chore(ci): link Unity Cloud builds, test reports, timings, performance and automation from the CI status comment #9713
+1,981
−205
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| name: Fetch Unity Cloud Build Links | ||
| description: >- | ||
| Download the unity_build_info_* artifacts of a Unity Cloud Build run and emit | ||
| sanitized markdown linking each build id to its Unity Cloud dashboard page: | ||
| bare table rows for appending to an existing two-column table, and a standalone | ||
| table section for comment bodies that have no table of their own. | ||
|
|
||
| inputs: | ||
| run-id: | ||
| description: Workflow run id of the Unity Cloud Build run whose artifacts to read. | ||
| required: true | ||
| github-token: | ||
| description: Token used to download the run's artifacts. | ||
| required: true | ||
|
|
||
| outputs: | ||
| rows: | ||
| description: >- | ||
| "| Name | Link |"-shaped rows for an existing two-column table, one per | ||
| target, each pairing the GitHub job log, the Unity Cloud build page and | ||
| the Unity log artifact; empty when no valid build info was found. | ||
| value: ${{ steps.fetch.outputs.rows }} | ||
| section: | ||
| description: >- | ||
| Standalone table (header + rows); empty when no valid build info was found. | ||
| value: ${{ steps.fetch.outputs.section }} | ||
| windows-cell: | ||
| description: >- | ||
| The Windows row's link cell alone ("[GitHub job](…) · [Unity Cloud #N](…) · | ||
| [Unity log](…)"), for callers composing their own rows; empty when unknown. | ||
| value: ${{ steps.fetch.outputs.windows-cell }} | ||
| mac-cell: | ||
| description: Mac twin of windows-cell. | ||
| value: ${{ steps.fetch.outputs.mac-cell }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Download and sanitize Unity Cloud build info | ||
| id: fetch | ||
| shell: bash | ||
| env: | ||
| GH_TOKEN: ${{ inputs.github-token }} | ||
| RUN_ID: ${{ inputs.run-id }} | ||
| REPO_FULL: ${{ github.repository }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| # The info files come out of the PR-controlled build workflow, so treat them as | ||
| # untrusted input: accept only a numeric build id and a Unity dashboard URL with | ||
| # a conservative charset before letting them anywhere near a comment body. | ||
| # Mirrors the producer's '/builds/<id>' requirement (build.py) so the two | ||
| # validators agree, and pins the id to digits — a query-string-only path | ||
| # under a Unity host (open-redirect bait) no longer passes. | ||
| URL_RE='^https://(cloud\.unity\.com|developer\.cloud\.unity3d\.com|dashboard\.unity3d\.com)/[A-Za-z0-9./_%~?=&#-]*/builds/[0-9]+[A-Za-z0-9./_%~?=&#-]*$' | ||
| parse_info() { | ||
| local target="$1" | ||
| local dir="ucb_info_${target}" | ||
| REPLY_ID="" | ||
| REPLY_URL="" | ||
| if gh run download "$RUN_ID" \ | ||
| --repo "$REPO_FULL" \ | ||
| --name "unity_build_info_${target}_launcher" \ | ||
| --dir "$dir" 2>"${dir}.err"; then | ||
| REPLY_ID=$(grep -m1 '^BUILD_ID=' "$dir/unity_cloud_build_info.env" | cut -d= -f2- || true) | ||
| REPLY_URL=$(grep -m1 '^DASHBOARD_URL=' "$dir/unity_cloud_build_info.env" | cut -d= -f2- || true) | ||
| [[ "$REPLY_ID" =~ ^[0-9]+$ ]] || REPLY_ID="" | ||
| [[ "$REPLY_URL" =~ $URL_RE ]] || REPLY_URL="" | ||
| else | ||
| # Absence is normal for runs predating the info artifact; still surface the | ||
| # gh error so an auth/permission regression doesn't silently eat the rows. | ||
| echo "note: could not fetch unity_build_info_${target}_launcher: $(tr '\n' ' ' < "${dir}.err")" | ||
| fi | ||
| } | ||
|
|
||
| # Per-target GitHub job pages, from the trusted Actions API (jobs of the | ||
| # matrix job "Build (<target>)"), so each row pairs the Unity Cloud build | ||
| # page with the GitHub-side job log. | ||
| JOBS_JSON=$(gh api "/repos/$REPO_FULL/actions/runs/$RUN_ID/jobs?per_page=100" 2>/dev/null || echo '{"jobs":[]}') | ||
|
|
||
| # Suite id + artifact ids feed the per-target Unity log download links | ||
| # (artifact downloads hang off the check suite, not the run). | ||
| SUITE_ID=$(gh api "/repos/$REPO_FULL/actions/runs/$RUN_ID" --jq '.check_suite_id' 2>/dev/null || echo "") | ||
| [[ "$SUITE_ID" =~ ^[0-9]+$ ]] || SUITE_ID="" | ||
| ARTIFACTS_JSON=$(gh api "/repos/$REPO_FULL/actions/runs/$RUN_ID/artifacts?per_page=100" 2>/dev/null || echo '{"artifacts":[]}') | ||
|
|
||
| WINDOWS_CELL="" | ||
| MAC_CELL="" | ||
| ROWS="" | ||
| for entry in "windows64:Windows" "macos:Mac"; do | ||
| target="${entry%%:*}" | ||
| label="${entry#*:}" | ||
| parse_info "$target" | ||
| job_url=$(jq -r --arg n "Build ($target)" '.jobs[]? | select(.name==$n) | .html_url // empty' <<< "$JOBS_JSON" | head -1) | ||
| log_id=$(jq -r --arg n "${target}_launcher_unity_log" \ | ||
| '.artifacts[]? | select(.name==$n and .expired==false) | .id' <<< "$ARTIFACTS_JSON" | head -1) | ||
| [[ "$log_id" =~ ^[0-9]+$ ]] || log_id="" | ||
|
|
||
| parts=() | ||
| [ -n "$job_url" ] && parts+=("[GitHub job](${job_url})") | ||
| # A URL without a valid id only occurs on a tampered artifact — drop the link | ||
| # rather than render an empty "[#](...)" label. | ||
| if [ -n "$REPLY_ID" ] && [ -n "$REPLY_URL" ]; then | ||
| parts+=("[Unity Cloud #${REPLY_ID}](${REPLY_URL})") | ||
| elif [ -n "$REPLY_ID" ]; then | ||
| parts+=("Unity Cloud #${REPLY_ID}") | ||
| fi | ||
| if [ -n "$log_id" ] && [ -n "$SUITE_ID" ]; then | ||
| parts+=("[Unity log](${GITHUB_SERVER_URL:-https://github.com}/${REPO_FULL}/suites/${SUITE_ID}/artifacts/${log_id})") | ||
| fi | ||
|
|
||
| cell="" | ||
| if [ "${#parts[@]}" -gt 0 ]; then | ||
| cell=$(printf '%s · ' "${parts[@]}") | ||
| cell="${cell% · }" | ||
| ROWS+="| ${label} | ${cell} |"$'\n' | ||
| fi | ||
| case "$target" in | ||
| windows64) WINDOWS_CELL="$cell" ;; | ||
| macos) MAC_CELL="$cell" ;; | ||
| esac | ||
| done | ||
|
|
||
| SECTION="" | ||
| if [ -n "$ROWS" ]; then | ||
| SECTION="| Name | Link |"$'\n'"| -------- | ----------------------- |"$'\n'"$ROWS" | ||
| fi | ||
|
|
||
| # The payload derives from artifact bytes, so the heredoc delimiter must not be | ||
| # guessable content even though the validation above already forbids newlines. | ||
| DELIM="UCB_EOF_${RANDOM}${RANDOM}_$$" | ||
| { | ||
| echo "rows<<${DELIM}" | ||
| printf '%s' "$ROWS" | ||
| echo "${DELIM}" | ||
| echo "section<<${DELIM}" | ||
| printf '%s' "$SECTION" | ||
| echo "${DELIM}" | ||
| echo "windows-cell<<${DELIM}" | ||
| printf '%s' "$WINDOWS_CELL" | ||
| echo "${DELIM}" | ||
| echo "mac-cell<<${DELIM}" | ||
| printf '%s' "$MAC_CELL" | ||
| echo "${DELIM}" | ||
| } >> "$GITHUB_OUTPUT" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -597,6 +597,10 @@ jobs: | |
| QUEUE_TIMEOUT: 14400 | ||
| BUILD_TIMEOUT: 10800 | ||
| TARGET: t_${{ matrix.target }} | ||
| # For the live PR status-comment update the moment the Unity-side | ||
|
Contributor
There was a problem hiding this comment. This line changes what the
In the other direction, the job runs PR-authored code (
build:
name: Build
runs-on: ubuntu-latest
needs: prebuild
permissions:
contents: read
pull-requests: writeWorth confirming against Unrelated and pre-existing, but adjacent enough to mention while you're in this file: L800's |
||
| # build id is known; empty PR number (push/dispatch) disables it. | ||
| GH_TOKEN: ${{ github.token }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number || '' }} | ||
| BRANCH_NAME: ${{ github.head_ref || github.ref_name }} | ||
| COMMIT_SHA: ${{ needs.prebuild.outputs.commit_sha }} | ||
| BUILD_OPTIONS: ${{ needs.prebuild.outputs.options }} | ||
|
|
@@ -976,6 +980,19 @@ jobs: | |
| path: unity_cloud_log.log | ||
| if-no-files-found: error | ||
|
|
||
| # Written by build.py as soon as the Unity-side build id is known, so it exists for | ||
| # failed builds too. The PR status comment uses it to deep-link the Unity Cloud | ||
| # build page instead of asking humans to search cloud.unity.com by hand. | ||
| - name: Upload Unity Cloud build info | ||
| if: ${{ always() && hashFiles('unity_cloud_build_info.env') != '' }} | ||
| uses: actions/upload-artifact@v6 | ||
| with: | ||
| name: unity_build_info_${{ matrix.target }}_${{ needs.prebuild.outputs.install_source }} | ||
| path: unity_cloud_build_info.env | ||
| if-no-files-found: error | ||
| # Only consumed by the immediately-following PR status comment run. | ||
| retention-days: 7 | ||
|
|
||
| - name: Print cloud logs | ||
| if: ${{ always() && hashFiles('unity_cloud_log.log') != '' }} | ||
| run: cat unity_cloud_log.log | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The stated motivation for this knob — "for bodies too large to pass comfortably via env" — is also what makes it worth a guard, because the next ceiling up is a hard one.
The file content correctly rejoins the existing path: it lands in
$SECTION_BODYand goes through the same marker-strip at L76-77, so a foreign body can't open or close a section fence. That's the part that mattered most and it's right.What the knob newly invites is a body that pushes
NEW_BODYpast GitHub's 65,536-character issue-comment limit. When that happens the PATCH at L153 returns 422,gh apiexits non-zero, andset -euo pipefailaborts the script mid-loop — no truncation, no fallback, no::warning::. The external caller sees a failed step whose log saysHTTP 422and nothing about the shared comment being full. Worse, the ceiling is on the combined body, so the failure surfaces on whichever writer happens to run when the total crosses over — which may well be the build or tests section, not the perf section that grew.A cap on the section body keeps the failure local and legible, and truncation is the right behaviour for a status section that already links out to the full report:
Separately, while this is now a documented cross-repo entry point:
$SECTIONis still unvalidated. It only ever reachesSTART/END, so it isn't an injection concern — but a typo'd or drifting value (perfinstead ofperformance, or anything carrying a run id) takes the L141 append branch, permanently adds a dead fence to that PR's comment, then fails the survive check for 5 attempts × a full paginated re-read. Two lines make the new contract fail fast instead of wedging the shared comment: