutoApprove = hasReviewResult && passed && isSimple && !touchesSensitive;
+            const canWaiveQa = hasReviewResult && passed && isSimple && !qaRequired;
+
+            if (canAutoApprove) {
+              if (ourApprovals.length === 0) {
+                const approvalBody = qaRequired
+                  ? 'Auto-approved by Claude — simple fix/chore with no blocking issues. QA approval is still required.'
+                  : 'Auto-approved by Claude — simple fix/chore with no blocking issues. No QA needed (non-runtime changes only).';
+                await github.rest.pulls.createReview({
+                  owner, repo, pull_number: prNumber, event: 'APPROVE', body: approvalBody
+                });
               }
               await github.rest.issues.addLabels({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                labels
-              });
-            } else if (passed && !isSimple) {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: prNumber,
-                body: '🔍 Claude reviewed this PR and found no blocking issues, but assessed it as **complex** — human DEV review is still required before merging.'
+                owner, repo, issue_number: prNumber, labels: ['claude-approved']
               });
+            } else if (hasReviewResult) {
+              for (const r of ourApprovals) {
+                await github.rest.pulls.dismissReview({
+                  owner, repo, pull_number: prNumber, review_id: r.id,
+                  message: 'Dismissed: latest Claude review no longer auto-approves this PR.'
+                }).catch(e => console.log(`dismissReview: ${e.message}`));
+              }
+              if (prLabels.includes('claude-approved')) {
+                await github.rest.issues.removeLabel({
+                  owner, repo, issue_number: prNumber, name: 'claude-approved'
+                }).catch(e => console.log(`removeLabel claude-approved: ${e.message}`));
+              }
+              if (touchesSensitive && passed && isSimple && !comments.data.some(c =>
+                  c.user?.login === 'github-actions[bot]' && c.body?.startsWith(SENSITIVE_MARKER))) {
+                const qaNote = qaRequired
+                  ? 'QA approval is still required.'
+                  : 'No QA needed (Claude reported `QA_REQUIRED: NO`).';
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: prNumber,
+                  body: `${SENSITIVE_MARKER} (\`.github/prompts\`, \`.github/workflows\`, or \`CODEOWNERS\`). Claude will not auto-approve these PRs — human DEV review is required. ${qaNote}`
+                });
+              } else if (!touchesSensitive && passed && !isSimple && !comments.data.some(c =>
+                  c.user?.login === 'github-actions[bot]' && c.body?.startsWith(COMPLEX_MARKER))) {
+                await github.rest.issues.createComment({
+                  owner, repo, issue_number: prNumber,
+                  body: COMPLEX_MARKER + ', but assessed it as **complex** — human DEV review is still required before merging.'
+                });
+              }
+            }
+
+            if (canWaiveQa) {
+              if (!prLabels.includes('no QA needed')) {
+                await github.rest.issues.addLabels({
+                  owner, repo, issue_number: prNumber, labels: ['no QA needed']
+                });
+              }
+            } else if (hasReviewResult && prLabels.includes('no QA needed')) {
+              await github.rest.issues.removeLabel({
+                owner, repo, issue_number: prNumber, name: 'no QA needed'
+              }).catch(e => console.log(`removeLabel no QA needed: ${e.message}`));
+            }
+
+            for (const c of claudeComments.slice(0, -1)) {
+              await github.graphql(
+                `mutation($id: ID!) {
+                  minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
+                    minimizedComment { isMinimized }
+                  }
+                }`,
+                { id: c.node_id }
+              ).catch(e => console.log(`minimizeComment ${c.id}: ${e.message}`));
             }
 
             let description;
@@ -184,6 +235,10 @@ jobs:
               description = 'Claude review encountered an error';
             } else if (failed) {
               description = 'Claude found issues that must be resolved';
+            } else if (touchesSensitive && isSimple) {
+              description = canWaiveQa
+                ? 'No blocking issues — sensitive paths, DEV review required (no QA needed)'
+                : 'No blocking issues — sensitive paths, DEV review required';
             } else if (isSimple) {
               description = 'No blocking issues found — PR auto-approved';
             } else {
@@ -261,6 +316,9 @@ jobs:
     needs: check-member
     if: needs.check-member.outputs.is-member == 'true'
     runs-on: ubuntu-latest
+    concurrency:
+      group: claude-on-demand-review-${{ github.event.issue.number }}
+      cancel-in-progress: true
     permissions:
       id-token: write
       contents: read
@@ -373,9 +431,10 @@ jobs:
               per_page: 100
             });
 
-            const claudeComment = comments.data
-              .reverse()
-              .find(c => c.user?.login === 'claude[bot]');
+            const claudeComments = comments.data.filter(c =>
+              c.user?.login === 'claude[bot]' && c.body?.includes('REVIEW_RESULT:')
+            );
+            const claudeComment = claudeComments[claudeComments.length - 1];
 
             const output = claudeComment?.body ?? '';
             console.log('Claude comment preview:', output.slice(0, 200));
@@ -384,6 +443,17 @@ jobs:
             const errored = '${{ steps.claude.outcome }}' === 'failure';
             const hasReviewResult = output.includes('REVIEW_RESULT:');
 
+            for (const c of claudeComments.slice(0, -1)) {
+              await github.graphql(
+                `mutation($id: ID!) {
+                  minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
+                    minimizedComment { isMinimized }
+                  }
+                }`,
+                { id: c.node_id }
+              ).catch(e => console.log(`minimizeComment ${c.id}: ${e.message}`));
+            }
+
             let description;
             if (errored && !output) {
               description = 'Claude review failed — credit balance too low or API error';

.github/workflows/dependency-security-review.yml

@@ -16,6 +16,10 @@ on:
       - '.github/workflows/**'
       - '.github/prompts/**'
 
+concurrency:
+  group: dependency-security-review-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   detect-and-review:
     if: github.event.pull_request.draft == false
@@ -182,9 +186,21 @@ jobs:
                 issue_number: ${{ github.event.pull_request.number }},
               });
 
-              const claudeComment = comments
-                .reverse()
-                .find(c => c.user?.login === 'claude[bot]');
+              const claudeComments = comments.filter(c =>
+                c.user?.login === 'claude[bot]' && c.body?.includes('DEPENDENCY_REVIEW:')
+              );
+              const claudeComment = claudeComments[claudeComments.length - 1];
+
+              for (const c of claudeComments.slice(0, -1)) {
+                await github.graphql(
+                  `mutation($id: ID!) {
+                    minimizeComment(input: { subjectId: $id, classifier: OUTDATED }) {
+                      minimizedComment { isMinimized }
+                    }
+                  }`,
+                  { id: c.node_id }
+                ).catch(e => console.log(`minimizeComment ${c.id}: ${e.message}`));
+              }
 
               const output = claudeComment?.body ?? '';
               const errored = '${{ steps.claude.outcome }}' === 'failure';