chore: pin GameCI image tag that exists (3.2.0 -> 3.2.2)

[eordano]

UNITY_IMAGE_VERSION: 3.2.0 (test.yml, test-performance.yml) names a GameCI image tag that does not exist for any Unity version. Docker Hub publishes only three tags per editor:

ubuntu-<editor>-linux-il2cpp-3
ubuntu-<editor>-linux-il2cpp-3.2
ubuntu-<editor>-linux-il2cpp-3.2.2

verified for 6000.4.0f1 (dev), 6000.5.2f1 and 6000.5.5f1. The workflows compose ubuntu-$version-$flavor-$imgVer, so the upstream half of the GHCR-miss fallback — pull unityci/editor:$tag, retag, push to GHCR — has never been able to resolve.

It goes unnoticed because GHCR still holds ubuntu-6000.4.0f1-linux-il2cpp-3.2.0, seeded back when that tag existed upstream. Every PR against dev hits that cache and never exercises the fallback. The first PR to move the editor version misses the cache and the job dies in ~3 minutes with manifest unknown, before the test runner starts (unity-test-runner step: 0s) — currently blocking the Unity 6000.5 upgrade PR.

Pins 3.2.2, which exists for every editor version in use, so both the cache hit and the upstream fallback resolve.

Not in scope: Performance Test (PlayMode) is skipped, not failing — it is gated behind workflow_dispatch || contains(labels.*.name, 'perf_test'), which is working as intended.

🤖 Generated with Claude Code

[github-actions]

Build skipped — no changes detected under Explorer/.

[claude]

Claude finished @eordano's task in 3m 11s —— View job

---

Security-focused review

• Read PR diff against origin/dev
• Verify the factual claim (which GameCI tags exist upstream)
• Review test.yml / test-performance.yml against W.1–W.10
• Post verdict

---

What the diff does

One env value, in two files, no other change:

File	Line	Change
.github/workflows/test.yml	28	UNITY_IMAGE_VERSION: 3.2.0 → 3.2.2
.github/workflows/test-performance.yml	22	UNITY_IMAGE_VERSION: 3.2.0 → 3.2.2

It feeds tag="ubuntu-$version-$flavor-$imgVer" at test.yml:169, test.yml:577 and test-performance.yml:110, which composes both unityci/editor:$tag (Docker Hub) and ghcr.io/<owner>/unityci-editor:$tag. So it changes which container base image CI pulls — a dependency change, even though no manifest file moved.

[PR] No new actions, no new secrets, no permission changes, no new execution surface. permissions: blocks in both files are explicit and minimal (contents: read, packages: write for the GHCR seed, checks: write/actions: read). Both use pull_request, not pull_request_target. Neither file invokes an LLM.

STEP W — workflow findings

No HIGH findings. Walking the list for the two changed files: W.1, W.3, W.4, W.5a/b/c, W.6 — N/A, no LLM or prompt in either workflow. W.8a/b — N/A, trigger is pull_request. W.9 — artifact retention is 3 days (test.yml:331), under the 14-day bar. W.10 — clean, scopes are explicit and each one is exercised. W.2 — $GITHUB_OUTPUT writes at test.yml:161/174/582 are single-line key=value, no heredoc.

W.7a is the one that applies, and it is pre-existing, not introduced here. Both workflows set UNITY_EMAIL / UNITY_PASSWORD / UNITY_LICENSE at the top-level env:, so every step — including third-party actions — sees them, and all externals are tag-pinned rather than SHA-pinned: game-ci/unity-test-runner@v4.3.1, game-ci/unity-builder@v4, webfactory/ssh-agent@v0.8.0, docker/login-action@v3, dorny/test-reporter@v2.1.1. Tags are movable. Out of scope for a one-line pin bump, but worth a separate hardening pass.

Dependency assessment — unityci/editor

Dependency	Version	Source	Type	Scope	Risk	Confidence
unityci/editor	ubuntu-<editor>-linux-il2cpp-3.2.2	Docker Hub (GameCI), cached to GHCR	native container image	CI-only, does not ship	LOW	MEDIUM

A. Provenance — GameCI is the established upstream for Unity CI images; .github/workflows/build-game-ci-image.yml:51 already clones game-ci/docker directly, so this is not a new trust relationship. [Inference] The tag is mutable: 3.2.2 is a semver tag, not a digest, so upstream can repush it. Practically mitigated by the seed-once-to-GHCR design (test.yml:604-613) — after the first pull, CI serves from GHCR and never re-resolves upstream. Digest pinning would be strictly better but is awkward here, since the tag is composed at runtime from ProjectVersion.txt.

B/C. Capability and shipping impact — [PR] CI-only. The image builds and tests the project; nothing from it lands in the desktop client. Same trust level as the tag it replaces.

D/E. [UNKNOWN] No transitive/lockfile surface to assess.

Three things to address

1. This PR's own CI never exercises the change. test.yml:5-6 gates the pull_request trigger on paths: ['Explorer/**']. This PR touches only .github/workflows/**, so Unity Test did not run — confirmed against the check list on this PR (no Unity Test run present; the two Unity Performance Test runs are skipped, correctly, per the perf_test gate you already called out). Both the cache-hit path and the fallback path are still unexercised.

This is also the cleanest way to validate the fix. GHCR should not yet hold ubuntu-6000.4.0f1-linux-il2cpp-3.2.2, so a workflow_dispatch run of Unity Test on this branch will miss the cache and take the upstream fallback — the exact path the PR claims has never resolved. If it seeds GHCR and proceeds to the test runner, the claim is proven end-to-end on dev's own editor version, without waiting for the 6000.5 PR.

2. Stale companion default — build-game-ci-image.yml:41. Not in this diff, but coupled to it:

image_suffix:
  description: 'Image Tag Suffix'
  required: true
  default: '3.2.0'

That workflow pushes ghcr.io/decentraland/unityci-editor:<os>-<editor>-<platform>-<suffix>. Two consequences. First, it's the likelier explanation for the existing GHCR -3.2.0 object than the PR body's "seeded back when that tag existed upstream" — an in-house build via this workflow would produce that tag whether or not it ever existed on Docker Hub. Doesn't change your conclusion, just the mechanism. Second, and the actual problem: after this merge, anyone building a replacement image with the defaults produces a -3.2.0 tag that the test workflows no longer look for. Bump it to 3.2.2 in the same PR. Fix this →

3. Validate PR Title is failing and will block merge. ci is not in this repo's allowed type list:

Unknown release type "ci" found in pull request title
Available types: break, chore, docs, feat, fix, refactor, revert, style, test, release

Retitle to chore: pin a GameCI image tag that actually exists (3.2.0 -> 3.2.2).

What I could not verify

[UNKNOWN] I could not independently confirm the Docker Hub tag inventory — outbound network (curl, WebFetch, WebSearch) is not permitted in this job, so the "only -3, -3.2, -3.2.2 exist" claim rests on your verification, not mine. Git history is also shallow here (2 commits), so I couldn't date when 3.2.0 entered the workflows. The claim is internally consistent — a nonexistent upstream tag is exactly what produces manifest unknown at ~3 minutes with unity-test-runner at 0s — and finding 1 above turns it into a one-click check.

Verdict

Nothing in this diff is a security concern: it's a CI-only base-image tag bump with no change to secrets, permissions, triggers, or shipped artifacts. The flag below is for the unverified upstream-tag claim and the stale build-game-ci-image.yml default, not for a defect in the change itself.

DEPENDENCY_REVIEW: NEEDS_ATTENTION

---

I did not push any changes — the GitHub App token can't modify files under .github/workflows/, so items 2 and 3 need a human. Item 1 is a workflow_dispatch run, also yours to trigger.
• Branch: chore/fix-gameci-image-version

[github-actions]

Slack notification sent to #explorer-ext-contributions for external review.
To re-send, delete this comment and re-add the ext-contribution label.

[decentraland-bot]

PR Review: ci: pin a GameCI image tag that actually exists (3.2.0 -> 3.2.2)

STEP 2 — Root-cause check: ✅ PASS

The PR fixes the root cause directly. UNITY_IMAGE_VERSION: 3.2.0 references a GameCI Docker image tag that does not exist on Docker Hub — the upstream only publishes -3, -3.2, and -3.2.2 suffixed tags. Pinning to 3.2.2 is the correct and minimal fix. The change goes unnoticed in CI today because GHCR has a cached image from when 3.2.0 existed upstream, but any Unity editor version bump (e.g. the 6000.5 upgrade) would cause a cache miss and immediate manifest unknown failure.

STEP 3 — Design & integration: N/A

No new code units, no runtime changes, no lifecycle concerns. This is a CI configuration value change only.

STEP 4 — Member audit: N/A

No code members added or changed.

STEP 5 — Line-level review

The diff is correct — both files change 3.2.0 → 3.2.2 in the UNITY_IMAGE_VERSION env var consistently.

[P2] PR title uses ci: type — not in allowed types.
The validate-pr-title.yml action (via decentraland/action-semantic-pull-request@v1) only allows these types: break, chore, docs, feat, fix, refactor, revert, style, test, release. The current title ci: pin a GameCI image tag… uses ci: which is not in that list, causing the semantic / title-matches-convention check to fail. Rename to chore: pin a GameCI image tag that actually exists (3.2.0 -> 3.2.2) to unblock CI.

Security review

No security concerns. The change modifies only a Docker image version tag in CI workflow files — no secrets, credentials, auth flows, input handling, or dependency additions.

Sub-agent review

Sub-agent analysis was not warranted — the diff contains only 2 lines of YAML version string changes with no C#, TypeScript, or runtime code to analyze.

CI Status

Check	Status
semantic / title-matches-convention	❌ Failing (ci: not in allowed types)
enforce-approvals	❌ Waiting on approvals
Build / Test	⏭️ Skipped (no Explorer/ changes)
Other checks	✅ Passing

STEP 8 — Non-blocking warnings

None.

---

REVIEW_RESULT: PASS ✅
COMPLEXITY: SIMPLE
COMPLEXITY_REASON: Two-line version string bump in CI workflow YAML files, no runtime code touched.
QA_REQUIRED: NO

---

Reviewed by Jarvis 🤖 · Requested by unknown via Slack