chore: com.decentraland.pulse.transport to fix missing csproj .meta warning - #9669
Conversation
Pins com.decentraland.pulse.transport to the Pulse commit that adds the missing DCLPulse.Transport.Shared.csproj.meta, silencing Unity's per-import warning: Asset Packages/com.decentraland.pulse.transport/DCLPulse.Transport.Shared.csproj has no meta file, but it's in an immutable folder. The asset will be ignored. Depends on decentraland/Pulse#36. Re-pin to the squash-merge commit before merging this PR. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🚦 CI Status
Windows and Mac build successful in Unity Cloud! You can find a link to the downloadable artifact below. No C# files changed — lint ratchet skipped. All Unity tests passed ✅
|
dalkia
changed the title
Signed-off-by: Juan Ignacio Molteni <juanignaciomolteni@gmail.com>
Signed-off-by: Juan Ignacio Molteni <juanignaciomolteni@gmail.com>
This comment has been minimized.
This comment has been minimized.
decentraland-bot
left a comment
decentraland-bot
left a comment
There was a problem hiding this comment.
Review — chore: com.decentraland.pulse.transport to fix missing csproj .meta warning
STEP 2 — Root-cause check ✅
Problem: Every Unity import warns that DCLPulse.Transport.Shared.csproj has no .meta in the immutable package cache.
Does the diff fix the cause? Yes. The warning originates from the upstream decentraland/Pulse package shipping a .csproj without a corresponding .meta. The fix correctly lives upstream — Pulse#36 adds the missing .meta file, and this PR bumps the pin to that merge commit. This is the right approach; there is nothing unity-explorer can do locally to suppress the warning.
STEP 3 — Design & integration ✅
N/A — no new code, systems, components, or logic. This is a pure dependency pin bump.
STEP 4 — Member audit ✅
N/A — no code members added or changed.
STEP 5 — Line-level review ✅
Verified:
- ✅ Commit hash
efe92879d9c6765421841fa67cf994500772fc6bis consistent acrossmanifest.json(version URL) andpackages-lock.json(version URL + hash field) - ✅ The pinned commit IS the squash-merge commit of Pulse#36 on
main(not a branch commit) — confirmed viagh api repos/decentraland/Pulse/compare/main...efe928...returningstatus: identical - ✅ Upstream commit only adds
src/DCLPulse.Transport.Shared/DCLPulse.Transport.Shared.csproj.meta(7 lines, DefaultImporter) — no behavioral changes to the package - ✅ No secrets, credentials, or security concerns
- ✅ No other dependencies changed
No findings.
STEP 6 — Complexity: SIMPLE
2 files changed, 4 lines modified (2 additions, 2 deletions per file). Pure commit-hash bump in JSON config files — no C# code, no ECS, no runtime logic.
STEP 7 — QA: YES
While the change is cosmetic (suppresses a warning), it alters a resolved runtime package version. Smoke-testing that the Explorer still loads correctly after the dependency bump is prudent.
STEP 8 — Non-blocking warnings
None. Main scene not modified.
Security review
No security concerns. The change only updates a Git commit hash reference to a merged, publicly-visible commit on the main branch of decentraland/Pulse. No new code paths, no auth changes, no secret exposure.
REVIEW_RESULT: PASS ✅
COMPLEXITY: SIMPLE
COMPLEXITY_REASON: Pure dependency pin bump in manifest/lock JSON files; no code changes
QA_REQUIRED: YES
Reviewed by Jarvis 🤖 · Requested by decentraland-bot via GitHub
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
|
Claude finished @dalkia's task in 1m 7s —— View job Security-focused dependency review (re-run after second
|
| Item | Old | New |
|---|---|---|
com.decentraland.pulse.transport |
…Pulse.git?path=src/DCLPulse.Transport.Shared#536d308a96cd5dce1011b012e7d0b39c27b01993 |
…#efe92879d9c6765421841fa67cf994500772fc6b |
- source — git UPM,
https://github.com/decentraland/Pulse.git, subpathsrc/DCLPulse.Transport.Shared(first-partydecentralandorg, HTTPS) - type — source code (C#: ENet P/Invoke bindings,
PacketMode/DisconnectReason/ENetChannelenums, Pulse protobufs) [Inference —docs/pulse.md:106,247] - scope — runtime, ships in the desktop client, gated behind
FeatureId.Pulse(FeaturesRegistry.cs:72)
Lockfile hygiene — correct. version (Explorer/Packages/packages-lock.json:104) and hash (:108) carry the same SHA; dependencies: {} (:107) unchanged — no new transitive deps. A repo-wide grep for the old SHA (536d308) returns nothing, so there is no stale reference left behind anywhere under Explorer/.
Step W — N/A. Zero workflow or prompt files in the PR delta (the test.yml change lives on dev, on both sides of the three-dot diff). W.1–W.10 do not apply. No new binaries (pre-computed binary list for this PR: none), no .asmdef, no editor/build scripts.
Step 1.5 — Registry metadata
[UNKNOWN] — not applicable. Git-sourced first-party package with no public registry listing, and this job has no network egress.
Step 2 — Assessment
A. Provenance / pinning — good [PR]. Full 40-char commit SHA on a decentraland-org repo over HTTPS — the strongest pin form available for a git UPM dep, consistent with neighbouring entries (com.decentraland.livekit-sdk, com.decentraland.rpc-csharp). No floating refs introduced. Pre-existing unpinned entries in manifest.json (com.atteneder.gltfast, com.cysharp.unitask, com.decentraland.renum, the unity-explorer-packages group) are untouched and out of scope.
B. Runtime capability — unchanged in kind. Network-facing by design (backs the ENet reliable-UDP transport; Runtime/ENet.cs is a [DllImport] P/Invoke wrapper). Proportionate and not new to this PR. The native .so/.dylib/.dll slices live in this repo (Explorer/Assets/Plugins/ENet/runtimes/, unchanged), not in the package — this bump adds no new native binary.
C. Shipping impact. All three desktop targets; inert unless Pulse is flag-enabled (PulseContainer swaps in IPulseMultiplayerService.Dummy when off).
D/E. No transitive changes [PR]. Advisories/maintenance [UNKNOWN] — first-party repo, no registry.
Upstream verification — carried over
Both items needing network egress were verified in the Jarvis review at 2026-08-10T17:59:33Z; attributing them there since I still have no egress this run:
efe9287reachable fromPulse:main? ✅gh api repos/decentraland/Pulse/compare/main...efe928…returnedstatus: identical— the pin is the squash-merge commit of Pulse#36 onmain, not a branch commit. This was the finding with real teeth (a branch-only SHA can be GC'd on branch deletion and retroactively break every future resolve); it's closed.- Bump contains only the
.meta? ✅ The upstream commit adds onlysrc/DCLPulse.Transport.Shared/DCLPulse.Transport.Shared.csproj.meta(7 lines,DefaultImporter). No change to the P/Invoke surface or the sharedDisconnectReason/PacketModeenums thatENetTransportcasts raw wire bytes into.
Housekeeping (non-blocking)
- PR body is still stale — third run flagging this. It says "It currently pins to the fix branch commit (
6d882c7)" and still carries the⚠️ Blocked on Add missing .meta for DCLPulse.Transport.Shared.csproj Pulse#36 / Draft banner, while HEAD pinsefe9287(the mergedmaincommit) and the PR is ready. The merge commit will permanently record this description. Fix this → - CI at review time:
Validate PR Title,Performance Test Merge Block,Require Jarvis Review,Jarvis Review Request✅ ·Unity Test,Unity Cloud Build,Dependency Security Reviewin progress ·Unity Performance Testskipped ·Enforce QA and DEV Approvals❌ — an approval gate (QA approval outstanding), not a build failure. Unity Cloud Build going green is the practical proof that the new pin resolves, imports cleanly, and the original.csproj has no meta filewarning is gone.
Summary table
| Dependency | Version | Source | Type | Scope | Risk | Evidence confidence |
|---|---|---|---|---|---|---|
com.decentraland.pulse.transport |
efe9287 (was 536d308) |
git — decentraland/Pulse, SHA-pinned |
source (C#, P/Invoke bindings + protobuf) | runtime, desktop, feature-flag gated | LOW | HIGH — pin style, lockfile consistency, and absence of stale SHAs verified from the tree; upstream reachability and one-file content verified in the prior network-enabled review |
No HIGH or MEDIUM risk items. First-party, SHA-pinned to a commit confirmed on main, no new transitive deps, no new binary, correct lockfile hygiene, upstream content confirmed to be a single 7-line .meta addition. The only open item is the stale PR description — documentation, not a security concern.
DEPENDENCY_REVIEW: PASS
2 participants
Problem
On every Unity import we get:
com.decentraland.pulse.transportis a Git UPM dependency pointing atdecentraland/Pulse(src/DCLPulse.Transport.Shared). That folder ships a.csproj(so it can also build standalone withdotnet build) but the csproj had no.meta. Because packages resolve into an immutable cache, Unity can't generate one and warns + ignores the file. Nothing in this repo can fix it — the meta has to live in the Pulse package.Change
Bump the
com.decentraland.pulse.transportpin (inmanifest.jsonandpackages-lock.json) to the Pulse commit that addsDCLPulse.Transport.Shared.csproj.meta.Draft until that PR merges. It currently pins to the fix branch commit (
6d882c7) so CI can resolve the package; re-pin to the squash-merge commit onmainbefore marking ready / merging, so the pin references a commit that lives permanently onmain.🤖 Generated with Claude Code