fix: replace orchestrator-develop branch references with main

The orchestrator-develop branch no longer exists. Update all fallback
clone commands and test fixtures to use main instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

action.yml

@@ -279,30 +279,120 @@ inputs:
     description:
       '[Orchestrator] Specifies the repo for the unity builder. Useful if you forked the repo for testing, features, or
       fixes.'
-  gitIntegrityCheck:
-    description: 'Run git integrity checks before build (fsck, lock cleanup, submodule validation)'
+  gcpProject:
     required: false
-    default: 'false'
-  gitAutoRecover:
-    description: 'Attempt automatic recovery if git corruption is detected'
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Google Cloud project ID for Cloud Run Jobs provider. Falls back to
+      GOOGLE_CLOUD_PROJECT env var.'
+  gcpRegion:
     required: false
-    default: 'false'
-  cleanReservedFilenames:
-    description: 'Remove Windows reserved filenames that cause Unity import loops'
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Google Cloud region for Cloud Run Jobs (e.g. us-central1). Defaults to the region
+      input if empty.'
+  gcpStorageType:
     required: false
-    default: 'false'
-  buildArchiveEnabled:
-    description: 'Archive build output after successful build'
+    default: 'gcs-fuse'
+    description:
+      '[Orchestrator] [Experimental] Storage type for Cloud Run Jobs. Options: gcs-fuse (mount GCS bucket as filesystem,
+      unlimited size, best for large sequential I/O), gcs-copy (copy artifacts in/out via gsutil, simpler, no FUSE
+      overhead), nfs (Filestore NFS mount, true POSIX, good random I/O, up to 100 TiB), in-memory (tmpfs, fastest but
+      volatile, up to 32 GiB).'
+  gcpBucket:
     required: false
-    default: 'false'
-  buildArchivePath:
-    description: 'Path to store build archives'
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] GCS bucket name for build artifact storage. Used by gcs-fuse and gcs-copy storage
+      types.'
+  gcpFilestoreIp:
     required: false
-    default: './build-archives'
-  buildArchiveRetention:
-    description: 'Days to retain build archives before cleanup'
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Filestore instance IP address for NFS storage type. Required when gcpStorageType is
+      nfs.'
+  gcpFilestoreShare:
     required: false
-    default: '30'
+    default: '/share1'
+    description:
+      '[Orchestrator] [Experimental] Filestore share name for NFS storage type. Defaults to /share1 (the Filestore
+      default).'
+  gcpMachineType:
+    required: false
+    default: 'e2-standard-4'
+    description: '[Orchestrator] [Experimental] Machine type for Cloud Run Jobs (e.g. e2-standard-4, e2-highmem-8).'
+  gcpDiskSizeGb:
+    required: false
+    default: '100'
+    description:
+      '[Orchestrator] [Experimental] Disk size in GB for Cloud Run Jobs in-memory volumes. Only applies to in-memory
+      storage type (max 32).'
+  gcpServiceAccount:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Google Cloud service account email for Cloud Run Jobs execution.'
+  gcpVpcConnector:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] VPC connector name for Cloud Run Jobs private networking.'
+  azureResourceGroup:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure resource group for Container Instances provider. Falls back to
+      AZURE_RESOURCE_GROUP env var.'
+  azureLocation:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure region for Container Instances (e.g. eastus, westeurope). Defaults to the
+      region input if empty.'
+  azureStorageType:
+    required: false
+    default: 'azure-files'
+    description:
+      '[Orchestrator] [Experimental] Storage type for Azure Container Instances. Options: azure-files (SMB file share
+      mount, up to 100 TiB, premium throughput), blob-copy (copy artifacts in/out via az storage blob, no mount
+      overhead), azure-files-nfs (NFS 4.1 file share mount, true POSIX, no SMB lock overhead), in-memory (emptyDir
+      tmpfs, fastest but volatile, size limited by container memory).'
+  azureStorageAccount:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure Storage Account name. Used by azure-files, azure-files-nfs, and blob-copy
+      storage types.'
+  azureFileShareName:
+    required: false
+    default: 'unity-builds'
+    description:
+      '[Orchestrator] [Experimental] Azure File Share name within the storage account. Used by azure-files and
+      azure-files-nfs storage types. Supports up to 100 TiB per share.'
+  azureBlobContainer:
+    required: false
+    default: 'unity-builds'
+    description: '[Orchestrator] [Experimental] Azure Blob container name for blob-copy storage type.'
+  azureSubscriptionId:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Azure subscription ID. Falls back to AZURE_SUBSCRIPTION_ID env var.'
+  azureCpu:
+    required: false
+    default: '4'
+    description: '[Orchestrator] [Experimental] CPU cores for Azure Container Instances (1-16).'
+  azureMemoryGb:
+    required: false
+    default: '16'
+    description: '[Orchestrator] [Experimental] Memory in GB for Azure Container Instances (1-16).'
+  azureDiskSizeGb:
+    required: false
+    default: '100'
+    description:
+      '[Orchestrator] [Experimental] File share quota in GB for Azure Container Instances. Premium shares support up to
+      102400 GB (100 TiB).'
+  azureSubnetId:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Azure subnet resource ID for VNet-integrated Container Instances.'
 
 outputs:
   volume:

src/index.ts

@@ -3,7 +3,6 @@ import { Action, BuildParameters, Cache, Orchestrator, Docker, ImageTag, Output
 import { Cli } from './model/cli/cli';
 import MacBuilder from './model/mac-builder';
 import PlatformSetup from './model/platform-setup';
-import { BuildReliabilityService } from './model/orchestrator/services/reliability';
 
 async function runMain() {
   try {
@@ -15,38 +14,11 @@ async function runMain() {
     Action.checkCompatibility();
     Cache.verify();
 
-    // Always configure git environment for CI reliability
-    BuildReliabilityService.configureGitEnvironment();
-
     const { workspace, actionFolder } = Action;
 
     const buildParameters = await BuildParameters.create();
     const baseImage = new ImageTag(buildParameters);
 
-    // Pre-build reliability checks
-    if (buildParameters.gitIntegrityCheck) {
-      core.info('Running git integrity checks...');
-
-      const isHealthy = BuildReliabilityService.checkGitIntegrity(workspace);
-      BuildReliabilityService.cleanStaleLockFiles(workspace);
-      BuildReliabilityService.validateSubmoduleBackingStores(workspace);
-
-      if (buildParameters.cleanReservedFilenames) {
-        BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
-      }
-
-      if (!isHealthy && buildParameters.gitAutoRecover) {
-        core.info('Git corruption detected, attempting automatic recovery...');
-        const recovered = BuildReliabilityService.recoverCorruptedRepo(workspace);
-        if (!recovered) {
-          core.warning('Automatic recovery failed. Build may encounter issues.');
-        }
-      }
-    } else if (buildParameters.cleanReservedFilenames) {
-      // cleanReservedFilenames can run independently of gitIntegrityCheck
-      BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
-    }
-
     let exitCode = -1;
 
     if (buildParameters.providerStrategy === 'local') {
@@ -65,13 +37,6 @@ async function runMain() {
       exitCode = 0;
     }
 
-    // Post-build: archive and enforce retention
-    if (buildParameters.buildArchiveEnabled && exitCode === 0) {
-      core.info('Archiving build output...');
-      BuildReliabilityService.archiveBuildOutput(buildParameters.buildPath, buildParameters.buildArchivePath);
-      BuildReliabilityService.enforceRetention(buildParameters.buildArchivePath, buildParameters.buildArchiveRetention);
-    }
-
     // Set output
     await Output.setBuildVersion(buildParameters.buildVersion);
     await Output.setAndroidVersionCode(buildParameters.androidVersionCode);

src/model/build-parameters.ts

@@ -106,12 +106,31 @@ class BuildParameters {
   public cacheUnityInstallationOnMac!: boolean;
   public unityHubVersionOnMac!: string;
   public dockerWorkspacePath!: string;
-  public gitIntegrityCheck!: boolean;
-  public gitAutoRecover!: boolean;
-  public cleanReservedFilenames!: boolean;
-  public buildArchiveEnabled!: boolean;
-  public buildArchivePath!: string;
-  public buildArchiveRetention!: number;
+
+  // GCP Cloud Run (Experimental)
+  public gcpProject!: string;
+  public gcpRegion!: string;
+  public gcpStorageType!: string;
+  public gcpBucket!: string;
+  public gcpFilestoreIp!: string;
+  public gcpFilestoreShare!: string;
+  public gcpMachineType!: string;
+  public gcpDiskSizeGb!: string;
+  public gcpServiceAccount!: string;
+  public gcpVpcConnector!: string;
+
+  // Azure Container Instances (Experimental)
+  public azureResourceGroup!: string;
+  public azureLocation!: string;
+  public azureStorageType!: string;
+  public azureStorageAccount!: string;
+  public azureBlobContainer!: string;
+  public azureFileShareName!: string;
+  public azureSubscriptionId!: string;
+  public azureCpu!: string;
+  public azureMemoryGb!: string;
+  public azureDiskSizeGb!: string;
+  public azureSubnetId!: string;
 
   public static shouldUseRetainedWorkspaceMode(buildParameters: BuildParameters) {
     return buildParameters.maxRetainedWorkspaces > 0 && Orchestrator.lockedWorkspace !== ``;
@@ -234,6 +253,27 @@ class BuildParameters {
       inputPullCommand: OrchestratorOptions.inputPullCommand,
       pullInputList: OrchestratorOptions.pullInputList,
       kubeStorageClass: OrchestratorOptions.kubeStorageClass,
+      gcpProject: Input.gcpProject,
+      gcpRegion: Input.gcpRegion,
+      gcpStorageType: Input.gcpStorageType,
+      gcpBucket: Input.gcpBucket,
+      gcpFilestoreIp: Input.gcpFilestoreIp,
+      gcpFilestoreShare: Input.gcpFilestoreShare,
+      gcpMachineType: Input.gcpMachineType,
+      gcpDiskSizeGb: Input.gcpDiskSizeGb,
+      gcpServiceAccount: Input.gcpServiceAccount,
+      gcpVpcConnector: Input.gcpVpcConnector,
+      azureResourceGroup: Input.azureResourceGroup,
+      azureLocation: Input.azureLocation,
+      azureStorageType: Input.azureStorageType,
+      azureStorageAccount: Input.azureStorageAccount,
+      azureBlobContainer: Input.azureBlobContainer,
+      azureFileShareName: Input.azureFileShareName,
+      azureSubscriptionId: Input.azureSubscriptionId,
+      azureCpu: Input.azureCpu,
+      azureMemoryGb: Input.azureMemoryGb,
+      azureDiskSizeGb: Input.azureDiskSizeGb,
+      azureSubnetId: Input.azureSubnetId,
       cacheKey: OrchestratorOptions.cacheKey,
       maxRetainedWorkspaces: Number.parseInt(OrchestratorOptions.maxRetainedWorkspaces),
       useLargePackages: OrchestratorOptions.useLargePackages,
@@ -248,12 +288,6 @@ class BuildParameters {
       cacheUnityInstallationOnMac: Input.cacheUnityInstallationOnMac,
       unityHubVersionOnMac: Input.unityHubVersionOnMac,
       dockerWorkspacePath: Input.dockerWorkspacePath,
-      gitIntegrityCheck: Input.gitIntegrityCheck,
-      gitAutoRecover: Input.gitAutoRecover,
-      cleanReservedFilenames: Input.cleanReservedFilenames,
-      buildArchiveEnabled: Input.buildArchiveEnabled,
-      buildArchivePath: Input.buildArchivePath,
-      buildArchiveRetention: Input.buildArchiveRetention,
     };
   }
 

src/model/input.ts

@@ -282,36 +282,90 @@ class Input {
     return Input.getInput('skipActivation')?.toLowerCase() ?? 'false';
   }
 
-  static get gitIntegrityCheck(): boolean {
-    const input = Input.getInput('gitIntegrityCheck') ?? 'false';
-
-    return input === 'true';
+  // GCP Cloud Run (Experimental)
+  static get gcpProject(): string {
+    return Input.getInput('gcpProject') ?? '';
   }
 
-  static get gitAutoRecover(): boolean {
-    const input = Input.getInput('gitAutoRecover') ?? 'false';
-
-    return input === 'true';
+  static get gcpRegion(): string {
+    return Input.getInput('gcpRegion') ?? '';
   }
 
-  static get cleanReservedFilenames(): boolean {
-    const input = Input.getInput('cleanReservedFilenames') ?? 'false';
-
-    return input === 'true';
+  static get gcpStorageType(): string {
+    return Input.getInput('gcpStorageType') ?? 'gcs-fuse';
   }
 
-  static get buildArchiveEnabled(): boolean {
-    const input = Input.getInput('buildArchiveEnabled') ?? 'false';
-
-    return input === 'true';
+  static get gcpBucket(): string {
+    return Input.getInput('gcpBucket') ?? '';
   }
 
-  static get buildArchivePath(): string {
-    return Input.getInput('buildArchivePath') ?? './build-archives';
+  static get gcpFilestoreIp(): string {
+    return Input.getInput('gcpFilestoreIp') ?? '';
   }
 
-  static get buildArchiveRetention(): number {
-    return Number.parseInt(Input.getInput('buildArchiveRetention') ?? '30', 10);
+  static get gcpFilestoreShare(): string {
+    return Input.getInput('gcpFilestoreShare') ?? '/share1';
+  }
+
+  static get gcpMachineType(): string {
+    return Input.getInput('gcpMachineType') ?? 'e2-standard-4';
+  }
+
+  static get gcpDiskSizeGb(): string {
+    return Input.getInput('gcpDiskSizeGb') ?? '100';
+  }
+
+  static get gcpServiceAccount(): string {
+    return Input.getInput('gcpServiceAccount') ?? '';
+  }
+
+  static get gcpVpcConnector(): string {
+    return Input.getInput('gcpVpcConnector') ?? '';
+  }
+
+  // Azure Container Instances (Experimental)
+  static get azureResourceGroup(): string {
+    return Input.getInput('azureResourceGroup') ?? '';
+  }
+
+  static get azureLocation(): string {
+    return Input.getInput('azureLocation') ?? '';
+  }
+
+  static get azureStorageType(): string {
+    return Input.getInput('azureStorageType') ?? 'azure-files';
+  }
+
+  static get azureStorageAccount(): string {
+    return Input.getInput('azureStorageAccount') ?? '';
+  }
+
+  static get azureBlobContainer(): string {
+    return Input.getInput('azureBlobContainer') ?? 'unity-builds';
+  }
+
+  static get azureFileShareName(): string {
+    return Input.getInput('azureFileShareName') ?? 'unity-builds';
+  }
+
+  static get azureSubscriptionId(): string {
+    return Input.getInput('azureSubscriptionId') ?? '';
+  }
+
+  static get azureCpu(): string {
+    return Input.getInput('azureCpu') ?? '4';
+  }
+
+  static get azureMemoryGb(): string {
+    return Input.getInput('azureMemoryGb') ?? '16';
+  }
+
+  static get azureDiskSizeGb(): string {
+    return Input.getInput('azureDiskSizeGb') ?? '100';
+  }
+
+  static get azureSubnetId(): string {
+    return Input.getInput('azureSubnetId') ?? '';
   }
 
   public static ToEnvVarFormat(input: string) {

src/model/orchestrator/orchestrator.ts

@@ -13,6 +13,8 @@ import OrchestratorEnvironmentVariable from './options/orchestrator-environment-
 import TestOrchestrator from './providers/test';
 import LocalOrchestrator from './providers/local';
 import LocalDockerOrchestrator from './providers/docker';
+import GcpCloudRunProvider from './providers/gcp-cloud-run';
+import AzureAciProvider from './providers/azure-aci';
 import loadProvider from './providers/provider-loader';
 import GitHub from '../github';
 import SharedWorkspaceLocking from './services/core/shared-workspace-locking';
@@ -158,6 +160,14 @@ class Orchestrator {
       case 'local':
         Orchestrator.Provider = new LocalOrchestrator();
         break;
+      case 'gcp-cloud-run':
+        OrchestratorLogger.log('⚠ EXPERIMENTAL: GCP Cloud Run Jobs provider');
+        Orchestrator.Provider = new GcpCloudRunProvider(Orchestrator.buildParameters);
+        break;
+      case 'azure-aci':
+        OrchestratorLogger.log('⚠ EXPERIMENTAL: Azure Container Instances provider');
+        Orchestrator.Provider = new AzureAciProvider(Orchestrator.buildParameters);
+        break;
       default:
         // Try to load provider using the dynamic loader for unknown providers
         try {

src/model/orchestrator/providers/azure-aci/index.ts

@@ -0,0 +1,536 @@
+/**
+ * Azure Container Instances (ACI) Provider (Experimental)
+ *
+ * Executes Unity builds as Azure Container Instances with configurable storage backends.
+ *
+ * Storage types:
+ *   - azure-files:     SMB file share mount via Azure Files. Up to 100 TiB per share,
+ *                       premium throughput. Default.
+ *                       Requires: azureStorageAccount, azureFileShareName
+ *   - blob-copy:       Copy artifacts in/out of Azure Blob Storage before/after the build.
+ *                       No mount overhead, simpler.
+ *                       Requires: azureStorageAccount, azureBlobContainer
+ *   - azure-files-nfs: NFS 4.1 file share mount. True POSIX semantics, no SMB lock overhead,
+ *                       better for Unity Library caching (many small random reads).
+ *                       Requires: azureStorageAccount, azureFileShareName, Premium FileStorage,
+ *                       VNet integration (azureSubnetId)
+ *   - in-memory:       emptyDir volume (tmpfs). Fastest I/O but volatile, size limited by
+ *                       container memory allocation.
+ *
+ * Prerequisites:
+ *   - Azure CLI authenticated (az login or service principal)
+ *   - A resource group for build resources
+ *   - Contributor role on the resource group
+ *
+ * @experimental This provider is experimental. APIs and behavior may change.
+ */
+
+import { ProviderInterface } from '../provider-interface';
+import BuildParameters from '../../../build-parameters';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import { Input } from '../../..';
+import ResourceTracking from '../../services/core/resource-tracking';
+
+type AzureStorageType = 'azure-files' | 'blob-copy' | 'azure-files-nfs' | 'in-memory';
+
+class AzureAciProvider implements ProviderInterface {
+  private readonly resourceGroup: string;
+  private readonly location: string;
+  private readonly storageType: AzureStorageType;
+  private readonly storageAccount: string;
+  private readonly blobContainer: string;
+  private readonly fileShareName: string;
+  private readonly subscriptionId: string;
+  private readonly cpu: number;
+  private readonly memoryGb: number;
+  private readonly diskSizeGb: number;
+  private readonly subnetId: string;
+  private buildParameters: BuildParameters;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.resourceGroup = buildParameters.azureResourceGroup || process.env.AZURE_RESOURCE_GROUP || '';
+    this.location = buildParameters.azureLocation || Input.region || 'eastus';
+    this.storageType = (buildParameters.azureStorageType || 'azure-files') as AzureStorageType;
+    this.storageAccount = buildParameters.azureStorageAccount || process.env.AZURE_STORAGE_ACCOUNT || '';
+    this.blobContainer = buildParameters.azureBlobContainer || 'unity-builds';
+    this.fileShareName = buildParameters.azureFileShareName || 'unity-builds';
+    this.subscriptionId = buildParameters.azureSubscriptionId || process.env.AZURE_SUBSCRIPTION_ID || '';
+    this.cpu = Number.parseInt(buildParameters.azureCpu || '4', 10);
+    this.memoryGb = Number.parseInt(buildParameters.azureMemoryGb || '16', 10);
+    this.diskSizeGb = Number.parseInt(buildParameters.azureDiskSizeGb || '100', 10);
+    this.subnetId = buildParameters.azureSubnetId || '';
+
+    OrchestratorLogger.log('[Azure ACI] Provider initialized (EXPERIMENTAL)');
+    OrchestratorLogger.log(`[Azure ACI] Resource Group: ${this.resourceGroup || '(not set)'}`);
+    OrchestratorLogger.log(`[Azure ACI] Location: ${this.location}`);
+    OrchestratorLogger.log(`[Azure ACI] Storage: ${this.storageType}`);
+    OrchestratorLogger.log(`[Azure ACI] Resources: ${this.cpu} CPU, ${this.memoryGb}GB RAM`);
+
+    this.validateStorageConfig();
+  }
+
+  private validateStorageConfig(): void {
+    switch (this.storageType) {
+      case 'azure-files':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning(
+            '[Azure ACI] Storage type "azure-files" requires azureStorageAccount to be set.',
+          );
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] File Share: ${this.storageAccount}/${this.fileShareName} (SMB)`);
+        }
+        break;
+      case 'azure-files-nfs':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning(
+            '[Azure ACI] Storage type "azure-files-nfs" requires azureStorageAccount (Premium FileStorage).',
+          );
+        }
+        if (!this.subnetId) {
+          OrchestratorLogger.logWarning('[Azure ACI] NFS file shares require VNet integration. Set azureSubnetId.');
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] File Share: ${this.storageAccount}/${this.fileShareName} (NFS 4.1)`);
+        }
+        break;
+      case 'blob-copy':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning('[Azure ACI] Storage type "blob-copy" requires azureStorageAccount to be set.');
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] Blob container: ${this.storageAccount}/${this.blobContainer}`);
+        }
+        break;
+      case 'in-memory':
+        OrchestratorLogger.log(
+          `[Azure ACI] In-memory volume (emptyDir): limited by ${this.memoryGb}GB container memory`,
+        );
+        break;
+      default:
+        OrchestratorLogger.logWarning(
+          `[Azure ACI] Unknown storage type '${this.storageType}'. Valid: azure-files, blob-copy, azure-files-nfs, in-memory`,
+        );
+    }
+
+    if (!this.resourceGroup) {
+      OrchestratorLogger.logWarning(
+        '[Azure ACI] No resource group specified. Set azureResourceGroup input or AZURE_RESOURCE_GROUP env var.',
+      );
+    }
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log(`[Azure ACI] Setting up workflow for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('azure-aci setup');
+
+    // Verify Azure CLI is available
+    try {
+      await OrchestratorSystem.Run('az version --output json', false, true);
+      OrchestratorLogger.log('[Azure ACI] Azure CLI detected');
+    } catch {
+      throw new Error(
+        '[Azure ACI] Azure CLI not found. Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli',
+      );
+    }
+
+    if (this.subscriptionId) {
+      await OrchestratorSystem.Run(`az account set --subscription="${this.subscriptionId}"`);
+    }
+
+    // Ensure resource group exists
+    if (this.resourceGroup) {
+      try {
+        await OrchestratorSystem.Run(`az group show --name "${this.resourceGroup}" --output json`, false, true);
+        OrchestratorLogger.log(`[Azure ACI] Resource group ${this.resourceGroup} exists`);
+      } catch {
+        OrchestratorLogger.log(`[Azure ACI] Creating resource group ${this.resourceGroup}`);
+        await OrchestratorSystem.Run(`az group create --name "${this.resourceGroup}" --location "${this.location}"`);
+      }
+    }
+
+    // Storage-specific setup
+    switch (this.storageType) {
+      case 'azure-files':
+        await this.setupStorageAccount('Standard_LRS', 'StorageV2');
+        await this.setupFileShare();
+        break;
+      case 'azure-files-nfs':
+        await this.setupStorageAccount('Premium_LRS', 'FileStorage');
+        await this.setupNfsFileShare();
+        break;
+      case 'blob-copy':
+        await this.setupStorageAccount('Standard_LRS', 'StorageV2');
+        await this.setupBlobContainer();
+        break;
+      case 'in-memory':
+        // No storage setup needed
+        break;
+    }
+  }
+
+  private async setupStorageAccount(sku: string, kind: string): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+
+    try {
+      await OrchestratorSystem.Run(
+        `az storage account show --name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+      OrchestratorLogger.log(`[Azure ACI] Storage account ${this.storageAccount} exists`);
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating storage account ${this.storageAccount} (${sku}, ${kind})`);
+      await OrchestratorSystem.Run(
+        `az storage account create --name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --location "${this.location}" --sku ${sku} --kind ${kind}`,
+      );
+    }
+  }
+
+  private async setupFileShare(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage share-rm show --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating file share ${this.fileShareName} (${this.diskSizeGb}GB)`);
+      await OrchestratorSystem.Run(
+        `az storage share-rm create --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --quota ${this.diskSizeGb}`,
+      );
+    }
+  }
+
+  private async setupNfsFileShare(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage share-rm show --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating NFS file share ${this.fileShareName} (${this.diskSizeGb}GB)`);
+      await OrchestratorSystem.Run(
+        `az storage share-rm create --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --quota ${this.diskSizeGb} --enabled-protocols NFS`,
+      );
+    }
+  }
+
+  private async setupBlobContainer(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage container show --name "${this.blobContainer}" --account-name "${this.storageAccount}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating blob container ${this.blobContainer}`);
+      await OrchestratorSystem.Run(
+        `az storage container create --name "${this.blobContainer}" --account-name "${this.storageAccount}"`,
+      );
+    }
+  }
+
+  private async getStorageKey(): Promise<string> {
+    if (!this.storageAccount || !this.resourceGroup) return '';
+    try {
+      const keyJson = await OrchestratorSystem.Run(
+        `az storage account keys list --account-name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+      const keys = JSON.parse(keyJson);
+      return keys[0]?.value || '';
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[Azure ACI] Could not get storage key: ${error.message}`);
+      return '';
+    }
+  }
+
+  private async buildVolumeFlags(mountdir: string): Promise<string> {
+    switch (this.storageType) {
+      case 'azure-files': {
+        const storageKey = await this.getStorageKey();
+        if (!storageKey) return '';
+        return [
+          `--azure-file-volume-account-name "${this.storageAccount}"`,
+          `--azure-file-volume-account-key "${storageKey}"`,
+          `--azure-file-volume-share-name "${this.fileShareName}"`,
+          `--azure-file-volume-mount-path "${mountdir}"`,
+        ].join(' ');
+      }
+
+      case 'azure-files-nfs': {
+        // ACI NFS mount uses a YAML deployment template; for CLI we use the same
+        // azure-file-volume flags but the share must be NFS-enabled and
+        // the container must be in a VNet
+        const storageKey = await this.getStorageKey();
+        if (!storageKey) return '';
+        return [
+          `--azure-file-volume-account-name "${this.storageAccount}"`,
+          `--azure-file-volume-account-key "${storageKey}"`,
+          `--azure-file-volume-share-name "${this.fileShareName}"`,
+          `--azure-file-volume-mount-path "${mountdir}"`,
+        ].join(' ');
+      }
+
+      case 'in-memory':
+        // ACI emptyDir volumes require YAML deployment; for simplicity we skip
+        // the volume mount and let the container use its own filesystem
+        OrchestratorLogger.log('[Azure ACI] In-memory mode: using container filesystem (no persistent mount)');
+        return '';
+
+      case 'blob-copy':
+        // No volume mount — artifacts are copied in/out via az storage blob commands
+        return '';
+
+      default:
+        return '';
+    }
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[Azure ACI] Running task for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('azure-aci task');
+
+    const containerName = `unity-build-${buildGuid}`
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, '-')
+      .slice(0, 63);
+
+    // Build environment variable flags
+    const allEnvVars = [
+      ...environment.map((env) => `${env.name}=${env.value}`),
+      ...secrets.map((s) => `${s.EnvironmentVariable}=${s.ParameterValue}`),
+    ];
+    const envFlag = allEnvVars.length > 0 ? `--environment-variables ${allEnvVars.map((e) => `"${e}"`).join(' ')}` : '';
+
+    // Build volume flags based on storage type
+    const volumeFlags = await this.buildVolumeFlags(mountdir);
+
+    const subnetFlag = this.subnetId ? `--subnet "${this.subnetId}"` : '';
+
+    // For blob-copy, wrap the user command with copy-in/copy-out steps
+    let effectiveCommands = commands;
+    if (this.storageType === 'blob-copy' && this.storageAccount && commands) {
+      effectiveCommands = [
+        `az storage blob download-batch --destination "${mountdir}" --source "${this.blobContainer}" --account-name "${this.storageAccount}" 2>/dev/null || true`,
+        commands,
+        `az storage blob upload-batch --source "${mountdir}" --destination "${this.blobContainer}" --account-name "${this.storageAccount}" --overwrite`,
+      ].join(' && ');
+    }
+
+    const commandFlag = effectiveCommands
+      ? `--command-line "/bin/sh -c '${effectiveCommands.replace(/'/g, "'\\''")}'"`
+      : '';
+
+    const createCmd = [
+      'az container create',
+      `--resource-group "${this.resourceGroup}"`,
+      `--name "${containerName}"`,
+      `--image "${image}"`,
+      `--location "${this.location}"`,
+      `--cpu ${this.cpu}`,
+      `--memory ${this.memoryGb}`,
+      '--restart-policy Never',
+      '--os-type Linux',
+      volumeFlags,
+      envFlag,
+      subnetFlag,
+      commandFlag,
+      '--output json',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    try {
+      await OrchestratorSystem.Run(createCmd);
+      OrchestratorLogger.log(
+        `[Azure ACI] Container ${containerName} created (storage: ${this.storageType}), waiting for completion...`,
+      );
+    } catch (error: any) {
+      throw new Error(`[Azure ACI] Failed to create container: ${error.message}`);
+    }
+
+    const output = await this.waitForContainerCompletion(containerName);
+    return output;
+  }
+
+  private async waitForContainerCompletion(containerName: string): Promise<string> {
+    const maxWaitMs = 24 * 60 * 60 * 1000;
+    const pollIntervalMs = 15_000;
+    const startTime = Date.now();
+    let lastLogLength = 0;
+
+    while (Date.now() - startTime < maxWaitMs) {
+      try {
+        const stateJson = await OrchestratorSystem.Run(
+          `az container show --resource-group "${this.resourceGroup}" --name "${containerName}" --output json`,
+          false,
+          true,
+        );
+
+        const state = JSON.parse(stateJson);
+        const containerState =
+          state.containers?.[0]?.instanceView?.currentState?.state || state.instanceView?.state || 'Unknown';
+        const provisioningState = state.provisioningState || 'Unknown';
+
+        // Stream logs incrementally
+        try {
+          const logs = await OrchestratorSystem.Run(
+            `az container logs --resource-group "${this.resourceGroup}" --name "${containerName}"`,
+            false,
+            true,
+          );
+          if (logs && logs.length > lastLogLength) {
+            const newLogs = logs.slice(lastLogLength);
+            for (const line of newLogs.split('\n')) {
+              if (line.trim()) {
+                OrchestratorLogger.log(`[Build] ${line}`);
+              }
+            }
+            lastLogLength = logs.length;
+          }
+        } catch {
+          // Logs may not be available yet
+        }
+
+        if (containerState === 'Terminated' || provisioningState === 'Succeeded') {
+          const exitCode = state.containers?.[0]?.instanceView?.currentState?.exitCode;
+          if (exitCode !== undefined && exitCode !== 0) {
+            throw new Error(`[Azure ACI] Container exited with code ${exitCode}`);
+          }
+          OrchestratorLogger.log('[Azure ACI] Container completed successfully');
+          try {
+            return await OrchestratorSystem.Run(
+              `az container logs --resource-group "${this.resourceGroup}" --name "${containerName}"`,
+              false,
+              true,
+            );
+          } catch {
+            return '';
+          }
+        }
+
+        if (provisioningState === 'Failed') {
+          const detail =
+            state.containers?.[0]?.instanceView?.currentState?.detailStatus ||
+            state.containers?.[0]?.instanceView?.events?.map((e: any) => e.message).join('; ') ||
+            'Unknown error';
+          throw new Error(`[Azure ACI] Container provisioning failed: ${detail}`);
+        }
+      } catch (error: any) {
+        if (error.message?.includes('Container provisioning failed') || error.message?.includes('exited with code')) {
+          throw error;
+        }
+        OrchestratorLogger.logWarning(`[Azure ACI] Polling error: ${error.message}`);
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+
+    throw new Error('[Azure ACI] Container execution timed out after 24 hours');
+  }
+
+  async cleanupWorkflow(
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log('[Azure ACI] Cleaning up workflow');
+  }
+
+  async garbageCollect(
+    filter: string,
+    previewOnly: boolean,
+    olderThan: Number,
+    fullCache: boolean,
+    baseDependencies: boolean,
+  ): Promise<string> {
+    OrchestratorLogger.log('[Azure ACI] Garbage collecting old container groups');
+
+    try {
+      const containersJson = await OrchestratorSystem.Run(
+        `az container list --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+
+      const containers = JSON.parse(containersJson || '[]');
+      const cutoffDate = new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - Number(olderThan));
+
+      let deletedCount = 0;
+      for (const container of containers) {
+        const name = container.name || '';
+        if (!name.startsWith('unity-build-')) continue;
+
+        const createdAt = new Date(container.tags?.createdAt || container.properties?.provisioningState || 0);
+        const state = container.containers?.[0]?.instanceView?.currentState?.state || '';
+
+        if (state === 'Terminated' || createdAt < cutoffDate) {
+          if (previewOnly) {
+            OrchestratorLogger.log(`[Azure ACI] Would delete: ${name}`);
+          } else {
+            await OrchestratorSystem.Run(
+              `az container delete --resource-group "${this.resourceGroup}" --name "${name}" --yes`,
+            );
+            deletedCount++;
+          }
+        }
+      }
+
+      return `Garbage collected ${deletedCount} Azure container instances`;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[Azure ACI] Garbage collection failed: ${error.message}`);
+      return '';
+    }
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    try {
+      const containersJson = await OrchestratorSystem.Run(
+        `az container list --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+
+      const containers = JSON.parse(containersJson || '[]');
+      return containers
+        .filter((c: any) => (c.name || '').startsWith('unity-build-'))
+        .map((c: any) => ({ Name: c.name || '' }));
+    } catch {
+      return [];
+    }
+  }
+
+  listWorkflow(): Promise<ProviderWorkflow[]> {
+    throw new Error('[Azure ACI] listWorkflow not implemented for this experimental provider');
+  }
+
+  async watchWorkflow(): Promise<string> {
+    throw new Error('[Azure ACI] watchWorkflow not implemented for this experimental provider');
+  }
+}
+
+export default AzureAciProvider;

src/model/orchestrator/providers/gcp-cloud-run/index.ts

@@ -0,0 +1,435 @@
+/**
+ * Google Cloud Run Jobs Provider (Experimental)
+ *
+ * Executes Unity builds as Cloud Run Jobs with configurable storage backends.
+ *
+ * Storage types:
+ *   - gcs-fuse:   Mount a GCS bucket as a POSIX filesystem via GCS FUSE sidecar.
+ *                  Unlimited size, best for large sequential reads/writes.
+ *                  Requires: gcpBucket
+ *   - gcs-copy:   Copy artifacts in/out of GCS before/after the build via gsutil.
+ *                  No mount overhead, simpler, works everywhere.
+ *                  Requires: gcpBucket
+ *   - nfs:        Mount a Filestore NFS share. True POSIX semantics, good random I/O,
+ *                  up to 100 TiB. Best for Library caching (many small random reads).
+ *                  Requires: gcpFilestoreIp, gcpFilestoreShare
+ *   - in-memory:  tmpfs volume (emptyDir). Fastest I/O but volatile and limited to 32 GiB.
+ *                  Good for scratch/temp space during builds.
+ *
+ * Prerequisites:
+ *   - Google Cloud SDK authenticated (GOOGLE_APPLICATION_CREDENTIALS or gcloud auth)
+ *   - Cloud Run Jobs API enabled
+ *   - Service account with roles: Cloud Run Admin, Storage Admin, Logs Viewer
+ *
+ * @experimental This provider is experimental. APIs and behavior may change.
+ */
+
+import { ProviderInterface } from '../provider-interface';
+import BuildParameters from '../../../build-parameters';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import { Input } from '../../..';
+import ResourceTracking from '../../services/core/resource-tracking';
+
+type GcpStorageType = 'gcs-fuse' | 'gcs-copy' | 'nfs' | 'in-memory';
+
+class GcpCloudRunProvider implements ProviderInterface {
+  private readonly project: string;
+  private readonly region: string;
+  private readonly storageType: GcpStorageType;
+  private readonly bucket: string;
+  private readonly filestoreIp: string;
+  private readonly filestoreShare: string;
+  private readonly machineType: string;
+  private readonly diskSizeGb: number;
+  private readonly serviceAccount: string;
+  private readonly vpcConnector: string;
+  private buildParameters: BuildParameters;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.project = buildParameters.gcpProject || process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || '';
+    this.region = buildParameters.gcpRegion || Input.region || 'us-central1';
+    this.storageType = (buildParameters.gcpStorageType || 'gcs-fuse') as GcpStorageType;
+    this.bucket = buildParameters.gcpBucket || '';
+    this.filestoreIp = buildParameters.gcpFilestoreIp || '';
+    this.filestoreShare = buildParameters.gcpFilestoreShare || '/share1';
+    this.machineType = buildParameters.gcpMachineType || 'e2-standard-4';
+    this.diskSizeGb = Number.parseInt(buildParameters.gcpDiskSizeGb || '100', 10);
+    this.serviceAccount = buildParameters.gcpServiceAccount || '';
+    this.vpcConnector = buildParameters.gcpVpcConnector || '';
+
+    OrchestratorLogger.log('[GCP Cloud Run] Provider initialized (EXPERIMENTAL)');
+    OrchestratorLogger.log(`[GCP Cloud Run] Project: ${this.project || '(auto-detect)'}`);
+    OrchestratorLogger.log(`[GCP Cloud Run] Region: ${this.region}`);
+    OrchestratorLogger.log(`[GCP Cloud Run] Storage: ${this.storageType}`);
+
+    this.validateStorageConfig();
+  }
+
+  private validateStorageConfig(): void {
+    switch (this.storageType) {
+      case 'gcs-fuse':
+      case 'gcs-copy':
+        if (!this.bucket) {
+          OrchestratorLogger.logWarning(
+            `[GCP Cloud Run] Storage type '${this.storageType}' requires gcpBucket to be set.`,
+          );
+        } else {
+          OrchestratorLogger.log(`[GCP Cloud Run] Bucket: gs://${this.bucket}`);
+        }
+        break;
+      case 'nfs':
+        if (!this.filestoreIp) {
+          OrchestratorLogger.logWarning('[GCP Cloud Run] Storage type "nfs" requires gcpFilestoreIp to be set.');
+        } else {
+          OrchestratorLogger.log(`[GCP Cloud Run] Filestore: ${this.filestoreIp}:${this.filestoreShare}`);
+        }
+        if (!this.vpcConnector) {
+          OrchestratorLogger.logWarning(
+            '[GCP Cloud Run] NFS storage usually requires gcpVpcConnector for private network access to Filestore.',
+          );
+        }
+        break;
+      case 'in-memory':
+        OrchestratorLogger.log(`[GCP Cloud Run] In-memory volume: ${Math.min(this.diskSizeGb, 32)} GiB (max 32)`);
+        break;
+      default:
+        OrchestratorLogger.logWarning(
+          `[GCP Cloud Run] Unknown storage type '${this.storageType}'. Valid: gcs-fuse, gcs-copy, nfs, in-memory`,
+        );
+    }
+
+    if (!this.project) {
+      OrchestratorLogger.logWarning(
+        '[GCP Cloud Run] No project specified. Set gcpProject input or GOOGLE_CLOUD_PROJECT env var.',
+      );
+    }
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log(`[GCP Cloud Run] Setting up workflow for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('gcp-cloud-run setup');
+
+    // Verify gcloud CLI is available
+    try {
+      await OrchestratorSystem.Run('gcloud --version', false, true);
+      OrchestratorLogger.log('[GCP Cloud Run] gcloud CLI detected');
+    } catch {
+      throw new Error(
+        '[GCP Cloud Run] gcloud CLI not found. Install Google Cloud SDK: https://cloud.google.com/sdk/docs/install',
+      );
+    }
+
+    // Verify Cloud Run Jobs API is enabled
+    try {
+      const projectFlag = this.project ? `--project=${this.project}` : '';
+      await OrchestratorSystem.Run(
+        `gcloud services list --enabled --filter="name:run.googleapis.com" ${projectFlag} --format="value(name)"`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.logWarning(
+        '[GCP Cloud Run] Could not verify Cloud Run API status. Ensure run.googleapis.com is enabled.',
+      );
+    }
+
+    // Storage-specific setup
+    if ((this.storageType === 'gcs-fuse' || this.storageType === 'gcs-copy') && this.bucket) {
+      await this.ensureBucketExists();
+    }
+  }
+
+  private async ensureBucketExists(): Promise<void> {
+    try {
+      await OrchestratorSystem.Run(
+        `gcloud storage buckets describe gs://${this.bucket} --format="value(name)"`,
+        false,
+        true,
+      );
+      OrchestratorLogger.log(`[GCP Cloud Run] Bucket gs://${this.bucket} exists`);
+    } catch {
+      OrchestratorLogger.log(`[GCP Cloud Run] Creating bucket gs://${this.bucket}`);
+      const projectFlag = this.project ? `--project=${this.project}` : '';
+      await OrchestratorSystem.Run(
+        `gcloud storage buckets create gs://${this.bucket} --location=${this.region} ${projectFlag}`,
+      );
+    }
+  }
+
+  private buildVolumeFlags(mountdir: string): { volumeFlags: string; mountFlags: string } {
+    switch (this.storageType) {
+      case 'gcs-fuse':
+        if (!this.bucket) return { volumeFlags: '', mountFlags: '' };
+        return {
+          volumeFlags: `--add-volume=name=gcs-fuse,type=cloud-storage,bucket=${this.bucket}`,
+          mountFlags: `--add-volume-mount=volume=gcs-fuse,mount-path=${mountdir}`,
+        };
+
+      case 'nfs':
+        if (!this.filestoreIp) return { volumeFlags: '', mountFlags: '' };
+        return {
+          volumeFlags: `--add-volume=name=nfs-vol,type=nfs,location=${this.filestoreIp}:${this.filestoreShare}`,
+          mountFlags: `--add-volume-mount=volume=nfs-vol,mount-path=${mountdir}`,
+        };
+
+      case 'in-memory': {
+        const sizeGib = Math.min(this.diskSizeGb, 32);
+        return {
+          volumeFlags: `--add-volume=name=tmpfs-vol,type=in-memory,size-limit=${sizeGib}Gi`,
+          mountFlags: `--add-volume-mount=volume=tmpfs-vol,mount-path=${mountdir}`,
+        };
+      }
+
+      case 'gcs-copy':
+        // No volume mount — artifacts are copied in/out via gsutil commands
+        return { volumeFlags: '', mountFlags: '' };
+
+      default:
+        return { volumeFlags: '', mountFlags: '' };
+    }
+  }
+
+  private async copyArtifactsIn(mountdir: string): Promise<void> {
+    if (this.storageType !== 'gcs-copy' || !this.bucket) return;
+    OrchestratorLogger.log(`[GCP Cloud Run] Copying artifacts from gs://${this.bucket} to ${mountdir}`);
+    try {
+      await OrchestratorSystem.Run(`gcloud storage cp -r "gs://${this.bucket}/*" "${mountdir}/" || true`, false, true);
+    } catch {
+      OrchestratorLogger.log('[GCP Cloud Run] No existing artifacts to restore (bucket may be empty)');
+    }
+  }
+
+  private async copyArtifactsOut(mountdir: string): Promise<void> {
+    if (this.storageType !== 'gcs-copy' || !this.bucket) return;
+    OrchestratorLogger.log(`[GCP Cloud Run] Uploading artifacts from ${mountdir} to gs://${this.bucket}`);
+    await OrchestratorSystem.Run(`gcloud storage cp -r "${mountdir}/*" "gs://${this.bucket}/"`, false, true);
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[GCP Cloud Run] Running task for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('gcp-cloud-run task');
+
+    const jobName = `unity-build-${buildGuid}`
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, '-')
+      .slice(0, 63);
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+
+    // Build environment variable flags
+    const envFlags = environment
+      .map((env) => `${env.name}=${env.value}`)
+      .concat(secrets.map((s) => `${s.EnvironmentVariable}=${s.ParameterValue}`));
+    const envString = envFlags.length > 0 ? `--set-env-vars="${envFlags.join(',')}"` : '';
+
+    // Build storage volume flags
+    const { volumeFlags, mountFlags } = this.buildVolumeFlags(mountdir);
+
+    // For gcs-copy, wrap the user command with copy-in/copy-out steps
+    let effectiveCommands = commands;
+    if (this.storageType === 'gcs-copy' && this.bucket && commands) {
+      effectiveCommands = [
+        `gcloud storage cp -r "gs://${this.bucket}/*" "${mountdir}/" 2>/dev/null || true`,
+        commands,
+        `gcloud storage cp -r "${mountdir}/*" "gs://${this.bucket}/"`,
+      ].join(' && ');
+    }
+
+    const saFlag = this.serviceAccount ? `--service-account=${this.serviceAccount}` : '';
+    const vpcFlag = this.vpcConnector ? `--vpc-connector=${this.vpcConnector}` : '';
+
+    // Create the Cloud Run Job
+    const createCmd = [
+      'gcloud run jobs create',
+      jobName,
+      `--image=${image}`,
+      `--region=${this.region}`,
+      '--task-timeout=86400s',
+      '--max-retries=0',
+      '--cpu=4',
+      '--memory=16Gi',
+      volumeFlags,
+      mountFlags,
+      envString,
+      saFlag,
+      vpcFlag,
+      projectFlag,
+      '--format=json',
+      '--quiet',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    try {
+      await OrchestratorSystem.Run(createCmd);
+      OrchestratorLogger.log(`[GCP Cloud Run] Job ${jobName} created`);
+    } catch (error: any) {
+      if (error.message?.includes('already exists')) {
+        OrchestratorLogger.log(`[GCP Cloud Run] Job ${jobName} already exists, updating...`);
+        const updateCmd = createCmd.replace('jobs create', 'jobs update');
+        await OrchestratorSystem.Run(updateCmd);
+      } else {
+        throw error;
+      }
+    }
+
+    // Override the command if provided
+    if (effectiveCommands) {
+      const updateCmd = [
+        'gcloud run jobs update',
+        jobName,
+        `--region=${this.region}`,
+        '--command="/bin/sh"',
+        `--args="-c,${effectiveCommands}"`,
+        projectFlag,
+        '--quiet',
+      ]
+        .filter(Boolean)
+        .join(' ');
+
+      await OrchestratorSystem.Run(updateCmd);
+    }
+
+    // Execute the job
+    OrchestratorLogger.log(`[GCP Cloud Run] Executing job ${jobName} (storage: ${this.storageType})...`);
+    const executeCmd = [
+      'gcloud run jobs execute',
+      jobName,
+      `--region=${this.region}`,
+      projectFlag,
+      '--wait',
+      '--format=json',
+      '--quiet',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    let output = '';
+    try {
+      output = await OrchestratorSystem.Run(executeCmd);
+      OrchestratorLogger.log('[GCP Cloud Run] Job execution completed');
+    } catch (error: any) {
+      await this.streamJobLogs(jobName);
+      throw new Error(`[GCP Cloud Run] Job execution failed: ${error.message}`);
+    }
+
+    await this.streamJobLogs(jobName);
+    return output;
+  }
+
+  private async streamJobLogs(jobName: string): Promise<void> {
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+    try {
+      const logs = await OrchestratorSystem.Run(
+        `gcloud logging read "resource.type=cloud_run_job AND resource.labels.job_name=${jobName}" ${projectFlag} --limit=1000 --format="value(textPayload)" --order=asc`,
+        false,
+        true,
+      );
+      if (logs) {
+        for (const line of logs.split('\n')) {
+          if (line.trim()) {
+            OrchestratorLogger.log(`[Build] ${line}`);
+          }
+        }
+      }
+    } catch {
+      OrchestratorLogger.logWarning('[GCP Cloud Run] Could not retrieve job logs');
+    }
+  }
+
+  async cleanupWorkflow(
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log('[GCP Cloud Run] Cleaning up workflow');
+  }
+
+  async garbageCollect(
+    filter: string,
+    previewOnly: boolean,
+    olderThan: Number,
+    fullCache: boolean,
+    baseDependencies: boolean,
+  ): Promise<string> {
+    OrchestratorLogger.log('[GCP Cloud Run] Garbage collecting old jobs');
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+
+    try {
+      const jobsJson = await OrchestratorSystem.Run(
+        `gcloud run jobs list --region=${this.region} ${projectFlag} --filter="metadata.name~unity-build-" --format="json(metadata.name,metadata.creationTimestamp)"`,
+        false,
+        true,
+      );
+
+      const jobs = JSON.parse(jobsJson || '[]');
+      const cutoffDate = new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - Number(olderThan));
+
+      let deletedCount = 0;
+      for (const job of jobs) {
+        const createdAt = new Date(job.metadata?.creationTimestamp || 0);
+        if (createdAt < cutoffDate) {
+          const name = job.metadata?.name;
+          if (previewOnly) {
+            OrchestratorLogger.log(`[GCP Cloud Run] Would delete: ${name}`);
+          } else {
+            await OrchestratorSystem.Run(
+              `gcloud run jobs delete ${name} --region=${this.region} ${projectFlag} --quiet`,
+            );
+            deletedCount++;
+          }
+        }
+      }
+
+      return `Garbage collected ${deletedCount} Cloud Run jobs`;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[GCP Cloud Run] Garbage collection failed: ${error.message}`);
+      return '';
+    }
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+    try {
+      const jobsJson = await OrchestratorSystem.Run(
+        `gcloud run jobs list --region=${this.region} ${projectFlag} --filter="metadata.name~unity-build-" --format="json(metadata.name)"`,
+        false,
+        true,
+      );
+
+      const jobs = JSON.parse(jobsJson || '[]');
+      return jobs.map((job: any) => ({ Name: job.metadata?.name || '' }));
+    } catch {
+      return [];
+    }
+  }
+
+  listWorkflow(): Promise<ProviderWorkflow[]> {
+    throw new Error('[GCP Cloud Run] listWorkflow not implemented for this experimental provider');
+  }
+
+  async watchWorkflow(): Promise<string> {
+    throw new Error('[GCP Cloud Run] watchWorkflow not implemented for this experimental provider');
+  }
+}
+
+export default GcpCloudRunProvider;

src/model/orchestrator/providers/provider-loader.ts

@@ -62,6 +62,8 @@ export default async function loadProvider(
           'local-docker': './docker',
           'local-system': './local',
           local: './local',
+          'gcp-cloud-run': './gcp-cloud-run',
+          'azure-aci': './azure-aci',
         };
 
         modulePath = providerModuleMap[providerSource] || providerSource;
@@ -136,7 +138,7 @@ export class ProviderLoader {
    * @returns string[] - Array of available provider names
    */
   static getAvailableProviders(): string[] {
-    return ['aws', 'k8s', 'test', 'local-docker', 'local-system', 'local'];
+    return ['aws', 'k8s', 'test', 'local-docker', 'local-system', 'local', 'gcp-cloud-run', 'azure-aci'];
   }
 
   /**

src/model/orchestrator/services/reliability/build-reliability-service.test.ts

@@ -1,638 +0,0 @@
-import { execSync, execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { BuildReliabilityService } from './build-reliability-service';
-
-// Mock dependencies
-jest.mock('node:child_process');
-jest.mock('node:fs');
-jest.mock('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-}));
-
-const mockExecSync = execSync as jest.MockedFunction<typeof execSync>;
-const mockExecFileSync = execFileSync as jest.MockedFunction<typeof execFileSync>;
-const mockFs = fs as jest.Mocked<typeof fs>;
-
-describe('BuildReliabilityService', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  // =========================================================================
-  // checkGitIntegrity
-  // =========================================================================
-
-  describe('checkGitIntegrity', () => {
-    it('should return true when fsck succeeds with clean output', () => {
-      mockExecSync.mockReturnValue('');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(true);
-      expect(mockExecSync).toHaveBeenCalledWith(
-        'git -C "/repo" fsck --no-dangling',
-        expect.objectContaining({ encoding: 'utf8' }),
-      );
-    });
-
-    it('should return false when fsck output contains corruption indicators', () => {
-      mockExecSync.mockReturnValue('broken link from tree abc123');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should return false when fsck output contains missing objects', () => {
-      mockExecSync.mockReturnValue('missing blob abc123');
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should return false when execSync throws (non-zero exit code)', () => {
-      mockExecSync.mockImplementation(() => {
-        const error: any = new Error('fsck failed');
-        error.stderr = Buffer.from('error: bad object HEAD');
-        throw error;
-      });
-      const result = BuildReliabilityService.checkGitIntegrity('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should use current directory when no repoPath provided', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.checkGitIntegrity();
-      expect(mockExecSync).toHaveBeenCalledWith('git -C "." fsck --no-dangling', expect.anything());
-    });
-  });
-
-  // =========================================================================
-  // cleanStaleLockFiles
-  // =========================================================================
-
-  describe('cleanStaleLockFiles', () => {
-    it('should return 0 when .git directory does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(0);
-    });
-
-    it('should remove lock files older than 10 minutes', () => {
-      const now = Date.now();
-      const oldTime = now - 15 * 60 * 1000; // 15 minutes ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: oldTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/repo', '.git')) {
-          return [
-            { name: 'index.lock', isDirectory: () => false },
-            { name: 'HEAD.lock', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(2);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(2);
-    });
-
-    it('should NOT remove lock files younger than 10 minutes', () => {
-      const now = Date.now();
-      const recentTime = now - 2 * 60 * 1000; // 2 minutes ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: recentTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/repo', '.git')) {
-          return [{ name: 'index.lock', isDirectory: () => false }] as any;
-        }
-        return [];
-      });
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(0);
-      expect(mockFs.unlinkSync).not.toHaveBeenCalled();
-    });
-
-    it('should recursively scan refs directory for lock files', () => {
-      const now = Date.now();
-      const oldTime = now - 15 * 60 * 1000;
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.statSync.mockImplementation((filePath: any) => {
-        if (filePath === path.join('/repo', '.git')) {
-          return { isDirectory: () => true } as fs.Stats;
-        }
-        return { mtimeMs: oldTime } as fs.Stats;
-      });
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        const gitDir = path.join('/repo', '.git');
-        if (dir === gitDir) {
-          return [{ name: 'refs', isDirectory: () => true }] as any;
-        }
-        if (dir === path.join(gitDir, 'refs')) {
-          return [{ name: 'heads', isDirectory: () => true }] as any;
-        }
-        if (dir === path.join(gitDir, 'refs', 'heads')) {
-          return [{ name: 'main.lock', isDirectory: () => false }] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
-      expect(result).toBe(1);
-    });
-  });
-
-  // =========================================================================
-  // validateSubmoduleBackingStores
-  // =========================================================================
-
-  describe('validateSubmoduleBackingStores', () => {
-    it('should return empty array when .gitmodules does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toEqual([]);
-    });
-
-    it('should detect broken backing store for submodule', () => {
-      mockFs.existsSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) return true;
-        if (p === path.join('/repo', 'lib/sub', '.git')) return true;
-        // Backing store does not exist
-        return false;
-      });
-      mockFs.readFileSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) {
-          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
-        }
-        if (p === path.join('/repo', 'lib/sub', '.git')) {
-          return 'gitdir: ../../.git/modules/lib/sub';
-        }
-        return '';
-      });
-      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
-
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toContain('lib/sub');
-    });
-
-    it('should return empty array when all submodule backing stores are valid', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readFileSync.mockImplementation((p: any) => {
-        if (p === path.join('/repo', '.gitmodules')) {
-          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
-        }
-        if (p === path.join('/repo', 'lib/sub', '.git')) {
-          return 'gitdir: ../../.git/modules/lib/sub';
-        }
-        return '';
-      });
-      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
-
-      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
-      expect(result).toEqual([]);
-    });
-  });
-
-  // =========================================================================
-  // recoverCorruptedRepo
-  // =========================================================================
-
-  describe('recoverCorruptedRepo', () => {
-    it('should orchestrate fsck cleanup and re-fetch, returning true on success', () => {
-      // cleanStaleLockFiles: no .git dir
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      // fetch succeeds, then fsck succeeds
-      mockExecSync.mockReturnValue('');
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      expect(result).toBe(true);
-      // Should have called fetch
-      expect(mockExecSync).toHaveBeenCalledWith('git -C "/repo" fetch --all', expect.anything());
-    });
-
-    it('should return false when recovery fails to restore integrity', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      // fetch succeeds, but fsck fails
-      mockExecSync.mockImplementation((cmd: any) => {
-        if (typeof cmd === 'string' && cmd.includes('fetch')) return '';
-        if (typeof cmd === 'string' && cmd.includes('fsck')) {
-          return 'missing blob abc123';
-        }
-        return '';
-      });
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      expect(result).toBe(false);
-    });
-
-    it('should continue recovery even when fetch fails', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
-
-      let callCount = 0;
-      mockExecSync.mockImplementation((cmd: any) => {
-        callCount++;
-        if (typeof cmd === 'string' && cmd.includes('fetch')) {
-          throw new Error('network error');
-        }
-        // fsck call
-        return '';
-      });
-
-      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
-      // Should still attempt fsck after failed fetch
-      expect(callCount).toBeGreaterThanOrEqual(2);
-    });
-  });
-
-  // =========================================================================
-  // cleanReservedFilenames
-  // =========================================================================
-
-  describe('cleanReservedFilenames', () => {
-    it('should return empty array when Assets directory does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toEqual([]);
-    });
-
-    it('should remove files with reserved names (con, prn, aux, nul)', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'con.txt', isDirectory: () => false },
-            { name: 'PRN.meta', isDirectory: () => false },
-            { name: 'aux.shader', isDirectory: () => false },
-            { name: 'nul.png', isDirectory: () => false },
-            { name: 'valid-file.cs', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(4);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(4);
-    });
-
-    it('should remove directories with reserved names', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [{ name: 'com1', isDirectory: () => true }] as any;
-        }
-        return [];
-      });
-      mockFs.rmSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(1);
-      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/project', 'Assets', 'com1'), {
-        recursive: true,
-        force: true,
-      });
-    });
-
-    it('should detect COM1 through COM9 and LPT1 through LPT9', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'com1.txt', isDirectory: () => false },
-            { name: 'COM9.meta', isDirectory: () => false },
-            { name: 'lpt1.dat', isDirectory: () => false },
-            { name: 'LPT9.log', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(4);
-    });
-
-    it('should not remove files that merely contain reserved names as substrings', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockImplementation((dir: any) => {
-        if (dir === path.join('/project', 'Assets')) {
-          return [
-            { name: 'controller.cs', isDirectory: () => false },
-            { name: 'printer-utils.cs', isDirectory: () => false },
-            { name: 'auxiliary.shader', isDirectory: () => false },
-          ] as any;
-        }
-        return [];
-      });
-
-      const result = BuildReliabilityService.cleanReservedFilenames('/project');
-      expect(result).toHaveLength(0);
-    });
-  });
-
-  // =========================================================================
-  // getAvailableSpaceMB
-  // =========================================================================
-
-  describe('getAvailableSpaceMB', () => {
-    it('should return -1 when the check fails', () => {
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command failed');
-      });
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('/some/path');
-      expect(result).toBe(-1);
-    });
-
-    it('should parse wmic output on Windows', () => {
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'win32' });
-
-      // 10 GB in bytes
-      mockExecFileSync.mockReturnValue('\r\nFreeSpace=10737418240\r\n' as any);
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('C:\\builds');
-      // 10737418240 / (1024 * 1024) = 10240 MB
-      expect(result).toBeCloseTo(10240, 0);
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-
-    it('should parse df output on Unix', () => {
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'linux' });
-
-      mockExecFileSync.mockReturnValue('  Avail\n  5120M\n' as any);
-
-      const result = BuildReliabilityService.getAvailableSpaceMB('/builds');
-      expect(result).toBe(5120);
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-  });
-
-  // =========================================================================
-  // getDirectorySizeMB
-  // =========================================================================
-
-  describe('getDirectorySizeMB', () => {
-    it('should return file size for a single file', () => {
-      // 5 MB in bytes
-      mockFs.statSync.mockReturnValue({ isDirectory: () => false, size: 5 * 1024 * 1024 } as any);
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/path/to/file.zip');
-      expect(result).toBeCloseTo(5, 0);
-    });
-
-    it('should return total size for a directory tree', () => {
-      const subDir = path.join('/build', 'sub');
-
-      mockFs.statSync.mockImplementation((p: any) => {
-        const pathStr = typeof p === 'string' ? p : p.toString();
-        if (pathStr === '/build' || pathStr === subDir) {
-          return { isDirectory: () => true, size: 0 } as any;
-        }
-
-        return { isDirectory: () => false, size: 1024 * 1024 } as any; // 1 MB each
-      });
-
-      mockFs.readdirSync.mockImplementation((dirPath: any, _options?: any) => {
-        const dirStr = typeof dirPath === 'string' ? dirPath : dirPath.toString();
-        if (dirStr === '/build') {
-          return [
-            { name: 'file1.bin', isDirectory: () => false },
-            { name: 'sub', isDirectory: () => true },
-          ] as any;
-        }
-        if (dirStr === subDir) {
-          return [{ name: 'file2.bin', isDirectory: () => false }] as any;
-        }
-
-        return [] as any;
-      });
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/build');
-      expect(result).toBeCloseTo(2, 0); // 2 files * 1 MB each
-    });
-
-    it('should return -1 when calculation fails', () => {
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Access denied');
-      });
-
-      const result = BuildReliabilityService.getDirectorySizeMB('/inaccessible');
-      expect(result).toBe(-1);
-    });
-  });
-
-  // =========================================================================
-  // archiveBuildOutput
-  // =========================================================================
-
-  describe('archiveBuildOutput', () => {
-    it('should skip archiving when source path does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-      expect(mockExecSync).not.toHaveBeenCalled();
-    });
-
-    it('should create archive directory and tar.gz output', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockExecSync.mockReturnValue('');
-      // Make disk space check return unknown so we proceed
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      expect(mockFs.mkdirSync).toHaveBeenCalledWith('/archives', { recursive: true });
-      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
-    });
-
-    it('should skip archival when insufficient disk space', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-
-      // Source is 1000 MB
-      mockFs.statSync.mockImplementation((p: any) => {
-        const pathStr = typeof p === 'string' ? p : p.toString();
-        if (pathStr.endsWith('big-file.bin')) {
-          return { isDirectory: () => false, size: 1000 * 1024 * 1024 } as any;
-        }
-        return { isDirectory: () => true, size: 0 } as any;
-      });
-      mockFs.readdirSync.mockImplementation(() => {
-        return [{ name: 'big-file.bin', isDirectory: () => false }] as any;
-      });
-
-      // Only 500 MB available
-      const originalPlatform = process.platform;
-      Object.defineProperty(process, 'platform', { value: 'linux' });
-      mockExecFileSync.mockReturnValue('  Avail\n  500M\n' as any);
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should NOT have attempted the tar command
-      expect(mockExecSync).not.toHaveBeenCalledWith(expect.stringContaining('tar'), expect.anything());
-
-      Object.defineProperty(process, 'platform', { value: originalPlatform });
-    });
-
-    it('should clean up partial archive on tar failure', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      // Make disk space check return unknown so we proceed
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      // tar command fails
-      mockExecSync.mockImplementation(() => {
-        const error: any = new Error('tar failed');
-        error.stderr = Buffer.from('No space left on device');
-        throw error;
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should have attempted to clean up the partial archive
-      // (existsSync returns true for the partial file)
-      expect(mockFs.unlinkSync).toHaveBeenCalled();
-    });
-
-    it('should proceed with warning when disk space check fails', () => {
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.mkdirSync.mockReturnValue(undefined as any);
-      mockExecSync.mockReturnValue('');
-
-      // Disk space check fails
-      mockExecFileSync.mockImplementation(() => {
-        throw new Error('Command not found');
-      });
-      // Directory size check also fails
-      mockFs.statSync.mockImplementation(() => {
-        throw new Error('Not mocked');
-      });
-
-      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
-
-      // Should still proceed with tar
-      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
-    });
-  });
-
-  // =========================================================================
-  // enforceRetention
-  // =========================================================================
-
-  describe('enforceRetention', () => {
-    it('should return 0 when archive path does not exist', () => {
-      mockFs.existsSync.mockReturnValue(false);
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(0);
-    });
-
-    it('should remove archives older than retention period', () => {
-      const now = Date.now();
-      const oldTime = now - 45 * 24 * 60 * 60 * 1000; // 45 days ago
-      const recentTime = now - 5 * 24 * 60 * 60 * 1000; // 5 days ago
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockReturnValue([
-        { name: 'build-old.tar.gz', isDirectory: () => false },
-        { name: 'build-recent.tar.gz', isDirectory: () => false },
-      ] as any);
-      mockFs.statSync.mockImplementation((p: any) => {
-        if ((p as string).includes('old')) {
-          return { mtimeMs: oldTime } as fs.Stats;
-        }
-        return { mtimeMs: recentTime } as fs.Stats;
-      });
-      mockFs.unlinkSync.mockReturnValue(undefined);
-
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(1);
-      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(1);
-    });
-
-    it('should keep all archives within retention period', () => {
-      const now = Date.now();
-      const recentTime = now - 5 * 24 * 60 * 60 * 1000;
-
-      mockFs.existsSync.mockReturnValue(true);
-      mockFs.readdirSync.mockReturnValue([
-        { name: 'build-1.tar.gz', isDirectory: () => false },
-        { name: 'build-2.tar.gz', isDirectory: () => false },
-      ] as any);
-      mockFs.statSync.mockReturnValue({ mtimeMs: recentTime } as fs.Stats);
-
-      const result = BuildReliabilityService.enforceRetention('/archive', 30);
-      expect(result).toBe(0);
-    });
-  });
-
-  // =========================================================================
-  // configureGitEnvironment
-  // =========================================================================
-
-  describe('configureGitEnvironment', () => {
-    it('should set GIT_TERMINAL_PROMPT=0 in process.env', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(process.env.GIT_TERMINAL_PROMPT).toBe('0');
-    });
-
-    it('should configure http.postBuffer via git config', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(mockExecSync).toHaveBeenCalledWith('git config --global http.postBuffer 524288000', expect.anything());
-    });
-
-    it('should configure core.longpaths via git config', () => {
-      mockExecSync.mockReturnValue('');
-      BuildReliabilityService.configureGitEnvironment();
-      expect(mockExecSync).toHaveBeenCalledWith('git config --global core.longpaths true', expect.anything());
-    });
-
-    it('should warn but not throw when git config commands fail', () => {
-      const core = require('@actions/core');
-      mockExecSync.mockImplementation(() => {
-        throw new Error('git config failed');
-      });
-
-      // Should not throw
-      expect(() => BuildReliabilityService.configureGitEnvironment()).not.toThrow();
-      expect(core.warning).toHaveBeenCalled();
-    });
-  });
-});

src/model/orchestrator/services/reliability/build-reliability-service.ts

@@ -1,527 +0,0 @@
-import { execSync, execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import * as core from '@actions/core';
-
-/**
- * Build reliability features for hardening CI pipelines.
- * Provides git integrity checks, stale lock cleanup, submodule validation,
- * reserved filename removal, build archival, and git environment configuration.
- * All features are opt-in and fail gracefully (warnings only).
- */
-export class BuildReliabilityService {
-  // Windows reserved device names that cause Unity asset importer infinite loops
-  private static readonly RESERVED_NAMES = new Set([
-    'con',
-    'prn',
-    'aux',
-    'nul',
-    'com1',
-    'com2',
-    'com3',
-    'com4',
-    'com5',
-    'com6',
-    'com7',
-    'com8',
-    'com9',
-    'lpt1',
-    'lpt2',
-    'lpt3',
-    'lpt4',
-    'lpt5',
-    'lpt6',
-    'lpt7',
-    'lpt8',
-    'lpt9',
-  ]);
-
-  // Lock files to look for in the .git directory
-  private static readonly LOCK_FILE_NAMES = new Set(['index.lock', 'shallow.lock', 'config.lock', 'HEAD.lock']);
-
-  // Maximum age in milliseconds before a lock file is considered stale (10 minutes)
-  private static readonly LOCK_FILE_MAX_AGE_MS = 10 * 60 * 1000;
-
-  /**
-   * Run git fsck to check repository integrity.
-   * Returns true if the repo is healthy, false if corruption detected.
-   */
-  static checkGitIntegrity(repoPath: string = '.'): boolean {
-    core.info(`[Reliability] Checking git integrity in ${repoPath}`);
-
-    try {
-      const output = execSync(`git -C "${repoPath}" fsck --no-dangling`, {
-        encoding: 'utf8',
-        timeout: 120_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-
-      // Parse output for corruption indicators
-      const corruptionPatterns = [
-        /broken link/i,
-        /missing (blob|tree|commit|tag)/i,
-        /dangling/i,
-        /corrupt/i,
-        /error in /i,
-      ];
-
-      for (const pattern of corruptionPatterns) {
-        if (pattern.test(output)) {
-          core.warning(`[Reliability] Git integrity check found issues: ${output.trim()}`);
-          return false;
-        }
-      }
-
-      core.info('[Reliability] Git integrity check passed');
-      return true;
-    } catch (error: any) {
-      // execSync throws on non-zero exit code
-      const stderr = error.stderr?.toString() ?? error.message;
-      core.warning(`[Reliability] Git integrity check failed: ${stderr}`);
-      return false;
-    }
-  }
-
-  /**
-   * Remove stale .lock files from the .git directory.
-   * Only removes lock files older than 10 minutes to avoid interfering with active operations.
-   * Returns the number of lock files removed.
-   */
-  static cleanStaleLockFiles(repoPath: string = '.'): number {
-    const gitDir = path.join(repoPath, '.git');
-    if (!fs.existsSync(gitDir) || !fs.statSync(gitDir).isDirectory()) {
-      return 0;
-    }
-
-    core.info(`[Reliability] Scanning for stale lock files in ${gitDir}`);
-    const now = Date.now();
-    let removed = 0;
-
-    const cleanDirectory = (directory: string): void => {
-      if (!fs.existsSync(directory)) return;
-
-      try {
-        const entries = fs.readdirSync(directory, { withFileTypes: true });
-        for (const entry of entries) {
-          const fullPath = path.join(directory, entry.name);
-          if (entry.isDirectory()) {
-            cleanDirectory(fullPath);
-          } else if (entry.name.endsWith('.lock')) {
-            // Check if it is a known lock file location OR under refs/
-            const relativePath = path.relative(gitDir, fullPath);
-            const isKnownLock = BuildReliabilityService.LOCK_FILE_NAMES.has(entry.name);
-            const isRefsLock = relativePath.startsWith('refs' + path.sep);
-
-            if (isKnownLock || isRefsLock) {
-              try {
-                const stat = fs.statSync(fullPath);
-                const ageMs = now - stat.mtimeMs;
-
-                if (ageMs > BuildReliabilityService.LOCK_FILE_MAX_AGE_MS) {
-                  fs.unlinkSync(fullPath);
-                  removed++;
-                  core.info(
-                    `[Reliability] Removed stale lock file (age: ${Math.round(ageMs / 1000)}s): ${relativePath}`,
-                  );
-                } else {
-                  core.info(
-                    `[Reliability] Lock file is recent (age: ${Math.round(ageMs / 1000)}s), skipping: ${relativePath}`,
-                  );
-                }
-              } catch {
-                core.warning(`[Reliability] Could not remove lock file: ${fullPath}`);
-              }
-            }
-          }
-        }
-      } catch {
-        // Directory not accessible
-      }
-    };
-
-    cleanDirectory(gitDir);
-
-    if (removed > 0) {
-      core.info(`[Reliability] Cleaned ${removed} stale lock file(s)`);
-    } else {
-      core.info('[Reliability] No stale lock files found');
-    }
-
-    return removed;
-  }
-
-  /**
-   * Validate that submodule .git files point to existing backing stores
-   * under .git/modules/. Returns list of submodule paths with broken backing stores.
-   */
-  static validateSubmoduleBackingStores(repoPath: string = '.'): string[] {
-    const broken: string[] = [];
-    const gitmodulesPath = path.join(repoPath, '.gitmodules');
-
-    if (!fs.existsSync(gitmodulesPath)) {
-      core.info('[Reliability] No .gitmodules found, skipping submodule validation');
-      return broken;
-    }
-
-    core.info(`[Reliability] Validating submodule backing stores in ${repoPath}`);
-
-    try {
-      const content = fs.readFileSync(gitmodulesPath, 'utf8');
-      const pathMatches = content.matchAll(/path\s*=\s*(.+)/g);
-
-      for (const match of pathMatches) {
-        const submodulePath = match[1].trim();
-        const gitFile = path.join(repoPath, submodulePath, '.git');
-
-        if (!fs.existsSync(gitFile)) {
-          // Submodule not initialized -- not necessarily broken
-          continue;
-        }
-
-        try {
-          const stat = fs.statSync(gitFile);
-          if (stat.isFile()) {
-            // .git is a file -- should contain "gitdir: <path>"
-            const gitFileContent = fs.readFileSync(gitFile, 'utf8').trim();
-            const gitdirMatch = gitFileContent.match(/^gitdir:\s*(.+)$/);
-
-            if (gitdirMatch) {
-              const backingStore = path.resolve(path.join(repoPath, submodulePath), gitdirMatch[1]);
-              if (!fs.existsSync(backingStore)) {
-                broken.push(submodulePath);
-                core.warning(`[Reliability] Submodule ${submodulePath} has broken backing store: ${backingStore}`);
-              } else {
-                core.info(`[Reliability] Submodule ${submodulePath} backing store OK`);
-              }
-            } else {
-              broken.push(submodulePath);
-              core.warning(`[Reliability] Submodule ${submodulePath} .git file has invalid format`);
-            }
-          }
-        } catch {
-          // Can't read .git file
-          core.warning(`[Reliability] Could not read .git file for submodule: ${submodulePath}`);
-        }
-      }
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not read .gitmodules: ${error.message}`);
-    }
-
-    if (broken.length > 0) {
-      core.warning(`[Reliability] ${broken.length} submodule(s) have broken backing stores`);
-    } else {
-      core.info('[Reliability] All submodule backing stores are valid');
-    }
-
-    return broken;
-  }
-
-  /**
-   * Orchestrate recovery of a corrupted repository.
-   * Sequence: fsck -> clean locks -> re-fetch -> retry fsck.
-   * Returns true if recovery succeeded.
-   */
-  static recoverCorruptedRepo(repoPath: string = '.'): boolean {
-    core.warning(`[Reliability] Attempting automatic recovery for ${repoPath}`);
-
-    // Step 1: Clean stale lock files that may be preventing operations
-    const locksRemoved = BuildReliabilityService.cleanStaleLockFiles(repoPath);
-    if (locksRemoved > 0) {
-      core.info(`[Reliability] Recovery: cleaned ${locksRemoved} lock file(s)`);
-    }
-
-    // Step 2: Re-fetch to restore missing objects
-    try {
-      core.info('[Reliability] Recovery: re-fetching from remote');
-      execSync(`git -C "${repoPath}" fetch --all`, {
-        encoding: 'utf8',
-        timeout: 300_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Recovery: fetch completed');
-    } catch (error: any) {
-      core.warning(`[Reliability] Recovery: fetch failed: ${error.stderr?.toString() ?? error.message}`);
-    }
-
-    // Step 3: Retry fsck
-    const healthy = BuildReliabilityService.checkGitIntegrity(repoPath);
-    if (healthy) {
-      core.info('[Reliability] Recovery succeeded -- repository is healthy');
-    } else {
-      core.warning('[Reliability] Recovery failed -- repository still has integrity issues');
-    }
-
-    return healthy;
-  }
-
-  /**
-   * Scan a directory tree for files/directories with Windows reserved names.
-   * These names (con, prn, aux, nul, com1-9, lpt1-9) with any extension
-   * cause Unity asset importer infinite loops on Windows.
-   * Returns list of paths that were removed.
-   */
-  static cleanReservedFilenames(projectPath: string): string[] {
-    const assetsPath = path.join(projectPath, 'Assets');
-    if (!fs.existsSync(assetsPath)) {
-      core.info(`[Reliability] No Assets directory found at ${assetsPath}, skipping reserved filename scan`);
-      return [];
-    }
-
-    core.info(`[Reliability] Scanning for reserved filenames in ${assetsPath}`);
-    const cleaned: string[] = [];
-
-    const scanDirectory = (directory: string): void => {
-      try {
-        const entries = fs.readdirSync(directory, { withFileTypes: true });
-        for (const entry of entries) {
-          const nameWithoutExtension = entry.name.split('.')[0].toLowerCase();
-          const fullPath = path.join(directory, entry.name);
-
-          if (BuildReliabilityService.RESERVED_NAMES.has(nameWithoutExtension)) {
-            try {
-              if (entry.isDirectory()) {
-                fs.rmSync(fullPath, { recursive: true, force: true });
-              } else {
-                fs.unlinkSync(fullPath);
-              }
-              cleaned.push(fullPath);
-              core.warning(`[Reliability] Removed reserved filename: ${fullPath}`);
-            } catch {
-              core.warning(`[Reliability] Could not remove reserved filename: ${fullPath}`);
-            }
-          } else if (entry.isDirectory()) {
-            scanDirectory(fullPath);
-          }
-        }
-      } catch {
-        // Directory not accessible
-      }
-    };
-
-    scanDirectory(assetsPath);
-
-    if (cleaned.length > 0) {
-      core.warning(`[Reliability] Cleaned ${cleaned.length} reserved filename(s)`);
-    } else {
-      core.info('[Reliability] No reserved filenames found');
-    }
-
-    return cleaned;
-  }
-
-  /**
-   * Get available disk space in megabytes for a given directory.
-   * Returns -1 if the check fails (unknown space).
-   *
-   * Cross-platform: uses wmic on Windows, df on Unix.
-   */
-  static getAvailableSpaceMB(directoryPath: string): number {
-    try {
-      if (process.platform === 'win32') {
-        const drive = path.parse(directoryPath).root;
-        const driveLetter = drive.replace(/[:\\\/]/g, '');
-        const output = execFileSync(
-          'wmic',
-          ['logicaldisk', 'where', `DeviceID='${driveLetter}:'`, 'get', 'FreeSpace', '/value'],
-          { encoding: 'utf8', timeout: 10_000 },
-        );
-        const match = output.match(/FreeSpace=(\d+)/);
-
-        return match ? Number.parseInt(match[1], 10) / (1024 * 1024) : -1;
-      } else {
-        const output = execFileSync('df', ['-BM', '--output=avail', directoryPath], {
-          encoding: 'utf8',
-          timeout: 10_000,
-        });
-        const lines = output.trim().split('\n');
-
-        return Number.parseInt(lines[lines.length - 1], 10);
-      }
-    } catch {
-      return -1; // Unknown, caller should proceed with warning
-    }
-  }
-
-  /**
-   * Calculate the total size of a directory in megabytes.
-   * Returns -1 if the calculation fails.
-   */
-  static getDirectorySizeMB(directoryPath: string): number {
-    try {
-      const stat = fs.statSync(directoryPath);
-      if (!stat.isDirectory()) {
-        return stat.size / (1024 * 1024);
-      }
-
-      let totalBytes = 0;
-      const walkDirectory = (dir: string): void => {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-          const fullPath = path.join(dir, entry.name);
-          if (entry.isDirectory()) {
-            walkDirectory(fullPath);
-          } else {
-            try {
-              totalBytes += fs.statSync(fullPath).size;
-            } catch {
-              // Skip inaccessible files
-            }
-          }
-        }
-      };
-
-      walkDirectory(directoryPath);
-
-      return totalBytes / (1024 * 1024);
-    } catch {
-      return -1;
-    }
-  }
-
-  /**
-   * Create a tar.gz archive of build output.
-   *
-   * Validates disk space before archiving. Skips archival with a warning
-   * if insufficient space is detected, preventing partial writes on full disks.
-   */
-  static archiveBuildOutput(sourcePath: string, archivePath: string): void {
-    if (!fs.existsSync(sourcePath)) {
-      core.info(`[Reliability] No build output to archive at ${sourcePath}`);
-      return;
-    }
-
-    fs.mkdirSync(archivePath, { recursive: true });
-
-    // Check available disk space before archiving
-    const sourceSizeMB = BuildReliabilityService.getDirectorySizeMB(sourcePath);
-    const availableSpaceMB = BuildReliabilityService.getAvailableSpaceMB(archivePath);
-
-    if (sourceSizeMB >= 0 && availableSpaceMB >= 0) {
-      const neededMB = Math.ceil(sourceSizeMB * 1.1); // 10% safety margin
-      if (availableSpaceMB < neededMB) {
-        core.warning(
-          `[Reliability] Insufficient disk space for archive. ` +
-            `Need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB. Skipping archive.`,
-        );
-        return;
-      }
-      core.info(
-        `[Reliability] Disk space check passed: need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB`,
-      );
-    } else if (availableSpaceMB < 0) {
-      core.warning('[Reliability] Could not determine available disk space. Proceeding with archive cautiously.');
-    }
-
-    const timestamp = new Date().toISOString().replace(/[.:]/g, '-');
-    const archiveFile = path.join(archivePath, `build-${timestamp}.tar.gz`);
-
-    try {
-      execSync(`tar -czf "${archiveFile}" -C "${path.dirname(sourcePath)}" "${path.basename(sourcePath)}"`, {
-        encoding: 'utf8',
-        timeout: 600_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info(`[Reliability] Build output archived to ${archiveFile}`);
-    } catch (error: any) {
-      core.warning(`[Reliability] Failed to archive build output: ${error.stderr?.toString() ?? error.message}`);
-
-      // Clean up partial archive if it exists to avoid leaving corrupted files
-      try {
-        if (fs.existsSync(archiveFile)) {
-          fs.unlinkSync(archiveFile);
-          core.info(`[Reliability] Cleaned up partial archive: ${archiveFile}`);
-        }
-      } catch {
-        // Best-effort cleanup
-      }
-    }
-  }
-
-  /**
-   * Enforce retention policy -- delete archives older than the retention period.
-   * Returns the number of old archives removed.
-   */
-  static enforceRetention(archivePath: string, retentionDays: number): number {
-    if (!fs.existsSync(archivePath)) {
-      return 0;
-    }
-
-    const now = Date.now();
-    const retentionMs = retentionDays * 24 * 60 * 60 * 1000;
-    let removed = 0;
-
-    try {
-      const entries = fs.readdirSync(archivePath, { withFileTypes: true });
-      for (const entry of entries) {
-        const fullPath = path.join(archivePath, entry.name);
-        try {
-          const stat = fs.statSync(fullPath);
-          const ageMs = now - stat.mtimeMs;
-
-          if (ageMs > retentionMs) {
-            if (entry.isDirectory()) {
-              fs.rmSync(fullPath, { recursive: true, force: true });
-            } else {
-              fs.unlinkSync(fullPath);
-            }
-            removed++;
-            core.info(
-              `[Reliability] Removed old archive: ${entry.name} (age: ${Math.round(
-                ageMs / (24 * 60 * 60 * 1000),
-              )} days)`,
-            );
-          }
-        } catch {
-          core.warning(`[Reliability] Could not process archive entry: ${fullPath}`);
-        }
-      }
-    } catch {
-      core.warning(`[Reliability] Could not read archive directory: ${archivePath}`);
-      return 0;
-    }
-
-    if (removed > 0) {
-      core.info(
-        `[Reliability] Retention enforced: removed ${removed} old archive(s), retention: ${retentionDays} days`,
-      );
-    }
-
-    return removed;
-  }
-
-  /**
-   * Configure git environment variables for CI reliability.
-   * Sets GIT_TERMINAL_PROMPT=0, increases http.postBuffer, enables core.longpaths.
-   */
-  static configureGitEnvironment(): void {
-    core.info('[Reliability] Configuring git environment for CI');
-
-    // Prevent git from prompting for credentials (hangs in CI)
-    process.env.GIT_TERMINAL_PROMPT = '0';
-    core.info('[Reliability] Set GIT_TERMINAL_PROMPT=0');
-
-    try {
-      // Increase http.postBuffer to 500MB for large pushes
-      execSync('git config --global http.postBuffer 524288000', {
-        encoding: 'utf8',
-        timeout: 10_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Set http.postBuffer=524288000 (500MB)');
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not set http.postBuffer: ${error.message}`);
-    }
-
-    try {
-      // Enable long paths on Windows
-      execSync('git config --global core.longpaths true', {
-        encoding: 'utf8',
-        timeout: 10_000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      });
-      core.info('[Reliability] Set core.longpaths=true');
-    } catch (error: any) {
-      core.warning(`[Reliability] Could not set core.longpaths: ${error.message}`);
-    }
-  }
-}

src/model/orchestrator/services/reliability/index.ts

@@ -1 +0,0 @@
-export { BuildReliabilityService } from './build-reliability-service';