ci: retire unsupported licensed fork builds (#14)

Retire organization-credentialed integration jobs whose activation contexts cannot be attested by the approved central return action. Preserve exact cleanup fixture coverage and fail-closed aggregates.

Author: wallstop

.github/workflows/build-tests-mac.yml

@@ -2,16 +2,6 @@ name: Builds - macOS
 
 on:
   workflow_dispatch:
-    inputs:
-      mode:
-        description: 'Run the cleanup contract, one organization smoke, or the upstream full matrix.'
-        required: true
-        default: contract-only
-        type: choice
-        options:
-          - contract-only
-          - smoke
-          - upstream-full
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -25,303 +15,23 @@ jobs:
     name: macOS resource cleanup proof contract
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Exercise private return evidence fixtures
         run: bash scripts/test-macos-resource-proof.sh
 
-  boundedOrganizationMacOSCanary:
-    name: StandaloneOSX on 2022.3.62f3 (bounded organization canary)
-    if: github.repository == 'Ambiguous-Interactive/unity-builder' && inputs.mode == 'smoke'
-    needs: [resource-cleanup-proof-contract]
-    runs-on: macos-14
-    # Explicit step budgets total 144 minutes; keep a 21-minute job-level
-    # reserve so verification and post cleanup survive a near-budget build.
-    timeout-minutes: 165
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        timeout-minutes: 5
-        with:
-          lfs: true
-
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
-        timeout-minutes: 5
-        with:
-          path: test-project/Library
-          key: Library-test-project-macos-StandaloneOSX-2022.3.62f3
-          restore-keys: |
-            Library-test-project-macos-StandaloneOSX-
-            Library-test-project-macos-
-            Library-test-project-
-
-      - name: Set scripting backend to IL2CPP
-        timeout-minutes: 1
-        run: >-
-          mv -f ./test-project/ProjectSettings/ProjectSettingsIl2cpp.asset
-          ./test-project/ProjectSettings/ProjectSettings.asset
-
-      - name: Require isolated return-process support
-        id: return-isolation
-        timeout-minutes: 1
-        run: python3 -c 'import os; assert hasattr(os, "setsid")'
-
-      - name: Acquire organization Unity lock
-        id: acquire-build-lock
-        timeout-minutes: 45
-        uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/acquire-build-lock-with-cleanup@59a2fa98224569e5a697f271a3ac4b866c53ac2c # v1.8.3
-        with:
-          lock-name: wallstop-organization-builds
-          lock-repository: Ambiguous-Interactive/ambiguous-organization-build-lock
-          runner-id: ${{ runner.name }}
-          holder-id-suffix: ${{ github.job }}
-          timeout-minutes: '40'
-          require-resource-lifecycle: 'true'
-          minimum-release-cooldown-seconds: '1'
-        env:
-          BUILD_LOCK_APP_ID: ${{ secrets.BUILD_LOCK_APP_ID }}
-          BUILD_LOCK_APP_PRIVATE_KEY: ${{ secrets.BUILD_LOCK_APP_PRIVATE_KEY }}
-
-      - name: Build bounded macOS smoke
-        id: build
-        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' }}
-        continue-on-error: true
-        timeout-minutes: 70
-        uses: ./
-        env:
-          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
-          UNITY_LICENSE: ${{ secrets.UNITY_LICENSE }}
-          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
-          UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
-        with:
-          allowDirtyBuild: true
-          buildName: 'GameCI Test Build'
-          customParameters: -profile SomeProfile -someBoolean -someValue exampleValue
-          projectPath: test-project
-          targetPlatform: StandaloneOSX
-          unityVersion: 2022.3.62f3
-
-      - name: Return macOS Unity license on the same runner
-        id: return-license
-        if: ${{ always() && steps.acquire-build-lock.outputs.acquired == 'true' && steps.build.outputs.resourceCleanupStatus != 'confirmed' }}
-        continue-on-error: true
-        timeout-minutes: 5
-        env:
-          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
-          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
-          UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
-        run: |
-          set -euo pipefail
-          attempt="$(mktemp -d "${RUNNER_TEMP}/unity-builder-fallback-return.XXXXXX")"
-          trap 'rm -rf -- "${attempt}"' EXIT
-          mkdir -p "${attempt}/project"
-          export ACTION_FOLDER="${GITHUB_WORKSPACE}/dist"
-          export ACTIVATE_LICENSE_PATH="${attempt}/project"
-          export UNITY_VERSION=2022.3.62f3
-          export UNITY_LICENSING_SERVER=''
-          export UNITY_BUILDER_RESOURCE_RETURN_LOG_PATH="${attempt}/return.log"
-          export UNITY_BUILDER_RESOURCE_STATUS_PATH="${attempt}/return.status"
-          export UNITY_BUILDER_RETURN_TIMEOUT_SECONDS=180
-          export UNITY_BUILDER_RETURN_KILL_GRACE_SECONDS=10
-          fallback_nonce="$(uuidgen | tr '[:upper:]' '[:lower:]')"
-          export UNITY_BUILDER_RESOURCE_PROOF_NONCE="${fallback_nonce}"
-          export UNITY_BUILDER_RESOURCE_PROOF_PATH="${attempt}/proof"
-          source dist/platforms/mac/steps/return_license.sh
-
-          status="$(cat "${attempt}/return.status" 2>/dev/null || true)"
-          cleanup_status=unknown
-          resource_health=healthy
-          resource_reason=return-missing-positive-evidence
-          if awk 'BEGIN { found=0 } { line=tolower($0); if (line ~ /20111/ && line ~ /(licen[cs]|activation|entitlement)/ && line ~ /(error|fail|limit|maximum|blocked|return|code)/) found=1 } END { exit !found }' "${attempt}/return.log"; then
-            resource_health=blocked
-            resource_reason=unity-account-limit-20111
-          elif [[ "${status}" == completed:0 ]] &&
-            [[ "$(cat "${attempt}/proof" 2>/dev/null || true)" == "resource-safe=${fallback_nonce}" ]] &&
-            grep -Eq '^(\[Licensing::Module\] )?Successfully returned the entitlement license$' "${attempt}/return.log" &&
-            grep -Eq '^(Serial number unavailable for ULF return|\[Licensing::Client\] Successfully returned ULF license with serial number[[:space:]]*:[[:space:]]*[^[:space:]]+)$' "${attempt}/return.log"; then
-            cleanup_status=confirmed
-            resource_reason=cleanup-confirmed
-          elif [[ "${status}" == timeout ]]; then
-            resource_reason=return-timeout
-          elif [[ "${status}" == terminated ]]; then
-            resource_reason=return-terminated
-          fi
-          evidence_digest="$(printf '%s' "${fallback_nonce}:${status}:${cleanup_status}:${resource_health}:${resource_reason}" | shasum -a 256 | awk '{print $1}')"
-          {
-            echo "cleanup-status=${cleanup_status}"
-            echo "resource-health=${resource_health}"
-            echo "resource-reason=${resource_reason}"
-            echo "evidence-digest=${evidence_digest}"
-          } >>"${GITHUB_OUTPUT}"
-
-      - name: Release organization Unity lock
-        id: release-build-lock
-        if: ${{ always() }}
-        timeout-minutes: 5
-        uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/release-build-lock@59a2fa98224569e5a697f271a3ac4b866c53ac2c # v1.8.3
-        with:
-          lock-name: wallstop-organization-builds
-          lock-repository: Ambiguous-Interactive/ambiguous-organization-build-lock
-          runner-id: ${{ runner.name }}
-          holder-id-suffix: ${{ github.job }}
-          holder-id: ${{ steps.acquire-build-lock.outputs.holder-id }}
-          resource-cleanup-status: ${{ steps.return-license.outputs.cleanup-status || steps.build.outputs.resourceCleanupStatus || 'unknown' }}
-          resource-health: ${{ (steps.acquire-build-lock.outputs.resource-health == 'blocked' || steps.build.outputs.resourceHealth == 'blocked' || steps.return-license.outputs.resource-health == 'blocked') && 'blocked' || 'healthy' }}
-          resource-reason: ${{ (steps.acquire-build-lock.outputs.resource-health == 'blocked' || steps.build.outputs.resourceHealth == 'blocked' || steps.return-license.outputs.resource-health == 'blocked') && 'unity-account-limit-20111' || steps.return-license.outputs.resource-reason || steps.build.outputs.resourceReason || steps.acquire-build-lock.outputs.resource-reason || 'cleanup-evidence-unknown' }}
-        env:
-          BUILD_LOCK_APP_ID: ${{ secrets.BUILD_LOCK_APP_ID }}
-          BUILD_LOCK_APP_PRIVATE_KEY: ${{ secrets.BUILD_LOCK_APP_PRIVATE_KEY }}
-
-      - name: Require a successful build and exact cleanup evidence
-        id: verify-cleanup
-        if: ${{ always() }}
-        timeout-minutes: 2
-        env:
-          ACQUIRED: ${{ steps.acquire-build-lock.outputs.acquired }}
-          BUILD_OUTCOME: ${{ steps.build.outcome }}
-          CLEANUP_STATUS: ${{ steps.return-license.outputs.cleanup-status || steps.build.outputs.resourceCleanupStatus }}
-          EVIDENCE_DIGEST: ${{ steps.return-license.outputs.evidence-digest || steps.build.outputs.resourceEvidenceDigest }}
-          ACQUIRE_HOLDER_ID: ${{ steps.acquire-build-lock.outputs.holder-id }}
-          RELEASE_AVAILABLE_AT: ${{ steps.release-build-lock.outputs.available-at }}
-          RELEASE_CLEANUP_RESULT: ${{ steps.release-build-lock.outputs.cleanup-result }}
-          RELEASE_HOLDER_ID: ${{ steps.release-build-lock.outputs.holder-id }}
-          RELEASE_OUTCOME: ${{ steps.release-build-lock.outcome }}
-          RELEASED: ${{ steps.release-build-lock.outputs.released }}
-          RELEASE_RESERVATION_STATE: ${{ steps.release-build-lock.outputs.reservation-state }}
-          RESOURCE_HEALTH: ${{ (steps.acquire-build-lock.outputs.resource-health == 'blocked' || steps.build.outputs.resourceHealth == 'blocked' || steps.return-license.outputs.resource-health == 'blocked') && 'blocked' || 'healthy' }}
-          RESOURCE_REASON: ${{ (steps.acquire-build-lock.outputs.resource-health == 'blocked' || steps.build.outputs.resourceHealth == 'blocked' || steps.return-license.outputs.resource-health == 'blocked') && 'unity-account-limit-20111' || steps.return-license.outputs.resource-reason || steps.build.outputs.resourceReason || steps.acquire-build-lock.outputs.resource-reason }}
-        run: |
-          set -euo pipefail
-          if [[ "${RESOURCE_HEALTH}" == blocked || "${RESOURCE_REASON}" == unity-account-limit-20111 ]]; then
-            echo '::error::Unity reported the account-limit 20111 incident.'
-            exit 1
-          fi
-          if [[ "${ACQUIRED}" != true || "${BUILD_OUTCOME}" != success ]]; then
-            echo '::error::Bounded macOS build did not succeed after lock admission.'
-            exit 1
-          fi
-          if [[ "${CLEANUP_STATUS}" != confirmed || "${RESOURCE_HEALTH}" != healthy || "${RESOURCE_REASON}" != cleanup-confirmed ]]; then
-            echo '::error::macOS cleanup did not produce the exact confirmed/healthy/cleanup-confirmed tuple.'
-            exit 1
-          fi
-          if [[ "${RELEASE_OUTCOME}" != success ]]; then
-            echo "::error::Schema-5 lock release finished with ${RELEASE_OUTCOME}."
-            exit 1
-          fi
-          if [[ "${RELEASED}" != true || "${RELEASE_CLEANUP_RESULT}" != cooldown-started || "${RELEASE_RESERVATION_STATE}" != cooldown ]]; then
-            echo '::error::Release did not remove the holder into the required cooldown.'
-            exit 1
-          fi
-          if [[ -z "${ACQUIRE_HOLDER_ID}" || "${RELEASE_HOLDER_ID}" != "${ACQUIRE_HOLDER_ID}" || -z "${RELEASE_AVAILABLE_AT}" ]]; then
-            echo '::error::Release outputs do not prove exact holder removal and cooldown availability.'
-            exit 1
-          fi
-          if [[ ! "${EVIDENCE_DIGEST}" =~ ^[0-9a-f]{64}$ ]]; then
-            echo '::error::macOS cleanup evidence digest is missing or malformed.'
-            exit 1
-          fi
-          echo "::notice::macOS cleanup evidence reason=${RESOURCE_REASON} evidence-digest=${EVIDENCE_DIGEST}"
-
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        if: ${{ success() }}
-        timeout-minutes: 5
-        with:
-          name: Build StandaloneOSX on macOS (2022.3.62f3)
-          path: build
-          retention-days: 14
-
-  buildForAllPlatformsMacOS:
-    name: ${{ matrix.targetPlatform }} on ${{ matrix.unityVersion }}
-    if: ${{ github.repository == 'game-ci/unity-builder' && inputs.mode == 'upstream-full' }}
-    needs: [resource-cleanup-proof-contract]
-    runs-on: macos-latest
-    strategy:
-      fail-fast: false
-      max-parallel: 1
-      matrix:
-        projectPath:
-          - test-project
-        unityVersion:
-          - 2021.3.45f2
-          - 2022.3.62f3
-          - 2023.2.22f1
-        targetPlatform:
-          - StandaloneOSX
-          - iOS
-        include:
-          - unityVersion: 6000.0.36f1
-            targetPlatform: StandaloneOSX
-          - unityVersion: 6000.0.36f1
-            targetPlatform: StandaloneOSX
-            buildProfile: 'Assets/Settings/Build Profiles/Sample macOS Build Profile.asset'
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-        with:
-          lfs: true
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
-        with:
-          path: ${{ matrix.projectPath }}/Library
-          key: Library-${{ matrix.projectPath }}-macos-${{ matrix.targetPlatform }}
-          restore-keys: |
-            Library-${{ matrix.projectPath }}-macos-
-            Library-
-      - name: Set scripting backend to IL2CPP
-        run: >-
-          mv -f ./test-project/ProjectSettings/ProjectSettingsIl2cpp.asset
-          ./test-project/ProjectSettings/ProjectSettings.asset
-      - uses: ./
-        env:
-          UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
-          UNITY_LICENSE: ${{ secrets.UNITY_LICENSE }}
-          UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
-          UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
-        with:
-          allowDirtyBuild: true
-          buildName: 'GameCI Test Build'
-          buildProfile: ${{ matrix.buildProfile }}
-          customParameters: -profile SomeProfile -someBoolean -someValue exampleValue
-          projectPath: ${{ matrix.projectPath }}
-          targetPlatform: ${{ matrix.targetPlatform }}
-          unityVersion: ${{ matrix.unityVersion }}
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
-        with:
-          name: Build ${{ matrix.targetPlatform }} on macOS (${{ matrix.unityVersion }})${{ matrix.buildProfile && ' With Build Profile' || '' }}
-          path: build
-          retention-days: 14
-
-  macos-license-ci:
-    name: macOS cleanup contract and licensed coverage
+  macos-cleanup-contract:
+    name: macOS cleanup contract
     if: ${{ always() }}
-    needs:
-      - resource-cleanup-proof-contract
-      - boundedOrganizationMacOSCanary
-      - buildForAllPlatformsMacOS
+    needs: [resource-cleanup-proof-contract]
     runs-on: ubuntu-latest
     steps:
-      - name: Require the exact requested coverage
+      - name: Require cleanup fixture coverage
         env:
-          CANARY_RESULT: ${{ needs.boundedOrganizationMacOSCanary.result }}
           CONTRACT_RESULT: ${{ needs.resource-cleanup-proof-contract.result }}
-          MODE: ${{ inputs.mode }}
-          REPOSITORY: ${{ github.repository }}
-          UPSTREAM_RESULT: ${{ needs.buildForAllPlatformsMacOS.result }}
         run: |
           set -euo pipefail
           if [[ "${CONTRACT_RESULT}" != success ]]; then
             echo "::error::macOS cleanup fixtures finished with ${CONTRACT_RESULT}."
             exit 1
           fi
-          case "${REPOSITORY}:${MODE}" in
-            Ambiguous-Interactive/unity-builder:contract-only|game-ci/unity-builder:contract-only)
-              [[ "${CANARY_RESULT}" == skipped && "${UPSTREAM_RESULT}" == skipped ]]
-              echo 'No licensed macOS coverage was requested; cleanup contract fixtures passed.'
-              ;;
-            Ambiguous-Interactive/unity-builder:smoke)
-              [[ "${CANARY_RESULT}" == success && "${UPSTREAM_RESULT}" == skipped ]]
-              ;;
-            game-ci/unity-builder:upstream-full)
-              [[ "${CANARY_RESULT}" == skipped && "${UPSTREAM_RESULT}" == success ]]
-              ;;
-            *)
-              echo "::error::Repository ${REPOSITORY} is not enrolled for licensed macOS coverage."
-              exit 1
-              ;;
-          esac
+          echo 'The fork runs cleanup fixtures without organization Unity credentials.'