feat: abgen-registry feature flag to switch AB registry + CDN #9757
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,111 @@ | ||
| name: Fetch Unity Cloud Build Links | ||
| description: >- | ||
| Download the unity_build_info_* artifacts of a Unity Cloud Build run and emit | ||
| sanitized markdown linking each build id to its Unity Cloud dashboard page: | ||
| bare table rows for appending to an existing two-column table, and a standalone | ||
| table section for comment bodies that have no table of their own. | ||
|
|
||
| inputs: | ||
| run-id: | ||
| description: Workflow run id of the Unity Cloud Build run whose artifacts to read. | ||
| required: true | ||
| github-token: | ||
| description: Token used to download the run's artifacts. | ||
| required: true | ||
|
|
||
| outputs: | ||
| rows: | ||
| description: >- | ||
| "| Name | Link |"-shaped rows for an existing two-column table, pairing | ||
| each target's Unity Cloud build page with its GitHub job log; empty when | ||
| no valid build info was found. | ||
| value: ${{ steps.fetch.outputs.rows }} | ||
| section: | ||
| description: >- | ||
| Standalone table (header + rows); empty when no valid build info was found. | ||
| value: ${{ steps.fetch.outputs.section }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - name: Download and sanitize Unity Cloud build info | ||
| id: fetch | ||
| shell: bash | ||
| env: | ||
| GH_TOKEN: ${{ inputs.github-token }} | ||
| RUN_ID: ${{ inputs.run-id }} | ||
| REPO_FULL: ${{ github.repository }} | ||
| run: | | ||
| set -euo pipefail | ||
|
|
||
| # The info files come out of the PR-controlled build workflow, so treat them as | ||
| # untrusted input: accept only a numeric build id and a Unity dashboard URL with | ||
| # a conservative charset before letting them anywhere near a comment body. | ||
| # Mirrors the producer's '/builds/<id>' requirement (build.py) so the two | ||
| # validators agree, and pins the id to digits — a query-string-only path | ||
| # under a Unity host (open-redirect bait) no longer passes. | ||
| URL_RE='^https://(cloud\.unity\.com|developer\.cloud\.unity3d\.com|dashboard\.unity3d\.com)/[A-Za-z0-9./_%~?=&#-]*/builds/[0-9]+[A-Za-z0-9./_%~?=&#-]*$' | ||
| parse_info() { | ||
| local target="$1" | ||
| local dir="ucb_info_${target}" | ||
| REPLY_ID="" | ||
| REPLY_URL="" | ||
| if gh run download "$RUN_ID" \ | ||
| --repo "$REPO_FULL" \ | ||
| --name "unity_build_info_${target}_launcher" \ | ||
| --dir "$dir" 2>"${dir}.err"; then | ||
| REPLY_ID=$(grep -m1 '^BUILD_ID=' "$dir/unity_cloud_build_info.env" | cut -d= -f2- || true) | ||
| REPLY_URL=$(grep -m1 '^DASHBOARD_URL=' "$dir/unity_cloud_build_info.env" | cut -d= -f2- || true) | ||
| [[ "$REPLY_ID" =~ ^[0-9]+$ ]] || REPLY_ID="" | ||
| [[ "$REPLY_URL" =~ $URL_RE ]] || REPLY_URL="" | ||
| else | ||
| # Absence is normal for runs predating the info artifact; still surface the | ||
| # gh error so an auth/permission regression doesn't silently eat the rows. | ||
| echo "note: could not fetch unity_build_info_${target}_launcher: $(tr '\n' ' ' < "${dir}.err")" | ||
| fi | ||
| } | ||
|
|
||
| # Per-target GitHub job pages, from the trusted Actions API (jobs of the | ||
| # matrix job "Build (<target>)"), so each row pairs the Unity Cloud build | ||
| # page with the GitHub-side job log. | ||
| JOBS_JSON=$(gh api "/repos/$REPO_FULL/actions/runs/$RUN_ID/jobs?per_page=100" 2>/dev/null || echo '{"jobs":[]}') | ||
|
|
||
| ROWS="" | ||
| for entry in "windows64:Windows" "macos:Mac"; do | ||
| target="${entry%%:*}" | ||
| label="${entry#*:}" | ||
| parse_info "$target" | ||
| job_url=$(jq -r --arg n "Build ($target)" '.jobs[]? | select(.name==$n) | .html_url // empty' <<< "$JOBS_JSON" | head -1) | ||
|
Contributor
There was a problem hiding this comment. This lookup can never match — the "· [GitHub job]" half of every row is silently dropped.
build:
name: Build
strategy:
matrix:
target: ${{ fromJSON(needs.prebuild.outputs.targets) }}GitHub only appends matrix values to the display name when Contrast name: Test (${{ matrix.testMode }})Two ways out — either interpolate the target into the producer's job name ( |
||
|
|
||
| cell="" | ||
| # A URL without a valid id only occurs on a tampered artifact — drop the link | ||
| # rather than render an empty "[#](...)" label. | ||
| if [ -n "$REPLY_ID" ] && [ -n "$REPLY_URL" ]; then | ||
| cell="[Unity Cloud #${REPLY_ID}](${REPLY_URL})" | ||
| elif [ -n "$REPLY_ID" ]; then | ||
| cell="Unity Cloud #${REPLY_ID}" | ||
| fi | ||
| if [ -n "$cell" ] && [ -n "$job_url" ]; then | ||
| cell="${cell} · [GitHub job](${job_url})" | ||
| fi | ||
| if [ -n "$cell" ]; then | ||
| ROWS+="| ${label} build | ${cell} |"$'\n' | ||
| fi | ||
| done | ||
|
|
||
| SECTION="" | ||
| if [ -n "$ROWS" ]; then | ||
| SECTION="| Name | Link |"$'\n'"| -------- | ----------------------- |"$'\n'"$ROWS" | ||
| fi | ||
|
|
||
| # The payload derives from artifact bytes, so the heredoc delimiter must not be | ||
| # guessable content even though the validation above already forbids newlines. | ||
| DELIM="UCB_EOF_${RANDOM}${RANDOM}_$$" | ||
| { | ||
| echo "rows<<${DELIM}" | ||
| printf '%s' "$ROWS" | ||
| echo "${DELIM}" | ||
| echo "section<<${DELIM}" | ||
| printf '%s' "$SECTION" | ||
| echo "${DELIM}" | ||
| } >> "$GITHUB_OUTPUT" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
_launcheris hardcoded, butinstall_sourceis an input with a second legal value.The producer names the artifact with the resolved input (
build-unitycloud.yml:986):and
install_sourceis achoiceoverlauncher | epic(build-unitycloud.yml:95-102), defaulting tolauncher. For anepicbuild the download misses,parse_infoemits only anote:, and the Unity Cloud rows vanish with no signal.Worth noting the sibling check in
pr-comment-artifact-url.ymlis already source-agnostic (startswith("unity_build_info_")), sobuild-rangoes true while this action finds nothing — the two halves disagree. Suggest resolving the name by prefix instead of assuming the suffix: