chore: sync with upstream v6.0.0 by anurag-stepsecurity · Pull Request #40 · step-security/unity-builder

anurag-stepsecurity · 2026-10-26T11:17:01Z

game-ci/unity-builder@v5.0.0...v6.0.0

anurag-stepsecurity · 2026-10-26T11:17:03Z

📦 Target Release Version: v6.0.0
📋 Previous Release Version: v5.0.0

github-actions · 2026-10-26T11:18:14Z

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v5.0.0...v6.0.0

📋 File-by-File Analysis:

`.github/workflows/auto-retry-known-flakes.yml`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ❌ No
Status: 🟡 Partial - ❌ Cherry-pick incomplete (+92 -0) | Missing 1 additions

`.github/workflows/build-tests-mac.yml`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 33 additions, 3 deletions)

`.github/workflows/build-tests-ubuntu.yml`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 45 additions, 3 deletions)

`.github/workflows/build-tests-windows.yml`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 34 additions, 3 deletions)

`.github/workflows/integrity-check.yml`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - ❌ No PR patch available (+0 -7)

`.github/workflows/sync-secrets.yml`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 10 additions, 1 deletions)

`.vscode/launch.json`

Upstream has changes: ✅ Yes
File exists in PR: ❌ No
Status: 🔴 Missing - File missing in PR (upstream has 3 additions, 13 deletions)

`action.yml`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+56 -5)

`src/build-args.test.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+397 -0)

`src/build-args.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+272 -0)

`src/download-cli.test.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+225 -0)

`src/download-cli.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+192 -0)

`src/index.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All upstream changes applied (+54 -69) with 4 additional changes

`src/resolve-project-path.test.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+53 -0)

`src/resolve-project-path.ts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+29 -0)

`tsconfig.json`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -1)

`vitest.config.mts`

Upstream has changes: ✅ Yes
File exists in PR: ✅ Yes
Changes match: ✅ Yes
Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -0)

📊 Summary:

Total files changed upstream: 17
Files present in PR: 11/17
Files with matching changes: 10/17

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

+    // suppress the alert (GitHub Code Scanning's default setup has no
+    // inline-suppression-comment mechanism - that was legacy LGTM.com
+    // behavior); the alert needs dismissing via the Security tab/API.
+    const exitCode = await exec.exec(cliPath, args, { ignoreReturnCode: true });


github-actions · 2026-10-26T11:22:06Z

PR Review

Action Type

Node-based action (uses node24, entry point dist/index.js). This PR syncs with upstream game-ci/unity-builder v6.0.0, which represents a major architectural shift: the action now delegates all build logic to the game-ci/cli binary (downloaded at runtime) instead of running Docker containers or shell scripts from the dist/ tree directly.

✅ Passed Checks

License: Present at LICENSE with both original author copyright (Webber Takken) and StepSecurity copyright.
action.yml: Present with author: step-security.
SECURITY.md: Present at repo root.
FUNDING.yml: Not present (correct).
.github/workflows/auto_cherry_pick.yml: Present and correctly configured.
.github/workflows/actions_release.yml: Present with script as an input (required since package manager is Yarn, not npm).
audit_package.yml: Contains script as an input and delegates to the audit_fix.yml reusable workflow.
renovate.json: Not present (correct).
PULL_REQUEST.md: Not present (correct).
ISSUE_TEMPLATE folder: Not present (correct).
CHANGELOG.md: Not present (correct).
.vscode folder: Not present (correct).
README banner: StepSecurity maintained-action banner is present at line 2 of README.md.
README semver tag: Example uses step-security/unity-builder@v4 (major version only — correct).
package.json author: "author": "step-security" — correct.
package.json repository: URL contains step-security — correct.
dist/ folder: Present and contains dist/index.js.
Build script: "build" key present in package.json scripts.
Subscription check: Present in src/index.ts, calls the correct URL https://agent.api.stepsecurity.io/v1/github/${GITHUB_REPOSITORY}/actions/maintained-actions-subscription.
Subscription upstream value: Set to 'game-ci/unity-builder', which correctly matches <original-owner>/<repo-name> (game-ci / unity-builder) from auto_cherry_pick.yml.

❌ Failed Checks

.github/workflows/audit_fix.yml not found by expected name: The checklist requires a file named audit_fix.yml, but the repo has audit_package.yml instead. The content is functionally equivalent (it calls the audit_fix.yml reusable workflow and includes the script input), but the filename does not match the expected convention.

⚠️ Warnings

Major architectural change — no Docker images: v6 removes all of dist/BlankProject/, dist/default-build-script/, and dist/platforms/. The action now downloads and shells out to the game-ci/cli binary at runtime. Existing users upgrading from v5 will see very different behavior; the migration impact should be validated carefully.
cliVersion defaults to "latest": The new cliVersion input defaults to latest, which resolves to the current release at run time. This means the action's behavior can change between runs without a version bump of the action itself. The description rightly recommends pinning for reproducible builds, but the default should arguably be a pinned version.
README example still references old version: README.md shows uses: step-security/unity-builder@v4 in the example. Since this PR syncs v6.0.0, the example should be updated to @v6.
unityVersion input silently ignored: The description now documents that non-"auto" values are currently ignored by the CLI. This is a silent regression from v5; users relying on unityVersion to pin a specific Unity release will get unexpected behavior without a clear error.

🔒 Security Findings

Unverified remote script execution (inline comment on src/download-cli.ts line 156): The action fetches install.sh from raw.githubusercontent.com/game-ci/cli/${resolvedVersion}/ and executes it without any integrity check (no SHA-256 hash verification). This creates a supply-chain dependency on the game-ci/cli repository's integrity.
No input validation on cliVersion (inline comment on src/download-cli.ts line 129): The cliVersion action input is interpolated directly into the fetch URL without validation. The per-file path sanitization (replace(/[^\w.-]/g, '_')) does not apply to the URL used for the network request. A basic semver pattern check would reduce the attack surface.

Summary

All standard StepSecurity compliance checks pass except a minor filename mismatch (audit_package.yml vs the expected audit_fix.yml). The two security findings in download-cli.ts (unverified script execution and missing URL-side input validation on cliVersion) should be addressed before merging.

anurag-stepsecurity · 2026-10-26T11:23:08Z

Sync verification

Caution

3 items need review: 3 unexpected changes.

Upstream	Versions	Files	dist/ reproducible	config.json
game-ci/unity-builder	v5.0.0 → v6.0.0 · compare	184	✅	✅

Review these

🚨 .github/workflows/auto-retry-known-flakes.yml: unexpected change, please review
🚨 osv-scanner.toml: unexpected change, please review
🚨 package.json: unexpected change, please review

✅ 77 files: exactly upstream's version

✅ 1 file: upstream's changes alongside StepSecurity's

src/index.ts

✅ 2 files: StepSecurity-specific changes only

✅ 100 files: build output or lockfiles, rebuilt from source

✅ 1 file: checked field by field

config.json

🚨 3 files: unexpected changes

✅ config.json checks

Check	Result
config.json is valid	✅
upstream.repository	✅
upstream.synced_tag is an upstream release	✅
upstream.synced_commit matches the tag	✅
upstream.synced_tag is the newest release	✅
upstream.archived	✅
onboarding_type	✅
action_type	✅

✅ Build checks

Check	Result
dist/ is a reproducible build of the PR	✅

✅ Integrity checks

Check	Result
every action's type is supported	✅
actions are node24 with their entrypoints built	✅
the subscription check is called	✅
every lockfile has its package.json	✅
our workflows are unchanged	✅
removed upstream files stay removed	✅
files upstream deleted are gone	✅
no workflow gains write permissions	✅
the PR description is the upstream compare link	✅

Signed-off-by: Anurag Rajawat <anurag@stepsecurity.io>

chore: sync with upstream v6.0.0

140be49

anurag-stepsecurity added the review-required label Oct 26, 2026

github-advanced-security Bot found potential problems Oct 26, 2026

View reviewed changes

github-actions Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread src/download-cli.ts

github-actions Bot reviewed Oct 26, 2026

View reviewed changes

Comment thread src/download-cli.ts

anurag-stepsecurity removed the review-required label Oct 26, 2026

anurag-stepsecurity added 2 commits October 26, 2026 17:18

chore: rm redundant workflow

a21076d

Signed-off-by: Anurag Rajawat <anurag@stepsecurity.io>

fix: resolve security vulnerabilities

bae15ac

Signed-off-by: Anurag Rajawat <anurag@stepsecurity.io>

anurag-stepsecurity enabled auto-merge October 26, 2026 12:02

Navigation Menu

Repository navigation

chore: sync with upstream v6.0.0 - #40

chore: sync with upstream v6.0.0#40
anurag-stepsecurity wants to merge 3 commits into
mainfrom
auto-cherry-pick

anurag-stepsecurity commented Oct 26, 2026

Uh oh!

anurag-stepsecurity commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

Uh oh!

anurag-stepsecurity commented Oct 26, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

anurag-stepsecurity commented Oct 26, 2026

Uh oh!

anurag-stepsecurity commented Oct 26, 2026

Uh oh!

github-actions Bot commented Oct 26, 2026

🔍 Cherry-Pick Verification Report

📋 File-by-File Analysis:

.github/workflows/auto-retry-known-flakes.yml

.github/workflows/build-tests-mac.yml

.github/workflows/build-tests-ubuntu.yml

.github/workflows/build-tests-windows.yml

.github/workflows/integrity-check.yml

.github/workflows/sync-secrets.yml

.vscode/launch.json

action.yml

src/build-args.test.ts

src/build-args.ts

src/download-cli.test.ts

src/download-cli.ts

src/index.ts

src/resolve-project-path.test.ts

src/resolve-project-path.ts

tsconfig.json

vitest.config.mts

📊 Summary:

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 26, 2026

PR Review

Action Type

✅ Passed Checks

❌ Failed Checks

⚠️ Warnings

🔒 Security Findings

Summary

Uh oh!

anurag-stepsecurity commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sync verification

Review these

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`.github/workflows/auto-retry-known-flakes.yml`

`.github/workflows/build-tests-mac.yml`

`.github/workflows/build-tests-ubuntu.yml`

`.github/workflows/build-tests-windows.yml`

`.github/workflows/integrity-check.yml`

`.github/workflows/sync-secrets.yml`

`.vscode/launch.json`

`action.yml`

`src/build-args.test.ts`

`src/build-args.ts`

`src/download-cli.test.ts`

`src/download-cli.ts`

`src/index.ts`

`src/resolve-project-path.test.ts`

`src/resolve-project-path.ts`

`tsconfig.json`

`vitest.config.mts`

anurag-stepsecurity commented Oct 26, 2026 •

edited

Loading