docs(ci): the red test-unity legs are fork PRs with no secrets, not a regression

[IvanMurzak]

Summary

• The 12 red test-unity-* legs are not a CI regression. Every test-pull-request run
  between 2026-08-25 and 2026-08-29 came from a fork, and GitHub withholds repository
  secrets from a pull_request run whose head repository is a fork — so secrets: inherit
  hands test_unity_plugin.yml an empty UNITY_LICENSE/UNITY_EMAIL/UNITY_PASSWORD and
  game-ci/unity-test-runner aborts before it pulls an image. The licensed path is healthy and
  no secret needs re-issuing.
• Documents the mechanism in docs/claude/ci-unity-license.md — including the duration tell
  that separates it from a bad .ulf and that survives log expiry, because job metadata
  outlives logs — and points at it from a comment on test_unity_plugin.yml's secrets: block.
• No behavioural change. 68 insertions, 0 deletions, both files documentation-only.

Cause class

Not (a) license/activation, not (b) action/runtime, not (c) test-project content, not (d)
Editor/ product code. It is a fifth class the diagnosis had to add: fork PRs receive no
secrets. It presents license-shaped — game-ci's error names UNITY_LICENSE — but is not
credential-shaped: the stored secrets are valid and untouched, so the owner gate G-P0 is not
exercised and Editor/ was never involved.

Evidence line (verbatim, run 33758511822, job 100658764301)

##[error]Missing Unity License File and no Serial was found. If this
is a personal license, make sure to follow the activation
steps and set the UNITY_LICENSE GitHub secret or enter a Unity
serial number inside the UNITY_SERIAL GitHub secret.

Its env: block in that same log reads UNITY_LICENSE:, UNITY_EMAIL: and UNITY_PASSWORD:
with nothing after the colon.

Why the premise was wrong

Head repository of every run in the window (gh api repos/IvanMurzak/Unity-MCP/actions/runs/<id>):

run	created	head repository	conclusion
32788655839	2026-08-24T23:17Z	IvanMurzak/Unity-MCP (same repo)	success
32822206166	2026-08-25T07:33Z	Nghaiz/Unity-MCP (fork)	failure
32989259890	2026-08-26T16:35Z	akimaleo/Unity-MCP (fork)	failure
32992648441	2026-08-26T17:11Z	zorionarrillaga/Unity-MCP (fork)	failure
33250121859	2026-08-29T11:26Z	zorionarrillaga/Unity-MCP (fork)	action_required

The last green run is the last same-repository run, and there was no same-repository PR in
between — so the red sample contains fork PRs and nothing else. Read as a time series it looks
exactly like a regression; it is a sampling artefact.

Two independent checks rule the alternatives out. Nothing in the repo changed: the only commit
touching .github/ between the last green and the first red is 91e2472a (release 0.90.0),
whose entire .github/ diff is three lines of .github/nuget-gate.lock, and
test_unity_plugin.yml was last modified 2026-07-20 (06ca3e1a). Nothing upstream changed
either: the action is SHA-pinned, and the pinned editor images ubuntu-2022.3.62f3-base-3,
ubuntu-2022.3.62f3-windows-mono-3 and ubuntu-6000.3.1f1-base-3 were last pushed 2026-04-13,
2026-04-13 and 2026-03-19 respectively — four months before the break.

The original logs are expired (HTTP 410), but job metadata is not. In 32992648441 every Unity
leg's Run game-ci/unity-test-runner@08fd329f… step started and completed in the same
second (04:57:53Z -> 04:57:53Z) with Free disk space and actions/cache succeeding before
it. An action that rejects its inputs immediately never reached an activation attempt.

Discriminator — both halves, one variable, same commit

Both dispatches ran test_pull_request_manual.yml against 91e2472a, the commit the fork PRs
branched from. The only difference between them is whether the Unity job received the secrets.

half	run	result
secrets present — dispatch on main, workflow unmodified	33757559794	green
secrets withheld — same dispatch from a throwaway branch whose test_pull_request_manual.yml kept one Unity job and dropped its secrets: inherit line	33758511822	red, with the error line above

The red half reproduces the historical fingerprint rather than merely failing: step 7
13:01:37Z -> 13:01:38Z, upload-artifact failing straight after it on
Input required and not supplied: path (nothing was produced to upload), and step numbering
jumping 8 → 14 — the same shape 32992648441 recorded. The throwaway branch has been deleted;
its harness was one deletion of secrets: inherit, so it reproduces from this description.

Caveat stated plainly: the 2026-08-25..27 logs are gone, so the error text cannot be
compared byte-for-byte against them. What is compared is the structural fingerprint, which the
API still serves for both.

What this PR deliberately does not do

Making a fork's Unity checks pass would satisfy the required-status-check ruleset with jobs
that compiled nothing — a leg that stops failing because it stopped running is worse than a red
one, and it trades away the only mechanical guarantee that a fork's code builds. That is a
policy decision for the owner, open in PR #971 — issue #543, which first asked for it, was closed as completed in
2026-03 — and is out of scope here.

Test plan

• python .github/scripts/check_nuget_gate.py locally → NuGet gate OK: 15 pins, generation UNITY_MCP_DEPS_3, propagation consistent. (exit 0)
• test_unity_plugin.yml re-parses as YAML with its three secrets: keys intact (the edit is comment-only)
• No Unity or CLI suite applies — the diff touches nothing under Unity-MCP-Plugin/** or cli/**
• Diff grepped for <?xml, LicenseVersion, UNITY_PASSWORD= → 0 hits; no secret value appears in this PR, its commits, or its logs
• This PR's own test_pull_request.yml run green on all jobs — nuget gate, test-cli (20 + 22) and all 12 test-unity-* legs actually running and passing: run
  33758936539, 17/17 checks
  green, the twelve Unity legs 3m43s—15m44s — the band of the last green run, not the
  1.3—3.2 min fail-fast band.

Closes #973

[IvanMurzak]

Fresh-evidence dispatch has finished. Recording the numbers, since the whole diagnosis rests on
them.

33757559794 —
test_pull_request_manual.yml on main, commit 91e2472a, secrets present:
14/14 jobs green, 15.9 min wall. That is inside the 14–16 min band of the last green run
32788655839 (2026-08-24), and nowhere near the 1.3–3.2 min fail-fast band the fork runs sat in.

leg
6000.3.1f1 editmode on windows-mono / base	15.9 / 15.7 min
2023.2.22f1 editmode on windows-mono / base	12.5 / 11.7 min
2022.3.62f3 editmode on windows-mono / base	12.4 / 12.4 min
the six standalone legs	5.0 – 6.0 min
test-cli (20, 22)	0.5 min each

Before the dispatch, test_pull_request_manual.yml had never run — gh run list --workflow test_pull_request_manual.yml returned [], so this run id cannot be a stale match for an older
one.

The Unity legs ran and passed. Nothing was skipped, and nothing about the licensed path needed
changing to get here.