fix: replace orchestrator-develop branch references with main

The orchestrator-develop branch no longer exists. Update all fallback clone commands and test fixtures to use main instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
ci: set macOS builds to continue-on-error
2026-06-01 14:26:17 -07:00 · 2026-03-09 19:59:58 +00:00 · 2026-03-05 23:33:04 +00:00 · 2026-03-05 11:56:43 +00:00 · 2026-03-05 09:39:53 +00:00
23 changed files with 1784 additions and 3341 deletions
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -1,4 +1,5 @@
 {
+  "root": true,
  "plugins": ["jest", "@typescript-eslint", "prettier", "unicorn"],
  "extends": ["plugin:unicorn/recommended", "plugin:github/recommended", "plugin:prettier/recommended"],
  "parser": "@typescript-eslint/parser",
--- a/action.yml
+++ b/action.yml
@@ -279,66 +279,24 @@ inputs:
    description:
      '[Orchestrator] Specifies the repo for the unity builder. Useful if you forked the repo for testing, features, or
      fixes.'
-  remotePowershellHost:
-    default: ''
+  syncStrategy:
+    description: 'Workspace sync strategy: full, git-delta, direct-input, storage-pull'
    required: false
-    description: '[Orchestrator] Remote PowerShell host (hostname or IP) for the remote-powershell provider'
-  remotePowershellCredential:
-    default: ''
+    default: 'full'
+  syncInputRef:
+    description: 'URI for direct-input or storage-pull content (storage://remote/path or file path)'
    required: false
-    description: '[Orchestrator] Remote PowerShell credential (username:password or certificate path)'
-  remotePowershellTransport:
-    default: 'wsman'
+  syncStorageRemote:
+    description: 'rclone remote name for storage-backed inputs (defaults to rcloneRemote)'
    required: false
-    description: '[Orchestrator] Remote PowerShell transport protocol (wsman or ssh)'
-  githubActionsRepo:
-    default: ''
+  syncRevertAfter:
+    description: 'Revert overlaid changes after job completion'
    required: false
-    description: '[Orchestrator] Target repository (owner/repo) for the github-actions provider'
-  githubActionsWorkflow:
-    default: ''
+    default: 'true'
+  syncStatePath:
+    description: 'Path to sync state file for delta tracking'
    required: false
-    description: '[Orchestrator] Workflow filename or ID to dispatch for the github-actions provider'
-  githubActionsToken:
-    default: ''
-    required: false
-    description: '[Orchestrator] PAT with actions:write scope for the github-actions provider'
-  githubActionsRef:
-    default: 'main'
-    required: false
-    description: '[Orchestrator] Branch/ref to run the workflow on for the github-actions provider'
-  gitlabProjectId:
-    default: ''
-    required: false
-    description: '[Orchestrator] GitLab project ID or URL-encoded path for the gitlab-ci provider'
-  gitlabTriggerToken:
-    default: ''
-    required: false
-    description: '[Orchestrator] Pipeline trigger token for the gitlab-ci provider'
-  gitlabApiUrl:
-    default: 'https://gitlab.com'
-    required: false
-    description: '[Orchestrator] GitLab API URL (for self-hosted instances) for the gitlab-ci provider'
-  gitlabRef:
-    default: 'main'
-    required: false
-    description: '[Orchestrator] Branch/ref to trigger the pipeline on for the gitlab-ci provider'
-  ansibleInventory:
-    default: ''
-    required: false
-    description: '[Orchestrator] Path to Ansible inventory file or dynamic inventory script'
-  ansiblePlaybook:
-    default: ''
-    required: false
-    description: '[Orchestrator] Path to Ansible playbook for Unity builds'
-  ansibleExtraVars:
-    default: ''
-    required: false
-    description: '[Orchestrator] Additional Ansible variables as JSON'
-  ansibleVaultPassword:
-    default: ''
-    required: false
-    description: '[Orchestrator] Path to Ansible vault password file'
+    default: '.game-ci/sync-state.json'

 outputs:
  volume:
--- a/dist/index.js
+++ b/dist/index.js
--- a/dist/index.js.map
+++ b/dist/index.js.map
--- a/src/index.ts
+++ b/src/index.ts
@@ -3,6 +3,8 @@ import { Action, BuildParameters, Cache, Orchestrator, Docker, ImageTag, Output
 import { Cli } from './model/cli/cli';
 import MacBuilder from './model/mac-builder';
 import PlatformSetup from './model/platform-setup';
+import { IncrementalSyncService } from './model/orchestrator/services/sync';
+import { SyncStrategy } from './model/orchestrator/services/sync/sync-state';

 async function runMain() {
  try {
@@ -23,6 +25,14 @@ async function runMain() {

    if (buildParameters.providerStrategy === 'local') {
      core.info('Building locally');
+
+      // Apply incremental sync strategy before build
+      const syncStrategy = buildParameters.syncStrategy as SyncStrategy;
+      if (syncStrategy !== 'full') {
+        core.info(`[Sync] Applying sync strategy: ${syncStrategy}`);
+        await applySyncStrategy(buildParameters, workspace);
+      }
+
      await PlatformSetup.setup(buildParameters, actionFolder);
      exitCode =
        process.platform === 'darwin'
@@ -32,6 +42,16 @@ async function runMain() {
              actionFolder,
              ...buildParameters,
            });
+
+      // Revert overlays after job completion if configured
+      if (buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        core.info('[Sync] Reverting overlay changes after job completion');
+        try {
+          await IncrementalSyncService.revertOverlays(workspace, buildParameters.syncStatePath);
+        } catch (revertError) {
+          core.warning(`[Sync] Overlay revert failed: ${(revertError as Error).message}`);
+        }
+      }
    } else {
      await Orchestrator.run(buildParameters, baseImage.toString());
      exitCode = 0;
@@ -50,4 +70,58 @@ async function runMain() {
  }
 }

+/**
+ * Apply the configured sync strategy to the workspace before build.
+ */
+async function applySyncStrategy(buildParameters: BuildParameters, workspace: string): Promise<void> {
+  const strategy = buildParameters.syncStrategy as SyncStrategy;
+  const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspace, buildParameters.syncStatePath);
+
+  if (resolvedStrategy === 'full') {
+    core.info('[Sync] Resolved to full sync (no incremental state available)');
+
+    return;
+  }
+
+  switch (resolvedStrategy) {
+    case 'git-delta': {
+      const targetReference = buildParameters.gitSha || buildParameters.branch;
+      const changedFiles = await IncrementalSyncService.syncGitDelta(
+        workspace,
+        targetReference,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Git delta sync applied: ${changedFiles} file(s) changed`);
+      break;
+    }
+    case 'direct-input': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] direct-input strategy requires syncInputRef to be set');
+      }
+      const overlays = await IncrementalSyncService.applyDirectInput(
+        workspace,
+        buildParameters.syncInputRef,
+        buildParameters.syncStorageRemote || undefined,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Direct input applied: ${overlays.length} overlay(s)`);
+      break;
+    }
+    case 'storage-pull': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] storage-pull strategy requires syncInputRef to be set');
+      }
+      const pulledFiles = await IncrementalSyncService.syncStoragePull(workspace, buildParameters.syncInputRef, {
+        rcloneRemote: buildParameters.syncStorageRemote || undefined,
+        syncRevertAfter: buildParameters.syncRevertAfter,
+        statePath: buildParameters.syncStatePath,
+      });
+      core.info(`[Sync] Storage pull complete: ${pulledFiles.length} file(s)`);
+      break;
+    }
+    default:
+      core.warning(`[Sync] Unknown sync strategy: ${resolvedStrategy}`);
+  }
+}
+
 runMain();
--- a/src/model/build-parameters.ts
+++ b/src/model/build-parameters.ts
@@ -106,29 +106,11 @@ class BuildParameters {
  public cacheUnityInstallationOnMac!: boolean;
  public unityHubVersionOnMac!: string;
  public dockerWorkspacePath!: string;
-
-  // Remote PowerShell provider
-  public remotePowershellHost!: string;
-  public remotePowershellCredential!: string;
-  public remotePowershellTransport!: string;
-
-  // GitHub Actions provider
-  public githubActionsRepo!: string;
-  public githubActionsWorkflow!: string;
-  public githubActionsToken!: string;
-  public githubActionsRef!: string;
-
-  // GitLab CI provider
-  public gitlabProjectId!: string;
-  public gitlabTriggerToken!: string;
-  public gitlabApiUrl!: string;
-  public gitlabRef!: string;
-
-  // Ansible provider
-  public ansibleInventory!: string;
-  public ansiblePlaybook!: string;
-  public ansibleExtraVars!: string;
-  public ansibleVaultPassword!: string;
+  public syncStrategy!: string;
+  public syncInputRef!: string;
+  public syncStorageRemote!: string;
+  public syncRevertAfter!: boolean;
+  public syncStatePath!: string;

  public static shouldUseRetainedWorkspaceMode(buildParameters: BuildParameters) {
    return buildParameters.maxRetainedWorkspaces > 0 && Orchestrator.lockedWorkspace !== ``;
@@ -265,29 +247,11 @@ class BuildParameters {
      cacheUnityInstallationOnMac: Input.cacheUnityInstallationOnMac,
      unityHubVersionOnMac: Input.unityHubVersionOnMac,
      dockerWorkspacePath: Input.dockerWorkspacePath,
-
-      // Remote PowerShell provider
-      remotePowershellHost: Input.remotePowershellHost,
-      remotePowershellCredential: Input.remotePowershellCredential,
-      remotePowershellTransport: Input.remotePowershellTransport,
-
-      // GitHub Actions provider
-      githubActionsRepo: Input.githubActionsRepo,
-      githubActionsWorkflow: Input.githubActionsWorkflow,
-      githubActionsToken: Input.githubActionsToken,
-      githubActionsRef: Input.githubActionsRef,
-
-      // GitLab CI provider
-      gitlabProjectId: Input.gitlabProjectId,
-      gitlabTriggerToken: Input.gitlabTriggerToken,
-      gitlabApiUrl: Input.gitlabApiUrl,
-      gitlabRef: Input.gitlabRef,
-
-      // Ansible provider
-      ansibleInventory: Input.ansibleInventory,
-      ansiblePlaybook: Input.ansiblePlaybook,
-      ansibleExtraVars: Input.ansibleExtraVars,
-      ansibleVaultPassword: Input.ansibleVaultPassword,
+      syncStrategy: Input.syncStrategy,
+      syncInputRef: Input.syncInputRef,
+      syncStorageRemote: Input.syncStorageRemote,
+      syncRevertAfter: Input.syncRevertAfter,
+      syncStatePath: Input.syncStatePath,
    };
  }

--- a/src/model/input.ts
+++ b/src/model/input.ts
@@ -241,6 +241,28 @@ class Input {
    return Input.getInput('dockerWorkspacePath') ?? '/github/workspace';
  }

+  static get syncStrategy(): string {
+    return Input.getInput('syncStrategy') ?? 'full';
+  }
+
+  static get syncInputRef(): string {
+    return Input.getInput('syncInputRef') ?? '';
+  }
+
+  static get syncStorageRemote(): string {
+    return Input.getInput('syncStorageRemote') ?? '';
+  }
+
+  static get syncRevertAfter(): boolean {
+    const input = Input.getInput('syncRevertAfter') ?? 'true';
+
+    return input === 'true';
+  }
+
+  static get syncStatePath(): string {
+    return Input.getInput('syncStatePath') ?? '.game-ci/sync-state.json';
+  }
+
  static get dockerCpuLimit(): string {
    return Input.getInput('dockerCpuLimit') ?? os.cpus().length.toString();
  }
@@ -282,82 +304,6 @@ class Input {
    return Input.getInput('skipActivation')?.toLowerCase() ?? 'false';
  }

-  // ### ### ###
-  // Remote PowerShell provider
-  // ### ### ###
-
-  static get remotePowershellHost(): string {
-    return Input.getInput('remotePowershellHost') ?? '';
-  }
-
-  static get remotePowershellCredential(): string {
-    return Input.getInput('remotePowershellCredential') ?? '';
-  }
-
-  static get remotePowershellTransport(): string {
-    return Input.getInput('remotePowershellTransport') ?? 'wsman';
-  }
-
-  // ### ### ###
-  // GitHub Actions provider
-  // ### ### ###
-
-  static get githubActionsRepo(): string {
-    return Input.getInput('githubActionsRepo') ?? '';
-  }
-
-  static get githubActionsWorkflow(): string {
-    return Input.getInput('githubActionsWorkflow') ?? '';
-  }
-
-  static get githubActionsToken(): string {
-    return Input.getInput('githubActionsToken') ?? '';
-  }
-
-  static get githubActionsRef(): string {
-    return Input.getInput('githubActionsRef') ?? 'main';
-  }
-
-  // ### ### ###
-  // GitLab CI provider
-  // ### ### ###
-
-  static get gitlabProjectId(): string {
-    return Input.getInput('gitlabProjectId') ?? '';
-  }
-
-  static get gitlabTriggerToken(): string {
-    return Input.getInput('gitlabTriggerToken') ?? '';
-  }
-
-  static get gitlabApiUrl(): string {
-    return Input.getInput('gitlabApiUrl') ?? 'https://gitlab.com';
-  }
-
-  static get gitlabRef(): string {
-    return Input.getInput('gitlabRef') ?? 'main';
-  }
-
-  // ### ### ###
-  // Ansible provider
-  // ### ### ###
-
-  static get ansibleInventory(): string {
-    return Input.getInput('ansibleInventory') ?? '';
-  }
-
-  static get ansiblePlaybook(): string {
-    return Input.getInput('ansiblePlaybook') ?? '';
-  }
-
-  static get ansibleExtraVars(): string {
-    return Input.getInput('ansibleExtraVars') ?? '';
-  }
-
-  static get ansibleVaultPassword(): string {
-    return Input.getInput('ansibleVaultPassword') ?? '';
-  }
-
  public static ToEnvVarFormat(input: string) {
    if (input.toUpperCase() === input) {
      return input;
--- a/src/model/orchestrator/orchestrator.ts
+++ b/src/model/orchestrator/orchestrator.ts
@@ -13,10 +13,6 @@ import OrchestratorEnvironmentVariable from './options/orchestrator-environment-
 import TestOrchestrator from './providers/test';
 import LocalOrchestrator from './providers/local';
 import LocalDockerOrchestrator from './providers/docker';
-import RemotePowershellProvider from './providers/remote-powershell';
-import GitHubActionsProvider from './providers/github-actions';
-import GitLabCIProvider from './providers/gitlab-ci';
-import AnsibleProvider from './providers/ansible';
 import loadProvider from './providers/provider-loader';
 import GitHub from '../github';
 import SharedWorkspaceLocking from './services/core/shared-workspace-locking';
@@ -162,18 +158,6 @@ class Orchestrator {
      case 'local':
        Orchestrator.Provider = new LocalOrchestrator();
        break;
-      case 'remote-powershell':
-        Orchestrator.Provider = new RemotePowershellProvider(Orchestrator.buildParameters);
-        break;
-      case 'github-actions':
-        Orchestrator.Provider = new GitHubActionsProvider(Orchestrator.buildParameters);
-        break;
-      case 'gitlab-ci':
-        Orchestrator.Provider = new GitLabCIProvider(Orchestrator.buildParameters);
-        break;
-      case 'ansible':
-        Orchestrator.Provider = new AnsibleProvider(Orchestrator.buildParameters);
-        break;
      default:
        // Try to load provider using the dynamic loader for unknown providers
        try {
--- a/src/model/orchestrator/providers/ansible/ansible-provider.test.ts
+++ b/src/model/orchestrator/providers/ansible/ansible-provider.test.ts
@@ -1,291 +0,0 @@
-import AnsibleProvider from '.';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import * as core from '@actions/core';
-
-jest.mock('../../services/core/orchestrator-system');
-jest.mock('../../services/core/orchestrator-logger');
-jest.mock('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn(),
-  setOutput: jest.fn(),
-  getInput: jest.fn(() => ''),
-}));
-
-const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
-const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
-const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
-
-function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
-  return {
-    ansibleInventory: '/etc/ansible/hosts',
-    ansiblePlaybook: '/playbooks/unity-build.yml',
-    ansibleExtraVars: '',
-    ansibleVaultPassword: '',
-    ...overrides,
-  } as BuildParameters;
-}
-
-describe('AnsibleProvider', () => {
-  let provider: AnsibleProvider;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    provider = new AnsibleProvider(createBuildParameters());
-  });
-
-  describe('constructor', () => {
-    it('initializes with all provided parameters', () => {
-      const params = createBuildParameters({
-        ansibleInventory: '/custom/inventory',
-        ansiblePlaybook: '/custom/playbook.yml',
-        ansibleExtraVars: '{"key":"value"}',
-        ansibleVaultPassword: '/vault/pass',
-      });
-      const p = new AnsibleProvider(params);
-      expect(p).toBeDefined();
-    });
-
-    it('handles missing optional parameters gracefully', () => {
-      const params = createBuildParameters({
-        ansiblePlaybook: undefined,
-        ansibleExtraVars: undefined,
-        ansibleVaultPassword: undefined,
-      });
-      const p = new AnsibleProvider(params);
-      expect(p).toBeDefined();
-    });
-  });
-
-  describe('setupWorkflow', () => {
-    it('verifies ansible binary, ansible-playbook binary, and inventory exist', async () => {
-      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible --version
-      mockRun.mockResolvedValueOnce('/usr/bin/ansible-playbook'); // ansible-playbook check
-      mockRun.mockResolvedValueOnce(''); // test -e inventory
-
-      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
-
-      expect(mockRun).toHaveBeenCalledTimes(3);
-      expect(mockRun.mock.calls[0][0]).toContain('ansible --version');
-      expect(mockRun.mock.calls[1][0]).toContain('ansible-playbook');
-      expect(mockRun.mock.calls[2][0]).toContain('test -e "/etc/ansible/hosts"');
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ansible'));
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ansible-playbook binary verified'));
-    });
-
-    it('throws when inventory is not configured', async () => {
-      const params = createBuildParameters({ ansibleInventory: '' });
-      provider = new AnsibleProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'ansibleInventory is required',
-      );
-    });
-
-    it('throws when ansible binary is not found on PATH', async () => {
-      mockRun.mockRejectedValueOnce(new Error('command not found: ansible'));
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'Ansible not found on PATH',
-      );
-    });
-
-    it('throws when ansible-playbook binary is not found', async () => {
-      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible version OK
-      mockRun.mockRejectedValueOnce(new Error('command not found')); // ansible-playbook missing
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'ansible-playbook not found on PATH',
-      );
-
-      expect(core.error).toHaveBeenCalledWith('ansible-playbook not found. Install Ansible or ensure it is in PATH.');
-    });
-
-    it('throws when inventory file does not exist', async () => {
-      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible version OK
-      mockRun.mockResolvedValueOnce('/usr/bin/ansible-playbook'); // ansible-playbook OK
-      mockRun.mockRejectedValueOnce(new Error('test -e failed')); // inventory missing
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'Inventory not found: /etc/ansible/hosts',
-      );
-    });
-  });
-
-  describe('runTaskInWorkflow', () => {
-    it('constructs ansible-playbook command with correct variables and returns output', async () => {
-      mockRun.mockResolvedValueOnce('PLAY [build] *****\nok: [server1]\nPLAY RECAP');
-
-      const result = await provider.runTaskInWorkflow(
-        'guid-run1',
-        'unityci/editor:2021.3',
-        'echo build',
-        '/mount',
-        '/workspace',
-        [],
-        [],
-      );
-
-      expect(result).toContain('PLAY [build]');
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('ansible-playbook');
-      expect(command).toContain('-i "/etc/ansible/hosts"');
-      expect(command).toContain('"/playbooks/unity-build.yml"');
-      expect(command).toContain('--no-color');
-      expect(command).toContain('build_guid');
-      expect(command).toContain('guid-run1');
-      expect(command).toContain('build_image');
-      expect(command).toContain('unityci/editor:2021.3');
-      expect(command).toContain('build_commands');
-      expect(command).toContain('mount_dir');
-      expect(command).toContain('working_dir');
-    });
-
-    it('throws when playbook is not configured', async () => {
-      const params = createBuildParameters({ ansiblePlaybook: '' });
-      provider = new AnsibleProvider(params);
-
-      await expect(provider.runTaskInWorkflow('guid-nopb', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'ansiblePlaybook is required',
-      );
-    });
-
-    it('passes environment variables as extra-vars in snake_case', async () => {
-      mockRun.mockResolvedValueOnce('ok');
-
-      const env = [
-        { name: 'UNITY_LICENSE', value: 'lic-data' },
-        { name: 'BUILD_TARGET', value: 'Linux64' },
-      ];
-
-      await provider.runTaskInWorkflow('guid-env', 'img', 'cmd', '/m', '/w', env as any, []);
-
-      const command = mockRun.mock.calls[0][0];
-      // Environment variable names are lowercased as Ansible variables
-      expect(command).toContain('unity_license');
-      expect(command).toContain('lic-data');
-      expect(command).toContain('build_target');
-      expect(command).toContain('Linux64');
-    });
-
-    it('merges user-provided extra vars from JSON string', async () => {
-      const params = createBuildParameters({
-        ansibleExtraVars: JSON.stringify({ custom_var: 'custom_value', another: '42' }),
-      });
-      provider = new AnsibleProvider(params);
-      mockRun.mockResolvedValueOnce('ok');
-
-      await provider.runTaskInWorkflow('guid-extra', 'img', 'cmd', '/m', '/w', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('custom_var');
-      expect(command).toContain('custom_value');
-      expect(command).toContain('another');
-    });
-
-    it('logs warning when extra vars JSON is invalid but continues', async () => {
-      const params = createBuildParameters({ ansibleExtraVars: 'not-valid-json{{{' });
-      provider = new AnsibleProvider(params);
-      mockRun.mockResolvedValueOnce('ok');
-
-      await provider.runTaskInWorkflow('guid-badjson', 'img', 'cmd', '/m', '/w', [], []);
-
-      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to parse ansibleExtraVars'));
-    });
-
-    it('includes vault password file flag when configured', async () => {
-      const params = createBuildParameters({ ansibleVaultPassword: '/secure/vault-pass.txt' });
-      provider = new AnsibleProvider(params);
-      mockRun.mockResolvedValueOnce('ok');
-
-      await provider.runTaskInWorkflow('guid-vault', 'img', 'cmd', '/m', '/w', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('--vault-password-file "/secure/vault-pass.txt"');
-    });
-
-    it('does not include vault password flag when not configured', async () => {
-      mockRun.mockResolvedValueOnce('ok');
-
-      await provider.runTaskInWorkflow('guid-novault', 'img', 'cmd', '/m', '/w', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).not.toContain('--vault-password-file');
-    });
-
-    it('prefixes secrets as environment variables in the command', async () => {
-      mockRun.mockResolvedValueOnce('ok');
-
-      const secrets = [
-        { ParameterKey: 'key1', EnvironmentVariable: 'SECRET_TOKEN', ParameterValue: 'tok-abc' },
-        { ParameterKey: 'key2', EnvironmentVariable: 'DEPLOY_KEY', ParameterValue: 'dk-xyz' },
-      ];
-
-      await provider.runTaskInWorkflow('guid-secrets', 'img', 'cmd', '/m', '/w', [], secrets as any);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toMatch(/^SECRET_TOKEN='tok-abc'/);
-      expect(command).toContain("DEPLOY_KEY='dk-xyz'");
-      expect(command).toContain('ansible-playbook');
-    });
-
-    it('throws and logs warning when playbook execution fails', async () => {
-      const execError = new Error('UNREACHABLE! Host unreachable');
-      mockRun.mockRejectedValueOnce(execError);
-
-      await expect(provider.runTaskInWorkflow('guid-hostfail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'UNREACHABLE',
-      );
-
-      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Playbook failed'));
-    });
-  });
-
-  describe('cleanupWorkflow', () => {
-    it('completes without error and logs cleanup message', async () => {
-      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
-    });
-  });
-
-  describe('garbageCollect', () => {
-    it('returns empty string (no-op)', async () => {
-      const result = await provider.garbageCollect('', false, 0, false, false);
-      expect(result).toBe('');
-    });
-  });
-
-  describe('listResources', () => {
-    it('returns inventory path as a resource when configured', async () => {
-      const resources = await provider.listResources();
-
-      expect(resources).toHaveLength(1);
-      expect(resources[0].Name).toBe('/etc/ansible/hosts');
-    });
-
-    it('returns empty array when inventory is not configured', async () => {
-      const params = createBuildParameters({ ansibleInventory: '' });
-      provider = new AnsibleProvider(params);
-
-      const resources = await provider.listResources();
-      expect(resources).toEqual([]);
-    });
-  });
-
-  describe('listWorkflow', () => {
-    it('returns empty array (not implemented)', async () => {
-      const workflows = await provider.listWorkflow();
-      expect(workflows).toEqual([]);
-    });
-  });
-
-  describe('watchWorkflow', () => {
-    it('returns empty string (not implemented)', async () => {
-      const result = await provider.watchWorkflow();
-      expect(result).toBe('');
-    });
-  });
-});
--- a/src/model/orchestrator/providers/ansible/index.ts
+++ b/src/model/orchestrator/providers/ansible/index.ts
@@ -1,197 +0,0 @@
-import * as core from '@actions/core';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import { ProviderInterface } from '../provider-interface';
-import OrchestratorSecret from '../../options/orchestrator-secret';
-import { ProviderResource } from '../provider-resource';
-import { ProviderWorkflow } from '../provider-workflow';
-
-/**
- * Ansible provider — executes Unity builds via Ansible playbooks
- * against managed inventory.
- *
- * Use case: Teams with existing Ansible infrastructure for server
- * management who want to leverage their inventory for build distribution.
- */
-class AnsibleProvider implements ProviderInterface {
-  private buildParameters: BuildParameters;
-  private inventory: string;
-  private playbook: string;
-  private extraVariables: string;
-  private vaultPassword: string;
-
-  constructor(buildParameters: BuildParameters) {
-    this.buildParameters = buildParameters;
-    this.inventory = buildParameters.ansibleInventory || '';
-    this.playbook = buildParameters.ansiblePlaybook || '';
-    this.extraVariables = buildParameters.ansibleExtraVars || '';
-    this.vaultPassword = buildParameters.ansibleVaultPassword || '';
-  }
-
-  async setupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildGuid: string,
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[Ansible] Setting up playbook execution`);
-
-    if (!this.inventory) {
-      throw new Error('ansibleInventory is required for the ansible provider');
-    }
-
-    // Verify ansible is available
-    try {
-      const version = await OrchestratorSystem.Run('ansible --version | head -1');
-      OrchestratorLogger.log(`[Ansible] ${version.trim()}`);
-    } catch (error: any) {
-      throw new Error(`Ansible not found on PATH: ${error.message || error}`);
-    }
-
-    // Verify ansible-playbook binary exists (may be separate from ansible)
-    try {
-      await OrchestratorSystem.Run('command -v ansible-playbook || which ansible-playbook || where ansible-playbook');
-      OrchestratorLogger.log(`[Ansible] ansible-playbook binary verified`);
-    } catch (error: any) {
-      core.error('ansible-playbook not found. Install Ansible or ensure it is in PATH.');
-      throw new Error(`ansible-playbook not found on PATH: ${error.message || error}`);
-    }
-
-    // Verify inventory exists
-    try {
-      await OrchestratorSystem.Run(`test -e "${this.inventory}"`);
-    } catch {
-      throw new Error(`Inventory not found: ${this.inventory}`);
-    }
-  }
-
-  async runTaskInWorkflow(
-    buildGuid: string,
-    image: string,
-    commands: string,
-    mountdir: string,
-    workingdir: string,
-    environment: OrchestratorEnvironmentVariable[],
-    secrets: OrchestratorSecret[],
-  ): Promise<string> {
-    OrchestratorLogger.log(`[Ansible] Running playbook against inventory ${this.inventory}`);
-
-    if (!this.playbook) {
-      throw new Error(
-        'ansiblePlaybook is required — no default playbook is provided yet. ' +
-          'Provide a playbook that accepts build_guid, build_image, build_commands, mount_dir, and working_dir variables.',
-      );
-    }
-
-    // Build extra-vars JSON
-    // These use snake_case because they are Ansible variable names passed to playbooks
-    const playbookVariables: Record<string, string> = {
-      // eslint-disable-next-line camelcase
-      build_guid: buildGuid,
-      // eslint-disable-next-line camelcase
-      build_image: image,
-      // eslint-disable-next-line camelcase
-      build_commands: commands,
-      // eslint-disable-next-line camelcase
-      mount_dir: mountdir,
-      // eslint-disable-next-line camelcase
-      working_dir: workingdir,
-    };
-
-    for (const element of environment) {
-      playbookVariables[element.name.toLowerCase()] = element.value;
-    }
-
-    // Merge user-provided extra vars
-    if (this.extraVariables) {
-      try {
-        const userVariables = JSON.parse(this.extraVariables);
-        Object.assign(playbookVariables, userVariables);
-      } catch {
-        OrchestratorLogger.logWarning(`[Ansible] Failed to parse ansibleExtraVars as JSON, using as-is`);
-      }
-    }
-
-    const extraVariablesJson = JSON.stringify(playbookVariables).replace(/'/g, "'\\''");
-
-    // Build ansible-playbook command
-    const commandParts = [
-      'ansible-playbook',
-      `-i "${this.inventory}"`,
-      `"${this.playbook}"`,
-      `-e '${extraVariablesJson}'`,
-      '--no-color',
-    ];
-
-    if (this.vaultPassword) {
-      commandParts.push(`--vault-password-file "${this.vaultPassword}"`);
-    }
-
-    // Add secret variables as extra environment
-    const environmentPrefix = secrets
-      .map((secret) => `${secret.EnvironmentVariable}='${secret.ParameterValue}'`)
-      .join(' ');
-
-    const fullCommand = environmentPrefix ? `${environmentPrefix} ${commandParts.join(' ')}` : commandParts.join(' ');
-
-    try {
-      const output = await OrchestratorSystem.Run(fullCommand);
-      OrchestratorLogger.log(`[Ansible] Playbook completed successfully`);
-
-      return output;
-    } catch (error: any) {
-      OrchestratorLogger.logWarning(`[Ansible] Playbook failed: ${error.message || error}`);
-      throw error;
-    }
-  }
-
-  async cleanupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[Ansible] Cleanup complete`);
-  }
-
-  async garbageCollect(
-    // eslint-disable-next-line no-unused-vars
-    filter: string,
-    // eslint-disable-next-line no-unused-vars
-    previewOnly: boolean,
-    // eslint-disable-next-line no-unused-vars
-    olderThan: Number,
-    // eslint-disable-next-line no-unused-vars
-    fullCache: boolean,
-    // eslint-disable-next-line no-unused-vars
-    baseDependencies: boolean,
-  ): Promise<string> {
-    return '';
-  }
-
-  async listResources(): Promise<ProviderResource[]> {
-    if (!this.inventory) return [];
-
-    const resource = new ProviderResource();
-    resource.Name = this.inventory;
-
-    return [resource];
-  }
-
-  async listWorkflow(): Promise<ProviderWorkflow[]> {
-    return [];
-  }
-
-  async watchWorkflow(): Promise<string> {
-    return '';
-  }
-}
-export default AnsibleProvider;
--- a/src/model/orchestrator/providers/github-actions/github-actions-provider.test.ts
+++ b/src/model/orchestrator/providers/github-actions/github-actions-provider.test.ts
@@ -1,333 +0,0 @@
-import GitHubActionsProvider from '.';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import * as core from '@actions/core';
-
-jest.mock('../../services/core/orchestrator-system');
-jest.mock('../../services/core/orchestrator-logger');
-jest.mock('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn(),
-  setOutput: jest.fn(),
-  getInput: jest.fn(() => ''),
-}));
-
-const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
-const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
-
-function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
-  return {
-    githubActionsRepo: 'owner/repo',
-    githubActionsWorkflow: 'build.yml',
-    githubActionsToken: 'ghp_test_token_123',
-    githubActionsRef: 'main',
-    ...overrides,
-  } as BuildParameters;
-}
-
-// Override setTimeout to execute callbacks immediately so polling loops complete fast
-const originalSetTimeout = global.setTimeout;
-beforeAll(() => {
-  global.setTimeout = ((fn: (...args: any[]) => void, _ms?: number, ...args: any[]) => {
-    return originalSetTimeout(fn, 0, ...args);
-  }) as any;
-});
-afterAll(() => {
-  global.setTimeout = originalSetTimeout;
-});
-
-describe('GitHubActionsProvider', () => {
-  let provider: GitHubActionsProvider;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    provider = new GitHubActionsProvider(createBuildParameters());
-  });
-
-  describe('constructor', () => {
-    it('sets default ref to main when not specified', () => {
-      const params = createBuildParameters({ githubActionsRef: undefined });
-      const p = new GitHubActionsProvider(params);
-      expect(p).toBeDefined();
-    });
-
-    it('uses provided ref when specified', () => {
-      const params = createBuildParameters({ githubActionsRef: 'develop' });
-      const p = new GitHubActionsProvider(params);
-      expect(p).toBeDefined();
-    });
-  });
-
-  describe('setupWorkflow', () => {
-    it('verifies workflow exists via gh api and logs success', async () => {
-      mockRun.mockResolvedValueOnce('12345\n');
-
-      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
-
-      expect(mockRun).toHaveBeenCalledTimes(1);
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('gh api repos/owner/repo/actions/workflows/build.yml');
-      expect(command).toContain("--jq '.id'");
-      expect(command).toContain('GH_TOKEN=ghp_test_token_123');
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Workflow verified'));
-    });
-
-    it('throws when repo is not configured', async () => {
-      const params = createBuildParameters({ githubActionsRepo: '' });
-      provider = new GitHubActionsProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'githubActionsRepo and githubActionsWorkflow are required',
-      );
-    });
-
-    it('throws when workflow is not configured', async () => {
-      const params = createBuildParameters({ githubActionsWorkflow: '' });
-      provider = new GitHubActionsProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'githubActionsRepo and githubActionsWorkflow are required',
-      );
-    });
-
-    it('throws when token is missing', async () => {
-      const params = createBuildParameters({ githubActionsToken: '' });
-      provider = new GitHubActionsProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'githubActionsToken is required',
-      );
-    });
-
-    it('throws descriptive error when workflow verification fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('Not Found'));
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'Failed to verify workflow build.yml in owner/repo',
-      );
-    });
-  });
-
-  describe('runTaskInWorkflow', () => {
-    it('dispatches workflow with correct inputs and returns logs on success', async () => {
-      // Dispatch succeeds
-      mockRun.mockResolvedValueOnce('');
-      // First poll finds the run
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 99001, status: 'in_progress' }));
-      // Status poll returns completed
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' }));
-      // Log fetch succeeds
-      mockRun.mockResolvedValueOnce('Build output log content here');
-
-      const result = await provider.runTaskInWorkflow(
-        'guid-abc',
-        'unityci/editor:2021.3',
-        'echo build',
-        '/mount',
-        '/work',
-        [],
-        [],
-      );
-
-      expect(result).toBe('Build output log content here');
-
-      // Verify dispatch command
-      const dispatchCommand = mockRun.mock.calls[0][0];
-      expect(dispatchCommand).toContain('dispatches');
-      expect(dispatchCommand).toContain('-X POST');
-      expect(dispatchCommand).toContain("ref='main'");
-
-      // Verify log fetch command
-      const logCommand = mockRun.mock.calls[3][0];
-      expect(logCommand).toContain('gh run view');
-      expect(logCommand).toContain('--log');
-      expect(logCommand).toContain('--repo owner/repo');
-    });
-
-    it('base64 encodes commands in the inputs payload', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 100, status: 'completed' })); // run found
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // status
-      mockRun.mockResolvedValueOnce('logs'); // logs
-
-      await provider.runTaskInWorkflow('guid-1', 'image:latest', 'echo hello && build', '/mnt', '/w', [], []);
-
-      const dispatchCommand = mockRun.mock.calls[0][0];
-      const expectedB64 = Buffer.from('echo hello && build').toString('base64');
-      expect(dispatchCommand).toContain(expectedB64);
-    });
-
-    it('includes environment variables as JSON input', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 200, status: 'completed' })); // run found
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // status
-      mockRun.mockResolvedValueOnce('logs'); // logs
-
-      const env = [
-        { name: 'UNITY_LICENSE', value: 'license-data' },
-        { name: 'BUILD_TARGET', value: 'StandaloneWindows64' },
-      ];
-
-      await provider.runTaskInWorkflow('guid-2', 'img', 'cmd', '/m', '/w', env as any, []);
-
-      const dispatchCommand = mockRun.mock.calls[0][0];
-      expect(dispatchCommand).toContain('UNITY_LICENSE');
-      expect(dispatchCommand).toContain('BUILD_TARGET');
-    });
-
-    it('throws when workflow dispatch fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('403 Forbidden'));
-
-      await expect(provider.runTaskInWorkflow('guid-err', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Failed to dispatch workflow',
-      );
-    });
-
-    it('throws when workflow run does not start within timeout', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch succeeds
-
-      // All 30 poll attempts fail
-      for (let i = 0; i < 30; i++) {
-        mockRun.mockRejectedValueOnce(new Error('not found'));
-      }
-
-      await expect(provider.runTaskInWorkflow('guid-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Workflow run did not start within',
-      );
-    });
-
-    it('throws when workflow run fails with non-success conclusion', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 300, status: 'in_progress' })); // run appears
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'failure' })); // fails
-
-      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Workflow run failed with conclusion: failure',
-      );
-    });
-
-    it('returns fallback message when log fetch fails', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 400, status: 'completed' })); // run appears
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // completes
-      mockRun.mockRejectedValueOnce(new Error('logs unavailable')); // log fetch fails
-
-      const result = await provider.runTaskInWorkflow('guid-nologs', 'img', 'cmd', '/m', '/w', [], []);
-
-      expect(result).toContain('completed successfully');
-      expect(result).toContain('logs unavailable');
-    });
-
-    it('handles cancelled workflow run conclusion', async () => {
-      mockRun.mockResolvedValueOnce(''); // dispatch
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 500, status: 'in_progress' })); // run
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'cancelled' })); // cancelled
-
-      await expect(provider.runTaskInWorkflow('guid-cancel', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Workflow run failed with conclusion: cancelled',
-      );
-    });
-
-    it('throws timeout error when polling exceeds maximum duration', async () => {
-      // Save real Date.now
-      const realDateNow = Date.now;
-      let callCount = 0;
-
-      // dispatch succeeds
-      mockRun.mockResolvedValueOnce('');
-      // run appears
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 600, status: 'in_progress' }));
-      // Status always returns in_progress
-      mockRun.mockImplementation(() => Promise.resolve(JSON.stringify({ status: 'in_progress' })));
-
-      // First call returns normal time, subsequent calls simulate 5 hours elapsed
-      Date.now = () => {
-        callCount++;
-        if (callCount <= 2) return realDateNow.call(Date);
-        return realDateNow.call(Date) + 14_400_001; // 4 hours + 1ms
-      };
-
-      try {
-        await expect(provider.runTaskInWorkflow('guid-poll-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-          'did not complete within 4 hours',
-        );
-
-        expect(core.error).toHaveBeenCalledWith(expect.stringContaining('did not complete within 4 hours'));
-      } finally {
-        Date.now = realDateNow;
-      }
-    });
-  });
-
-  describe('cleanupWorkflow', () => {
-    it('completes without error and logs cleanup message', async () => {
-      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
-    });
-  });
-
-  describe('garbageCollect', () => {
-    it('returns empty string (no-op)', async () => {
-      const result = await provider.garbageCollect('', false, 0, false, false);
-      expect(result).toBe('');
-    });
-  });
-
-  describe('listResources', () => {
-    it('returns runner names from the repository', async () => {
-      mockRun.mockResolvedValueOnce('runner-1\nrunner-2\nrunner-3\n');
-
-      const resources = await provider.listResources();
-
-      expect(resources).toHaveLength(3);
-      expect(resources[0].Name).toBe('runner-1');
-      expect(resources[1].Name).toBe('runner-2');
-      expect(resources[2].Name).toBe('runner-3');
-    });
-
-    it('returns empty array when repo or token is missing', async () => {
-      const params = createBuildParameters({ githubActionsRepo: '' });
-      provider = new GitHubActionsProvider(params);
-
-      const resources = await provider.listResources();
-      expect(resources).toEqual([]);
-      expect(mockRun).not.toHaveBeenCalled();
-    });
-
-    it('returns empty array when API call fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('API error'));
-
-      const resources = await provider.listResources();
-      expect(resources).toEqual([]);
-    });
-  });
-
-  describe('listWorkflow', () => {
-    it('returns recent workflow run names', async () => {
-      mockRun.mockResolvedValueOnce('Build Unity\nRun Tests\n');
-
-      const workflows = await provider.listWorkflow();
-
-      expect(workflows).toHaveLength(2);
-      expect(workflows[0].Name).toBe('Build Unity');
-      expect(workflows[1].Name).toBe('Run Tests');
-    });
-
-    it('returns empty array when credentials missing', async () => {
-      const params = createBuildParameters({ githubActionsToken: '' });
-      provider = new GitHubActionsProvider(params);
-
-      const workflows = await provider.listWorkflow();
-      expect(workflows).toEqual([]);
-    });
-  });
-
-  describe('watchWorkflow', () => {
-    it('returns message when no active run exists', async () => {
-      const result = await provider.watchWorkflow();
-      expect(result).toBe('No active run to watch');
-    });
-  });
-});
--- a/src/model/orchestrator/providers/github-actions/index.ts
+++ b/src/model/orchestrator/providers/github-actions/index.ts
@@ -1,284 +0,0 @@
-import * as core from '@actions/core';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import { ProviderInterface } from '../provider-interface';
-import OrchestratorSecret from '../../options/orchestrator-secret';
-import { ProviderResource } from '../provider-resource';
-import { ProviderWorkflow } from '../provider-workflow';
-
-const MAX_POLLING_DURATION_MS = 14_400_000; // 4 hours
-
-/**
- * GitHub Actions provider — triggers builds as workflow_dispatch events
- * on a target repository via the GitHub API.
- *
- * Use case: Distribute builds across orgs, use specialized runner pools,
- * or trigger builds in repos with Unity licenses.
- */
-class GitHubActionsProvider implements ProviderInterface {
-  private buildParameters: BuildParameters;
-  private repo: string;
-  private workflow: string;
-  private token: string;
-  private ref: string;
-  private runId: number = 0;
-
-  constructor(buildParameters: BuildParameters) {
-    this.buildParameters = buildParameters;
-    this.repo = buildParameters.githubActionsRepo || '';
-    this.workflow = buildParameters.githubActionsWorkflow || '';
-    this.token = buildParameters.githubActionsToken || '';
-    this.ref = buildParameters.githubActionsRef || 'main';
-  }
-
-  async setupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildGuid: string,
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[GitHubActions] Setting up workflow dispatch to ${this.repo}`);
-
-    if (!this.repo || !this.workflow) {
-      throw new Error('githubActionsRepo and githubActionsWorkflow are required for the github-actions provider');
-    }
-
-    if (!this.token) {
-      throw new Error('githubActionsToken is required (PAT with actions:write scope)');
-    }
-
-    // Verify repository and workflow exist
-    try {
-      const result = await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/workflows/${this.workflow} --jq '.id'`,
-      );
-      OrchestratorLogger.log(`[GitHubActions] Workflow verified: ${this.workflow} (ID: ${result.trim()})`);
-    } catch (error: any) {
-      throw new Error(`Failed to verify workflow ${this.workflow} in ${this.repo}: ${error.message || error}`);
-    }
-  }
-
-  async runTaskInWorkflow(
-    buildGuid: string,
-    image: string,
-    commands: string,
-    mountdir: string,
-    workingdir: string,
-    environment: OrchestratorEnvironmentVariable[],
-    // eslint-disable-next-line no-unused-vars
-    secrets: OrchestratorSecret[],
-  ): Promise<string> {
-    OrchestratorLogger.log(`[GitHubActions] Dispatching workflow ${this.workflow} on ${this.repo}@${this.ref}`);
-
-    // Build inputs payload
-    const inputs: Record<string, string> = {
-      buildGuid,
-      image,
-      commands: Buffer.from(commands).toString('base64'),
-      mountdir,
-      workingdir,
-    };
-
-    // Add environment variables as a JSON input
-    if (environment.length > 0) {
-      inputs.environment = JSON.stringify(environment.map((element) => ({ name: element.name, value: element.value })));
-    }
-
-    // Record the time before dispatch to identify the run
-    const beforeDispatch = new Date().toISOString();
-
-    // Dispatch the workflow
-    const inputsJson = JSON.stringify(inputs).replace(/'/g, "'\\''");
-    try {
-      await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/workflows/${this.workflow}/dispatches -X POST -f ref='${this.ref}' -f "inputs=${inputsJson}"`,
-      );
-      OrchestratorLogger.log(`[GitHubActions] Workflow dispatched`);
-    } catch (error: any) {
-      throw new Error(`Failed to dispatch workflow: ${error.message || error}`);
-    }
-
-    // Poll for the run to appear
-    OrchestratorLogger.log(`[GitHubActions] Waiting for workflow run to start...`);
-    let attempts = 0;
-    const maxAttempts = 30;
-
-    while (attempts < maxAttempts) {
-      attempts++;
-      await new Promise((resolve) => setTimeout(resolve, 10_000));
-
-      try {
-        const runsJson = await OrchestratorSystem.Run(
-          `GH_TOKEN=${this.token} gh api "repos/${this.repo}/actions/workflows/${this.workflow}/runs?created=>${beforeDispatch}&per_page=5" --jq '.workflow_runs[0] | {id, status, conclusion}'`,
-          true,
-        );
-
-        const run = JSON.parse(runsJson.trim());
-        if (run.id) {
-          this.runId = run.id;
-          OrchestratorLogger.log(`[GitHubActions] Run started: ${this.runId} (status: ${run.status})`);
-          break;
-        }
-      } catch {
-        // Run not yet available
-      }
-    }
-
-    if (!this.runId) {
-      throw new Error(`Workflow run did not start within ${maxAttempts * 10}s`);
-    }
-
-    // Poll until completion and stream logs (with maximum duration guard)
-    let status = 'in_progress';
-    const pollingStartTime = Date.now();
-    const runUrl = `https://github.com/${this.repo}/actions/runs/${this.runId}`;
-
-    while (status === 'in_progress' || status === 'queued') {
-      const elapsedMs = Date.now() - pollingStartTime;
-      if (elapsedMs >= MAX_POLLING_DURATION_MS) {
-        const hours = Math.round(MAX_POLLING_DURATION_MS / 3_600_000);
-        const message = `GitHub Actions workflow did not complete within ${hours} hours. Run URL: ${runUrl}`;
-        core.error(message);
-        throw new Error(message);
-      }
-
-      await new Promise((resolve) => setTimeout(resolve, 15_000));
-
-      try {
-        const statusJson = await OrchestratorSystem.Run(
-          `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runs/${this.runId} --jq '{status, conclusion}'`,
-          true,
-        );
-
-        const result = JSON.parse(statusJson.trim());
-        status = result.status;
-
-        if (status === 'completed') {
-          OrchestratorLogger.log(`[GitHubActions] Run ${this.runId} completed: ${result.conclusion}`);
-
-          if (result.conclusion !== 'success') {
-            throw new Error(`Workflow run failed with conclusion: ${result.conclusion}`);
-          }
-
-          break;
-        }
-
-        OrchestratorLogger.log(`[GitHubActions] Run ${this.runId} status: ${status}`);
-      } catch (error: any) {
-        if (error.message && error.message.includes('conclusion')) {
-          throw error;
-        }
-        if (error.message && error.message.includes('did not complete within')) {
-          throw error;
-        }
-        OrchestratorLogger.logWarning(`[GitHubActions] Status check error: ${error.message || error}`);
-      }
-    }
-
-    // Fetch logs
-    try {
-      const logs = await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh run view ${this.runId} --repo ${this.repo} --log`,
-        true,
-      );
-
-      return logs;
-    } catch {
-      return `Run ${this.runId} completed successfully (logs unavailable)`;
-    }
-  }
-
-  async cleanupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[GitHubActions] Cleanup complete (no resources to tear down)`);
-  }
-
-  async garbageCollect(
-    // eslint-disable-next-line no-unused-vars
-    filter: string,
-    // eslint-disable-next-line no-unused-vars
-    previewOnly: boolean,
-    // eslint-disable-next-line no-unused-vars
-    olderThan: Number,
-    // eslint-disable-next-line no-unused-vars
-    fullCache: boolean,
-    // eslint-disable-next-line no-unused-vars
-    baseDependencies: boolean,
-  ): Promise<string> {
-    return '';
-  }
-
-  async listResources(): Promise<ProviderResource[]> {
-    if (!this.repo || !this.token) return [];
-
-    try {
-      const runnersJson = await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runners --jq '.runners[] | .name'`,
-        true,
-      );
-
-      return runnersJson
-        .trim()
-        .split('\n')
-        .filter(Boolean)
-        .map((name) => {
-          const resource = new ProviderResource();
-          resource.Name = name.trim();
-
-          return resource;
-        });
-    } catch {
-      return [];
-    }
-  }
-
-  async listWorkflow(): Promise<ProviderWorkflow[]> {
-    if (!this.repo || !this.token) return [];
-
-    try {
-      const runsJson = await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runs?per_page=10 --jq '.workflow_runs[] | .name'`,
-        true,
-      );
-
-      return runsJson
-        .trim()
-        .split('\n')
-        .filter(Boolean)
-        .map((name) => {
-          const workflow = new ProviderWorkflow();
-          workflow.Name = name.trim();
-
-          return workflow;
-        });
-    } catch {
-      return [];
-    }
-  }
-
-  async watchWorkflow(): Promise<string> {
-    if (!this.runId) return 'No active run to watch';
-
-    try {
-      return await OrchestratorSystem.Run(
-        `GH_TOKEN=${this.token} gh run watch ${this.runId} --repo ${this.repo}`,
-        true,
-      );
-    } catch {
-      return '';
-    }
-  }
-}
-export default GitHubActionsProvider;
--- a/src/model/orchestrator/providers/gitlab-ci/gitlab-ci-provider.test.ts
+++ b/src/model/orchestrator/providers/gitlab-ci/gitlab-ci-provider.test.ts
@@ -1,329 +0,0 @@
-import GitLabCIProvider from '.';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import * as core from '@actions/core';
-
-jest.mock('../../services/core/orchestrator-system');
-jest.mock('../../services/core/orchestrator-logger');
-jest.mock('@actions/core', () => ({
-  info: jest.fn(),
-  warning: jest.fn(),
-  error: jest.fn(),
-  setOutput: jest.fn(),
-  getInput: jest.fn(() => ''),
-}));
-
-const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
-const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
-const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
-
-function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
-  return {
-    gitlabProjectId: 'my-group/my-project',
-    gitlabTriggerToken: 'glptt-test-token-456',
-    gitlabApiUrl: 'https://gitlab.example.com',
-    gitlabRef: 'main',
-    ...overrides,
-  } as BuildParameters;
-}
-
-// Override setTimeout to execute callbacks immediately so polling loops complete fast
-const originalSetTimeout = global.setTimeout;
-beforeAll(() => {
-  global.setTimeout = ((fn: (...args: any[]) => void, _ms?: number, ...args: any[]) => {
-    return originalSetTimeout(fn, 0, ...args);
-  }) as any;
-});
-afterAll(() => {
-  global.setTimeout = originalSetTimeout;
-});
-
-describe('GitLabCIProvider', () => {
-  let provider: GitLabCIProvider;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    provider = new GitLabCIProvider(createBuildParameters());
-  });
-
-  describe('constructor', () => {
-    it('strips trailing slashes from apiUrl', () => {
-      const params = createBuildParameters({ gitlabApiUrl: 'https://gitlab.example.com///' });
-      const p = new GitLabCIProvider(params);
-      expect(p).toBeDefined();
-    });
-
-    it('defaults apiUrl to https://gitlab.com when not provided', () => {
-      const params = createBuildParameters({ gitlabApiUrl: undefined });
-      const p = new GitLabCIProvider(params);
-      expect(p).toBeDefined();
-    });
-
-    it('defaults ref to main when not provided', () => {
-      const params = createBuildParameters({ gitlabRef: undefined });
-      const p = new GitLabCIProvider(params);
-      expect(p).toBeDefined();
-    });
-  });
-
-  describe('setupWorkflow', () => {
-    it('verifies project access via curl and logs success', async () => {
-      mockRun.mockResolvedValueOnce('');
-
-      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
-
-      expect(mockRun).toHaveBeenCalledTimes(1);
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('curl -sf');
-      expect(command).toContain('PRIVATE-TOKEN: glptt-test-token-456');
-      expect(command).toContain('gitlab.example.com/api/v4/projects/');
-      expect(command).toContain(encodeURIComponent('my-group/my-project'));
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Project access verified'));
-    });
-
-    it('throws when projectId is not configured', async () => {
-      const params = createBuildParameters({ gitlabProjectId: '' });
-      provider = new GitLabCIProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'gitlabProjectId and gitlabTriggerToken are required',
-      );
-    });
-
-    it('throws when triggerToken is not configured', async () => {
-      const params = createBuildParameters({ gitlabTriggerToken: '' });
-      provider = new GitLabCIProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'gitlabProjectId and gitlabTriggerToken are required',
-      );
-    });
-
-    it('throws descriptive error when project access check fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('401 Unauthorized'));
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'Failed to access GitLab project my-group/my-project',
-      );
-    });
-  });
-
-  describe('runTaskInWorkflow', () => {
-    it('triggers pipeline and returns job logs on success', async () => {
-      // Pipeline trigger response
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5001, status: 'pending' }));
-      // Status poll returns success
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
-      // Jobs list
-      mockRun.mockResolvedValueOnce(
-        JSON.stringify([
-          { id: 10001, name: 'build-unity', status: 'success' },
-          { id: 10002, name: 'test-unity', status: 'success' },
-        ]),
-      );
-      // Job traces
-      mockRun.mockResolvedValueOnce('Building Unity project...\nDone.');
-      mockRun.mockResolvedValueOnce('Running tests...\nAll passed.');
-
-      const result = await provider.runTaskInWorkflow(
-        'guid-gl1',
-        'unityci/editor:2021.3',
-        'echo build',
-        '/mount',
-        '/work',
-        [],
-        [],
-      );
-
-      expect(result).toContain('build-unity');
-      expect(result).toContain('test-unity');
-      expect(result).toContain('Building Unity project');
-      expect(result).toContain('Running tests');
-
-      // Verify trigger command
-      const triggerCommand = mockRun.mock.calls[0][0];
-      expect(triggerCommand).toContain('trigger/pipeline');
-      expect(triggerCommand).toContain(`token=${createBuildParameters().gitlabTriggerToken}`);
-      expect(triggerCommand).toContain('ref=main');
-    });
-
-    it('passes build variables including base64-encoded commands', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5002, status: 'success' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify([]));
-
-      await provider.runTaskInWorkflow(
-        'guid-vars',
-        'ubuntu:20.04',
-        'make build',
-        '/mnt/data',
-        '/workspace',
-        [{ name: 'UNITY_VERSION', value: '2021.3.1f1' } as any],
-        [],
-      );
-
-      const triggerCommand = mockRun.mock.calls[0][0];
-      const expectedB64 = Buffer.from('make build').toString('base64');
-      expect(triggerCommand).toContain(`variables[BUILD_COMMANDS]=${expectedB64}`);
-      expect(triggerCommand).toContain('variables[BUILD_GUID]=guid-vars');
-      expect(triggerCommand).toContain('variables[BUILD_IMAGE]=ubuntu:20.04');
-      expect(triggerCommand).toContain('variables[MOUNT_DIR]=/mnt/data');
-      expect(triggerCommand).toContain('variables[WORKING_DIR]=/workspace');
-      expect(triggerCommand).toContain('variables[UNITY_VERSION]=2021.3.1f1');
-    });
-
-    it('throws when pipeline trigger fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('404 Not Found'));
-
-      await expect(provider.runTaskInWorkflow('guid-err', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Failed to trigger pipeline',
-      );
-    });
-
-    it('throws when pipeline finishes with failure status', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5003, status: 'pending' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'failed' }));
-
-      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Pipeline 5003 finished with status: failed',
-      );
-    });
-
-    it('throws when pipeline is canceled', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5004, status: 'pending' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'canceled' }));
-
-      await expect(provider.runTaskInWorkflow('guid-cancel', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Pipeline 5004 finished with status: canceled',
-      );
-    });
-
-    it('handles job log fetch failures gracefully', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5005, status: 'success' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify([{ id: 20001, name: 'build', status: 'success' }]));
-      // Job trace fetch fails
-      mockRun.mockRejectedValueOnce(new Error('trace unavailable'));
-
-      const result = await provider.runTaskInWorkflow('guid-nologs', 'img', 'cmd', '/m', '/w', [], []);
-
-      expect(result).toContain('build');
-      expect(result).toContain('logs unavailable');
-    });
-
-    it('returns fallback message when entire job fetch fails', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5006, status: 'success' }));
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
-      // Jobs list fails
-      mockRun.mockRejectedValueOnce(new Error('API error'));
-
-      const result = await provider.runTaskInWorkflow('guid-noapi', 'img', 'cmd', '/m', '/w', [], []);
-
-      expect(result).toContain('Pipeline 5006 completed successfully');
-      expect(result).toContain('logs unavailable');
-    });
-
-    it('continues polling through status check errors until completion', async () => {
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5007, status: 'pending' }));
-      // First status check fails
-      mockRun.mockRejectedValueOnce(new Error('network blip'));
-      // Second status check succeeds
-      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
-      // Jobs/logs
-      mockRun.mockResolvedValueOnce(JSON.stringify([]));
-
-      await provider.runTaskInWorkflow('guid-retry', 'img', 'cmd', '/m', '/w', [], []);
-
-      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Status check error'));
-    });
-
-    it('throws timeout error when polling exceeds maximum duration', async () => {
-      const realDateNow = Date.now;
-      let callCount = 0;
-
-      // Trigger pipeline succeeds
-      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5008, status: 'running' }));
-      // Status always returns running
-      mockRun.mockImplementation(() => Promise.resolve(JSON.stringify({ status: 'running' })));
-
-      // After first call, simulate 5 hours elapsed
-      Date.now = () => {
-        callCount++;
-        if (callCount <= 1) return realDateNow.call(Date);
-        return realDateNow.call(Date) + 14_400_001; // 4 hours + 1ms
-      };
-
-      try {
-        await expect(provider.runTaskInWorkflow('guid-poll-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-          'did not complete within 4 hours',
-        );
-
-        expect(core.error).toHaveBeenCalledWith(expect.stringContaining('did not complete within 4 hours'));
-      } finally {
-        Date.now = realDateNow;
-      }
-    });
-  });
-
-  describe('cleanupWorkflow', () => {
-    it('completes without error and logs cleanup message', async () => {
-      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
-    });
-  });
-
-  describe('garbageCollect', () => {
-    it('returns empty string (no-op)', async () => {
-      const result = await provider.garbageCollect('', false, 0, false, false);
-      expect(result).toBe('');
-    });
-  });
-
-  describe('listResources', () => {
-    it('returns empty array (not implemented)', async () => {
-      const resources = await provider.listResources();
-      expect(resources).toEqual([]);
-    });
-  });
-
-  describe('listWorkflow', () => {
-    it('returns recent pipeline names when credentials are available', async () => {
-      mockRun.mockResolvedValueOnce(
-        JSON.stringify([
-          { id: 100, status: 'success' },
-          { id: 101, status: 'failed' },
-        ]),
-      );
-
-      const workflows = await provider.listWorkflow();
-
-      expect(workflows).toHaveLength(2);
-      expect(workflows[0].Name).toBe('Pipeline #100 (success)');
-      expect(workflows[1].Name).toBe('Pipeline #101 (failed)');
-    });
-
-    it('returns empty array when credentials are missing', async () => {
-      const params = createBuildParameters({ gitlabProjectId: '' });
-      provider = new GitLabCIProvider(params);
-
-      const workflows = await provider.listWorkflow();
-      expect(workflows).toEqual([]);
-      expect(mockRun).not.toHaveBeenCalled();
-    });
-
-    it('returns empty array when API call fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('API error'));
-
-      const workflows = await provider.listWorkflow();
-      expect(workflows).toEqual([]);
-    });
-  });
-
-  describe('watchWorkflow', () => {
-    it('returns empty string (not implemented)', async () => {
-      const result = await provider.watchWorkflow();
-      expect(result).toBe('');
-    });
-  });
-});
--- a/src/model/orchestrator/providers/gitlab-ci/index.ts
+++ b/src/model/orchestrator/providers/gitlab-ci/index.ts
@@ -1,224 +0,0 @@
-import * as core from '@actions/core';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import { ProviderInterface } from '../provider-interface';
-import OrchestratorSecret from '../../options/orchestrator-secret';
-import { ProviderResource } from '../provider-resource';
-import { ProviderWorkflow } from '../provider-workflow';
-
-const MAX_POLLING_DURATION_MS = 14_400_000; // 4 hours
-
-/**
- * GitLab CI provider — triggers builds as GitLab CI pipelines
- * via the GitLab API.
- *
- * Use case: Teams using GitLab CI, hybrid GitHub/GitLab setups,
- * or GitLab runners with Unity licenses.
- */
-class GitLabCIProvider implements ProviderInterface {
-  private buildParameters: BuildParameters;
-  private projectId: string;
-  private triggerToken: string;
-  private apiUrl: string;
-  private ref: string;
-  private pipelineId: number = 0;
-
-  constructor(buildParameters: BuildParameters) {
-    this.buildParameters = buildParameters;
-    this.projectId = buildParameters.gitlabProjectId || '';
-    this.triggerToken = buildParameters.gitlabTriggerToken || '';
-    this.apiUrl = (buildParameters.gitlabApiUrl || 'https://gitlab.com').replace(/\/+$/, '');
-    this.ref = buildParameters.gitlabRef || 'main';
-  }
-
-  async setupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildGuid: string,
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[GitLabCI] Setting up pipeline trigger for project ${this.projectId}`);
-
-    if (!this.projectId || !this.triggerToken) {
-      throw new Error('gitlabProjectId and gitlabTriggerToken are required for the gitlab-ci provider');
-    }
-
-    // Verify project access
-    const encodedProject = encodeURIComponent(this.projectId);
-    try {
-      await OrchestratorSystem.Run(
-        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}" -o /dev/null`,
-      );
-      OrchestratorLogger.log(`[GitLabCI] Project access verified`);
-    } catch (error: any) {
-      throw new Error(`Failed to access GitLab project ${this.projectId}: ${error.message || error}`);
-    }
-  }
-
-  async runTaskInWorkflow(
-    buildGuid: string,
-    image: string,
-    commands: string,
-    mountdir: string,
-    workingdir: string,
-    environment: OrchestratorEnvironmentVariable[],
-    // eslint-disable-next-line no-unused-vars
-    secrets: OrchestratorSecret[],
-  ): Promise<string> {
-    OrchestratorLogger.log(`[GitLabCI] Triggering pipeline on project ${this.projectId}@${this.ref}`);
-
-    const encodedProject = encodeURIComponent(this.projectId);
-
-    // Build variables for the pipeline
-    const pipelineVariables: string[] = [
-      `-f "variables[BUILD_GUID]=${buildGuid}"`,
-      `-f "variables[BUILD_IMAGE]=${image}"`,
-      `-f "variables[BUILD_COMMANDS]=${Buffer.from(commands).toString('base64')}"`,
-      `-f "variables[MOUNT_DIR]=${mountdir}"`,
-      `-f "variables[WORKING_DIR]=${workingdir}"`,
-    ];
-
-    for (const element of environment) {
-      pipelineVariables.push(`-f "variables[${element.name}]=${element.value}"`);
-    }
-
-    // Trigger pipeline
-    try {
-      const response = await OrchestratorSystem.Run(
-        `curl -sf -X POST "${this.apiUrl}/api/v4/projects/${encodedProject}/trigger/pipeline" -f "token=${
-          this.triggerToken
-        }" -f "ref=${this.ref}" ${pipelineVariables.join(' ')}`,
-      );
-
-      const pipeline = JSON.parse(response);
-      this.pipelineId = pipeline.id;
-      OrchestratorLogger.log(`[GitLabCI] Pipeline triggered: ${this.pipelineId} (status: ${pipeline.status})`);
-    } catch (error: any) {
-      throw new Error(`Failed to trigger pipeline: ${error.message || error}`);
-    }
-
-    // Poll until completion (with maximum duration guard)
-    let status = 'pending';
-    const terminalStatuses = new Set(['success', 'failed', 'canceled', 'skipped']);
-    const pollingStartTime = Date.now();
-    const pipelineUrl = `${this.apiUrl}/${this.projectId}/-/pipelines/${this.pipelineId}`;
-
-    while (!terminalStatuses.has(status)) {
-      const elapsedMs = Date.now() - pollingStartTime;
-      if (elapsedMs >= MAX_POLLING_DURATION_MS) {
-        const hours = Math.round(MAX_POLLING_DURATION_MS / 3_600_000);
-        const message = `GitLab CI pipeline did not complete within ${hours} hours. Pipeline URL: ${pipelineUrl}`;
-        core.error(message);
-        throw new Error(message);
-      }
-
-      await new Promise((resolve) => setTimeout(resolve, 15_000));
-
-      try {
-        const statusResponse = await OrchestratorSystem.Run(
-          `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines/${this.pipelineId}"`,
-          true,
-        );
-
-        const pipelineStatus = JSON.parse(statusResponse);
-        status = pipelineStatus.status;
-        OrchestratorLogger.log(`[GitLabCI] Pipeline ${this.pipelineId} status: ${status}`);
-      } catch (error: any) {
-        OrchestratorLogger.logWarning(`[GitLabCI] Status check error: ${error.message || error}`);
-      }
-    }
-
-    if (status !== 'success') {
-      throw new Error(`Pipeline ${this.pipelineId} finished with status: ${status}`);
-    }
-
-    // Fetch job logs
-    try {
-      const jobsResponse = await OrchestratorSystem.Run(
-        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines/${this.pipelineId}/jobs"`,
-        true,
-      );
-
-      const jobs = JSON.parse(jobsResponse);
-      const logs: string[] = [];
-
-      for (const job of jobs) {
-        try {
-          const jobLog = await OrchestratorSystem.Run(
-            `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/jobs/${job.id}/trace"`,
-            true,
-          );
-          logs.push(`=== Job: ${job.name} (${job.status}) ===\n${jobLog}`);
-        } catch {
-          logs.push(`=== Job: ${job.name} (${job.status}) === (logs unavailable)`);
-        }
-      }
-
-      return logs.join('\n\n');
-    } catch {
-      return `Pipeline ${this.pipelineId} completed successfully (logs unavailable)`;
-    }
-  }
-
-  async cleanupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[GitLabCI] Cleanup complete`);
-  }
-
-  async garbageCollect(
-    // eslint-disable-next-line no-unused-vars
-    filter: string,
-    // eslint-disable-next-line no-unused-vars
-    previewOnly: boolean,
-    // eslint-disable-next-line no-unused-vars
-    olderThan: Number,
-    // eslint-disable-next-line no-unused-vars
-    fullCache: boolean,
-    // eslint-disable-next-line no-unused-vars
-    baseDependencies: boolean,
-  ): Promise<string> {
-    return '';
-  }
-
-  async listResources(): Promise<ProviderResource[]> {
-    return [];
-  }
-
-  async listWorkflow(): Promise<ProviderWorkflow[]> {
-    if (!this.projectId || !this.triggerToken) return [];
-
-    try {
-      const encodedProject = encodeURIComponent(this.projectId);
-      const response = await OrchestratorSystem.Run(
-        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines?per_page=10"`,
-        true,
-      );
-
-      return JSON.parse(response).map((pipeline: any) => {
-        const workflow = new ProviderWorkflow();
-        workflow.Name = `Pipeline #${pipeline.id} (${pipeline.status})`;
-
-        return workflow;
-      });
-    } catch {
-      return [];
-    }
-  }
-
-  async watchWorkflow(): Promise<string> {
-    return '';
-  }
-}
-export default GitLabCIProvider;
--- a/src/model/orchestrator/providers/provider-selection.test.ts
+++ b/src/model/orchestrator/providers/provider-selection.test.ts
@@ -1,164 +0,0 @@
-import BuildParameters from '../../build-parameters';
-import RemotePowershellProvider from './remote-powershell';
-import GitHubActionsProvider from './github-actions';
-import GitLabCIProvider from './gitlab-ci';
-import AnsibleProvider from './ansible';
-
-/**
- * Tests for provider selection logic in Orchestrator.setProvider.
- *
- * These tests verify that the correct provider class is instantiated based on
- * the providerStrategy field in BuildParameters. Rather than invoking the full
- * Orchestrator.setProvider (which has heavy dependencies on OrchestratorOptions,
- * AWS detection, etc.), we test the provider constructors directly to verify
- * they produce the right provider type from the same build parameters the
- * orchestrator switch statement uses.
- */
-describe('Provider Selection', () => {
-  describe('remote-powershell provider', () => {
-    it('creates RemotePowershellProvider from build parameters', () => {
-      const params = {
-        providerStrategy: 'remote-powershell',
-        remotePowershellHost: 'build-server.local',
-        remotePowershellTransport: 'wsman',
-        remotePowershellCredential: 'user:pass',
-      } as BuildParameters;
-
-      const provider = new RemotePowershellProvider(params);
-
-      expect(provider).toBeInstanceOf(RemotePowershellProvider);
-      expect(provider.constructor.name).toBe('RemotePowershellProvider');
-    });
-  });
-
-  describe('github-actions provider', () => {
-    it('creates GitHubActionsProvider from build parameters', () => {
-      const params = {
-        providerStrategy: 'github-actions',
-        githubActionsRepo: 'org/repo',
-        githubActionsWorkflow: 'ci.yml',
-        githubActionsToken: 'ghp_token',
-        githubActionsRef: 'main',
-      } as BuildParameters;
-
-      const provider = new GitHubActionsProvider(params);
-
-      expect(provider).toBeInstanceOf(GitHubActionsProvider);
-      expect(provider.constructor.name).toBe('GitHubActionsProvider');
-    });
-  });
-
-  describe('gitlab-ci provider', () => {
-    it('creates GitLabCIProvider from build parameters', () => {
-      const params = {
-        providerStrategy: 'gitlab-ci',
-        gitlabProjectId: 'group/project',
-        gitlabTriggerToken: 'glptt-token',
-        gitlabApiUrl: 'https://gitlab.com',
-        gitlabRef: 'main',
-      } as BuildParameters;
-
-      const provider = new GitLabCIProvider(params);
-
-      expect(provider).toBeInstanceOf(GitLabCIProvider);
-      expect(provider.constructor.name).toBe('GitLabCIProvider');
-    });
-  });
-
-  describe('ansible provider', () => {
-    it('creates AnsibleProvider from build parameters', () => {
-      const params = {
-        providerStrategy: 'ansible',
-        ansibleInventory: '/etc/ansible/hosts',
-        ansiblePlaybook: '/playbooks/build.yml',
-        ansibleExtraVars: '',
-        ansibleVaultPassword: '',
-      } as BuildParameters;
-
-      const provider = new AnsibleProvider(params);
-
-      expect(provider).toBeInstanceOf(AnsibleProvider);
-      expect(provider.constructor.name).toBe('AnsibleProvider');
-    });
-  });
-
-  describe('provider strategy routing', () => {
-    it('each provider strategy maps to a distinct provider class', () => {
-      const strategies: Record<string, new (params: BuildParameters) => any> = {
-        'remote-powershell': RemotePowershellProvider,
-        'github-actions': GitHubActionsProvider,
-        'gitlab-ci': GitLabCIProvider,
-        ansible: AnsibleProvider,
-      };
-
-      const params = {
-        remotePowershellHost: 'host',
-        remotePowershellTransport: 'wsman',
-        remotePowershellCredential: '',
-        githubActionsRepo: 'org/repo',
-        githubActionsWorkflow: 'ci.yml',
-        githubActionsToken: 'token',
-        githubActionsRef: 'main',
-        gitlabProjectId: 'proj',
-        gitlabTriggerToken: 'tok',
-        gitlabApiUrl: 'https://gitlab.com',
-        gitlabRef: 'main',
-        ansibleInventory: '/inv',
-        ansiblePlaybook: '/pb.yml',
-        ansibleExtraVars: '',
-        ansibleVaultPassword: '',
-      } as BuildParameters;
-
-      const instances = Object.entries(strategies).map(([strategy, ProviderClass]) => {
-        const provider = new ProviderClass(params);
-        return { strategy, className: provider.constructor.name };
-      });
-
-      // Verify all four strategies produce different provider classes
-      const classNames = instances.map((i) => i.className);
-      const uniqueClassNames = new Set(classNames);
-      expect(uniqueClassNames.size).toBe(4);
-
-      // Verify expected mapping
-      expect(instances.find((i) => i.strategy === 'remote-powershell')!.className).toBe('RemotePowershellProvider');
-      expect(instances.find((i) => i.strategy === 'github-actions')!.className).toBe('GitHubActionsProvider');
-      expect(instances.find((i) => i.strategy === 'gitlab-ci')!.className).toBe('GitLabCIProvider');
-      expect(instances.find((i) => i.strategy === 'ansible')!.className).toBe('AnsibleProvider');
-    });
-
-    it('all providers implement ProviderInterface methods', () => {
-      const params = {
-        remotePowershellHost: 'host',
-        githubActionsRepo: 'org/repo',
-        githubActionsWorkflow: 'ci.yml',
-        githubActionsToken: 'token',
-        gitlabProjectId: 'proj',
-        gitlabTriggerToken: 'tok',
-        ansibleInventory: '/inv',
-      } as BuildParameters;
-
-      const providers = [
-        new RemotePowershellProvider(params),
-        new GitHubActionsProvider(params),
-        new GitLabCIProvider(params),
-        new AnsibleProvider(params),
-      ];
-
-      const requiredMethods = [
-        'setupWorkflow',
-        'runTaskInWorkflow',
-        'cleanupWorkflow',
-        'garbageCollect',
-        'listResources',
-        'listWorkflow',
-        'watchWorkflow',
-      ];
-
-      for (const provider of providers) {
-        for (const method of requiredMethods) {
-          expect(typeof (provider as any)[method]).toBe('function');
-        }
-      }
-    });
-  });
-});
--- a/src/model/orchestrator/providers/remote-powershell/index.ts
+++ b/src/model/orchestrator/providers/remote-powershell/index.ts
@@ -1,166 +0,0 @@
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-import { ProviderInterface } from '../provider-interface';
-import OrchestratorSecret from '../../options/orchestrator-secret';
-import { ProviderResource } from '../provider-resource';
-import { ProviderWorkflow } from '../provider-workflow';
-
-/**
- * Remote PowerShell provider — executes Unity builds on remote machines
- * via PowerShell Remoting (WinRM or SSH).
- *
- * Use case: Teams with dedicated build machines not part of a CI system.
- */
-class RemotePowershellProvider implements ProviderInterface {
-  private buildParameters: BuildParameters;
-  private host: string;
-  private transport: string;
-  private credential: string;
-  private sessionId: string = '';
-
-  constructor(buildParameters: BuildParameters) {
-    this.buildParameters = buildParameters;
-    this.host = buildParameters.remotePowershellHost || '';
-    this.transport = buildParameters.remotePowershellTransport || 'wsman';
-    this.credential = buildParameters.remotePowershellCredential || '';
-  }
-
-  async setupWorkflow(
-    buildGuid: string,
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[RemotePowershell] Setting up remote session to ${this.host} via ${this.transport}`);
-
-    if (!this.host) {
-      throw new Error('remotePowershellHost is required for the remote-powershell provider');
-    }
-
-    // Test connectivity
-    const testCommand = this.buildPwshCommand(`Test-WSMan -ComputerName "${this.host}" -ErrorAction Stop`);
-    try {
-      await OrchestratorSystem.Run(testCommand);
-      OrchestratorLogger.log(`[RemotePowershell] Connection test passed`);
-    } catch (error: any) {
-      throw new Error(`Failed to connect to remote host ${this.host}: ${error.message || error}`);
-    }
-
-    this.sessionId = buildGuid;
-    OrchestratorLogger.log(`[RemotePowershell] Session ${this.sessionId} ready`);
-  }
-
-  async runTaskInWorkflow(
-    buildGuid: string,
-    image: string,
-    commands: string,
-    mountdir: string,
-    workingdir: string,
-    environment: OrchestratorEnvironmentVariable[],
-    secrets: OrchestratorSecret[],
-  ): Promise<string> {
-    OrchestratorLogger.log(`[RemotePowershell] Executing task on ${this.host}`);
-
-    // Build environment variable block for remote session
-    const environmentBlock = environment.map((element) => `$env:${element.name} = '${element.value}'`).join('; ');
-
-    const secretBlock = secrets
-      .map((secret) => `$env:${secret.EnvironmentVariable} = '${secret.ParameterValue}'`)
-      .join('; ');
-
-    // Wrap commands for remote execution
-    const remoteScript = [environmentBlock, secretBlock, `Set-Location "${workingdir}"`, commands]
-      .filter(Boolean)
-      .join('; ');
-
-    const invokeCommand = this.buildInvokeCommand(remoteScript);
-
-    try {
-      const output = await OrchestratorSystem.Run(invokeCommand);
-      OrchestratorLogger.log(`[RemotePowershell] Task completed successfully`);
-
-      return output;
-    } catch (error: any) {
-      OrchestratorLogger.logWarning(`[RemotePowershell] Task failed: ${error.message || error}`);
-      throw error;
-    }
-  }
-
-  async cleanupWorkflow(
-    // eslint-disable-next-line no-unused-vars
-    buildParameters: BuildParameters,
-    // eslint-disable-next-line no-unused-vars
-    branchName: string,
-    // eslint-disable-next-line no-unused-vars
-    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
-  ): Promise<void> {
-    OrchestratorLogger.log(`[RemotePowershell] Cleaning up session ${this.sessionId}`);
-
-    // Remote sessions are stateless per invocation — no cleanup needed
-  }
-
-  async garbageCollect(
-    // eslint-disable-next-line no-unused-vars
-    filter: string,
-    // eslint-disable-next-line no-unused-vars
-    previewOnly: boolean,
-    // eslint-disable-next-line no-unused-vars
-    olderThan: Number,
-    // eslint-disable-next-line no-unused-vars
-    fullCache: boolean,
-    // eslint-disable-next-line no-unused-vars
-    baseDependencies: boolean,
-  ): Promise<string> {
-    OrchestratorLogger.log(`[RemotePowershell] Garbage collection not supported for remote PowerShell provider`);
-
-    return '';
-  }
-
-  async listResources(): Promise<ProviderResource[]> {
-    const resource = new ProviderResource();
-    resource.Name = this.host;
-
-    return [resource];
-  }
-
-  async listWorkflow(): Promise<ProviderWorkflow[]> {
-    return [];
-  }
-
-  async watchWorkflow(): Promise<string> {
-    return '';
-  }
-
-  private buildPwshCommand(script: string): string {
-    return `pwsh -NoProfile -NonInteractive -Command "${script.replace(/"/g, '\\"')}"`;
-  }
-
-  private buildInvokeCommand(remoteScript: string): string {
-    const escapedScript = remoteScript.replace(/"/g, '\\"').replace(/'/g, "''");
-
-    if (this.transport === 'ssh') {
-      return `pwsh -NoProfile -NonInteractive -Command "Invoke-Command -HostName '${this.host}' -ScriptBlock { ${escapedScript} }"`;
-    }
-
-    // WinRM (default)
-    // Split on the FIRST colon only — passwords may contain colons
-    let credentialPart = '';
-    if (this.credential) {
-      const colonIndex = this.credential.indexOf(':');
-      if (colonIndex === -1) {
-        throw new Error('remotePowershellCredential must be in "username:password" format (no colon found)');
-      }
-      const user = this.credential.substring(0, colonIndex);
-      const pass = this.credential.substring(colonIndex + 1);
-      credentialPart = `-Credential (New-Object PSCredential('${user}', (ConvertTo-SecureString '${pass}' -AsPlainText -Force)))`;
-    }
-
-    return `pwsh -NoProfile -NonInteractive -Command "Invoke-Command -ComputerName '${this.host}' ${credentialPart} -ScriptBlock { ${escapedScript} }"`;
-  }
-}
-export default RemotePowershellProvider;
--- a/src/model/orchestrator/providers/remote-powershell/remote-powershell-provider.test.ts
+++ b/src/model/orchestrator/providers/remote-powershell/remote-powershell-provider.test.ts
@@ -1,264 +0,0 @@
-import RemotePowershellProvider from '.';
-import BuildParameters from '../../../build-parameters';
-import { OrchestratorSystem } from '../../services/core/orchestrator-system';
-import OrchestratorLogger from '../../services/core/orchestrator-logger';
-
-jest.mock('../../services/core/orchestrator-system');
-jest.mock('../../services/core/orchestrator-logger');
-
-const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
-const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
-const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
-
-function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
-  return {
-    remotePowershellHost: 'build-server-01.internal',
-    remotePowershellTransport: 'wsman',
-    remotePowershellCredential: 'admin:P@ssw0rd!',
-    ...overrides,
-  } as BuildParameters;
-}
-
-describe('RemotePowershellProvider', () => {
-  let provider: RemotePowershellProvider;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    provider = new RemotePowershellProvider(createBuildParameters());
-  });
-
-  describe('constructor', () => {
-    it('defaults transport to wsman when not specified', () => {
-      const params = createBuildParameters({ remotePowershellTransport: undefined });
-      const p = new RemotePowershellProvider(params);
-      expect(p).toBeDefined();
-    });
-
-    it('accepts ssh transport', () => {
-      const params = createBuildParameters({ remotePowershellTransport: 'ssh' });
-      const p = new RemotePowershellProvider(params);
-      expect(p).toBeDefined();
-    });
-  });
-
-  describe('setupWorkflow', () => {
-    it('tests WinRM connectivity via Test-WSMan and logs success', async () => {
-      mockRun.mockResolvedValueOnce('wsman output');
-
-      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
-
-      expect(mockRun).toHaveBeenCalledTimes(1);
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('pwsh -NoProfile -NonInteractive');
-      expect(command).toContain('Test-WSMan');
-      expect(command).toContain('build-server-01.internal');
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Connection test passed'));
-    });
-
-    it('sets session ID to the build GUID', async () => {
-      mockRun.mockResolvedValueOnce('');
-
-      await provider.setupWorkflow('my-build-guid', createBuildParameters(), 'main', []);
-
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('my-build-guid'));
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ready'));
-    });
-
-    it('throws when host is not configured', async () => {
-      const params = createBuildParameters({ remotePowershellHost: '' });
-      provider = new RemotePowershellProvider(params);
-
-      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
-        'remotePowershellHost is required',
-      );
-    });
-
-    it('throws descriptive error when connectivity test fails', async () => {
-      mockRun.mockRejectedValueOnce(new Error('WinRM service not running'));
-
-      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
-        'Failed to connect to remote host build-server-01.internal',
-      );
-    });
-  });
-
-  describe('runTaskInWorkflow', () => {
-    it('constructs WinRM Invoke-Command with credential and returns output', async () => {
-      mockRun.mockResolvedValueOnce('Build succeeded!');
-
-      const result = await provider.runTaskInWorkflow(
-        'guid-run1',
-        'unused-image',
-        'Unity.exe -batchmode -buildTarget Win64',
-        '/mount',
-        'C:\\Projects\\MyGame',
-        [],
-        [],
-      );
-
-      expect(result).toBe('Build succeeded!');
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('pwsh -NoProfile -NonInteractive');
-      expect(command).toContain("Invoke-Command -ComputerName 'build-server-01.internal'");
-      expect(command).toContain('-Credential');
-      expect(command).toContain('New-Object PSCredential');
-      expect(command).toContain('-ScriptBlock');
-      expect(command).toContain('Set-Location');
-    });
-
-    it('constructs SSH Invoke-Command when transport is ssh', async () => {
-      const params = createBuildParameters({ remotePowershellTransport: 'ssh' });
-      provider = new RemotePowershellProvider(params);
-      mockRun.mockResolvedValueOnce('SSH build output');
-
-      const result = await provider.runTaskInWorkflow('guid-ssh', 'img', 'build', '/m', '/w', [], []);
-
-      expect(result).toBe('SSH build output');
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain("Invoke-Command -HostName 'build-server-01.internal'");
-      expect(command).not.toContain('-ComputerName');
-      expect(command).not.toContain('-Credential');
-    });
-
-    it('includes environment variables in the remote script block', async () => {
-      mockRun.mockResolvedValueOnce('output');
-
-      const env = [
-        { name: 'UNITY_LICENSE', value: 'license-data-abc' },
-        { name: 'BUILD_TARGET', value: 'StandaloneWindows64' },
-      ];
-
-      await provider.runTaskInWorkflow('guid-env', 'img', 'build-cmd', '/m', '/w', env as any, []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('$env:UNITY_LICENSE');
-      expect(command).toContain('$env:BUILD_TARGET');
-    });
-
-    it('includes secrets in the remote script block', async () => {
-      mockRun.mockResolvedValueOnce('output');
-
-      const secrets = [{ ParameterKey: 'key1', EnvironmentVariable: 'SECRET_KEY', ParameterValue: 'secret-val-123' }];
-
-      await provider.runTaskInWorkflow('guid-sec', 'img', 'build-cmd', '/m', '/w', [], secrets as any);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('$env:SECRET_KEY');
-    });
-
-    it('does not include credential in plaintext log output when using WinRM', async () => {
-      mockRun.mockResolvedValueOnce('output');
-
-      await provider.runTaskInWorkflow('guid-cred', 'img', 'cmd', '/m', '/w', [], []);
-
-      // The credential is used via ConvertTo-SecureString, not logged directly
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('ConvertTo-SecureString');
-      expect(command).toContain('-AsPlainText -Force');
-    });
-
-    it('omits credential part when no credential is configured (WinRM)', async () => {
-      const params = createBuildParameters({ remotePowershellCredential: '' });
-      provider = new RemotePowershellProvider(params);
-      mockRun.mockResolvedValueOnce('output');
-
-      await provider.runTaskInWorkflow('guid-nocred', 'img', 'cmd', '/m', '/w', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain("Invoke-Command -ComputerName 'build-server-01.internal'");
-      expect(command).not.toContain('-Credential');
-      expect(command).not.toContain('PSCredential');
-    });
-
-    it('throws and logs warning when remote execution fails', async () => {
-      const execError = new Error('Remote execution failed: access denied');
-      mockRun.mockRejectedValueOnce(execError);
-
-      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'Remote execution failed',
-      );
-
-      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Task failed'));
-    });
-
-    it('preserves passwords containing colons when splitting credentials', async () => {
-      const params = createBuildParameters({
-        remotePowershellCredential: 'admin:P@ss:w0rd:with:colons!',
-      });
-      provider = new RemotePowershellProvider(params);
-      mockRun.mockResolvedValueOnce('output');
-
-      await provider.runTaskInWorkflow('guid-colon', 'img', 'cmd', '/m', '/w', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain("PSCredential('admin'");
-      expect(command).toContain("ConvertTo-SecureString 'P@ss:w0rd:with:colons!'");
-    });
-
-    it('throws when credential has no colon separator', async () => {
-      const params = createBuildParameters({
-        remotePowershellCredential: 'nocolonhere',
-      });
-      provider = new RemotePowershellProvider(params);
-
-      await expect(provider.runTaskInWorkflow('guid-badcred', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
-        'username:password',
-      );
-    });
-
-    it('sets working directory in the remote script', async () => {
-      mockRun.mockResolvedValueOnce('output');
-
-      await provider.runTaskInWorkflow('guid-wd', 'img', 'cmd', '/m', 'D:\\Builds\\Project', [], []);
-
-      const command = mockRun.mock.calls[0][0];
-      expect(command).toContain('Set-Location');
-      expect(command).toContain('D:\\Builds\\Project');
-    });
-  });
-
-  describe('cleanupWorkflow', () => {
-    it('completes without error and logs session cleanup', async () => {
-      // Setup first to set sessionId
-      mockRun.mockResolvedValueOnce('');
-      await provider.setupWorkflow('guid-cleanup', createBuildParameters(), 'main', []);
-
-      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
-
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleaning up session'));
-    });
-  });
-
-  describe('garbageCollect', () => {
-    it('returns empty string and logs not-supported message', async () => {
-      const result = await provider.garbageCollect('', false, 0, false, false);
-      expect(result).toBe('');
-      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('not supported'));
-    });
-  });
-
-  describe('listResources', () => {
-    it('returns the configured host as a resource', async () => {
-      const resources = await provider.listResources();
-
-      expect(resources).toHaveLength(1);
-      expect(resources[0].Name).toBe('build-server-01.internal');
-    });
-  });
-
-  describe('listWorkflow', () => {
-    it('returns empty array (not implemented)', async () => {
-      const workflows = await provider.listWorkflow();
-      expect(workflows).toEqual([]);
-    });
-  });
-
-  describe('watchWorkflow', () => {
-    it('returns empty string (not implemented)', async () => {
-      const result = await provider.watchWorkflow();
-      expect(result).toBe('');
-    });
-  });
-});
--- a/src/model/orchestrator/remote-client/index.ts
+++ b/src/model/orchestrator/remote-client/index.ts
@@ -15,15 +15,24 @@ import BuildParameters from '../../build-parameters';
 import { Cli } from '../../cli/cli';
 import OrchestratorOptions from '../options/orchestrator-options';
 import ResourceTracking from '../services/core/resource-tracking';
+import { IncrementalSyncService } from '../services/sync';
+import { SyncStrategy } from '../services/sync/sync-state';

 export class RemoteClient {
  @CliFunction(`remote-cli-pre-build`, `sets up a repository, usually before a game-ci build`)
  static async setupRemoteClient() {
    OrchestratorLogger.log(`bootstrap game ci orchestrator...`);
    await ResourceTracking.logDiskUsageSnapshot('remote-cli-pre-build (start)');
-    if (!(await RemoteClient.handleRetainedWorkspace())) {
+
+    const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+
+    if (syncStrategy !== 'full') {
+      OrchestratorLogger.log(`[Sync] Using incremental sync strategy: ${syncStrategy}`);
+      await RemoteClient.handleIncrementalSync(syncStrategy);
+    } else if (!(await RemoteClient.handleRetainedWorkspace())) {
      await RemoteClient.bootstrapRepository();
    }
+
    await RemoteClient.replaceLargePackageReferencesWithSharedReferences();
    await RemoteClient.runCustomHookFiles(`before-build`);
  }
@@ -157,6 +166,20 @@ export class RemoteClient {

      await RemoteClient.runCustomHookFiles(`after-build`);

+      // Revert sync overlays if configured
+      const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+      if (Orchestrator.buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        try {
+          OrchestratorLogger.log('[Sync] Reverting overlay changes after job completion');
+          await IncrementalSyncService.revertOverlays(
+            OrchestratorFolders.repoPathAbsolute,
+            Orchestrator.buildParameters.syncStatePath,
+          );
+        } catch (revertError: any) {
+          RemoteClientLogger.logWarning(`[Sync] Overlay revert failed: ${revertError.message}`);
+        }
+      }
+
      // WIP - need to give the pod permissions to create config map
      await RemoteClientLogger.handleLogManagementPostJob();
    } catch (error: any) {
@@ -229,6 +252,78 @@ export class RemoteClient {
      RemoteClientLogger.log(JSON.stringify(error, undefined, 4));
    }
  }
+
+  /**
+   * Handle incremental sync strategies (git-delta, direct-input, storage-pull).
+   *
+   * For git-delta: requires an existing workspace with sync state; fetches and applies
+   * only changed files.
+   *
+   * For direct-input and storage-pull: requires an existing workspace; applies overlay
+   * content on top.
+   *
+   * Falls back to full bootstrapRepository() if incremental sync cannot proceed.
+   */
+  private static async handleIncrementalSync(strategy: SyncStrategy): Promise<void> {
+    const buildParameters = Orchestrator.buildParameters;
+    const workspacePath = OrchestratorFolders.repoPathAbsolute;
+    const statePath = buildParameters.syncStatePath;
+
+    // Resolve strategy — may fall back to 'full' if no state exists
+    const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspacePath, statePath);
+
+    if (resolvedStrategy === 'full') {
+      OrchestratorLogger.log('[Sync] Falling back to full bootstrap');
+      if (!(await RemoteClient.handleRetainedWorkspace())) {
+        await RemoteClient.bootstrapRepository();
+      }
+
+      return;
+    }
+
+    switch (resolvedStrategy) {
+      case 'git-delta': {
+        const targetReference = buildParameters.gitSha || buildParameters.branch;
+        OrchestratorLogger.log(`[Sync] Git delta sync to ${targetReference}`);
+        const changedFiles = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference, statePath);
+        OrchestratorLogger.log(`[Sync] Git delta complete: ${changedFiles} file(s) updated`);
+        break;
+      }
+      case 'direct-input': {
+        const inputReference = buildParameters.syncInputRef;
+        if (!inputReference) {
+          throw new Error('[Sync] direct-input strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Applying direct input: ${inputReference}`);
+        await IncrementalSyncService.applyDirectInput(
+          workspacePath,
+          inputReference,
+          buildParameters.syncStorageRemote || undefined,
+          statePath,
+        );
+        break;
+      }
+      case 'storage-pull': {
+        const storageUri = buildParameters.syncInputRef;
+        if (!storageUri) {
+          throw new Error('[Sync] storage-pull strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Storage pull from: ${storageUri}`);
+        await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+          rcloneRemote: buildParameters.syncStorageRemote || undefined,
+          syncRevertAfter: buildParameters.syncRevertAfter,
+          statePath,
+        });
+        break;
+      }
+      default:
+        OrchestratorLogger.logWarning(`[Sync] Unknown strategy: ${resolvedStrategy}, falling back to full`);
+        if (!(await RemoteClient.handleRetainedWorkspace())) {
+          await RemoteClient.bootstrapRepository();
+        }
+    }
+  }
+
  public static async bootstrapRepository() {
    await OrchestratorSystem.Run(
      `mkdir -p ${OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.uniqueOrchestratorJobFolderAbsolute)}`,
--- a/src/model/orchestrator/services/sync/incremental-sync-service.ts
+++ b/src/model/orchestrator/services/sync/incremental-sync-service.ts
@@ -0,0 +1,315 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState, SyncStrategy } from './sync-state';
+import { SyncStateManager } from './sync-state-manager';
+
+/**
+ * Service for incremental workspace synchronization.
+ *
+ * Supports multiple sync strategies:
+ * - full: Traditional clone + cache restore (default)
+ * - git-delta: Fetch and apply only changed files since last sync
+ * - direct-input: Apply file changes passed as job input (no git push required)
+ * - storage-pull: Fetch changed files from rclone-backed generic storage
+ */
+export class IncrementalSyncService {
+  /**
+   * Load sync state from the workspace.
+   */
+  static loadSyncState(workspacePath: string, statePath?: string): SyncState | undefined {
+    return SyncStateManager.loadState(workspacePath, statePath);
+  }
+
+  /**
+   * Save sync state to the workspace.
+   */
+  static saveSyncState(workspacePath: string, state: SyncState, statePath?: string): void {
+    SyncStateManager.saveState(workspacePath, state, statePath);
+  }
+
+  /**
+   * Determine the appropriate sync strategy based on workspace state and configuration.
+   */
+  static resolveStrategy(requestedStrategy: SyncStrategy, workspacePath: string, statePath?: string): SyncStrategy {
+    if (requestedStrategy === 'full') {
+      return 'full';
+    }
+
+    // git-delta requires an existing sync state
+    if (requestedStrategy === 'git-delta') {
+      const state = SyncStateManager.loadState(workspacePath, statePath);
+      if (!state) {
+        OrchestratorLogger.log('[Sync] No sync state found, falling back to full sync');
+
+        return 'full';
+      }
+
+      return 'git-delta';
+    }
+
+    return requestedStrategy;
+  }
+
+  /**
+   * Execute a git-delta sync: fetch latest and apply only changed files.
+   *
+   * @param workspacePath - Path to the git workspace
+   * @param targetReference - Git ref to sync to (commit SHA, branch, tag)
+   * @param statePath - Optional custom path for sync state file
+   * @returns Number of files changed
+   */
+  static async syncGitDelta(workspacePath: string, targetReference: string, statePath?: string): Promise<number> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state) {
+      throw new Error('Cannot git-delta sync without existing sync state');
+    }
+
+    OrchestratorLogger.log(`[Sync] Git delta: ${state.lastSyncCommit.slice(0, 8)} -> ${targetReference.slice(0, 8)}`);
+
+    // Fetch latest
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" fetch origin`, true);
+
+    // Get list of changed files
+    const diffOutput = await OrchestratorSystem.Run(
+      `git -C "${workspacePath}" diff --name-only ${state.lastSyncCommit}..${targetReference}`,
+      true,
+    );
+
+    const changedFiles = diffOutput.split('\n').filter(Boolean);
+    OrchestratorLogger.log(`[Sync] ${changedFiles.length} file(s) changed`);
+
+    if (changedFiles.length > 0) {
+      // Checkout target ref
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout ${targetReference}`, true);
+    }
+
+    // Update sync state
+    const newState: SyncState = {
+      lastSyncCommit: targetReference,
+      lastSyncTimestamp: new Date().toISOString(),
+      workspaceHash: SyncStateManager.calculateWorkspaceHash(workspacePath),
+      pendingOverlays: state.pendingOverlays,
+    };
+    SyncStateManager.saveState(workspacePath, newState, statePath);
+
+    return changedFiles.length;
+  }
+
+  /**
+   * Apply a direct input overlay from a local archive or storage URI.
+   *
+   * For storage URIs (storage://remote:bucket/path), the archive is fetched via rclone.
+   * For local paths, the archive is extracted directly.
+   *
+   * @param workspacePath - Path to the workspace
+   * @param inputReference - Local path or storage:// URI to the input archive
+   * @param rcloneRemote - rclone remote name for storage:// URIs (optional, uses URI-embedded remote)
+   * @param statePath - Optional custom path for sync state file
+   * @returns List of overlay paths applied
+   */
+  static async applyDirectInput(
+    workspacePath: string,
+    inputReference: string,
+    rcloneRemote?: string,
+    statePath?: string,
+  ): Promise<string[]> {
+    let localArchive = inputReference;
+
+    // If storage URI, fetch via rclone first
+    if (inputReference.startsWith('storage://')) {
+      const parsed = IncrementalSyncService.parseStorageUri(inputReference);
+      const remote = rcloneRemote || parsed.remote;
+      const remotePath = parsed.path;
+
+      localArchive = path.join(workspacePath, '.game-ci-input-overlay.tar');
+      OrchestratorLogger.log(`[Sync] Fetching input from storage: ${inputReference}`);
+
+      await IncrementalSyncService.executeRcloneCopy(remote, remotePath, path.dirname(localArchive));
+    }
+
+    if (!fs.existsSync(localArchive)) {
+      throw new Error(`Input archive not found: ${localArchive}`);
+    }
+
+    OrchestratorLogger.log(`[Sync] Applying direct input overlay from ${localArchive}`);
+
+    // Extract overlay
+    await OrchestratorSystem.Run(`tar -xf "${localArchive}" -C "${workspacePath}"`, true);
+
+    // Track overlay in sync state
+    const state = SyncStateManager.loadState(workspacePath, statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(localArchive);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    return [localArchive];
+  }
+
+  /**
+   * Execute a storage-pull sync: pull changed files from an rclone remote.
+   *
+   * This strategy fetches content from a remote storage backend (S3, GCS, Azure, etc.)
+   * and overlays it onto the workspace. Supports two modes:
+   * - overlay: extract on top of existing workspace (default)
+   * - clean: fresh git checkout, then apply overlay
+   *
+   * @param workspacePath - Path to the workspace
+   * @param storageUri - storage://remote:bucket/path URI pointing to remote content
+   * @param options - Configuration for the storage-pull operation
+   * @returns List of files pulled from storage
+   */
+  static async syncStoragePull(
+    workspacePath: string,
+    storageUri: string,
+    options: {
+      rcloneRemote?: string;
+      cleanMode?: boolean;
+      syncRevertAfter?: boolean;
+      statePath?: string;
+    } = {},
+  ): Promise<string[]> {
+    if (!storageUri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${storageUri}. Must start with storage://`);
+    }
+
+    // Verify rclone is available
+    try {
+      await OrchestratorSystem.Run('rclone version', true, true);
+    } catch {
+      throw new Error('rclone binary not found. Install rclone to use storage-pull sync strategy.');
+    }
+
+    const parsed = IncrementalSyncService.parseStorageUri(storageUri);
+    const remote = options.rcloneRemote || parsed.remote;
+    const remotePath = parsed.path;
+
+    OrchestratorLogger.log(`[Sync] Storage pull: ${remote}:${remotePath} -> ${workspacePath}`);
+
+    // Clean mode: reset workspace to clean git state before applying overlay
+    if (options.cleanMode) {
+      OrchestratorLogger.log('[Sync] Clean mode: resetting workspace to HEAD');
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+    }
+
+    // Pull from remote storage directly into workspace
+    const rcloneSource = `${remote}:${remotePath}`;
+    await OrchestratorSystem.Run(`rclone copy "${rcloneSource}" "${workspacePath}" --transfers 8 --checkers 16`, true);
+
+    // List what was pulled for tracking
+    let pulledFiles: string[] = [];
+    try {
+      const lsOutput = await OrchestratorSystem.Run(`rclone ls "${rcloneSource}"`, true, true);
+      pulledFiles = lsOutput
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => {
+          // rclone ls outputs: "  <size> <path>"
+          const trimmed = line.trim();
+          const spaceIndex = trimmed.indexOf(' ');
+
+          return spaceIndex >= 0 ? trimmed.slice(spaceIndex + 1).trim() : trimmed;
+        })
+        .filter(Boolean);
+    } catch {
+      OrchestratorLogger.logWarning('[Sync] Could not list pulled files from remote');
+    }
+
+    OrchestratorLogger.log(`[Sync] Pulled ${pulledFiles.length} file(s) from storage`);
+
+    // Update sync state with overlay tracking
+    const state = SyncStateManager.loadState(workspacePath, options.statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(storageUri);
+    state.lastSyncTimestamp = new Date().toISOString();
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, options.statePath);
+
+    return pulledFiles;
+  }
+
+  /**
+   * Parse a storage:// URI into remote and path components.
+   *
+   * Supported formats:
+   * - storage://remote:bucket/path  (explicit remote with colon separator)
+   * - storage://remote/path         (remote name is first path segment)
+   *
+   * @param uri - The storage:// URI to parse
+   * @returns Object with remote name and path
+   */
+  static parseStorageUri(uri: string): { remote: string; path: string } {
+    if (!uri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${uri}. Must start with storage://`);
+    }
+
+    const stripped = uri.replace('storage://', '');
+
+    // Check for explicit remote:path format (e.g., "myremote:bucket/path")
+    const colonIndex = stripped.indexOf(':');
+    if (colonIndex > 0) {
+      return {
+        remote: stripped.slice(0, colonIndex),
+        path: stripped.slice(colonIndex + 1),
+      };
+    }
+
+    // Fallback: first segment is remote name (e.g., "myremote/bucket/path")
+    const slashIndex = stripped.indexOf('/');
+    if (slashIndex > 0) {
+      return {
+        remote: stripped.slice(0, slashIndex),
+        path: stripped.slice(slashIndex + 1),
+      };
+    }
+
+    // Just a remote name with no path
+    return {
+      remote: stripped,
+      path: '',
+    };
+  }
+
+  /**
+   * Execute rclone copy with standard flags.
+   */
+  private static async executeRcloneCopy(remote: string, remotePath: string, destinationPath: string): Promise<void> {
+    await OrchestratorSystem.Run(
+      `rclone copy "${remote}:${remotePath}" "${destinationPath}" --transfers 8 --checkers 16`,
+      true,
+    );
+  }
+
+  /**
+   * Revert pending overlays by restoring git state.
+   */
+  static async revertOverlays(workspacePath: string, statePath?: string): Promise<void> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state || state.pendingOverlays.length === 0) {
+      return;
+    }
+
+    OrchestratorLogger.log(`[Sync] Reverting ${state.pendingOverlays.length} overlay(s)`);
+
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+
+    // Clean untracked files from overlays
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+
+    state.pendingOverlays = [];
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    OrchestratorLogger.log('[Sync] Overlays reverted');
+  }
+}
--- a/src/model/orchestrator/services/sync/incremental-sync.test.ts
+++ b/src/model/orchestrator/services/sync/incremental-sync.test.ts
@@ -0,0 +1,544 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { IncrementalSyncService } from './incremental-sync-service';
+import { SyncStateManager } from './sync-state-manager';
+import { SyncState } from './sync-state';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+// Mock dependencies
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system');
+jest.mock('../core/orchestrator-logger');
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+const mockSystem = OrchestratorSystem as jest.Mocked<typeof OrchestratorSystem>;
+const mockLogger = OrchestratorLogger as jest.Mocked<typeof OrchestratorLogger>;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  jest.restoreAllMocks();
+});
+
+describe('IncrementalSyncService', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('parseStorageUri', () => {
+    it('parses storage://remote:bucket/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket/some/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/some/path' });
+    });
+
+    it('parses storage://remote/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote/mybucket/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/path' });
+    });
+
+    it('parses storage://remote:bucket with no sub-path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket' });
+    });
+
+    it('handles remote-only URI without path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote');
+      expect(result).toEqual({ remote: 'myremote', path: '' });
+    });
+
+    it('throws on invalid URI without storage:// prefix', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('http://example.com')).toThrow('Invalid storage URI');
+    });
+
+    it('throws on empty URI', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('')).toThrow('Invalid storage URI');
+    });
+  });
+
+  describe('resolveStrategy', () => {
+    it('returns full when full is requested', () => {
+      const result = IncrementalSyncService.resolveStrategy('full', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns git-delta when sync state exists', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('git-delta');
+    });
+
+    it('falls back to full when git-delta requested but no sync state', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns direct-input as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('direct-input', workspacePath);
+      expect(result).toBe('direct-input');
+    });
+
+    it('returns storage-pull as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('storage-pull', workspacePath);
+      expect(result).toBe('storage-pull');
+    });
+  });
+
+  describe('syncGitDelta', () => {
+    const targetReference = 'def456789';
+
+    beforeEach(() => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123456',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+    });
+
+    it('fetches and checks out changed files', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\nfile2.cs\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(2);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" fetch origin'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('diff --name-only abc123456..def456789'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('checkout def456789'), true);
+    });
+
+    it('skips checkout when no files changed', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce(''); // git diff (empty)
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(0);
+
+      // Should only have fetch + diff calls, no checkout
+      expect(mockSystem.Run).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.syncGitDelta(workspacePath, targetReference)).rejects.toThrow(
+        'Cannot git-delta sync without existing sync state',
+      );
+    });
+
+    it('saves updated sync state after delta sync', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.lastSyncCommit).toBe(targetReference);
+    });
+  });
+
+  describe('applyDirectInput', () => {
+    it('extracts a local archive to workspace', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        // State file path does not exist
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce(''); // tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(result).toEqual([archivePath]);
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('tar -xf "/tmp/overlay.tar"'), true);
+    });
+
+    it('fetches archive from storage URI via rclone then extracts', async () => {
+      const storageUri = 'storage://s3remote:builds/overlay.tar';
+
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        const pathString = p.toString();
+        if (pathString.includes('.game-ci-input-overlay.tar')) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValue(''); // rclone copy + tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, storageUri);
+
+      expect(result.length).toBe(1);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3remote:builds/overlay.tar"'),
+        true,
+      );
+    });
+
+    it('throws when local archive does not exist', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.applyDirectInput(workspacePath, '/missing/archive.tar')).rejects.toThrow(
+        'Input archive not found',
+      );
+    });
+
+    it('tracks overlay in sync state', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce('');
+
+      await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(archivePath);
+    });
+  });
+
+  describe('syncStoragePull', () => {
+    const storageUri = 'storage://s3:game-builds/latest';
+
+    beforeEach(() => {
+      mockFs.existsSync.mockReturnValue(false); // no existing state
+    });
+
+    it('pulls files from rclone remote into workspace', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version check
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  1234 file1.txt\n  5678 dir/file2.cs\n'); // rclone ls
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual(['file1.txt', 'dir/file2.cs']);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3:game-builds/latest" "/workspace/project"'),
+        true,
+      );
+    });
+
+    it('uses custom rclone remote when provided', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+        rcloneRemote: 'custom-remote',
+      });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "custom-remote:game-builds/latest"'),
+        true,
+      );
+    });
+
+    it('resets workspace in clean mode before pull', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout -- .
+      mockSystem.Run.mockResolvedValueOnce(''); // git clean -fd
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, { cleanMode: true });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('throws on invalid storage URI', async () => {
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, 'http://example.com')).rejects.toThrow(
+        'Invalid storage URI',
+      );
+    });
+
+    it('throws when rclone binary is not available', async () => {
+      mockSystem.Run.mockRejectedValueOnce(new Error('command not found: rclone'));
+
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, storageUri)).rejects.toThrow(
+        'rclone binary not found',
+      );
+    });
+
+    it('saves sync state with overlay tracking', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  100 a.txt\n'); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(storageUri);
+    });
+
+    it('handles rclone ls failure gracefully', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockRejectedValueOnce(new Error('ls failed')); // rclone ls fails
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual([]);
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Could not list pulled files'));
+    });
+  });
+
+  describe('revertOverlays', () => {
+    it('reverts git state and cleans untracked files', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar', 'storage://s3:builds/content'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('clears pending overlays in saved state', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toEqual([]);
+    });
+
+    it('does nothing when no overlays are pending', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('does nothing when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+  });
+});
+
+describe('SyncStateManager', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('loadState', () => {
+    it('returns parsed state from default path', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toEqual(state);
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, '.game-ci/sync-state.json'), 'utf8');
+    });
+
+    it('uses custom state path when provided', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      SyncStateManager.loadState(workspacePath, 'custom/state.json');
+
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, 'custom/state.json'), 'utf8');
+    });
+
+    it('returns undefined when state file does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+    });
+
+    it('returns undefined and logs warning on malformed JSON', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('not-valid-json{{{');
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to load sync state'));
+    });
+  });
+
+  describe('saveState', () => {
+    it('writes state to default path with pretty JSON', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: ['overlay1'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalledWith(
+        path.join(workspacePath, '.game-ci/sync-state.json'),
+        JSON.stringify(state, undefined, 2),
+        'utf8',
+      );
+    });
+
+    it('creates parent directories if they do not exist', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(false);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith(expect.stringContaining('.game-ci'), { recursive: true });
+    });
+
+    it('logs warning on write failure instead of throwing', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.writeFileSync.mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      // Should not throw
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to save sync state'));
+    });
+  });
+
+  describe('calculateWorkspaceHash', () => {
+    it('produces a deterministic SHA-256 hash from workspace files', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation((filePath: fs.PathOrFileDescriptor) => {
+        const p = filePath.toString();
+        if (p.includes('ProjectVersion.txt')) return 'm_EditorVersion: 2022.3.10f1';
+        if (p.includes('manifest.json')) return '{"dependencies":{}}';
+        if (p.includes('packages-lock.json')) return '{"dependencies":{}}';
+        if (p.includes('csc.rsp')) return '-nullable+';
+
+        return '';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).toBe(hash2);
+      expect(hash1).toHaveLength(64); // SHA-256 hex digest
+    });
+
+    it('produces different hashes for different workspace content', () => {
+      let callCount = 0;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation(() => {
+        callCount++;
+
+        return callCount <= 4 ? 'content-v1' : 'content-v2';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('includes missing file markers in hash for absent files', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const hash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash).toHaveLength(64);
+    });
+  });
+
+  describe('hasDrifted', () => {
+    it('returns false when workspace hash matches', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const savedHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, savedHash);
+
+      expect(result).toBe(false);
+    });
+
+    it('returns true when workspace hash differs', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, 'some-old-hash-that-will-not-match');
+
+      expect(result).toBe(true);
+    });
+  });
+});
--- a/src/model/orchestrator/services/sync/index.ts
+++ b/src/model/orchestrator/services/sync/index.ts
@@ -0,0 +1,3 @@
+export { SyncState, SyncStrategy } from './sync-state';
+export { IncrementalSyncService } from './incremental-sync-service';
+export { SyncStateManager } from './sync-state-manager';
--- a/src/model/orchestrator/services/sync/sync-state-manager.ts
+++ b/src/model/orchestrator/services/sync/sync-state-manager.ts
@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState } from './sync-state';
+
+/**
+ * Manages persistent sync state for incremental workspace updates.
+ *
+ * The sync state tracks what has been synced to a workspace, enabling
+ * delta-based updates instead of full clones. State is stored as a JSON
+ * file in the workspace (default: .game-ci/sync-state.json).
+ */
+export class SyncStateManager {
+  static readonly DEFAULT_STATE_PATH = '.game-ci/sync-state.json';
+
+  /**
+   * Key workspace files whose content is hashed for drift detection.
+   * Changes to any of these files indicate the workspace may have been
+   * modified outside of the sync system.
+   */
+  private static readonly WORKSPACE_HASH_FILES = [
+    'ProjectSettings/ProjectVersion.txt',
+    'Packages/manifest.json',
+    'Packages/packages-lock.json',
+    'Assets/csc.rsp',
+  ];
+
+  /**
+   * Load sync state from the workspace.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   * @returns The loaded sync state, or undefined if no state exists or parsing fails
+   */
+  static loadState(workspacePath: string, statePath?: string): SyncState | undefined {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    if (!fs.existsSync(resolvedPath)) {
+      return;
+    }
+
+    try {
+      const content = fs.readFileSync(resolvedPath, 'utf8');
+
+      return JSON.parse(content) as SyncState;
+    } catch {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to load sync state from ${resolvedPath}`);
+
+      return;
+    }
+  }
+
+  /**
+   * Save sync state to the workspace.
+   *
+   * Creates parent directories if they do not exist.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param state - The sync state to persist
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   */
+  static saveState(workspacePath: string, state: SyncState, statePath?: string): void {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    try {
+      const directory = path.dirname(resolvedPath);
+      if (!fs.existsSync(directory)) {
+        fs.mkdirSync(directory, { recursive: true });
+      }
+
+      fs.writeFileSync(resolvedPath, JSON.stringify(state, undefined, 2), 'utf8');
+      OrchestratorLogger.log(
+        `[SyncState] State saved: commit=${state.lastSyncCommit}, overlays=${state.pendingOverlays.length}`,
+      );
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to save sync state: ${error.message}`);
+    }
+  }
+
+  /**
+   * Calculate a SHA-256 hash of key workspace files for drift detection.
+   *
+   * Hashes the content of known workspace files (ProjectVersion.txt,
+   * manifest.json, etc.) to produce a fingerprint. If the hash changes
+   * between syncs, the workspace may have been modified externally.
+   *
+   * Files that do not exist are skipped (their absence is part of the hash).
+   *
+   * @param workspacePath - Root path of the workspace
+   * @returns Hex-encoded SHA-256 hash string
+   */
+  static calculateWorkspaceHash(workspacePath: string): string {
+    const hash = crypto.createHash('sha256');
+
+    for (const relativePath of SyncStateManager.WORKSPACE_HASH_FILES) {
+      const filePath = path.join(workspacePath, relativePath);
+      try {
+        if (fs.existsSync(filePath)) {
+          const content = fs.readFileSync(filePath, 'utf8');
+          hash.update(`${relativePath}:${content}`);
+        } else {
+          hash.update(`${relativePath}:__missing__`);
+        }
+      } catch {
+        hash.update(`${relativePath}:__error__`);
+      }
+    }
+
+    return hash.digest('hex');
+  }
+
+  /**
+   * Check if the workspace has drifted from a previously saved hash.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param savedHash - The previously saved workspace hash to compare against
+   * @returns true if the current workspace hash differs from the saved hash
+   */
+  static hasDrifted(workspacePath: string, savedHash: string): boolean {
+    const currentHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+    return currentHash !== savedHash;
+  }
+}
--- a/src/model/orchestrator/services/sync/sync-state.ts
+++ b/src/model/orchestrator/services/sync/sync-state.ts
@@ -0,0 +1,19 @@
+/**
+ * Persistent sync state for incremental workspace updates.
+ * Stored on the runner to track what has already been synced.
+ */
+export interface SyncState {
+  /** Last successfully synced git commit SHA */
+  lastSyncCommit: string;
+
+  /** ISO 8601 timestamp of last sync */
+  lastSyncTimestamp: string;
+
+  /** SHA-256 hash of workspace state (optional) */
+  workspaceHash?: string;
+
+  /** List of overlay paths that haven't been reverted */
+  pendingOverlays: string[];
+}
+
+export type SyncStrategy = 'full' | 'git-delta' | 'direct-input' | 'storage-pull';
Author	SHA1	Message	Date
frostebite	d503b0b61a	fix: replace orchestrator-develop branch references with main The orchestrator-develop branch no longer exists. Update all fallback clone commands and test fixtures to use main instead. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 19:59:58 +00:00
frostebite	07eec62d28	ci: set macOS builds to continue-on-error Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 23:33:04 +00:00
frostebite	4870fb5a5c	feat(sync): complete incremental sync protocol with storage-pull, state management, and tests (#799 ) - Add storage-pull strategy: rclone-based sync from remote storage with overlay and clean modes, URI parsing (storage://remote:bucket/path), transfer parallelism, and automatic rclone availability checking - Add SyncStateManager: persistent state load/save with configurable paths, workspace hash calculation via SHA-256 of key project files, and drift detection for external modification awareness - Add action.yml inputs: syncStrategy, syncInputRef, syncStorageRemote, syncRevertAfter, syncStatePath with sensible defaults - Wire sync into Input (5 getters), BuildParameters (5 fields), index.ts (local build path), and RemoteClient (orchestrator path) with post-job overlay revert when syncRevertAfter is true - Add 42 unit tests covering all strategies, URI parsing, state management, hash calculation, drift detection, error handling, and edge cases (missing rclone, invalid URIs, absent state, empty diffs) - Add root:true to eslintrc to prevent plugin resolution conflicts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 11:56:43 +00:00
frostebite	3033ee0067	feat(orchestrator): incremental sync protocol — git delta, direct input, and storage-backed sync Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 09:39:53 +00:00