[Matuyuhi]

Security:

• Pass inputs through env: instead of interpolating ${{ inputs.* }} into
  run: blocks. Previously a branch name or header containing shell
  metacharacters could execute arbitrary commands on the runner.
• Stop writing the authorization header to $GITHUB_ENV, which exposed the
  credential to every subsequent step in the calling job. It now lives only in
  the environment of the single step that needs it, and is masked in logs.
• Stop echoing the raw API response unconditionally; it is emitted only under
  debug logging.

Correctness:

• Drop the internal actions/checkout@v4. Nothing reads the repository, and it
  clobbered the caller's checkout.
• Wire up platform and machine_type_label, which were documented but never
  sent. They now default to empty and are omitted from the payload unless set,
  so build target defaults still apply.
• Validate required inputs and the clean flag before issuing the request.
• Fail loudly when a 2xx response carries no build ID instead of reporting
  build_id=null as success.
• Fall back to the raw response body when an error body is not JSON; jq -r '.error' previously produced an empty message.
• Retry only DNS and connection failures. Triggering a build is not idempotent,
  so a request that may have reached Unity is never resent.
• Write the response to $RUNNER_TEMP rather than the caller's workspace.
• Skip the apt-get install when curl and jq are already present, and
  handle runners without sudo or without apt-get.
• Add a build summary table to the job summary.

Features:

• Add an api_url input so a newer API version can be targeted without
  changing the action. The response parser accepts both a single-element array
  and a bare object.

Tooling and docs:

• Add scripts/lint-action.sh and a CI workflow: validates the manifest, checks
  outputs reference real step IDs, rejects inputs interpolated into run:
  blocks, and runs bash -n plus shellcheck on every embedded script.
• Rewrite the README: remove the stale commit_sha reference and the incorrect
  claim that the branch's latest SHA is fetched, and document outputs usage,
  API versioning and behaviour.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01BbivmM23ZX7xoHxbEN79Pw

[Copilot]

Pull request overview

This PR hardens and simplifies the composite GitHub Action that triggers Unity Build Automation (Unity Cloud Build) by reducing injection risk, improving input/response handling, and adding CI linting plus updated documentation.

Changes:

• Refactors action.yml to pass inputs via env, validate inputs, improve error handling, and add safer dependency installation and logging/summary behavior.
• Adds a lint script + CI workflow to validate action.yml structure and lint embedded run: scripts.
• Rewrites the README to reflect the action’s behavior, inputs/outputs, and API versioning.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
scripts/lint-action.sh	Adds an action manifest + embedded-script linting helper.
README.md	Updates usage, inputs/outputs, API versioning notes, and behavioral guarantees.
action.yml	Hardens the trigger step (env-passing, validation, payload wiring, retries, summaries) and simplifies dependencies.
.github/workflows/ci.yml	Adds CI to run the new lint script and workflow linting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.