Repository navigation
Migrate to Unity Build Automation API v2 with service accounts - #3
Merged
Merged
Conversation
Unity deprecated Build Automation API v1 and removes it on 2026-12-21, so default to v2 at https://build-automation.services.api.unity.com/v2. v2 authenticates with HTTP Basic using a service account key ID and secret and rejects the legacy Build Automation API key, so add `unity_service_account_key_id` / `unity_service_account_secret_key` inputs that are base64-encoded into the Authorization header. `authorization_header` stays supported for callers that can only supply a pre-built header, but the two are mutually exclusive: supplying both, or half of the key pair, now fails before any request is sent rather than silently using stale credentials. Adapt response handling to v2: - 202 Accepted is the success status (the existing `^2` check covers it). - Errors are RFC 7807, so read `detail`/`title` alongside v1's `error`/`message`, and surface the `requestId` Unity support asks for. - 401/403 responses explain that v2 needs service account credentials with a Build Automation role, the most likely migration failure. - A 2xx carrying a per-target `error` and no build ID (e.g. a build is already running) now reports that message instead of the raw body. - Expose the `buildStatus` field v2 returns as a new `build_status` output. Pointing `api_url` back at v1 still works and logs a deprecation warning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Mxrx7ufpE3maxhLfSYwPA
Since this releases under a new version tag, the v1 fallbacks are dead weight. Remove them so there is exactly one supported configuration: - Delete the `authorization_header` input. API v2 only accepts service account credentials, so the pre-built-header escape hatch could only carry a value the caller had to hand-encode anyway. The key ID and secret inputs are now plain required inputs, validated alongside the org/project/target IDs, which drops the mutually-exclusive/paired-input checks entirely. - Reject a v1 base URL instead of warning. v1 does not accept service account credentials, so pointing `api_url` at it can only produce a confusing 401; the error names the older release to pin instead. - Parse errors as RFC 7807 only (`detail`/`title`), dropping v1's `error`/`message`. The 2xx-without-a-build-ID path still reads `error`, which v2's GetBuildResponse defines for an already-running target. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Mxrx7ufpE3maxhLfSYwPA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates the action to use Unity Build Automation API v2, replacing the deprecated v1 API. The most significant change is the authentication mechanism: instead of accepting a pre-formed authorization header, the action now takes a service account key ID and secret, constructs the HTTP Basic credential internally, and validates that v1 URLs are not used.
Key Changes
Authentication overhaul: Replaced single
authorization_headerinput with two new inputs (unity_service_account_key_idandunity_service_account_secret_key). The action now constructs the base64-encoded HTTP Basic credential internally and masks both the secret key and derived credential in logs.API endpoint migration: Changed default API URL from
https://build-api.cloud.unity3d.com/api/v1tohttps://build-automation.services.api.unity.com/v2. Added validation to reject v1 URLs with a clear error message.Error handling improvements: Updated error parsing to handle v2's RFC 7807 error format (
detail,title,requestIdfields instead of v1'serror/message). Added special handling for 401/403 errors to guide users toward service account setup. Extracts and includesrequestIdin error messages for support investigations.Response parsing updates: Added extraction of
buildStatusfield from API responses and exposed it as a new output. Enhanced handling of 2xx responses that contain per-target errors (e.g., when a build is already running).Documentation: Added comprehensive migration guide explaining the v1→v2 transition, authentication setup, and what changed in the API contract. Updated all examples and input/output tables.
Implementation Details
keyId:secretKeyand strips newlines (to handle GNU coreutils' line wrapping) before constructing theAuthorization: Basicheader.::add-mask::.https://claude.ai/code/session_016Mxrx7ufpE3maxhLfSYwPA