Thin wrapper: invoke game-ci/cli as a subprocess

.github/workflows/main.yml

@@ -80,6 +80,17 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      # The thin wrapper shells out to game-ci/cli, which detects the engine
+      # (and Unity version) from ProjectSettings/ProjectVersion.txt in the
+      # checked-out workspace - unlike the old self-contained action, it's
+      # no longer enough for this job to just check out unity-activate's own
+      # repo with no Unity project in it ("Engine not detected from
+      # projectPath"). Write a minimal fixture matching the matrix version.
+      - name: Write a minimal Unity project fixture
+        run: |
+          mkdir -p ProjectSettings
+          echo "m_EditorVersion: ${{ matrix.unityVersion }}" > ProjectSettings/ProjectVersion.txt
+
       # Activate Unity
       - name: Activate Unity
         uses: ./

.snyk

@@ -0,0 +1,23 @@
+# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
+version: v1.25.0
+ignore:
+  SNYK-JS-ACTIONSGLOB-11484208:
+    - '*':
+        reason: >-
+          ReDoS in @actions/glob's globEscape (CVE-2025-5890). Snyk lists every
+          published version as affected - the upstream fix is on master but has
+          not been released - so there is no version of @actions/glob to upgrade
+          to. It reaches this action only as a transitive dependency of
+          @actions/cache, which we use to cache the game-ci CLI download.
+
+          Not reachable with attacker-controlled input here: the only paths
+          handed to @actions/cache are built by cacheDirFor() in
+          src/download-cli.ts as os.tmpdir()/game-ci-cli-cache/<version>, and
+          <version> is validated against PINNED_VERSION_PATTERN before it is
+          used. No user-supplied glob pattern reaches globEscape.
+
+          Revisit when @actions/glob publishes a release containing the fix,
+          then drop this entry and bump the dependency.
+        expires: 2027-03-04T00:00:00.000Z
+        created: 2026-09-04T00:00:00.000Z
+patch: {}

action.yml

@@ -5,7 +5,17 @@ inputs:
   unityVersion:
     required: false
     default: '2019.2.11f1'
-    description: 'Version of unity to use for building the project.'
+    description: >-
+      Unused: kept for backward compatibility with existing workflows. The
+      underlying game-ci CLI detects the Unity version from the checked-out
+      project itself (ProjectSettings/ProjectVersion.txt).
+  cliVersion:
+    required: false
+    default: 'latest'
+    description: >-
+      Release tag of the game-ci/cli binary to install and run (e.g.
+      "v0.1.0"). Defaults to the latest release; pin this for reproducible
+      builds.
 outputs: {}
 branding:
   icon: 'box'