Release 1.0.0

.github/workflows/release-preflight.yml

@@ -0,0 +1,130 @@
+# Release preflight — required status check for develop -> master PRs.
+#
+# Installed into each package repo by:
+#   release.py install-preflight <package>
+#
+# WHY THIS EXISTS
+# These are solo repos: GitHub refuses to let a PR author review their own PR
+# (HTTP 422 "Review cannot be requested from pull request author"), so a human
+# review gate is unavailable. This gives a real blocking gate instead — the same
+# package-local gates the release driver enforces, run before the merge rather
+# than after it.
+#
+# THIS FILE MUST STAY OUT OF THE PUBLISHED TARBALL
+# `.github/` IS packed by default — the published googlesheetimporter 0.7.2 asset
+# still contains `package/.github/workflows/openai.yml`. Each package therefore
+# lists `.github/` in its `.gitignore`, which Unity's packer uses as its
+# pack-ignore list; git keeps tracking the file regardless, since .gitignore does
+# not untrack existing paths. Measured on a real clone: 434 -> 433 entries,
+# `.github` 1 -> 0, `Runtime` unchanged.
+#
+# Do NOT verify this on a copy with `.git` removed: the packer behaves differently
+# without a repo and reports `.github` as excluded when it is not. `G24` also
+# surfaces it as an unexpected added file if the ignore line is ever dropped.
+#
+# WHAT IT DOES NOT CHECK
+# Only gates decidable from the package directory plus the base ref, so the check
+# needs no token, no submodules and no network: G7 (bare SemVer), G8/G9 (CHANGELOG
+# heading matches package.json and is newest+highest), G10 (date sane), G11
+# (version advances past master), G15 (the PR touches both files). Remote-state
+# gates (G0-G6, G12-G14) and the whole tarball chain (G20-G27) run locally in
+# `release.py preflight` / `pack` before the PR is opened.
+
+name: release-preflight
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-preflight-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  preflight:
+    if: github.event.action != 'closed'
+    runs-on: ubuntu-latest
+    steps:
+      # `lfs: true` is load-bearing, not a nicety. The default (false) leaves every
+      # LFS-tracked file as a ~130-byte pointer stub, which would make G28 fail on
+      # every PR. With it on, G28 becomes a genuine check that the LFS objects are
+      # FETCHABLE from the remote — the exact failure that hit uiservice, where the
+      # working tree held stubs while the published 1.2.1 had real content.
+      - name: Check out the package
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          lfs: true
+          persist-credentials: false
+
+      # The gate logic is shared rather than vendored into six repos, so there is
+      # one source of truth. Pinning its full commit keeps an unchanged package PR
+      # reproducible when Frameworks/develop advances; the installer performs
+      # intentional snapshot updates across all package repositories.
+      - name: Check out the release tooling
+        uses: actions/checkout@v7
+        with:
+          repository: CoderGamester/Frameworks
+          # Immutable tooling snapshot. Update intentionally through
+          # `release.py install-preflight`, never by following a moving branch.
+          ref: be8c147f3d12d94a4055d556ffdc0a26e077e5ec
+          path: .release-tooling
+          sparse-checkout: .claude/skills/unity-package-release/scripts
+          persist-credentials: false
+
+      - name: Assert the release tooling checkout
+        run: |
+          test -f .release-tooling/.claude/skills/unity-package-release/scripts/release.py
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Preflight
+        run: |
+          python3 .release-tooling/.claude/skills/unity-package-release/scripts/release.py \
+            preflight-pr --path . --base "origin/${{ github.base_ref }}"
+
+  # GITHUB_TOKEN cannot dispatch into another repository. Add a fine-grained
+  # FRAMEWORKS_DISPATCH_TOKEN secret (Contents: read/write on Frameworks) to each
+  # package repository to activate this hand-off. A missing token is reported as
+  # a warning rather than turning an already-merged release PR red.
+  notify-release:
+    if: github.event.action == 'closed' && github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify the host release workflow
+        env:
+          DISPATCH_TOKEN: ${{ secrets.FRAMEWORKS_DISPATCH_TOKEN }}
+          PACKAGE_REPOSITORY: ${{ github.event.repository.name }}
+        run: |
+          if [ -z "$DISPATCH_TOKEN" ]; then
+            echo "::warning::FRAMEWORKS_DISPATCH_TOKEN is not configured; skipping host release notification."
+            exit 0
+          fi
+
+          case "$PACKAGE_REPOSITORY" in
+            Unity-GameData) package=gamedata ;;
+            Unity-GoogleSheet-Importer) package=googlesheetimporter ;;
+            Unity-MobileServices) package=mobileservices ;;
+            Unity-Services) package=services ;;
+            Statechart-HFSM) package=statechart ;;
+            Unity-UiService) package=uiservice ;;
+            *)
+              echo "::error::Unknown package repository: $PACKAGE_REPOSITORY"
+              exit 1
+              ;;
+          esac
+
+          payload=$(printf '{"event_type":"upm-release","client_payload":{"package":"%s","phase":"status"}}' "$package")
+          curl --fail-with-body --location --request POST \
+            --url https://api.github.com/repos/CoderGamester/Frameworks/dispatches \
+            --header "Accept: application/vnd.github+json" \
+            --header "Authorization: Bearer $DISPATCH_TOKEN" \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            --data "$payload"

.gitignore

@@ -79,3 +79,9 @@ crashlytics-build.properties
 
 
 
+
+# Tests audit history (unity-tests-audit skill -- local developer state, never committed)
+.audit-history.md
+
+# CI config: tracked in git, excluded from the published UPM tarball
+.github/