feat: expose fail-closed Windows cleanup proof

.github/workflows/build-tests-mac.yml

@@ -2,18 +2,17 @@ name: Builds - MacOS
 
 on:
   workflow_dispatch:
-  push:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 
 jobs:
   buildForAllPlatformsMacOS:
     name: ${{ matrix.targetPlatform }} on ${{ matrix.unityVersion }}
+    # The fork cannot run this paid-license matrix until macOS cleanup emits
+    # lifecycle proof equivalent to the Windows owning-container proof.
+    if: ${{ github.repository == 'game-ci/unity-builder' }}
     runs-on: macos-latest
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
         projectPath:
           - test-project

.github/workflows/build-tests-ubuntu.yml

@@ -2,11 +2,6 @@ name: Builds - Ubuntu
 
 on:
   workflow_dispatch:
-  push:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
 
 env:
   UNITY_LICENSE: "<?xml version=\"1.0\" encoding=\"UTF-8\"?><root>\n    <License
@@ -39,6 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
         providerStrategy:
           # - local-docker

.github/workflows/build-tests-windows.yml

@@ -4,16 +4,22 @@ on:
   workflow_dispatch:
   push:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
 jobs:
+  resource-cleanup-proof-contract:
+    name: Resource cleanup proof contract
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@v4
+      - shell: pwsh
+        run: ./scripts/test-windows-resource-proof.ps1
+
   buildForAllPlatformsWindows:
     name: ${{ matrix.targetPlatform }} on ${{ matrix.unityVersion }}
+    if: github.event_name == 'workflow_dispatch'
     runs-on: windows-2022
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
         projectPath:
           - test-project
@@ -94,12 +100,33 @@ jobs:
           Write-Error "Docker daemon did not start within $($maxRetries * $retryDelay) seconds"
           exit 1
 
+      - name: Acquire organization Unity lock
+        id: acquire-build-lock
+        timeout-minutes: 45
+        # ambiguous-organization-build-lock v1.5.0
+        uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/acquire-build-lock@7f892c7c585a962940f83c2f058e3cdcd3c673c5
+        with:
+          lock-name: wallstop-organization-builds
+          lock-repository: Ambiguous-Interactive/ambiguous-organization-build-lock
+          # GitHub-hosted runner names are not stable physical-machine IDs.
+          # A per-job identity prevents a future ephemeral VM from reclaiming
+          # a quarantine created by this one.
+          runner-id: ${{ runner.name }}:${{ github.run_id }}:${{ github.run_attempt }}:${{ strategy.job-index }}
+          holder-id-suffix: ${{ github.job }}-${{ strategy.job-index }}
+          timeout-minutes: '40'
+          require-resource-lifecycle: 'true'
+          minimum-release-cooldown-seconds: '360'
+        env:
+          BUILD_LOCK_APP_ID: ${{ secrets.BUILD_LOCK_APP_ID }}
+          BUILD_LOCK_APP_PRIVATE_KEY: ${{ secrets.BUILD_LOCK_APP_PRIVATE_KEY }}
+
       ###########################
       #          Build          #
       ###########################
       - name: Build
         uses: ./
         id: build-1
+        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' }}
         continue-on-error: true
         timeout-minutes: 30
         env:
@@ -119,7 +146,7 @@ jobs:
       # We use dirty build because we are replacing the default project settings file above
 
       - name: Sleep for Retry
-        if: ${{ steps.build-1.outcome == 'failure' }}
+        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' && steps.build-1.outcome == 'failure' }}
         run: |
           Start-Sleep -s 120
 
@@ -128,7 +155,7 @@ jobs:
         id: build-2
         continue-on-error: true
         timeout-minutes: 30
-        if: steps.build-1.outcome == 'failure'
+        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' && steps.build-1.outcome == 'failure' }}
         env:
           UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
           UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
@@ -145,15 +172,15 @@ jobs:
       # We use dirty build because we are replacing the default project settings file above
 
       - name: Sleep for Retry
-        if: ${{ steps.build-1.outcome == 'failure' && steps.build-2.outcome == 'failure' }}
+        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' && steps.build-1.outcome == 'failure' && steps.build-2.outcome == 'failure' }}
         run: |
           Start-Sleep -s 240
 
       - name: Build Retry 2
         uses: ./
         id: build-3
         timeout-minutes: 30
-        if: ${{ steps.build-1.outcome == 'failure' && steps.build-2.outcome == 'failure' }}
+        if: ${{ steps.acquire-build-lock.outputs.acquired == 'true' && steps.build-1.outcome == 'failure' && steps.build-2.outcome == 'failure' }}
         env:
           UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
           UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
@@ -169,6 +196,59 @@ jobs:
           allowDirtyBuild: true
       # We use dirty build because we are replacing the default project settings file above
 
+      - name: Classify activation-owning cleanup proof
+        id: cleanup-proof
+        if: ${{ always() && steps.acquire-build-lock.outcome == 'success' }}
+        shell: pwsh
+        env:
+          BUILD_1_OUTCOME: ${{ steps.build-1.outcome }}
+          BUILD_1_RESOURCE_SAFE: ${{ steps.build-1.outputs.resourceSafe }}
+          BUILD_2_OUTCOME: ${{ steps.build-2.outcome }}
+          BUILD_2_RESOURCE_SAFE: ${{ steps.build-2.outputs.resourceSafe }}
+          BUILD_3_OUTCOME: ${{ steps.build-3.outcome }}
+          BUILD_3_RESOURCE_SAFE: ${{ steps.build-3.outputs.resourceSafe }}
+        run: ./scripts/classify-build-resource-proof.ps1
+
+      - name: Release organization Unity lock
+        if: ${{ always() && (steps.acquire-build-lock.outcome == 'success' || steps.acquire-build-lock.outcome == 'failure' || steps.acquire-build-lock.outcome == 'cancelled') }}
+        timeout-minutes: 5
+        # ambiguous-organization-build-lock v1.5.0
+        uses: Ambiguous-Interactive/ambiguous-organization-build-lock/.github/actions/release-build-lock@7f892c7c585a962940f83c2f058e3cdcd3c673c5
+        with:
+          lock-name: wallstop-organization-builds
+          lock-repository: Ambiguous-Interactive/ambiguous-organization-build-lock
+          runner-id: ${{ runner.name }}:${{ github.run_id }}:${{ github.run_attempt }}:${{ strategy.job-index }}
+          holder-id-suffix: ${{ github.job }}-${{ strategy.job-index }}
+          resource-safe: ${{ steps.cleanup-proof.outputs.resource-safe || 'false' }}
+        env:
+          BUILD_LOCK_APP_ID: ${{ secrets.BUILD_LOCK_APP_ID }}
+          BUILD_LOCK_APP_PRIVATE_KEY: ${{ secrets.BUILD_LOCK_APP_PRIVATE_KEY }}
+
+      - name: Verify activation-owning cleanup proof
+        if: ${{ always() }}
+        shell: pwsh
+        env:
+          LOCK_ACQUIRED: ${{ steps.acquire-build-lock.outputs.acquired }}
+          BUILD_1_OUTCOME: ${{ steps.build-1.outcome }}
+          BUILD_2_OUTCOME: ${{ steps.build-2.outcome }}
+          BUILD_3_OUTCOME: ${{ steps.build-3.outcome }}
+          CLEANUP_RESOURCE_SAFE: ${{ steps.cleanup-proof.outputs.resource-safe }}
+        run: |
+          if ($env:LOCK_ACQUIRED -ne 'true') {
+            throw 'Windows canary did not acquire the lifecycle-aware organization lock.'
+          }
+          $successfulBuilds = 0
+          foreach ($attempt in 1..3) {
+            $outcome = [Environment]::GetEnvironmentVariable("BUILD_${attempt}_OUTCOME")
+            if ($outcome -eq 'success') { $successfulBuilds++ }
+          }
+          if ($successfulBuilds -eq 0) {
+            throw 'No Windows build attempt succeeded; cleanup proof cannot be accepted.'
+          }
+          if ($env:CLEANUP_RESOURCE_SAFE -ne 'true') {
+            throw 'At least one Windows build attempt ended without activation-owning cleanup proof.'
+          }
+
       ###########################
       #          Upload         #
       ###########################

.github/workflows/integrity-check.yml

@@ -49,10 +49,13 @@ jobs:
           case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
           yarn install --immutable
       - run: yarn lint
+      - run: node scripts/verify-resource-cleanup-contract.mjs .
       - run: yarn test:ci --coverage
       - run: bash <(curl -s https://codecov.io/bash)
-      - run: yarn build || { echo "build command should always succeed" ; exit 61; }
-  #      - run: yarn build --quiet && git diff --quiet dist || { echo "dist should be auto generated" ; git diff dist ; exit 62; }
+      - name: Verify generated distribution
+        run: |
+          yarn build || { echo "build command should always succeed"; exit 61; }
+          git diff --exit-code -- dist || { echo "generated dist is stale"; exit 62; }
 
   orchestrator-integration:
     name: Orchestrator Integration