refactor(cli): move cache command under orchestrate subcommand

Cache is an orchestrator feature, so it belongs under `game-ci orchestrate cache`
rather than as a top-level `game-ci cache` command.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.eslintrc.json

@@ -1,4 +1,5 @@
 {
+  "root": true,
   "plugins": ["jest", "@typescript-eslint", "prettier", "unicorn"],
   "extends": ["plugin:unicorn/recommended", "plugin:github/recommended", "plugin:prettier/recommended"],
   "parser": "@typescript-eslint/parser",

.github/workflows/build-tests-mac.yml

@@ -12,7 +12,6 @@ jobs:
   buildForAllPlatformsMacOS:
     name: ${{ matrix.targetPlatform }} on ${{ matrix.unityVersion }}
     runs-on: macos-latest
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:

.github/workflows/release-cli.yml

@@ -0,0 +1,170 @@
+name: Release CLI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to build (e.g., v2.0.0). Uses latest release if empty.'
+        required: false
+        type: string
+      publish-npm:
+        description: 'Publish to npm'
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name || inputs.tag || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-binaries:
+    name: Build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: linux-x64
+            os: ubuntu-latest
+            pkg-target: node20-linux-x64
+            binary-name: game-ci-linux-x64
+          - target: linux-arm64
+            os: ubuntu-latest
+            pkg-target: node20-linux-arm64
+            binary-name: game-ci-linux-arm64
+          - target: macos-x64
+            os: macos-latest
+            pkg-target: node20-macos-x64
+            binary-name: game-ci-macos-x64
+          - target: macos-arm64
+            os: macos-latest
+            pkg-target: node20-macos-arm64
+            binary-name: game-ci-macos-arm64
+          - target: windows-x64
+            os: windows-latest
+            pkg-target: node20-win-x64
+            binary-name: game-ci-windows-x64.exe
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name || inputs.tag || github.ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build TypeScript
+        run: yarn build
+
+      - name: Verify CLI before packaging
+        run: node lib/cli.js version
+
+      - name: Build standalone binary
+        run: npx pkg lib/cli.js --target ${{ matrix.pkg-target }} --output ${{ matrix.binary-name }} --compress GZip
+
+      - name: Verify standalone binary (non-cross-compiled)
+        if: |
+          (matrix.target == 'linux-x64' && runner.os == 'Linux') ||
+          (matrix.target == 'macos-arm64' && runner.os == 'macOS' && runner.arch == 'ARM64') ||
+          (matrix.target == 'macos-x64' && runner.os == 'macOS' && runner.arch == 'X64') ||
+          (matrix.target == 'windows-x64' && runner.os == 'Windows')
+        run: ./${{ matrix.binary-name }} version
+        shell: bash
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: binary-${{ matrix.target }}
+          path: ${{ matrix.binary-name }}
+          retention-days: 5
+
+  create-checksums-and-upload:
+    name: Checksums and release upload
+    needs: build-binaries
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: binaries
+          pattern: binary-*
+          merge-multiple: true
+
+      - name: List binaries
+        run: ls -la binaries/
+
+      - name: Generate SHA256 checksums
+        run: |
+          cd binaries
+          sha256sum game-ci-* > checksums.txt
+          echo "=== checksums.txt ==="
+          cat checksums.txt
+
+      - name: Determine release tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          elif [ -n "${{ inputs.tag }}" ]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "No release tag available. Skipping upload."
+            echo "tag=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload binaries to release
+        if: steps.tag.outputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          cd binaries
+          for f in game-ci-* checksums.txt; do
+            echo "Uploading $f..."
+            gh release upload "${{ steps.tag.outputs.tag }}" "$f" \
+              --repo "${{ github.repository }}" \
+              --clobber
+          done
+
+  publish-npm:
+    name: Publish to npm
+    needs: build-binaries
+    runs-on: ubuntu-latest
+    if: >-
+      (github.event_name == 'release') || (github.event_name == 'workflow_dispatch' && inputs.publish-npm)
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name || inputs.tag || github.ref }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Build
+        run: yarn build
+
+      - name: Run tests
+        run: yarn test
+
+      - name: Verify CLI
+        run: |
+          node lib/cli.js version
+          node lib/cli.js --help
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/validate-community-plugins.yml

@@ -0,0 +1,203 @@
+name: Validate Community Plugins
+
+on:
+  schedule:
+    # Run weekly on Sunday at 02:00 UTC
+    - cron: '0 2 * * 0'
+  workflow_dispatch:
+    inputs:
+      plugin_filter:
+        description: 'Filter plugins by name (regex pattern, empty = all)'
+        required: false
+        default: ''
+      unity_version:
+        description: 'Override Unity version (empty = use plugin default)'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  load-plugins:
+    name: Load Plugin Registry
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.parse.outputs.matrix }}
+      plugin_count: ${{ steps.parse.outputs.count }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse plugin registry
+        id: parse
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const yaml = require('js-yaml');
+
+            const registry = yaml.load(fs.readFileSync('community-plugins.yml', 'utf8'));
+            let plugins = registry.plugins || [];
+
+            // Apply name filter if provided
+            const filter = '${{ github.event.inputs.plugin_filter }}';
+            if (filter) {
+              const regex = new RegExp(filter, 'i');
+              plugins = plugins.filter(p => regex.test(p.name));
+            }
+
+            // Expand platform matrix
+            const matrix = [];
+            for (const plugin of plugins) {
+              const platforms = plugin.platforms || ['StandaloneLinux64'];
+              for (const platform of platforms) {
+                matrix.push({
+                  name: plugin.name,
+                  package: plugin.package,
+                  source: plugin.source || 'git',
+                  unity: '${{ github.event.inputs.unity_version }}' || plugin.unity || '2021.3',
+                  platform: platform,
+                  timeout: plugin.timeout || 30
+                });
+              }
+            }
+
+            core.setOutput('matrix', JSON.stringify({ include: matrix }));
+            core.setOutput('count', matrix.length);
+            console.log(`Found ${matrix.length} plugin-platform combinations to validate`);
+
+  validate:
+    name: '${{ matrix.name }} (${{ matrix.platform }})'
+    needs: load-plugins
+    if: needs.load-plugins.outputs.plugin_count > 0
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ fromJson(matrix.timeout) }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.load-plugins.outputs.matrix) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Create test project
+        run: |
+          mkdir -p test-project/Assets
+          mkdir -p test-project/Packages
+          mkdir -p test-project/ProjectSettings
+
+          # Create minimal manifest.json
+          if [ "${{ matrix.source }}" = "git" ]; then
+            cat > test-project/Packages/manifest.json << 'MANIFEST'
+          {
+            "dependencies": {
+              "com.unity.modules.imgui": "1.0.0",
+              "com.unity.modules.jsonserialize": "1.0.0"
+            }
+          }
+          MANIFEST
+
+            # Add git package via manifest
+            cd test-project
+            cat Packages/manifest.json | python3 -c "
+          import sys, json
+          manifest = json.load(sys.stdin)
+          manifest['dependencies']['${{ matrix.name }}'] = '${{ matrix.package }}'
+          json.dump(manifest, sys.stdout, indent=2)
+          " > Packages/manifest.tmp && mv Packages/manifest.tmp Packages/manifest.json
+            cd ..
+          fi
+
+          # Create minimal ProjectSettings
+          cat > test-project/ProjectSettings/ProjectVersion.txt << EOF
+          m_EditorVersion: ${{ matrix.unity }}
+          EOF
+
+      - name: Build with unity-builder
+        uses: ./
+        id: build
+        with:
+          projectPath: test-project
+          targetPlatform: ${{ matrix.platform }}
+          unityVersion: ${{ matrix.unity }}
+        continue-on-error: true
+
+      - name: Record result
+        if: always()
+        run: |
+          STATUS="${{ steps.build.outcome }}"
+          echo "## ${{ matrix.name }} — ${{ matrix.platform }}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ "$STATUS" = "success" ]; then
+            echo "✅ **PASSED** — Compiled and built successfully" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ **FAILED** — Build or compilation failed" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- Unity: ${{ matrix.unity }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Platform: ${{ matrix.platform }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Source: ${{ matrix.source }}" >> $GITHUB_STEP_SUMMARY
+          echo "- Package: \`${{ matrix.package }}\`" >> $GITHUB_STEP_SUMMARY
+
+  report:
+    name: Validation Report
+    needs: [load-plugins, validate]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Generate summary
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data: run } = await github.rest.actions.listJobsForWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.runId
+            });
+
+            const validateJobs = run.jobs.filter(j => j.name.startsWith('validate'));
+            const passed = validateJobs.filter(j => j.conclusion === 'success').length;
+            const failed = validateJobs.filter(j => j.conclusion === 'failure').length;
+            const total = validateJobs.length;
+
+            let summary = `# Community Plugin Validation Report\n\n`;
+            summary += `**${passed}/${total} passed** | ${failed} failed\n\n`;
+            summary += `| Plugin | Platform | Status |\n|--------|----------|--------|\n`;
+
+            for (const job of validateJobs) {
+              const icon = job.conclusion === 'success' ? '✅' : '❌';
+              summary += `| ${job.name} | | ${icon} ${job.conclusion} |\n`;
+            }
+
+            await core.summary.addRaw(summary).write();
+
+            // Create or update issue if there are failures
+            if (failed > 0) {
+              const title = `Community Plugin Validation: ${failed} failure(s) — ${new Date().toISOString().split('T')[0]}`;
+              const body = summary + `\n\n[Workflow Run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`;
+
+              const { data: issues } = await github.rest.issues.listForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                labels: 'community-plugin-validation'
+              });
+
+              if (issues.length > 0) {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issues[0].number,
+                  body: body
+                });
+              } else {
+                await github.rest.issues.create({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  title: title,
+                  body: body,
+                  labels: ['community-plugin-validation']
+                });
+              }
+            }

action.yml

@@ -105,6 +105,12 @@ inputs:
     required: false
     default: ''
     description: '[Orchestrator] Github private token to pull from github'
+  gitAuthMode:
+    required: false
+    default: 'header'
+    description:
+      '[Orchestrator] How git authentication is configured. "header" (default) uses http.extraHeader so the token
+      never appears in clone URLs or git config. "url" embeds the token in clone URLs (legacy behavior).'
   githubOwner:
     required: false
     default: ''
@@ -194,6 +200,51 @@ inputs:
     description:
       '[Orchestrator] Either local, k8s or aws can be used to run builds on a remote cluster. Additional parameters must
       be configured.'
+  fallbackProviderStrategy:
+    default: ''
+    required: false
+    description:
+      '[Orchestrator] Fallback provider when the primary is unavailable. Used with runnerCheckEnabled for automatic
+      failover, or as a catch-all if the primary provider fails to initialize.'
+  runnerCheckEnabled:
+    default: 'false'
+    required: false
+    description:
+      '[Orchestrator] Check GitHub Actions runner availability before starting a build. When no suitable runners are
+      available and fallbackProviderStrategy is set, automatically routes to the fallback provider.'
+  runnerCheckLabels:
+    default: ''
+    required: false
+    description:
+      '[Orchestrator] Comma-separated runner labels to filter when checking availability (e.g. self-hosted,linux).
+      When empty, checks all runners in the repository.'
+  runnerCheckMinAvailable:
+    default: '1'
+    required: false
+    description:
+      '[Orchestrator] Minimum number of idle runners required for the primary provider. If fewer are available,
+      routes to fallbackProviderStrategy.'
+  retryOnFallback:
+    default: 'false'
+    required: false
+    description:
+      '[Orchestrator] When true and fallbackProviderStrategy is set, automatically retry the build on the fallback
+      provider if the primary provider fails. Useful for long builds where transient cloud failures are common.'
+  providerInitTimeout:
+    default: '0'
+    required: false
+    description:
+      '[Orchestrator] Maximum seconds to wait for the primary provider to initialize (setupWorkflow). If exceeded
+      and fallbackProviderStrategy is set, switches to the fallback. Set to 0 to disable (default).'
+  secretSource:
+    default: ''
+    required: false
+    description:
+      '[Orchestrator] Premade secret source for pulling build secrets. Supported values: aws-secrets-manager,
+      aws-parameter-store, gcp-secret-manager, azure-key-vault, hashicorp-vault, hashicorp-vault-kv1,
+      vault (alias for hashicorp-vault), env. Can also be a custom shell command with {0} placeholder
+      for the key, or a path to a YAML file defining custom sources. Takes precedence over
+      inputPullCommand when set.'
   resourceTracking:
     default: 'false'
     required: false
@@ -269,6 +320,28 @@ inputs:
     default: 'false'
     required: false
     description: 'Skip the activation/deactivation of Unity. This assumes Unity is already activated.'
+  artifactOutputTypes:
+    description: 'Comma-separated list of output types to collect (build, logs, test-results, coverage, images, metrics, data-export, server-build, custom)'
+    required: false
+    default: 'build,logs,test-results'
+  artifactUploadTarget:
+    description: 'Where to upload artifacts: github-artifacts, storage, local, none'
+    required: false
+    default: 'github-artifacts'
+  artifactUploadPath:
+    description: 'Destination path for artifact upload (storage URI or local path)'
+    required: false
+  artifactCompression:
+    description: 'Compression for artifacts: none, gzip, lz4'
+    required: false
+    default: 'gzip'
+  artifactRetentionDays:
+    description: 'Retention period for uploaded artifacts in days'
+    required: false
+    default: '30'
+  artifactCustomTypes:
+    description: 'JSON string defining custom output types [{name, defaultPath, description}]'
+    required: false
   cloneDepth:
     default: '50'
     required: false
@@ -279,6 +352,329 @@ inputs:
     description:
       '[Orchestrator] Specifies the repo for the unity builder. Useful if you forked the repo for testing, features, or
       fixes.'
+  submoduleProfilePath:
+    required: false
+    default: ''
+    description:
+      'Path to a YAML submodule profile file (relative to repo root). Defines which submodules to initialize (branch:
+      main) or skip (branch: empty). See docs for format.'
+  submoduleVariantPath:
+    required: false
+    default: ''
+    description:
+      'Path to a YAML variant overlay file that modifies the base submodule profile. Used for server or debug build
+      variants.'
+  submoduleToken:
+    required: false
+    default: ''
+    description:
+      'Git token for authenticating submodule clones. Falls back to gitPrivateToken or GITHUB_TOKEN if empty.'
+  localCacheEnabled:
+    required: false
+    default: 'false'
+    description:
+      'Enable filesystem-based caching for local builds. Caches the Unity Library folder and optionally LFS objects
+      between builds without requiring actions/cache.'
+  localCacheRoot:
+    required: false
+    default: ''
+    description:
+      'Root directory for local build cache. Defaults to $RUNNER_TEMP/game-ci-cache or .game-ci/cache if RUNNER_TEMP is
+      not set.'
+  localCacheLibrary:
+    required: false
+    default: 'true'
+    description: 'Cache the Unity Library folder for local builds. Only effective when localCacheEnabled is true.'
+  localCacheLfs:
+    required: false
+    default: 'false'
+    description: 'Cache Git LFS objects for local builds. Only effective when localCacheEnabled is true.'
+  childWorkspacesEnabled:
+    required: false
+    default: 'false'
+    description:
+      'Enable child workspace isolation for multi-product builds. Uses atomic filesystem moves for O(1) workspace
+      restore instead of tar/download/extract. Ideal for 50GB+ workspaces on self-hosted runners.'
+  childWorkspaceName:
+    required: false
+    default: ''
+    description:
+      'Name for this child workspace (e.g., product name like "TurnOfWar"). Used as the cache key for workspace
+      isolation. Required when childWorkspacesEnabled is true.'
+  childWorkspaceCacheRoot:
+    required: false
+    default: ''
+    description:
+      'Parent directory for cached child workspaces. Should be on the same NTFS volume as the build directory for O(1)
+      atomic restore via filesystem rename. Defaults to $RUNNER_TEMP/game-ci-workspaces.'
+  childWorkspacePreserveGit:
+    required: false
+    default: 'true'
+    description:
+      'Preserve .git directory in cached child workspace. Enables delta operations on restore but increases cache size.
+      Set to false to save disk space at the cost of full re-clone on restore.'
+  childWorkspaceSeparateLibrary:
+    required: false
+    default: 'true'
+    description:
+      'Cache Unity Library folder separately from the child workspace. Allows independent Library restore even when
+      workspace cache is invalidated. Recommended for large projects.'
+  lfsTransferAgent:
+    required: false
+    default: ''
+    description:
+      'Custom Git LFS transfer agent. Set to "elastic-git-storage" for built-in support (auto-installs from GitHub
+      releases). Append @version for a specific release (e.g. "elastic-git-storage@v1.0.0"). Or provide a path to any
+      custom transfer agent executable. When set, the agent is registered via git config before LFS operations.'
+  lfsTransferAgentArgs:
+    required: false
+    default: ''
+    description: 'Additional arguments to pass to the custom LFS transfer agent.'
+  lfsStoragePaths:
+    required: false
+    default: ''
+    description:
+      'Semicolon-separated list of storage paths for the custom LFS transfer agent. Interpretation depends on the agent
+      (e.g. local paths, WebDAV URLs, rclone remotes).'
+  gitHooksEnabled:
+    required: false
+    default: 'false'
+    description:
+      'Install and run git hooks (lefthook, husky, or native) during builds. When false (default), hooks are disabled
+      for build performance.'
+  gitHooksSkipList:
+    required: false
+    default: ''
+    description:
+      'Comma-separated list of hook names to skip even when gitHooksEnabled is true. Example: pre-push,post-merge'
+  gitHooksRunBeforeBuild:
+    required: false
+    default: ''
+    description:
+      'Comma-separated list of lefthook hook groups to run before the Unity build. Allows CI to trigger checks that
+      normally only run on git events. Example: pre-commit,pre-push. Requires lefthook. Works with Unity Git Hooks
+      (com.frostebite.unitygithooks) when installed as a UPM package — the init script runs automatically.'
+  providerExecutable:
+    required: false
+    default: ''
+    description:
+      'Path to an external CLI executable that implements the provider protocol. Enables providers written in any
+      language (Go, Python, Rust, shell). Uses JSON-over-stdin/stdout communication.'
+  gcpProject:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Google Cloud project ID for Cloud Run Jobs provider. Falls back to
+      GOOGLE_CLOUD_PROJECT env var.'
+  gcpRegion:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Google Cloud region for Cloud Run Jobs (e.g. us-central1). Defaults to the region
+      input if empty.'
+  gcpStorageType:
+    required: false
+    default: 'gcs-fuse'
+    description:
+      '[Orchestrator] [Experimental] Storage type for Cloud Run Jobs. Options: gcs-fuse (mount GCS bucket as filesystem,
+      unlimited size, best for large sequential I/O), gcs-copy (copy artifacts in/out via gsutil, simpler, no FUSE
+      overhead), nfs (Filestore NFS mount, true POSIX, good random I/O, up to 100 TiB), in-memory (tmpfs, fastest but
+      volatile, up to 32 GiB).'
+  gcpBucket:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] GCS bucket name for build artifact storage. Used by gcs-fuse and gcs-copy storage
+      types.'
+  gcpFilestoreIp:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Filestore instance IP address for NFS storage type. Required when gcpStorageType is
+      nfs.'
+  gcpFilestoreShare:
+    required: false
+    default: '/share1'
+    description:
+      '[Orchestrator] [Experimental] Filestore share name for NFS storage type. Defaults to /share1 (the Filestore
+      default).'
+  gcpMachineType:
+    required: false
+    default: 'e2-standard-4'
+    description: '[Orchestrator] [Experimental] Machine type for Cloud Run Jobs (e.g. e2-standard-4, e2-highmem-8).'
+  gcpDiskSizeGb:
+    required: false
+    default: '100'
+    description:
+      '[Orchestrator] [Experimental] Disk size in GB for Cloud Run Jobs in-memory volumes. Only applies to in-memory
+      storage type (max 32).'
+  gcpServiceAccount:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Google Cloud service account email for Cloud Run Jobs execution.'
+  gcpVpcConnector:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] VPC connector name for Cloud Run Jobs private networking.'
+  azureResourceGroup:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure resource group for Container Instances provider. Falls back to
+      AZURE_RESOURCE_GROUP env var.'
+  azureLocation:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure region for Container Instances (e.g. eastus, westeurope). Defaults to the
+      region input if empty.'
+  azureStorageType:
+    required: false
+    default: 'azure-files'
+    description:
+      '[Orchestrator] [Experimental] Storage type for Azure Container Instances. Options: azure-files (SMB file share
+      mount, up to 100 TiB, premium throughput), blob-copy (copy artifacts in/out via az storage blob, no mount
+      overhead), azure-files-nfs (NFS 4.1 file share mount, true POSIX, no SMB lock overhead), in-memory (emptyDir
+      tmpfs, fastest but volatile, size limited by container memory).'
+  azureStorageAccount:
+    required: false
+    default: ''
+    description:
+      '[Orchestrator] [Experimental] Azure Storage Account name. Used by azure-files, azure-files-nfs, and blob-copy
+      storage types.'
+  azureFileShareName:
+    required: false
+    default: 'unity-builds'
+    description:
+      '[Orchestrator] [Experimental] Azure File Share name within the storage account. Used by azure-files and
+      azure-files-nfs storage types. Supports up to 100 TiB per share.'
+  azureBlobContainer:
+    required: false
+    default: 'unity-builds'
+    description: '[Orchestrator] [Experimental] Azure Blob container name for blob-copy storage type.'
+  azureSubscriptionId:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Azure subscription ID. Falls back to AZURE_SUBSCRIPTION_ID env var.'
+  azureCpu:
+    required: false
+    default: '4'
+    description: '[Orchestrator] [Experimental] CPU cores for Azure Container Instances (1-16).'
+  azureMemoryGb:
+    required: false
+    default: '16'
+    description: '[Orchestrator] [Experimental] Memory in GB for Azure Container Instances (1-16).'
+  azureDiskSizeGb:
+    required: false
+    default: '100'
+    description:
+      '[Orchestrator] [Experimental] File share quota in GB for Azure Container Instances. Premium shares support up to
+      102400 GB (100 TiB).'
+  azureSubnetId:
+    required: false
+    default: ''
+    description: '[Orchestrator] [Experimental] Azure subnet resource ID for VNet-integrated Container Instances.'
+  remotePowershellHost:
+    default: ''
+    required: false
+    description: '[Orchestrator] Remote PowerShell host (hostname or IP) for the remote-powershell provider'
+  remotePowershellCredential:
+    default: ''
+    required: false
+    description: '[Orchestrator] Remote PowerShell credential (username:password or certificate path)'
+  remotePowershellTransport:
+    default: 'wsman'
+    required: false
+    description: '[Orchestrator] Remote PowerShell transport protocol (wsman or ssh)'
+  githubActionsRepo:
+    default: ''
+    required: false
+    description: '[Orchestrator] Target repository (owner/repo) for the github-actions provider'
+  githubActionsWorkflow:
+    default: ''
+    required: false
+    description: '[Orchestrator] Workflow filename or ID to dispatch for the github-actions provider'
+  githubActionsToken:
+    default: ''
+    required: false
+    description: '[Orchestrator] PAT with actions:write scope for the github-actions provider'
+  githubActionsRef:
+    default: 'main'
+    required: false
+    description: '[Orchestrator] Branch/ref to run the workflow on for the github-actions provider'
+  gitlabProjectId:
+    default: ''
+    required: false
+    description: '[Orchestrator] GitLab project ID or URL-encoded path for the gitlab-ci provider'
+  gitlabTriggerToken:
+    default: ''
+    required: false
+    description: '[Orchestrator] Pipeline trigger token for the gitlab-ci provider'
+  gitlabApiUrl:
+    default: 'https://gitlab.com'
+    required: false
+    description: '[Orchestrator] GitLab API URL (for self-hosted instances) for the gitlab-ci provider'
+  gitlabRef:
+    default: 'main'
+    required: false
+    description: '[Orchestrator] Branch/ref to trigger the pipeline on for the gitlab-ci provider'
+  ansibleInventory:
+    default: ''
+    required: false
+    description: '[Orchestrator] Path to Ansible inventory file or dynamic inventory script'
+  ansiblePlaybook:
+    default: ''
+    required: false
+    description: '[Orchestrator] Path to Ansible playbook for Unity builds'
+  ansibleExtraVars:
+    default: ''
+    required: false
+    description: '[Orchestrator] Additional Ansible variables as JSON'
+  ansibleVaultPassword:
+    default: ''
+    required: false
+    description: '[Orchestrator] Path to Ansible vault password file'
+  gitIntegrityCheck:
+    description: 'Run git integrity checks before build (fsck, lock cleanup, submodule validation)'
+    required: false
+    default: 'false'
+  gitAutoRecover:
+    description: 'Attempt automatic recovery if git corruption is detected'
+    required: false
+    default: 'false'
+  cleanReservedFilenames:
+    description: 'Remove Windows reserved filenames that cause Unity import loops'
+    required: false
+    default: 'false'
+  buildArchiveEnabled:
+    description: 'Archive build output after successful build'
+    required: false
+    default: 'false'
+  buildArchivePath:
+    description: 'Path to store build archives'
+    required: false
+    default: './build-archives'
+  buildArchiveRetention:
+    description: 'Days to retain build archives before cleanup'
+    required: false
+    default: '30'
+  testSuitePath:
+    description: 'Path to YAML test suite definition file'
+    required: false
+  testSuiteEvent:
+    description: 'CI event name for suite selection (pr, push, release)'
+    required: false
+  testTaxonomyPath:
+    description: 'Path to custom taxonomy definition YAML'
+    required: false
+  testResultFormat:
+    description: 'Test result output format: junit, json, or both'
+    required: false
+    default: 'junit'
+  testResultPath:
+    description: 'Directory for structured test result output'
+    required: false
+    default: './test-results'
 
   hotRunnerEnabled:
     description: '[HotRunner] Use persistent hot runner for builds (requires pre-registered runners)'
@@ -308,6 +704,24 @@ inputs:
     description: '[HotRunner] Fall back to cold build if no hot runner available'
     required: false
     default: 'true'
+  syncStrategy:
+    description: 'Workspace sync strategy: full, git-delta, direct-input, storage-pull'
+    required: false
+    default: 'full'
+  syncInputRef:
+    description: 'URI for direct-input or storage-pull content (storage://remote/path or file path)'
+    required: false
+  syncStorageRemote:
+    description: 'rclone remote name for storage-backed inputs (defaults to rcloneRemote)'
+    required: false
+  syncRevertAfter:
+    description: 'Revert overlaid changes after job completion'
+    required: false
+    default: 'true'
+  syncStatePath:
+    description: 'Path to sync state file for delta tracking'
+    required: false
+    default: '.game-ci/sync-state.json'
 
 outputs:
   volume:
@@ -321,6 +735,8 @@ outputs:
       'Returns the exit code from the build scripts. This code is 0 if the build was successful. If there was an error
       during activation, the code is from the activation step. If activation is successful, the code is from the project
       build step.'
+  artifactManifestPath:
+    description: 'Path to the generated artifact manifest JSON file'
 branding:
   icon: 'box'
   color: 'gray-dark'

community-plugins.yml

@@ -0,0 +1,27 @@
+# Community Plugin Validation Registry
+# Packages listed here are automatically tested on a schedule
+# to ensure compatibility with unity-builder.
+#
+# Format:
+#   - name: Human-readable name
+#     package: UPM package name or git URL
+#     source: upm | git | asset-store
+#     unity: Minimum Unity version (optional, defaults to 2021.3)
+#     platforms: List of platforms to test (optional, defaults to [StandaloneLinux64])
+#     timeout: Build timeout in minutes (optional, defaults to 30)
+
+plugins:
+  # Example entries — community members can submit PRs to add their packages
+  - name: UniTask
+    package: https://github.com/Cysharp/UniTask.git?path=src/UniTask/Assets/Plugins/UniTask
+    source: git
+    platforms: [StandaloneLinux64, StandaloneWindows64]
+
+  - name: NaughtyAttributes
+    package: https://github.com/dbrizov/NaughtyAttributes.git?path=Assets/NaughtyAttributes
+    source: git
+
+  - name: Unity Atoms
+    package: https://github.com/unity-atoms/unity-atoms.git
+    source: git
+    platforms: [StandaloneLinux64]

delete-me-update-all-integration-branches.ps1

@@ -0,0 +1,138 @@
+# delete-me-update-all-integration-branches.ps1
+# Updates ALL integration branches from their component branches.
+# Run from any branch -- it will stash changes, update each integration branch, then return.
+
+$ErrorActionPreference = 'Stop'
+
+$originalBranch = git rev-parse --abbrev-ref HEAD
+$stashed = $false
+
+# Stash any uncommitted changes
+$status = git status --porcelain
+if ($status) {
+    Write-Host "Stashing uncommitted changes..." -ForegroundColor Cyan
+    git stash push -m "auto-stash before integration branch update"
+    $stashed = $true
+}
+
+Write-Host "Fetching all branches from origin..." -ForegroundColor Cyan
+git fetch origin
+
+$integrationBranches = @(
+    @{
+        Name = 'release/next-gen'
+        Branches = @(
+            'feature/test-workflow-engine'
+            'feature/hot-runner-protocol'
+            'feature/generic-artifact-system'
+            'feature/incremental-sync-protocol'
+            'feature/community-plugin-validation'
+            'feature/cli-support'
+        )
+    }
+    @{
+        Name = 'release/lts-infrastructure'
+        Branches = @(
+            'feature/orchestrator-enterprise-support'
+            'feature/cloud-run-azure-providers'
+            'feature/provider-load-balancing'
+            'feature/orchestrator-unit-tests'
+            'fix/secure-git-token-usage'
+            'feature/premade-secret-sources'
+            'feature/ci-platform-providers'
+            'feature/build-reliability'
+            'ci/orchestrator-integrity-speedup'
+        )
+    }
+    @{
+        Name = 'release/lts-2.0.0'
+        Branches = @(
+            # Infrastructure
+            'feature/orchestrator-enterprise-support'
+            'feature/cloud-run-azure-providers'
+            'feature/provider-load-balancing'
+            'feature/orchestrator-unit-tests'
+            'fix/secure-git-token-usage'
+            'feature/premade-secret-sources'
+            'feature/ci-platform-providers'
+            'feature/build-reliability'
+            'ci/orchestrator-integrity-speedup'
+            # Next-gen
+            'feature/test-workflow-engine'
+            'feature/hot-runner-protocol'
+            'feature/generic-artifact-system'
+            'feature/incremental-sync-protocol'
+            'feature/community-plugin-validation'
+            'feature/cli-support'
+        )
+    }
+)
+
+foreach ($integration in $integrationBranches) {
+    $name = $integration.Name
+    Write-Host "`n========================================" -ForegroundColor Cyan
+    Write-Host "Updating $name" -ForegroundColor Cyan
+    Write-Host "========================================" -ForegroundColor Cyan
+
+    # Check if branch exists locally
+    $exists = git branch --list $name
+    if (-not $exists) {
+        Write-Host "Creating local branch from origin/$name..." -ForegroundColor Yellow
+        git checkout -b $name "origin/$name"
+    } else {
+        git checkout $name
+        git pull origin $name --ff-only 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            git pull origin $name --no-edit
+        }
+    }
+
+    $failed = @()
+    foreach ($branch in $integration.Branches) {
+        $remoteBranch = "origin/$branch"
+        # Check if remote branch exists
+        $refExists = git rev-parse --verify $remoteBranch 2>$null
+        if ($LASTEXITCODE -ne 0) {
+            Write-Host "  Skipping $branch (not found on remote)" -ForegroundColor DarkGray
+            continue
+        }
+
+        # Check if already merged
+        $mergeBase = git merge-base HEAD $remoteBranch 2>$null
+        $remoteHead = git rev-parse $remoteBranch 2>$null
+        if ($mergeBase -eq $remoteHead) {
+            Write-Host "  $branch - already up to date" -ForegroundColor DarkGray
+            continue
+        }
+
+        Write-Host "  Merging $branch..." -ForegroundColor Yellow
+        $result = git merge $remoteBranch --no-edit 2>&1
+        if ($LASTEXITCODE -ne 0) {
+            Write-Host "    CONFLICT - skipped (resolve manually)" -ForegroundColor Red
+            $failed += $branch
+            git merge --abort
+        } else {
+            Write-Host "    OK" -ForegroundColor Green
+        }
+    }
+
+    if ($failed.Count -gt 0) {
+        Write-Host "`n  Conflicts in:" -ForegroundColor Red
+        $failed | ForEach-Object { Write-Host "    - $_" -ForegroundColor Red }
+    }
+
+    # Push
+    Write-Host "  Pushing $name to origin..." -ForegroundColor Cyan
+    git push origin $name
+}
+
+# Return to original branch
+Write-Host "`nReturning to $originalBranch..." -ForegroundColor Cyan
+git checkout $originalBranch
+
+if ($stashed) {
+    Write-Host "Restoring stashed changes..." -ForegroundColor Cyan
+    git stash pop
+}
+
+Write-Host "`nDone!" -ForegroundColor Green

delete-me-update-this-integration-branch.ps1

@@ -0,0 +1,60 @@
+# delete-me-update-this-integration-branch.ps1
+# Run this script from the repo root while on the release/lts-2.0.0 branch.
+# It merges the latest from each component branch to keep this integration branch current.
+# After running, review any conflicts, then commit and push.
+
+$ErrorActionPreference = 'Stop'
+
+$branchName = git rev-parse --abbrev-ref HEAD
+if ($branchName -ne 'release/lts-2.0.0') {
+    Write-Error "Must be on release/lts-2.0.0 branch. Currently on: $branchName"
+    exit 1
+}
+
+# Component branches for this integration branch
+$branches = @(
+    # Infrastructure
+    'feature/orchestrator-enterprise-support'
+    'feature/cloud-run-azure-providers'
+    'feature/provider-load-balancing'
+    'feature/orchestrator-unit-tests'
+    'fix/secure-git-token-usage'
+    'feature/premade-secret-sources'
+    'feature/ci-platform-providers'
+    'feature/build-reliability'
+    'ci/orchestrator-integrity-speedup'
+    # Next-gen
+    'feature/test-workflow-engine'
+    'feature/hot-runner-protocol'
+    'feature/generic-artifact-system'
+    'feature/incremental-sync-protocol'
+    'feature/community-plugin-validation'
+    'feature/cli-support'
+)
+
+Write-Host "Fetching latest from origin..." -ForegroundColor Cyan
+git fetch origin
+
+$failed = @()
+foreach ($branch in $branches) {
+    Write-Host "`nMerging origin/$branch..." -ForegroundColor Yellow
+    $result = git merge "origin/$branch" --no-edit 2>&1
+    if ($LASTEXITCODE -ne 0) {
+        Write-Host "  CONFLICT merging $branch - resolve manually" -ForegroundColor Red
+        $failed += $branch
+        # Abort this merge so we can continue with others
+        git merge --abort
+    } else {
+        Write-Host "  Merged successfully" -ForegroundColor Green
+    }
+}
+
+if ($failed.Count -gt 0) {
+    Write-Host "`nThe following branches had conflicts and were skipped:" -ForegroundColor Red
+    $failed | ForEach-Object { Write-Host "  - $_" -ForegroundColor Red }
+    Write-Host "`nRe-run after resolving, or merge them manually:" -ForegroundColor Yellow
+    $failed | ForEach-Object { Write-Host "  git merge origin/$_" -ForegroundColor Yellow }
+} else {
+    Write-Host "`nAll branches merged successfully!" -ForegroundColor Green
+    Write-Host "Run 'git push origin release/lts-2.0.0' to update the remote." -ForegroundColor Cyan
+}

install.ps1

@@ -0,0 +1,122 @@
+# game-ci CLI installer for Windows
+# Usage: irm https://raw.githubusercontent.com/game-ci/unity-builder/main/install.ps1 | iex
+#
+# Environment variables:
+#   GAME_CI_VERSION   - Install a specific version (e.g., v2.0.0). Defaults to latest.
+#   GAME_CI_INSTALL   - Installation directory. Defaults to $HOME\.game-ci\bin.
+
+$ErrorActionPreference = 'Stop'
+
+$Repo = "game-ci/unity-builder"
+$InstallDir = if ($env:GAME_CI_INSTALL) { $env:GAME_CI_INSTALL } else { Join-Path $env:USERPROFILE ".game-ci\bin" }
+$AssetName = "game-ci-windows-x64.exe"
+$BinaryName = "game-ci.exe"
+
+function Write-Info($Message) {
+    Write-Host "info: " -ForegroundColor Green -NoNewline
+    Write-Host $Message
+}
+
+function Write-Warn($Message) {
+    Write-Host "warn: " -ForegroundColor Yellow -NoNewline
+    Write-Host $Message
+}
+
+# Determine version
+if ($env:GAME_CI_VERSION) {
+    $Version = $env:GAME_CI_VERSION
+    Write-Info "Using specified version: $Version"
+} else {
+    Write-Info "Fetching latest release..."
+    try {
+        $Release = Invoke-RestMethod "https://api.github.com/repos/$Repo/releases/latest"
+        $Version = $Release.tag_name
+    } catch {
+        Write-Host "error: Could not determine latest version. Check https://github.com/$Repo/releases" -ForegroundColor Red
+        exit 1
+    }
+}
+
+$DownloadUrl = "https://github.com/$Repo/releases/download/$Version/$AssetName"
+$ChecksumUrl = "https://github.com/$Repo/releases/download/$Version/checksums.txt"
+$BinaryPath = Join-Path $InstallDir $BinaryName
+
+Write-Host ""
+Write-Info "Installing game-ci $Version (windows-x64)"
+Write-Info "  from: $DownloadUrl"
+Write-Info "  to:   $BinaryPath"
+Write-Host ""
+
+# Create install directory
+if (-not (Test-Path $InstallDir)) {
+    New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
+}
+
+# Download binary
+try {
+    Invoke-WebRequest -Uri $DownloadUrl -OutFile $BinaryPath -UseBasicParsing
+} catch {
+    if ($_.Exception.Response.StatusCode -eq 404) {
+        Write-Host "error: Release asset not found: $AssetName ($Version)" -ForegroundColor Red
+        Write-Host "       Check available assets at https://github.com/$Repo/releases/tag/$Version" -ForegroundColor Red
+    } else {
+        Write-Host "error: Download failed: $_" -ForegroundColor Red
+    }
+    exit 1
+}
+
+# Verify checksum
+try {
+    $Checksums = Invoke-WebRequest -Uri $ChecksumUrl -UseBasicParsing | Select-Object -ExpandProperty Content
+    $ExpectedLine = $Checksums -split "`n" | Where-Object { $_ -match $AssetName } | Select-Object -First 1
+    if ($ExpectedLine) {
+        $ExpectedHash = ($ExpectedLine -split '\s+')[0]
+        $ActualHash = (Get-FileHash -Path $BinaryPath -Algorithm SHA256).Hash.ToLower()
+        if ($ExpectedHash -eq $ActualHash) {
+            Write-Info "Checksum verified (SHA256)"
+        } else {
+            Write-Host "error: Checksum verification failed!" -ForegroundColor Red
+            Write-Host "  Expected: $ExpectedHash" -ForegroundColor Red
+            Write-Host "  Got:      $ActualHash" -ForegroundColor Red
+            Remove-Item $BinaryPath -Force
+            exit 1
+        }
+    }
+} catch {
+    # Checksums not available for this release; continue without verification
+}
+
+# Verify the binary works
+try {
+    $VersionOutput = & $BinaryPath version 2>&1
+    Write-Info "Verified: $($VersionOutput | Select-Object -First 1)"
+} catch {
+    Write-Warn "Binary downloaded but could not verify. It may still work."
+}
+
+Write-Host ""
+Write-Host "game-ci installed successfully!" -ForegroundColor Green -BackgroundColor Black
+Write-Host ""
+
+# Check PATH and offer to add
+$UserPath = [Environment]::GetEnvironmentVariable('PATH', 'User')
+if ($UserPath -notlike "*$InstallDir*") {
+    Write-Warn "game-ci is not in your PATH."
+    Write-Host ""
+    Write-Host "To add it permanently, run:" -ForegroundColor Yellow
+    Write-Host ""
+    Write-Host "  [Environment]::SetEnvironmentVariable('PATH', ""$InstallDir;"" + [Environment]::GetEnvironmentVariable('PATH', 'User'), 'User')"
+    Write-Host ""
+    Write-Info "Then restart your terminal."
+
+    # Offer to add automatically
+    Write-Host ""
+    $AddToPath = Read-Host "Add to PATH now? (Y/n)"
+    if ($AddToPath -ne 'n' -and $AddToPath -ne 'N') {
+        [Environment]::SetEnvironmentVariable('PATH', "$InstallDir;$UserPath", 'User')
+        $env:PATH = "$InstallDir;$env:PATH"
+        Write-Info "Added to PATH. You can now run: game-ci --help"
+    }
+} else {
+    Write-Info "game-ci is already in your PATH. Run: game-ci --help"
+}

install.sh

@@ -0,0 +1,196 @@
+#!/bin/sh
+# game-ci CLI installer
+# Usage: curl -fsSL https://raw.githubusercontent.com/game-ci/unity-builder/main/install.sh | sh
+#
+# Environment variables:
+#   GAME_CI_VERSION   - Install a specific version (e.g., v2.0.0). Defaults to latest.
+#   GAME_CI_INSTALL   - Installation directory. Defaults to ~/.game-ci/bin.
+
+set -e
+
+REPO="game-ci/unity-builder"
+INSTALL_DIR="${GAME_CI_INSTALL:-$HOME/.game-ci/bin}"
+BINARY_NAME="game-ci"
+
+# Colors (disabled if not a terminal)
+if [ -t 1 ]; then
+  BOLD='\033[1m'
+  GREEN='\033[0;32m'
+  YELLOW='\033[0;33m'
+  RED='\033[0;31m'
+  RESET='\033[0m'
+else
+  BOLD=''
+  GREEN=''
+  YELLOW=''
+  RED=''
+  RESET=''
+fi
+
+info() {
+  printf "${GREEN}info${RESET}: %s\n" "$1"
+}
+
+warn() {
+  printf "${YELLOW}warn${RESET}: %s\n" "$1"
+}
+
+error() {
+  printf "${RED}error${RESET}: %s\n" "$1" >&2
+  exit 1
+}
+
+# Detect OS and architecture
+detect_platform() {
+  OS="$(uname -s)"
+  ARCH="$(uname -m)"
+
+  case "$OS" in
+    Linux*)  PLATFORM="linux" ;;
+    Darwin*) PLATFORM="macos" ;;
+    MINGW*|MSYS*|CYGWIN*)
+      PLATFORM="windows"
+      warn "For Windows, consider using install.ps1 instead:"
+      warn "  irm https://raw.githubusercontent.com/game-ci/unity-builder/main/install.ps1 | iex"
+      ;;
+    *) error "Unsupported operating system: $OS" ;;
+  esac
+
+  case "$ARCH" in
+    x86_64|amd64)  ARCH="x64" ;;
+    aarch64|arm64) ARCH="arm64" ;;
+    *) error "Unsupported architecture: $ARCH" ;;
+  esac
+
+  ASSET_NAME="game-ci-${PLATFORM}-${ARCH}"
+  if [ "$PLATFORM" = "windows" ]; then
+    ASSET_NAME="${ASSET_NAME}.exe"
+    BINARY_NAME="game-ci.exe"
+  fi
+}
+
+# Get latest release tag from GitHub API
+get_latest_version() {
+  if [ -n "$GAME_CI_VERSION" ]; then
+    VERSION="$GAME_CI_VERSION"
+    info "Using specified version: $VERSION"
+    return
+  fi
+
+  info "Fetching latest release..."
+
+  if command -v curl > /dev/null 2>&1; then
+    VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  elif command -v wget > /dev/null 2>&1; then
+    VERSION=$(wget -qO- "https://api.github.com/repos/${REPO}/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
+  else
+    error "Neither curl nor wget found. Please install one of them."
+  fi
+
+  if [ -z "$VERSION" ]; then
+    error "Could not determine latest version. Check https://github.com/${REPO}/releases"
+  fi
+}
+
+# Download and install the binary
+install() {
+  DOWNLOAD_URL="https://github.com/${REPO}/releases/download/${VERSION}/${ASSET_NAME}"
+
+  printf "\n"
+  info "Installing game-ci ${VERSION} (${PLATFORM}-${ARCH})"
+  info "  from: ${DOWNLOAD_URL}"
+  info "  to:   ${INSTALL_DIR}/${BINARY_NAME}"
+  printf "\n"
+
+  mkdir -p "$INSTALL_DIR"
+
+  # Download with progress
+  if command -v curl > /dev/null 2>&1; then
+    HTTP_CODE=$(curl -fSL "$DOWNLOAD_URL" -o "${INSTALL_DIR}/${BINARY_NAME}" -w "%{http_code}" 2>/dev/null) || true
+    if [ "$HTTP_CODE" = "404" ]; then
+      error "Release asset not found: ${ASSET_NAME} (${VERSION}). Check available assets at https://github.com/${REPO}/releases/tag/${VERSION}"
+    elif [ ! -f "${INSTALL_DIR}/${BINARY_NAME}" ]; then
+      error "Download failed. URL: ${DOWNLOAD_URL}"
+    fi
+  elif command -v wget > /dev/null 2>&1; then
+    wget -q "$DOWNLOAD_URL" -O "${INSTALL_DIR}/${BINARY_NAME}" || error "Download failed. URL: ${DOWNLOAD_URL}"
+  fi
+
+  chmod +x "${INSTALL_DIR}/${BINARY_NAME}"
+
+  # Verify the binary works
+  if "${INSTALL_DIR}/${BINARY_NAME}" version > /dev/null 2>&1; then
+    INSTALLED_VERSION=$("${INSTALL_DIR}/${BINARY_NAME}" version 2>&1 | head -1)
+    info "Verified: ${INSTALLED_VERSION}"
+  else
+    warn "Binary downloaded but could not verify. It may still work."
+  fi
+
+  printf "\n"
+  printf "${BOLD}game-ci installed successfully!${RESET}\n"
+  printf "\n"
+
+  # Check if install dir is in PATH
+  case ":$PATH:" in
+    *":${INSTALL_DIR}:"*)
+      info "game-ci is already in your PATH. Run: game-ci --help"
+      ;;
+    *)
+      SHELL_NAME=$(basename "$SHELL" 2>/dev/null || echo "sh")
+      case "$SHELL_NAME" in
+        zsh)  PROFILE="~/.zshrc" ;;
+        bash) PROFILE="~/.bashrc" ;;
+        fish) PROFILE="~/.config/fish/config.fish" ;;
+        *)    PROFILE="~/.profile" ;;
+      esac
+
+      printf "${YELLOW}Add game-ci to your PATH by adding this to ${PROFILE}:${RESET}\n"
+      printf "\n"
+      if [ "$SHELL_NAME" = "fish" ]; then
+        printf "  set -gx PATH \"%s\" \$PATH\n" "$INSTALL_DIR"
+      else
+        printf "  export PATH=\"%s:\$PATH\"\n" "$INSTALL_DIR"
+      fi
+      printf "\n"
+      info "Then restart your shell or run: source ${PROFILE}"
+      ;;
+  esac
+}
+
+# Verify checksum if checksums.txt is available
+verify_checksum() {
+  if ! command -v sha256sum > /dev/null 2>&1; then
+    return 0
+  fi
+
+  CHECKSUM_URL="https://github.com/${REPO}/releases/download/${VERSION}/checksums.txt"
+
+  CHECKSUMS=""
+  if command -v curl > /dev/null 2>&1; then
+    CHECKSUMS=$(curl -fsSL "$CHECKSUM_URL" 2>/dev/null) || return 0
+  elif command -v wget > /dev/null 2>&1; then
+    CHECKSUMS=$(wget -qO- "$CHECKSUM_URL" 2>/dev/null) || return 0
+  fi
+
+  if [ -z "$CHECKSUMS" ]; then
+    return 0
+  fi
+
+  EXPECTED=$(echo "$CHECKSUMS" | grep "$ASSET_NAME" | awk '{print $1}')
+  if [ -z "$EXPECTED" ]; then
+    return 0
+  fi
+
+  ACTUAL=$(sha256sum "${INSTALL_DIR}/${BINARY_NAME}" | awk '{print $1}')
+  if [ "$EXPECTED" != "$ACTUAL" ]; then
+    error "Checksum verification failed!\n  Expected: ${EXPECTED}\n  Got:      ${ACTUAL}"
+  fi
+
+  info "Checksum verified (SHA256)"
+}
+
+# Main
+detect_platform
+get_latest_version
+install
+verify_checksum

package.json

@@ -3,6 +3,24 @@
   "version": "3.0.0",
   "description": "Build Unity projects for different platforms.",
   "main": "dist/index.js",
+  "bin": {
+    "game-ci": "./lib/cli.js"
+  },
+  "pkg": {
+    "scripts": "lib/**/*.js",
+    "assets": [
+      "lib/**/*.json",
+      "package.json"
+    ],
+    "targets": [
+      "node20-linux-x64",
+      "node20-linux-arm64",
+      "node20-macos-x64",
+      "node20-macos-arm64",
+      "node20-win-x64"
+    ],
+    "outputPath": "dist-binaries"
+  },
   "repository": "git@github.com:game-ci/unity-builder.git",
   "author": "Webber <webber@takken.io>",
   "license": "MIT",
@@ -12,6 +30,7 @@
     "lint": "prettier --check \"src/**/*.{js,ts}\" && eslint src/**/*.ts",
     "format": "prettier --write \"src/**/*.{js,ts}\"",
     "cli": "yarn ts-node src/index.ts -m cli",
+    "game-ci": "ts-node src/cli.ts",
     "gcp-secrets-tests": "cross-env providerStrategy=aws orchestratorTests=true inputPullCommand=\"gcp-secret-manager\" populateOverride=true pullInputList=UNITY_EMAIL,UNITY_SERIAL,UNITY_PASSWORD yarn test -i -t \"orchestrator\"",
     "gcp-secrets-cli": "cross-env orchestratorTests=true USE_IL2CPP=false inputPullCommand=\"gcp-secret-manager\" yarn ts-node src/index.ts -m cli --populateOverride true --pullInputList UNITY_EMAIL,UNITY_SERIAL,UNITY_PASSWORD",
     "aws-secrets-cli": "cross-env orchestratorTests=true inputPullCommand=\"aws-secret-manager\" yarn ts-node src/index.ts -m cli --populateOverride true --pullInputList UNITY_EMAIL,UNITY_SERIAL,UNITY_PASSWORD",
@@ -54,7 +73,8 @@
     "ts-md5": "^1.3.1",
     "unity-changeset": "^3.1.0",
     "uuid": "^9.0.0",
-    "yaml": "^2.2.2"
+    "yaml": "^2.2.2",
+    "yargs": "^17.7.2"
   },
   "devDependencies": {
     "@types/base-64": "^1.0.0",
@@ -62,6 +82,7 @@
     "@types/node": "^17.0.23",
     "@types/semver": "^7.3.9",
     "@types/uuid": "^9.0.0",
+    "@types/yargs": "^17.0.35",
     "@typescript-eslint/parser": "4.8.1",
     "@vercel/ncc": "^0.36.1",
     "cross-env": "^7.0.3",
@@ -77,6 +98,7 @@
     "js-yaml": "^4.1.0",
     "lefthook": "^1.6.1",
     "node-fetch": "2",
+    "pkg": "^5.8.1",
     "prettier": "^2.5.1",
     "ts-jest": "^27.1.3",
     "ts-node": "10.8.1",

src/cli.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+
+import yargs from 'yargs';
+import { hideBin } from 'yargs/helpers';
+import buildCommand from './cli/commands/build';
+import activateCommand from './cli/commands/activate';
+import orchestrateCommand from './cli/commands/orchestrate';
+import statusCommand from './cli/commands/status';
+import versionCommand from './cli/commands/version';
+import updateCommand from './cli/commands/update';
+import * as core from '@actions/core';
+
+const cli = yargs(hideBin(process.argv))
+  .scriptName('game-ci')
+  .usage('$0 <command> [options]')
+  .command(buildCommand)
+  .command(activateCommand)
+  .command(orchestrateCommand)
+  .command(statusCommand)
+  .command(versionCommand)
+  .command(updateCommand)
+  .demandCommand(1, 'You must specify a command. Run game-ci --help for available commands.')
+  .strict()
+  .alias('h', 'help')
+  .epilogue('For more information, visit https://game.ci')
+  .wrap(Math.min(120, process.stdout.columns || 80));
+
+async function main() {
+  try {
+    await cli.parse();
+  } catch (error: any) {
+    if (error.name !== 'YError') {
+      core.error(`Error: ${error.message}`);
+      process.exit(1);
+    }
+  }
+}
+
+main();

src/cli/__tests__/cli-integration.test.ts

@@ -0,0 +1,110 @@
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+
+/**
+ * Integration tests that spawn the CLI as a child process and verify
+ * exit codes and output. Uses node with --require ts-node/register to
+ * run the TypeScript entry point directly so no build step is required.
+ */
+
+const CLI_ENTRY = path.resolve(__dirname, '..', '..', 'cli.ts');
+
+function runCli(cliArguments: string[]): Promise<{ code: number | null; stdout: string; stderr: string }> {
+  return new Promise((resolve) => {
+    execFile(
+      process.execPath,
+      ['--require', 'ts-node/register/transpile-only', CLI_ENTRY, ...cliArguments],
+      { timeout: 30_000, cwd: path.resolve(__dirname, '..', '..', '..') },
+      (error, stdout, stderr) => {
+        resolve({
+          code: error ? error.code ?? 1 : 0,
+          stdout: stdout.toString(),
+          stderr: stderr.toString(),
+        });
+      },
+    );
+  });
+}
+
+// Integration tests spawn child processes which need more time than the default 5s
+jest.setTimeout(30_000);
+
+describe('CLI integration', () => {
+  it('exits 0 and shows all commands for --help', async () => {
+    const result = await runCli(['--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('game-ci');
+    expect(result.stdout).toContain('build');
+    expect(result.stdout).toContain('activate');
+    expect(result.stdout).toContain('orchestrate');
+    expect(result.stdout).toContain('status');
+    expect(result.stdout).toContain('version');
+    expect(result.stdout).toContain('update');
+  });
+
+  it('exits 0 and shows version info for version command', async () => {
+    const result = await runCli(['version']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('unity-builder');
+  });
+
+  it('exits 0 and shows build flags for build --help', async () => {
+    const result = await runCli(['build', '--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('--target-platform');
+    expect(result.stdout).toContain('--unity-version');
+    expect(result.stdout).toContain('--project-path');
+    expect(result.stdout).toContain('--build-name');
+    expect(result.stdout).toContain('--builds-path');
+    expect(result.stdout).toContain('--build-method');
+    expect(result.stdout).toContain('--custom-parameters');
+    expect(result.stdout).toContain('--provider-strategy');
+  });
+
+  it('exits non-zero for an unknown command', async () => {
+    const result = await runCli(['nonexistent']);
+
+    expect(result.code).not.toStrictEqual(0);
+  });
+
+  it('exits non-zero when no command is provided', async () => {
+    const result = await runCli([]);
+
+    expect(result.code).not.toStrictEqual(0);
+  });
+
+  it('exits 0 for orchestrate --help', async () => {
+    const result = await runCli(['orchestrate', '--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('--target-platform');
+    expect(result.stdout).toContain('--provider-strategy');
+    expect(result.stdout).toContain('cache');
+  });
+
+  it('exits 0 for activate --help', async () => {
+    const result = await runCli(['activate', '--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('activate');
+  });
+
+  it('exits 0 for orchestrate cache --help', async () => {
+    const result = await runCli(['orchestrate', 'cache', '--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('cache');
+  });
+
+  it('exits 0 for update --help', async () => {
+    const result = await runCli(['update', '--help']);
+
+    expect(result.code).toStrictEqual(0);
+    expect(result.stdout).toContain('update');
+    expect(result.stdout).toContain('--force');
+    expect(result.stdout).toContain('--version');
+  });
+});

src/cli/__tests__/commands.test.ts

@@ -0,0 +1,245 @@
+import buildCommand from '../commands/build';
+import activateCommand from '../commands/activate';
+import orchestrateCommand from '../commands/orchestrate';
+import statusCommand from '../commands/status';
+import versionCommand from '../commands/version';
+import updateCommand from '../commands/update';
+
+function createFakeYargs(): { yargs: any; options: Record<string, any> } {
+  const options: Record<string, any> = {};
+  const yargs: any = {
+    option: jest.fn(),
+    positional: jest.fn(),
+    example: jest.fn(),
+    env: jest.fn(),
+    command: jest.fn(),
+  };
+
+  yargs.option.mockImplementation((name: string, config: any) => {
+    options[name] = config;
+
+    return yargs;
+  });
+  yargs.positional.mockImplementation((name: string, config: any) => {
+    options[name] = config;
+
+    return yargs;
+  });
+  yargs.example.mockReturnValue(yargs);
+  yargs.env.mockReturnValue(yargs);
+  yargs.command.mockReturnValue(yargs);
+
+  return { yargs, options };
+}
+
+describe('CLI commands', () => {
+  describe('build command', () => {
+    it('exports the correct command name', () => {
+      expect(buildCommand.command).toStrictEqual('build');
+    });
+
+    it('has a description', () => {
+      expect(buildCommand.describe).toBeTruthy();
+    });
+
+    it('has a builder function', () => {
+      expect(typeof buildCommand.builder).toStrictEqual('function');
+    });
+
+    it('has a handler function', () => {
+      expect(typeof buildCommand.handler).toStrictEqual('function');
+    });
+
+    it('defines all expected build flags via builder', () => {
+      const { yargs, options } = createFakeYargs();
+
+      (buildCommand.builder as Function)(yargs);
+
+      // Core build flags
+      expect(options['target-platform']).toBeDefined();
+      expect(options['target-platform'].demandOption).toStrictEqual(true);
+      expect(options['unity-version']).toBeDefined();
+      expect(options['project-path']).toBeDefined();
+      expect(options['build-profile']).toBeDefined();
+      expect(options['build-name']).toBeDefined();
+      expect(options['builds-path']).toBeDefined();
+      expect(options['build-method']).toBeDefined();
+      expect(options['custom-parameters']).toBeDefined();
+      expect(options['versioning']).toBeDefined();
+      expect(options['version']).toBeDefined();
+      expect(options['custom-image']).toBeDefined();
+      expect(options['manual-exit']).toBeDefined();
+      expect(options['enable-gpu']).toBeDefined();
+
+      // Android flags
+      expect(options['android-version-code']).toBeDefined();
+      expect(options['android-export-type']).toBeDefined();
+      expect(options['android-keystore-name']).toBeDefined();
+      expect(options['android-keystore-base64']).toBeDefined();
+      expect(options['android-keystore-pass']).toBeDefined();
+      expect(options['android-keyalias-name']).toBeDefined();
+      expect(options['android-keyalias-pass']).toBeDefined();
+      expect(options['android-target-sdk-version']).toBeDefined();
+      expect(options['android-symbol-type']).toBeDefined();
+
+      // Docker flags
+      expect(options['docker-cpu-limit']).toBeDefined();
+      expect(options['docker-memory-limit']).toBeDefined();
+      expect(options['docker-workspace-path']).toBeDefined();
+      expect(options['run-as-host-user']).toBeDefined();
+      expect(options['chown-files-to']).toBeDefined();
+
+      // Provider flags
+      expect(options['provider-strategy']).toBeDefined();
+      expect(options['skip-activation']).toBeDefined();
+      expect(options['unity-licensing-server']).toBeDefined();
+    });
+
+    it('sets correct default values', () => {
+      const { yargs, options } = createFakeYargs();
+
+      (buildCommand.builder as Function)(yargs);
+
+      expect(options['unity-version'].default).toStrictEqual('auto');
+      expect(options['project-path'].default).toStrictEqual('.');
+      expect(options['builds-path'].default).toStrictEqual('build');
+      expect(options['versioning'].default).toStrictEqual('Semantic');
+      expect(options['manual-exit'].default).toStrictEqual(false);
+      expect(options['enable-gpu'].default).toStrictEqual(false);
+      expect(options['android-export-type'].default).toStrictEqual('androidPackage');
+      expect(options['android-symbol-type'].default).toStrictEqual('none');
+      expect(options['provider-strategy'].default).toStrictEqual('local');
+    });
+
+    it('provides camelCase aliases for kebab-case options', () => {
+      const { yargs, options } = createFakeYargs();
+
+      (buildCommand.builder as Function)(yargs);
+
+      expect(options['target-platform'].alias).toStrictEqual('targetPlatform');
+      expect(options['unity-version'].alias).toStrictEqual('unityVersion');
+      expect(options['project-path'].alias).toStrictEqual('projectPath');
+      expect(options['build-name'].alias).toStrictEqual('buildName');
+      expect(options['builds-path'].alias).toStrictEqual('buildsPath');
+      expect(options['build-method'].alias).toStrictEqual('buildMethod');
+    });
+  });
+
+  describe('activate command', () => {
+    it('exports the correct command name', () => {
+      expect(activateCommand.command).toStrictEqual('activate');
+    });
+
+    it('has a description', () => {
+      expect(activateCommand.describe).toBeTruthy();
+    });
+
+    it('has a builder function', () => {
+      expect(typeof activateCommand.builder).toStrictEqual('function');
+    });
+
+    it('has a handler function', () => {
+      expect(typeof activateCommand.handler).toStrictEqual('function');
+    });
+  });
+
+  describe('orchestrate command', () => {
+    it('exports the correct command name', () => {
+      expect(orchestrateCommand.command).toStrictEqual('orchestrate');
+    });
+
+    it('has a description', () => {
+      expect(orchestrateCommand.describe).toBeTruthy();
+    });
+
+    it('has a builder function', () => {
+      expect(typeof orchestrateCommand.builder).toStrictEqual('function');
+    });
+
+    it('has a handler function', () => {
+      expect(typeof orchestrateCommand.handler).toStrictEqual('function');
+    });
+
+    it('defines key orchestrator flags', () => {
+      const { yargs, options } = createFakeYargs();
+
+      (orchestrateCommand.builder as Function)(yargs);
+
+      expect(options['target-platform']).toBeDefined();
+      expect(options['provider-strategy']).toBeDefined();
+      expect(options['provider-strategy'].default).toStrictEqual('aws');
+      expect(options['aws-stack-name']).toBeDefined();
+      expect(options['kube-config']).toBeDefined();
+      expect(options['kube-volume']).toBeDefined();
+      expect(options['cache-key']).toBeDefined();
+      expect(options['watch-to-end']).toBeDefined();
+      expect(options['clone-depth']).toBeDefined();
+    });
+
+    it('registers cache as a subcommand', () => {
+      const { yargs } = createFakeYargs();
+
+      (orchestrateCommand.builder as Function)(yargs);
+
+      expect(yargs.command).toHaveBeenCalled();
+    });
+  });
+
+  describe('status command', () => {
+    it('exports the correct command name', () => {
+      expect(statusCommand.command).toStrictEqual('status');
+    });
+
+    it('has a description', () => {
+      expect(statusCommand.describe).toBeTruthy();
+    });
+
+    it('has a handler function', () => {
+      expect(typeof statusCommand.handler).toStrictEqual('function');
+    });
+  });
+
+  describe('version command', () => {
+    it('exports the correct command name', () => {
+      expect(versionCommand.command).toStrictEqual('version');
+    });
+
+    it('has a description', () => {
+      expect(versionCommand.describe).toBeTruthy();
+    });
+
+    it('has a handler function', () => {
+      expect(typeof versionCommand.handler).toStrictEqual('function');
+    });
+  });
+
+  describe('update command', () => {
+    it('exports the correct command name', () => {
+      expect(updateCommand.command).toStrictEqual('update');
+    });
+
+    it('has a description', () => {
+      expect(updateCommand.describe).toBeTruthy();
+    });
+
+    it('has a builder function', () => {
+      expect(typeof updateCommand.builder).toStrictEqual('function');
+    });
+
+    it('has a handler function', () => {
+      expect(typeof updateCommand.handler).toStrictEqual('function');
+    });
+
+    it('defines force and version flags', () => {
+      const { yargs, options } = createFakeYargs();
+
+      (updateCommand.builder as Function)(yargs);
+
+      expect(options['force']).toBeDefined();
+      expect(options['force'].type).toStrictEqual('boolean');
+      expect(options['force'].default).toStrictEqual(false);
+      expect(options['version']).toBeDefined();
+      expect(options['version'].type).toStrictEqual('string');
+    });
+  });
+});

src/cli/__tests__/input-mapper.test.ts

@@ -0,0 +1,221 @@
+import { mapCliArgumentsToInput, CliArguments } from '../input-mapper';
+import { Cli } from '../../model/cli/cli';
+import GitHub from '../../model/github';
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  Cli.options = undefined;
+});
+
+describe('mapCliArgumentsToInput', () => {
+  describe('basic mapping', () => {
+    it('populates Cli.options from CLI arguments', () => {
+      const cliArguments: CliArguments = {
+        targetPlatform: 'StandaloneLinux64',
+        unityVersion: '2022.3.56f1',
+        projectPath: './my-project',
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options).toBeDefined();
+      expect(Cli.options!['targetPlatform']).toStrictEqual('StandaloneLinux64');
+      expect(Cli.options!['unityVersion']).toStrictEqual('2022.3.56f1');
+      expect(Cli.options!['projectPath']).toStrictEqual('./my-project');
+    });
+
+    it('disables GitHub Actions input reading', () => {
+      const cliArguments: CliArguments = { targetPlatform: 'WebGL' };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(GitHub.githubInputEnabled).toStrictEqual(false);
+    });
+
+    it('sets mode to cli by default when not provided', () => {
+      const cliArguments: CliArguments = { targetPlatform: 'Android' };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['mode']).toStrictEqual('cli');
+    });
+
+    it('preserves an explicitly provided mode', () => {
+      const cliArguments: CliArguments = { targetPlatform: 'Android', mode: 'custom-mode' };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['mode']).toStrictEqual('custom-mode');
+    });
+  });
+
+  describe('default values', () => {
+    it('omits undefined values from Cli.options', () => {
+      const cliArguments: CliArguments = {
+        targetPlatform: 'StandaloneLinux64',
+        unityVersion: undefined,
+        buildName: undefined,
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['targetPlatform']).toStrictEqual('StandaloneLinux64');
+      expect(Cli.options!).not.toHaveProperty('unityVersion');
+      expect(Cli.options!).not.toHaveProperty('buildName');
+    });
+  });
+
+  describe('boolean conversion', () => {
+    it('converts boolean true to string "true"', () => {
+      const cliArguments: CliArguments = { manualExit: true };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['manualExit']).toStrictEqual('true');
+    });
+
+    it('converts boolean false to string "false"', () => {
+      const cliArguments: CliArguments = { enableGpu: false };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['enableGpu']).toStrictEqual('false');
+    });
+
+    it('converts allowDirtyBuild boolean to string', () => {
+      const cliArguments: CliArguments = { allowDirtyBuild: true };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['allowDirtyBuild']).toStrictEqual('true');
+    });
+  });
+
+  describe('yargs internal properties', () => {
+    it('filters out yargs _ property', () => {
+      const cliArguments: CliArguments = {
+        targetPlatform: 'iOS',
+        _: ['build'] as any,
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!).not.toHaveProperty('_');
+    });
+
+    it('filters out yargs $0 property', () => {
+      const cliArguments: CliArguments = {
+        targetPlatform: 'iOS',
+        $0: 'game-ci' as any,
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!).not.toHaveProperty('$0');
+    });
+  });
+
+  describe('flag name conversion', () => {
+    it('passes camelCase keys through directly', () => {
+      const cliArguments: CliArguments = {
+        androidKeystoreName: 'my.keystore',
+        androidKeystorePass: 'secret',
+        dockerCpuLimit: '4',
+        dockerMemoryLimit: '8g',
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['androidKeystoreName']).toStrictEqual('my.keystore');
+      expect(Cli.options!['androidKeystorePass']).toStrictEqual('secret');
+      expect(Cli.options!['dockerCpuLimit']).toStrictEqual('4');
+      expect(Cli.options!['dockerMemoryLimit']).toStrictEqual('8g');
+    });
+
+    it('maps all android-related arguments', () => {
+      const cliArguments: CliArguments = {
+        androidVersionCode: '42',
+        androidExportType: 'androidAppBundle',
+        androidKeystoreBase64: 'base64data',
+        androidKeyaliasName: 'myalias',
+        androidKeyaliasPass: 'aliaspass',
+        androidTargetSdkVersion: '33',
+        androidSymbolType: 'public',
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['androidVersionCode']).toStrictEqual('42');
+      expect(Cli.options!['androidExportType']).toStrictEqual('androidAppBundle');
+      expect(Cli.options!['androidKeystoreBase64']).toStrictEqual('base64data');
+      expect(Cli.options!['androidKeyaliasName']).toStrictEqual('myalias');
+      expect(Cli.options!['androidKeyaliasPass']).toStrictEqual('aliaspass');
+      expect(Cli.options!['androidTargetSdkVersion']).toStrictEqual('33');
+      expect(Cli.options!['androidSymbolType']).toStrictEqual('public');
+    });
+
+    it('maps docker and container arguments', () => {
+      const cliArguments: CliArguments = {
+        dockerIsolationMode: 'hyperv',
+        dockerWorkspacePath: '/custom/workspace',
+        containerRegistryRepository: 'custom/editor',
+        containerRegistryImageVersion: '5',
+        runAsHostUser: 'true',
+        chownFilesTo: 'root:root',
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['dockerIsolationMode']).toStrictEqual('hyperv');
+      expect(Cli.options!['dockerWorkspacePath']).toStrictEqual('/custom/workspace');
+      expect(Cli.options!['containerRegistryRepository']).toStrictEqual('custom/editor');
+      expect(Cli.options!['containerRegistryImageVersion']).toStrictEqual('5');
+      expect(Cli.options!['runAsHostUser']).toStrictEqual('true');
+      expect(Cli.options!['chownFilesTo']).toStrictEqual('root:root');
+    });
+
+    it('maps orchestrator-related arguments', () => {
+      const cliArguments: CliArguments = {
+        providerStrategy: 'k8s',
+        awsStackName: 'my-stack',
+        kubeConfig: 'base64config',
+        kubeVolume: 'my-pvc',
+        kubeVolumeSize: '10Gi',
+        kubeStorageClass: 'gp3',
+        containerCpu: '2048',
+        containerMemory: '4096',
+        cacheKey: 'my-cache',
+        watchToEnd: 'false',
+        cloneDepth: '100',
+      };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.options!['providerStrategy']).toStrictEqual('k8s');
+      expect(Cli.options!['awsStackName']).toStrictEqual('my-stack');
+      expect(Cli.options!['kubeConfig']).toStrictEqual('base64config');
+      expect(Cli.options!['kubeVolume']).toStrictEqual('my-pvc');
+      expect(Cli.options!['kubeVolumeSize']).toStrictEqual('10Gi');
+      expect(Cli.options!['kubeStorageClass']).toStrictEqual('gp3');
+      expect(Cli.options!['containerCpu']).toStrictEqual('2048');
+      expect(Cli.options!['containerMemory']).toStrictEqual('4096');
+      expect(Cli.options!['cacheKey']).toStrictEqual('my-cache');
+      expect(Cli.options!['watchToEnd']).toStrictEqual('false');
+      expect(Cli.options!['cloneDepth']).toStrictEqual('100');
+    });
+  });
+
+  describe('Cli.isCliMode integration', () => {
+    it('enables CLI mode after mapping', () => {
+      const cliArguments: CliArguments = { targetPlatform: 'WebGL' };
+
+      mapCliArgumentsToInput(cliArguments);
+
+      expect(Cli.isCliMode).toStrictEqual(true);
+    });
+
+    it('is not in CLI mode before mapping', () => {
+      expect(Cli.isCliMode).toStrictEqual(false);
+    });
+  });
+});

src/cli/commands/activate.ts

@@ -0,0 +1,83 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import { mapCliArgumentsToInput, CliArguments } from '../input-mapper';
+
+interface ActivateArguments extends CliArguments {
+  unityVersion?: string;
+  unitySerial?: string;
+  unityLicensingServer?: string;
+}
+
+const activateCommand: CommandModule<object, ActivateArguments> = {
+  command: 'activate',
+  describe: 'Verify Unity license configuration',
+  builder: (yargs) => {
+    return yargs
+      .option('unity-version', {
+        alias: 'unityVersion',
+        type: 'string',
+        description: 'Version of Unity to activate',
+        default: 'auto',
+      })
+      .option('unity-licensing-server', {
+        alias: 'unityLicensingServer',
+        type: 'string',
+        description: 'The Unity licensing server address for floating licenses',
+        default: '',
+      })
+      .env('UNITY')
+      .example(
+        'UNITY_SERIAL=XXXX-XXXX-XXXX-XXXX game-ci activate',
+        'Activate Unity using a serial from environment variable',
+      )
+      .example(
+        'game-ci activate --unity-licensing-server http://license-server:8080',
+        'Activate Unity using a floating license server',
+      ) as any;
+  },
+  handler: async (cliArguments) => {
+    try {
+      mapCliArgumentsToInput(cliArguments);
+
+      const unitySerial = process.env.UNITY_SERIAL;
+      const unityLicense = process.env.UNITY_LICENSE;
+      const licensingServer = cliArguments.unityLicensingServer || process.env.UNITY_LICENSING_SERVER || '';
+
+      if (licensingServer) {
+        core.info(`Activating Unity via licensing server: ${licensingServer}`);
+        core.info('Floating license activation is handled automatically during builds.');
+        core.info('No manual activation step is needed when using a licensing server.');
+
+        return;
+      }
+
+      if (!unitySerial && !unityLicense) {
+        throw new Error(
+          'No Unity license found.\n\n' +
+            'Provide one of the following:\n' +
+            '  - UNITY_SERIAL environment variable (professional license)\n' +
+            '  - UNITY_LICENSE environment variable (personal license file content)\n' +
+            '  - --unity-licensing-server flag (floating license)\n\n' +
+            'For more information, visit: https://game.ci/docs/github/activation',
+        );
+      }
+
+      if (unitySerial) {
+        const maskedSerial = unitySerial.length > 8 ? `${unitySerial.slice(0, 4)}...${unitySerial.slice(-4)}` : '****';
+        core.info(`Unity serial detected: ${maskedSerial}`);
+        core.info('License will be activated automatically when running a build.');
+      } else if (unityLicense) {
+        core.info('Unity license file detected from UNITY_LICENSE environment variable.');
+        core.info('License will be activated automatically when running a build.');
+      }
+
+      core.info('\nActivation verified. You can now run: game-ci build --target-platform <platform>');
+    } catch (error: any) {
+      core.setFailed(`Activation failed: ${error.message}`);
+
+      throw error;
+    }
+  },
+};
+
+export default activateCommand;

src/cli/commands/build.ts

@@ -0,0 +1,299 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import { BuildParameters, ImageTag, Orchestrator } from '../../model';
+import { mapCliArgumentsToInput, CliArguments } from '../input-mapper';
+import MacBuilder from '../../model/mac-builder';
+import Docker from '../../model/docker';
+import Action from '../../model/action';
+import PlatformSetup from '../../model/platform-setup';
+
+interface BuildArguments extends CliArguments {
+  targetPlatform: string;
+}
+
+const buildCommand: CommandModule<object, BuildArguments> = {
+  command: 'build',
+  describe: 'Build a Unity project',
+  builder: (yargs) => {
+    return yargs
+      .option('target-platform', {
+        alias: 'targetPlatform',
+        type: 'string',
+        description: 'Platform that the build should target',
+        demandOption: true,
+      })
+      .option('unity-version', {
+        alias: 'unityVersion',
+        type: 'string',
+        description: 'Version of Unity to use for building the project. Use "auto" to detect.',
+        default: 'auto',
+      })
+      .option('project-path', {
+        alias: 'projectPath',
+        type: 'string',
+        description: 'Path to the Unity project to be built',
+        default: '.',
+      })
+      .option('build-profile', {
+        alias: 'buildProfile',
+        type: 'string',
+        description: 'Path to the build profile to activate, relative to the project root',
+        default: '',
+      })
+      .option('build-name', {
+        alias: 'buildName',
+        type: 'string',
+        description: 'Name of the build (no file extension)',
+        default: '',
+      })
+      .option('builds-path', {
+        alias: 'buildsPath',
+        type: 'string',
+        description: 'Path where the builds should be stored',
+        default: 'build',
+      })
+      .option('build-method', {
+        alias: 'buildMethod',
+        type: 'string',
+        description: 'Path to a Namespace.Class.StaticMethod to run to perform the build',
+        default: '',
+      })
+      .option('custom-parameters', {
+        alias: 'customParameters',
+        type: 'string',
+        description: 'Custom parameters to configure the build',
+        default: '',
+      })
+      .option('versioning', {
+        type: 'string',
+        description: 'The versioning scheme to use when building the project',
+        default: 'Semantic',
+      })
+      .option('version', {
+        type: 'string',
+        description: 'The version, when used with the "Custom" versioning scheme',
+        default: '',
+      })
+      .option('custom-image', {
+        alias: 'customImage',
+        type: 'string',
+        description: 'Specific docker image that should be used for building the project',
+        default: '',
+      })
+      .option('manual-exit', {
+        alias: 'manualExit',
+        type: 'boolean',
+        description: 'Suppresses -quit. Exit your build method using EditorApplication.Exit(0) instead.',
+        default: false,
+      })
+      .option('enable-gpu', {
+        alias: 'enableGpu',
+        type: 'boolean',
+        description: 'Launches unity without specifying -nographics',
+        default: false,
+      })
+      .option('android-version-code', {
+        alias: 'androidVersionCode',
+        type: 'string',
+        description: 'The android versionCode',
+        default: '',
+      })
+      .option('android-export-type', {
+        alias: 'androidExportType',
+        type: 'string',
+        description: 'The android export type (androidPackage, androidAppBundle, androidStudioProject)',
+        default: 'androidPackage',
+      })
+      .option('android-keystore-name', {
+        alias: 'androidKeystoreName',
+        type: 'string',
+        description: 'The android keystoreName',
+        default: '',
+      })
+      .option('android-keystore-base64', {
+        alias: 'androidKeystoreBase64',
+        type: 'string',
+        description: 'The base64 contents of the android keystore file',
+        default: '',
+      })
+      .option('android-keystore-pass', {
+        alias: 'androidKeystorePass',
+        type: 'string',
+        description: 'The android keystorePass',
+        default: '',
+      })
+      .option('android-keyalias-name', {
+        alias: 'androidKeyaliasName',
+        type: 'string',
+        description: 'The android keyaliasName',
+        default: '',
+      })
+      .option('android-keyalias-pass', {
+        alias: 'androidKeyaliasPass',
+        type: 'string',
+        description: 'The android keyaliasPass',
+        default: '',
+      })
+      .option('android-target-sdk-version', {
+        alias: 'androidTargetSdkVersion',
+        type: 'string',
+        description: 'The android target API level',
+        default: '',
+      })
+      .option('android-symbol-type', {
+        alias: 'androidSymbolType',
+        type: 'string',
+        description: 'The android symbol type to export (none, public, debugging)',
+        default: 'none',
+      })
+      .option('docker-cpu-limit', {
+        alias: 'dockerCpuLimit',
+        type: 'string',
+        description: 'Number of CPU cores to assign the docker container',
+        default: '',
+      })
+      .option('docker-memory-limit', {
+        alias: 'dockerMemoryLimit',
+        type: 'string',
+        description: 'Amount of memory to assign the docker container (e.g. 512m, 4g)',
+        default: '',
+      })
+      .option('docker-workspace-path', {
+        alias: 'dockerWorkspacePath',
+        type: 'string',
+        description: 'The path to mount the workspace inside the docker container',
+        default: '/github/workspace',
+      })
+      .option('run-as-host-user', {
+        alias: 'runAsHostUser',
+        type: 'string',
+        description: 'Whether to run as a user that matches the host system',
+        default: 'false',
+      })
+      .option('chown-files-to', {
+        alias: 'chownFilesTo',
+        type: 'string',
+        description: 'User and optionally group to give ownership of build artifacts',
+        default: '',
+      })
+      .option('ssh-agent', {
+        alias: 'sshAgent',
+        type: 'string',
+        description: 'SSH Agent path to forward to the container',
+        default: '',
+      })
+      .option('git-private-token', {
+        alias: 'gitPrivateToken',
+        type: 'string',
+        description: 'GitHub private token to pull from GitHub',
+        default: '',
+      })
+      .option('provider-strategy', {
+        alias: 'providerStrategy',
+        type: 'string',
+        description: 'Execution strategy: local, k8s, or aws',
+        default: 'local',
+      })
+      .option('skip-activation', {
+        alias: 'skipActivation',
+        type: 'string',
+        description: 'Skip the activation/deactivation of Unity',
+        default: 'false',
+      })
+      .option('unity-licensing-server', {
+        alias: 'unityLicensingServer',
+        type: 'string',
+        description: 'The Unity licensing server address',
+        default: '',
+      })
+      .option('container-registry-repository', {
+        alias: 'containerRegistryRepository',
+        type: 'string',
+        description: 'Container registry and repository to pull image from. Only applicable if customImage is not set.',
+        default: 'unityci/editor',
+      })
+      .option('container-registry-image-version', {
+        alias: 'containerRegistryImageVersion',
+        type: 'string',
+        description: 'Container registry image version. Only applicable if customImage is not set.',
+        default: '3',
+      })
+      .option('docker-isolation-mode', {
+        alias: 'dockerIsolationMode',
+        type: 'string',
+        description:
+          'Isolation mode to use for the docker container (process, hyperv, or default). Only applicable on Windows.',
+        default: 'default',
+      })
+      .option('ssh-public-keys-directory-path', {
+        alias: 'sshPublicKeysDirectoryPath',
+        type: 'string',
+        description: 'Path to a directory containing SSH public keys to forward to the container',
+        default: '',
+      })
+      .option('cache-unity-installation-on-mac', {
+        alias: 'cacheUnityInstallationOnMac',
+        type: 'boolean',
+        description: 'Whether to cache the Unity hub and editor installation on MacOS',
+        default: false,
+      })
+      .option('unity-hub-version-on-mac', {
+        alias: 'unityHubVersionOnMac',
+        type: 'string',
+        description: 'The version of Unity Hub to install on MacOS (e.g. 3.4.0). Defaults to latest available on brew.',
+        default: '',
+      })
+      .example('game-ci build --target-platform StandaloneLinux64', 'Build for Linux using auto-detected Unity version')
+      .example(
+        'game-ci build --target-platform Android --unity-version 2022.3.56f1 --build-method MyBuild.Run',
+        'Build for Android with a specific Unity version and build method',
+      ) as any;
+  },
+  handler: async (cliArguments) => {
+    try {
+      mapCliArgumentsToInput(cliArguments);
+
+      const buildParameters = await BuildParameters.create();
+      const baseImage = new ImageTag(buildParameters);
+
+      let exitCode = -1;
+
+      if (buildParameters.providerStrategy === 'local') {
+        core.info(`Building locally for ${buildParameters.targetPlatform}...`);
+        core.info(`Unity version: ${buildParameters.editorVersion}`);
+        core.info(`Project path: ${buildParameters.projectPath}`);
+
+        const actionFolder = Action.actionFolder;
+        await PlatformSetup.setup(buildParameters, actionFolder);
+
+        exitCode =
+          process.platform === 'darwin'
+            ? await MacBuilder.run(actionFolder)
+            : await Docker.run(baseImage.toString(), {
+                workspace: process.cwd(),
+                actionFolder,
+                ...buildParameters,
+              });
+      } else {
+        core.info(`Building via orchestrator (${buildParameters.providerStrategy})...`);
+        await Orchestrator.run(buildParameters, baseImage.toString());
+        exitCode = 0;
+      }
+
+      // Output results
+      core.info(`\nBuild completed with exit code: ${exitCode}`);
+      core.info(`Build version: ${buildParameters.buildVersion}`);
+      core.info(`Build path: ${buildParameters.buildPath}`);
+
+      if (exitCode !== 0) {
+        throw new Error(`Build failed with exit code ${exitCode}`);
+      }
+    } catch (error: any) {
+      core.setFailed(`Build failed: ${error.message}`);
+
+      throw error;
+    }
+  },
+};
+
+export default buildCommand;

src/cli/commands/cache.ts

@@ -0,0 +1,160 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const cacheCommand: CommandModule = {
+  command: 'cache <action>',
+  describe: 'Manage build caches',
+  builder: (yargs) => {
+    return yargs
+      .positional('action', {
+        describe: 'Cache action to perform',
+        choices: ['list', 'restore', 'clear'] as const,
+      })
+      .option('cache-dir', {
+        alias: 'cacheDir',
+        type: 'string',
+        description: 'Path to the cache directory',
+        default: '',
+      })
+      .option('project-path', {
+        alias: 'projectPath',
+        type: 'string',
+        description: 'Path to the Unity project',
+        default: '.',
+      })
+      .example('game-ci orchestrate cache list', 'List all cached workspaces')
+      .example('game-ci orchestrate cache restore --cache-dir ./my-cache', 'Restore a cached workspace')
+      .example('game-ci orchestrate cache clear', 'Clear all cached workspaces');
+  },
+  handler: async (cliArguments) => {
+    const action = cliArguments.action as string;
+    const projectPath = (cliArguments.projectPath as string) || '.';
+    const cacheDirectory = (cliArguments.cacheDir as string) || path.join(projectPath, 'Library');
+
+    try {
+      switch (action) {
+        case 'list': {
+          await listCache(cacheDirectory, projectPath);
+          break;
+        }
+
+        case 'restore': {
+          await restoreCache(cacheDirectory);
+          break;
+        }
+
+        case 'clear': {
+          await clearCache(cacheDirectory);
+          break;
+        }
+
+        default: {
+          throw new Error(`Unknown cache action: ${action}. Available actions: list, restore, clear`);
+        }
+      }
+    } catch (error: any) {
+      core.setFailed(`Cache operation failed: ${error.message}`);
+
+      throw error;
+    }
+  },
+};
+
+async function listCache(cacheDirectory: string, projectPath: string): Promise<void> {
+  const libraryPath = path.resolve(projectPath, 'Library');
+
+  core.info('Cache Status:');
+  core.info('=============');
+
+  if (fs.existsSync(libraryPath)) {
+    const stats = fs.statSync(libraryPath);
+    const files = fs.readdirSync(libraryPath);
+    core.info(`  Library folder: ${libraryPath}`);
+    core.info(`  Entries: ${files.length}`);
+    core.info(`  Last modified: ${stats.mtime.toISOString()}`);
+
+    // Show size of key subdirectories
+    const keyDirectories = ['PackageCache', 'ScriptAssemblies', 'ShaderCache', 'Bee'];
+    for (const directory of keyDirectories) {
+      const directoryPath = path.join(libraryPath, directory);
+      if (fs.existsSync(directoryPath)) {
+        const directoryStats = fs.statSync(directoryPath);
+        core.info(`  ${directory}/: exists (modified ${directoryStats.mtime.toISOString()})`);
+      }
+    }
+  } else {
+    core.info(`  Library folder not found at: ${libraryPath}`);
+    core.info('  No cache available. First build will be a clean build.');
+  }
+
+  // Check for .tar cache files if a custom cache dir is specified
+  if (cacheDirectory && cacheDirectory !== libraryPath && fs.existsSync(cacheDirectory)) {
+    core.info(`\nCache directory: ${cacheDirectory}`);
+    const cacheFiles = fs.readdirSync(cacheDirectory).filter((f) => f.endsWith('.tar') || f.endsWith('.tar.lz4'));
+    if (cacheFiles.length > 0) {
+      core.info(`  Cache archives found: ${cacheFiles.length}`);
+      for (const file of cacheFiles) {
+        const filePath = path.join(cacheDirectory, file);
+        const fileStats = fs.statSync(filePath);
+        const sizeMegabytes = (fileStats.size / (1024 * 1024)).toFixed(1);
+        core.info(`  - ${file} (${sizeMegabytes} MB, ${fileStats.mtime.toISOString()})`);
+      }
+    } else {
+      core.info('  No cache archives found.');
+    }
+  }
+}
+
+async function restoreCache(cacheDirectory: string): Promise<void> {
+  if (!cacheDirectory) {
+    throw new Error('--cache-dir is required for restore');
+  }
+
+  if (!fs.existsSync(cacheDirectory)) {
+    core.info(`Cache directory does not exist: ${cacheDirectory}`);
+    core.info('Nothing to restore.');
+
+    return;
+  }
+
+  const cacheFiles = fs.readdirSync(cacheDirectory).filter((f) => f.endsWith('.tar') || f.endsWith('.tar.lz4'));
+  if (cacheFiles.length === 0) {
+    core.info('No cache archives found to restore.');
+
+    return;
+  }
+
+  // Sort by modification time, newest first
+  const sorted = cacheFiles
+    .map((f) => ({ name: f, mtime: fs.statSync(path.join(cacheDirectory, f)).mtime }))
+    .sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+
+  core.info(`Found ${sorted.length} cache archive(s). Latest: ${sorted[0].name}`);
+  core.info('Use the orchestrator cache system for full restore functionality:');
+  core.info('  game-ci orchestrate --cache-key <key> ...');
+}
+
+async function clearCache(cacheDirectory: string): Promise<void> {
+  let cleared = false;
+
+  if (cacheDirectory && fs.existsSync(cacheDirectory)) {
+    const cacheFiles = fs.readdirSync(cacheDirectory).filter((f) => f.endsWith('.tar') || f.endsWith('.tar.lz4'));
+    if (cacheFiles.length > 0) {
+      for (const file of cacheFiles) {
+        fs.unlinkSync(path.join(cacheDirectory, file));
+        core.info(`  Removed: ${file}`);
+      }
+      cleared = true;
+    }
+  }
+
+  if (!cleared) {
+    core.info('No cache archives found to clear.');
+  } else {
+    core.info('Cache cleared.');
+  }
+}
+
+export default cacheCommand;

src/cli/commands/orchestrate.ts

@@ -0,0 +1,222 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import { BuildParameters, ImageTag, Orchestrator } from '../../model';
+import { mapCliArgumentsToInput, CliArguments } from '../input-mapper';
+import cacheCommand from './cache';
+
+interface OrchestrateArguments extends CliArguments {
+  targetPlatform: string;
+  providerStrategy?: string;
+}
+
+const orchestrateCommand: CommandModule<object, OrchestrateArguments> = {
+  command: 'orchestrate',
+  describe: 'Orchestrator — remote builds, cache management, and provider tools',
+  builder: (yargs) => {
+    return yargs
+      .command(cacheCommand)
+      .option('target-platform', {
+        alias: 'targetPlatform',
+        type: 'string',
+        description: 'Platform that the build should target',
+      })
+      .option('provider-strategy', {
+        alias: 'providerStrategy',
+        type: 'string',
+        description: 'Orchestrator provider: aws, k8s, local-docker, local-system',
+        default: 'aws',
+      })
+      .option('unity-version', {
+        alias: 'unityVersion',
+        type: 'string',
+        description: 'Version of Unity to use for building',
+        default: 'auto',
+      })
+      .option('project-path', {
+        alias: 'projectPath',
+        type: 'string',
+        description: 'Path to the Unity project to be built',
+        default: '.',
+      })
+      .option('build-name', {
+        alias: 'buildName',
+        type: 'string',
+        description: 'Name of the build',
+        default: '',
+      })
+      .option('builds-path', {
+        alias: 'buildsPath',
+        type: 'string',
+        description: 'Path where the builds should be stored',
+        default: 'build',
+      })
+      .option('build-method', {
+        alias: 'buildMethod',
+        type: 'string',
+        description: 'Path to a Namespace.Class.StaticMethod to run to perform the build',
+        default: '',
+      })
+      .option('custom-parameters', {
+        alias: 'customParameters',
+        type: 'string',
+        description: 'Custom parameters to configure the build',
+        default: '',
+      })
+      .option('versioning', {
+        type: 'string',
+        description: 'The versioning scheme to use',
+        default: 'None',
+      })
+      .option('aws-stack-name', {
+        alias: 'awsStackName',
+        type: 'string',
+        description: 'The Cloud Formation stack name (AWS provider)',
+        default: 'game-ci',
+      })
+      .option('kube-config', {
+        alias: 'kubeConfig',
+        type: 'string',
+        description: 'Base64 encoded Kubernetes config (K8s provider)',
+        default: '',
+      })
+      .option('kube-volume', {
+        alias: 'kubeVolume',
+        type: 'string',
+        description: 'Persistent Volume Claim name for Unity build (K8s provider)',
+        default: '',
+      })
+      .option('kube-volume-size', {
+        alias: 'kubeVolumeSize',
+        type: 'string',
+        description: 'Disc space for Kubernetes Persistent Volume',
+        default: '5Gi',
+      })
+      .option('container-cpu', {
+        alias: 'containerCpu',
+        type: 'string',
+        description: 'CPU allocation for remote build container',
+        default: '1024',
+      })
+      .option('container-memory', {
+        alias: 'containerMemory',
+        type: 'string',
+        description: 'Memory allocation for remote build container',
+        default: '3072',
+      })
+      .option('cache-key', {
+        alias: 'cacheKey',
+        type: 'string',
+        description: 'Cache key to indicate bucket for cache',
+        default: '',
+      })
+      .option('git-private-token', {
+        alias: 'gitPrivateToken',
+        type: 'string',
+        description: 'GitHub private token for repository access',
+        default: '',
+      })
+      .option('allow-dirty-build', {
+        alias: 'allowDirtyBuild',
+        type: 'boolean',
+        description: 'Allow builds from dirty branches',
+        default: false,
+      })
+      .option('watch-to-end', {
+        alias: 'watchToEnd',
+        type: 'string',
+        description: 'Whether to watch the build to completion',
+        default: 'true',
+      })
+      .option('clone-depth', {
+        alias: 'cloneDepth',
+        type: 'string',
+        description: 'Git clone depth (0 for full clone)',
+        default: '50',
+      })
+      .option('skip-activation', {
+        alias: 'skipActivation',
+        type: 'string',
+        description: 'Skip Unity activation/deactivation',
+        default: 'false',
+      })
+      .option('kube-storage-class', {
+        alias: 'kubeStorageClass',
+        type: 'string',
+        description: 'Kubernetes storage class to use for orchestrator jobs. Leave empty to install rook cluster.',
+        default: '',
+      })
+      .option('read-input-from-override-list', {
+        alias: 'readInputFromOverrideList',
+        type: 'string',
+        description: 'Comma separated list of input value names to read from the input override command',
+        default: '',
+      })
+      .option('read-input-override-command', {
+        alias: 'readInputOverrideCommand',
+        type: 'string',
+        description: 'Command to execute to pull input from an external source (e.g. cloud provider secret managers)',
+        default: '',
+      })
+      .option('post-build-steps', {
+        alias: 'postBuildSteps',
+        type: 'string',
+        description:
+          'Post build job in yaml format with the keys image, secrets (name, value object array), command string',
+        default: '',
+      })
+      .option('pre-build-steps', {
+        alias: 'preBuildSteps',
+        type: 'string',
+        description:
+          'Pre build job after repository setup but before the build job (yaml format with keys image, secrets, command)',
+        default: '',
+      })
+      .option('custom-job', {
+        alias: 'customJob',
+        type: 'string',
+        description:
+          'Custom job instead of the standard build automation (yaml format with keys image, secrets, command)',
+        default: '',
+      })
+      .example(
+        'game-ci orchestrate --target-platform StandaloneLinux64 --provider-strategy aws',
+        'Build on AWS using the orchestrator',
+      )
+      .example(
+        'game-ci orchestrate --target-platform StandaloneLinux64 --provider-strategy k8s --kube-config <base64>',
+        'Build on Kubernetes',
+      ) as any;
+  },
+  handler: async (cliArguments) => {
+    try {
+      if (!cliArguments.targetPlatform) {
+        throw new Error('--target-platform is required for orchestrate builds. Run game-ci orchestrate --help.');
+      }
+
+      mapCliArgumentsToInput(cliArguments);
+
+      const buildParameters = await BuildParameters.create();
+      const baseImage = new ImageTag(buildParameters);
+
+      core.info(`Orchestrating build via ${buildParameters.providerStrategy}...`);
+      core.info(`Target platform: ${buildParameters.targetPlatform}`);
+      core.info(`Unity version: ${buildParameters.editorVersion}`);
+      core.info(`Build GUID: ${buildParameters.buildGuid}`);
+
+      const result = await Orchestrator.run(buildParameters, baseImage.toString());
+
+      core.info(`\nOrchestrated build completed.`);
+      if (result?.BuildResults) {
+        core.info(`Results: ${result.BuildResults}`);
+      } else {
+        core.warning('Build completed but no build results were returned.');
+      }
+    } catch (error: any) {
+      core.setFailed(`Orchestrated build failed: ${error.message}`);
+
+      throw error;
+    }
+  },
+};
+
+export default orchestrateCommand;

src/cli/commands/status.ts

@@ -0,0 +1,84 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import fs from 'node:fs';
+import path from 'node:path';
+import UnityVersioning from '../../model/unity-versioning';
+
+const statusCommand: CommandModule = {
+  command: 'status',
+  describe: 'Show build status and workspace info',
+  builder: (yargs) => {
+    return yargs.option('project-path', {
+      alias: 'projectPath',
+      type: 'string',
+      description: 'Path to the Unity project',
+      default: '.',
+    });
+  },
+  handler: async (cliArguments) => {
+    const projectPath = (cliArguments.projectPath as string) || '.';
+
+    core.info('game-ci Workspace Status');
+    core.info('========================\n');
+
+    // Project detection
+    const projectVersionPath = path.join(projectPath, 'ProjectSettings', 'ProjectVersion.txt');
+    const hasProject = fs.existsSync(projectVersionPath);
+
+    core.info(`Project Path: ${path.resolve(projectPath)}`);
+    core.info(`Unity Project Found: ${hasProject ? 'Yes' : 'No'}`);
+
+    if (hasProject) {
+      try {
+        const unityVersion = UnityVersioning.determineUnityVersion(projectPath, 'auto');
+        core.info(`Unity Version: ${unityVersion}`);
+      } catch {
+        core.info(`Unity Version: Unable to detect`);
+      }
+
+      // Library folder status
+      const libraryPath = path.join(projectPath, 'Library');
+      if (fs.existsSync(libraryPath)) {
+        const stats = fs.statSync(libraryPath);
+        core.info(`Library Cache: Present (modified ${stats.mtime.toISOString()})`);
+      } else {
+        core.info(`Library Cache: Not present (clean build required)`);
+      }
+
+      // Build output detection
+      const buildsPath = path.join(projectPath, '..', 'build');
+      if (fs.existsSync(buildsPath)) {
+        const builds = fs.readdirSync(buildsPath);
+        if (builds.length > 0) {
+          core.info(`\nBuild Outputs (${buildsPath}):`);
+          for (const build of builds) {
+            const buildPath = path.join(buildsPath, build);
+            const buildStats = fs.statSync(buildPath);
+            core.info(`  - ${build} (${buildStats.isDirectory() ? 'dir' : 'file'}, ${buildStats.mtime.toISOString()})`);
+          }
+        }
+      }
+    }
+
+    // Environment
+    core.info('\nEnvironment:');
+    core.info(`  Platform: ${process.platform}`);
+    core.info(`  Node.js: ${process.version}`);
+    core.info(`  UNITY_SERIAL: ${process.env.UNITY_SERIAL ? 'Set' : 'Not set'}`);
+    core.info(`  UNITY_LICENSE: ${process.env.UNITY_LICENSE ? 'Set' : 'Not set'}`);
+    core.info(`  UNITY_EMAIL: ${process.env.UNITY_EMAIL ? 'Set' : 'Not set'}`);
+    core.info(`  UNITY_PASSWORD: ${process.env.UNITY_PASSWORD ? 'Set' : 'Not set'}`);
+
+    // Docker availability
+    core.info(`\nDocker: Checking...`);
+    try {
+      const { execSync } = await import('node:child_process');
+      const dockerVersion = execSync('docker --version', { encoding: 'utf8' }).trim();
+      core.info(`  ${dockerVersion}`);
+    } catch {
+      core.info(`  Docker not found or not accessible`);
+    }
+  },
+};
+
+export default statusCommand;

src/cli/commands/update.ts

@@ -0,0 +1,387 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import https from 'node:https';
+import http from 'node:http';
+import { execFileSync } from 'node:child_process';
+
+const REPO = 'game-ci/unity-builder';
+
+interface GitHubRelease {
+  // eslint-disable-next-line camelcase
+  tag_name: string;
+  assets: Array<{
+    name: string;
+    // eslint-disable-next-line camelcase
+    browser_download_url: string;
+    size: number;
+  }>;
+}
+
+interface UpdateArguments {
+  force?: boolean;
+  version?: string;
+}
+
+/**
+ * Fetches JSON from a URL via HTTPS, following redirects.
+ */
+function fetchJson(url: string): Promise<any> {
+  return new Promise((resolve, reject) => {
+    const get = (targetUrl: string, redirectCount: number) => {
+      if (redirectCount > 5) {
+        reject(new Error('Too many redirects'));
+
+        return;
+      }
+      https
+        .get(
+          targetUrl,
+          {
+            headers: { 'User-Agent': 'game-ci-cli', Accept: 'application/json' },
+          },
+          (response) => {
+            if (
+              response.statusCode &&
+              response.statusCode >= 300 &&
+              response.statusCode < 400 &&
+              response.headers.location
+            ) {
+              get(response.headers.location, redirectCount + 1);
+
+              return;
+            }
+            if (response.statusCode !== 200) {
+              reject(new Error(`HTTP ${response.statusCode} from ${targetUrl}`));
+
+              return;
+            }
+            let data = '';
+            response.on('data', (chunk) => (data += chunk));
+            response.on('end', () => {
+              try {
+                resolve(JSON.parse(data));
+              } catch {
+                reject(new Error('Invalid JSON response'));
+              }
+            });
+          },
+        )
+        .on('error', reject);
+    };
+    get(url, 0);
+  });
+}
+
+/**
+ * Downloads a file from a URL, following redirects. Returns the file content as a Buffer.
+ */
+function downloadFile(url: string): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const get = (targetUrl: string, redirectCount: number) => {
+      if (redirectCount > 10) {
+        reject(new Error('Too many redirects'));
+
+        return;
+      }
+
+      const protocol = targetUrl.startsWith('https') ? https : http;
+      protocol
+        .get(targetUrl, { headers: { 'User-Agent': 'game-ci-cli' } }, (response) => {
+          if (
+            response.statusCode &&
+            response.statusCode >= 300 &&
+            response.statusCode < 400 &&
+            response.headers.location
+          ) {
+            get(response.headers.location, redirectCount + 1);
+
+            return;
+          }
+          if (response.statusCode !== 200) {
+            reject(new Error(`HTTP ${response.statusCode} downloading ${targetUrl}`));
+
+            return;
+          }
+          const chunks: Buffer[] = [];
+          response.on('data', (chunk: Buffer) => chunks.push(chunk));
+          response.on('end', () => resolve(Buffer.concat(chunks)));
+        })
+        .on('error', reject);
+    };
+    get(url, 0);
+  });
+}
+
+/**
+ * Gets the current version from package.json or the compiled binary.
+ */
+function getCurrentVersion(): string {
+  // Try reading from package.json at various relative locations
+  const candidates = [
+    path.join(__dirname, '..', '..', '..', 'package.json'),
+    path.join(__dirname, '..', '..', 'package.json'),
+    path.join(process.cwd(), 'package.json'),
+  ];
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      try {
+        const packageData = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+        if (packageData.version) {
+          return packageData.version;
+        }
+      } catch {
+        // Continue to next candidate
+      }
+    }
+  }
+
+  return 'unknown';
+}
+
+/**
+ * Determines the correct asset name for the current platform/architecture.
+ */
+function getAssetName(): string {
+  const platform = process.platform;
+  const arch = process.arch;
+
+  let osPart: string;
+  switch (platform) {
+    case 'linux':
+      osPart = 'linux';
+      break;
+    case 'darwin':
+      osPart = 'macos';
+      break;
+    case 'win32':
+      osPart = 'windows';
+      break;
+    default:
+      throw new Error(`Unsupported platform: ${platform}`);
+  }
+
+  let archPart: string;
+  switch (arch) {
+    case 'x64':
+      archPart = 'x64';
+      break;
+    case 'arm64':
+      archPart = 'arm64';
+      break;
+    default:
+      throw new Error(`Unsupported architecture: ${arch}`);
+  }
+
+  const assetBaseName = `game-ci-${osPart}-${archPart}`;
+
+  return osPart === 'windows' ? `${assetBaseName}.exe` : assetBaseName;
+}
+
+/**
+ * Determines the path to the currently running executable.
+ * For standalone binaries (pkg), process.execPath points to the binary itself.
+ * For Node.js execution, we return undefined since self-update does not apply.
+ */
+function getExecutablePath(): string | undefined {
+  // When running as a pkg binary, process.pkg is defined
+  if ((process as any).pkg) {
+    return process.execPath;
+  }
+
+  // When running via Node.js, check if there is a standalone binary in the typical install location
+  const installDirectory = process.env.GAME_CI_INSTALL || path.join(os.homedir(), '.game-ci', 'bin');
+  const binaryName = process.platform === 'win32' ? 'game-ci.exe' : 'game-ci';
+  const installedPath = path.join(installDirectory, binaryName);
+
+  if (fs.existsSync(installedPath)) {
+    return installedPath;
+  }
+
+  return;
+}
+
+/**
+ * Strips leading 'v' from a version string and splits into numeric parts.
+ */
+function parseVersionParts(version: string): number[] {
+  return version
+    .replace(/^v/, '')
+    .split('.')
+    .map((part) => Number(part));
+}
+
+/**
+ * Compares two semver strings. Returns:
+ *  -1 if a < b
+ *   0 if a == b
+ *   1 if a > b
+ */
+function compareSemver(a: string, b: string): number {
+  const partsA = parseVersionParts(a);
+  const partsB = parseVersionParts(b);
+
+  for (let index = 0; index < 3; index++) {
+    const x = partsA[index] || 0;
+    const y = partsB[index] || 0;
+    if (x < y) return -1;
+    if (x > y) return 1;
+  }
+
+  return 0;
+}
+
+const updateCommand: CommandModule<object, UpdateArguments> = {
+  command: 'update',
+  describe: 'Update game-ci to the latest version',
+  builder: (yargs) => {
+    return yargs
+      .option('force', {
+        alias: 'f',
+        type: 'boolean',
+        description: 'Force update even if already on latest version',
+        default: false,
+      })
+      .option('version', {
+        type: 'string',
+        description: 'Update to a specific version (e.g., v2.0.0)',
+        default: '',
+      })
+      .example('game-ci update', 'Update to the latest version')
+      .example('game-ci update --version v2.1.0', 'Update to a specific version')
+      .example('game-ci update --force', 'Force reinstall of the current version') as any;
+  },
+  handler: async (cliArguments) => {
+    try {
+      const currentVersion = getCurrentVersion();
+      core.info(`Current version: v${currentVersion}`);
+      core.info(`Platform: ${process.platform} ${process.arch}`);
+      core.info('');
+
+      // Fetch release info
+      let release: GitHubRelease;
+      const targetVersion = cliArguments.version as string;
+
+      if (targetVersion) {
+        const tag = targetVersion.startsWith('v') ? targetVersion : `v${targetVersion}`;
+        core.info(`Fetching release ${tag}...`);
+        release = await fetchJson(`https://api.github.com/repos/${REPO}/releases/tags/${tag}`);
+      } else {
+        core.info('Checking for updates...');
+        release = await fetchJson(`https://api.github.com/repos/${REPO}/releases/latest`);
+      }
+
+      const latestVersion = release.tag_name;
+      core.info(`Latest version:  ${latestVersion}`);
+      core.info('');
+
+      // Compare versions
+      const comparison = compareSemver(currentVersion, latestVersion);
+      if (comparison >= 0 && !cliArguments.force) {
+        core.info('You are already on the latest version. Use --force to reinstall.');
+
+        return;
+      }
+
+      if (comparison > 0 && !targetVersion) {
+        core.info(`Current version (v${currentVersion}) is newer than latest release (${latestVersion}).`);
+        core.info('Use --force to downgrade, or --version to target a specific release.');
+
+        return;
+      }
+
+      // Find the correct asset
+      const assetName = getAssetName();
+      const asset = release.assets.find((a) => a.name === assetName);
+
+      if (!asset) {
+        const available = release.assets.map((a) => a.name).join(', ');
+        throw new Error(
+          `No binary found for ${process.platform}-${process.arch} (looking for ${assetName}).\nAvailable assets: ${available}`,
+        );
+      }
+
+      const sizeMb = (asset.size / (1024 * 1024)).toFixed(1);
+      core.info(`Downloading ${assetName} (${sizeMb} MB)...`);
+
+      // Download the new binary
+      const binaryData = await downloadFile(asset.browser_download_url);
+
+      // Determine where to write the updated binary
+      const executablePath = getExecutablePath();
+
+      if (!executablePath) {
+        core.info('');
+        core.info('game-ci is running via Node.js (not as a standalone binary).');
+        core.info('To update the npm package, run:');
+        core.info('  npm install -g unity-builder@latest');
+        core.info('');
+        core.info('To install the standalone binary instead:');
+        core.info('  curl -fsSL https://raw.githubusercontent.com/game-ci/unity-builder/main/install.sh | sh');
+
+        return;
+      }
+
+      // Write the new binary.
+      // On Windows, we cannot overwrite a running executable directly.
+      // Write to a temporary file, then rename.
+      const temporaryPath = `${executablePath}.update`;
+      const backupPath = `${executablePath}.backup`;
+
+      fs.writeFileSync(temporaryPath, binaryData);
+
+      if (process.platform !== 'win32') {
+        fs.chmodSync(temporaryPath, 0o755);
+      }
+
+      // Verify the downloaded binary
+      try {
+        const output = execFileSync(temporaryPath, ['version'], { encoding: 'utf8', timeout: 10_000 });
+        core.info(`Verified new binary: ${output.trim().split('\n')[0]}`);
+      } catch (verifyError: any) {
+        fs.unlinkSync(temporaryPath);
+        throw new Error(`Downloaded binary failed verification: ${verifyError.message}`);
+      }
+
+      // Replace the current binary
+      try {
+        // Backup current
+        if (fs.existsSync(backupPath)) {
+          fs.unlinkSync(backupPath);
+        }
+        fs.renameSync(executablePath, backupPath);
+        fs.renameSync(temporaryPath, executablePath);
+
+        // Clean up backup
+        try {
+          fs.unlinkSync(backupPath);
+        } catch {
+          // On Windows the backup may be locked; that is fine
+        }
+      } catch (replaceError: any) {
+        // Attempt to restore from backup
+        if (fs.existsSync(backupPath) && !fs.existsSync(executablePath)) {
+          fs.renameSync(backupPath, executablePath);
+        }
+
+        // Clean up temporary file
+        if (fs.existsSync(temporaryPath)) {
+          fs.unlinkSync(temporaryPath);
+        }
+        throw new Error(`Failed to replace binary: ${replaceError.message}`);
+      }
+
+      core.info('');
+      core.info(`Successfully updated game-ci to ${latestVersion}`);
+    } catch (error: any) {
+      core.error(`Update failed: ${error.message}`);
+
+      throw error;
+    }
+  },
+};
+
+export default updateCommand;

src/cli/commands/version.ts

@@ -0,0 +1,37 @@
+import type { CommandModule } from 'yargs';
+import * as core from '@actions/core';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const versionCommand: CommandModule = {
+  command: 'version',
+  describe: 'Show version info',
+  builder: {},
+  handler: async () => {
+    try {
+      // Read version from package.json
+      let packageJsonPath = path.join(__dirname, '..', '..', '..', 'package.json');
+      if (!fs.existsSync(packageJsonPath)) {
+        packageJsonPath = path.join(__dirname, '..', '..', 'package.json');
+      }
+      if (!fs.existsSync(packageJsonPath)) {
+        packageJsonPath = path.join(process.cwd(), 'package.json');
+      }
+
+      if (fs.existsSync(packageJsonPath)) {
+        const packageData = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+        core.info(`game-ci (unity-builder) v${packageData.version}`);
+        core.info(`Node.js ${process.version}`);
+        core.info(`Platform: ${process.platform} ${process.arch}`);
+      } else {
+        core.info('game-ci (unity-builder)');
+        core.info('Version information unavailable');
+      }
+    } catch (error: any) {
+      core.info('game-ci (unity-builder)');
+      core.error(`Could not read version: ${error.message}`);
+    }
+  },
+};
+
+export default versionCommand;

src/cli/input-mapper.ts

@@ -0,0 +1,106 @@
+import { Cli } from '../model/cli/cli';
+import GitHub from '../model/github';
+
+/**
+ * Maps CLI arguments (kebab-case flags) to the Input/OrchestratorOptions
+ * interface used by the action. This bridges the gap between user-friendly
+ * CLI flags and the camelCase environment/input system unity-builder expects.
+ *
+ * The existing Input class already queries Cli.options, environment variables,
+ * and GitHub Action inputs in priority order. We populate Cli.options so that
+ * the rest of the codebase works unchanged.
+ */
+export interface CliArguments {
+  targetPlatform?: string;
+  unityVersion?: string;
+  projectPath?: string;
+  buildProfile?: string;
+  buildName?: string;
+  buildsPath?: string;
+  buildMethod?: string;
+  customParameters?: string;
+  versioning?: string;
+  version?: string;
+  customImage?: string;
+  manualExit?: boolean;
+  enableGpu?: boolean;
+
+  androidVersionCode?: string;
+  androidExportType?: string;
+  androidKeystoreName?: string;
+  androidKeystoreBase64?: string;
+  androidKeystorePass?: string;
+  androidKeyaliasName?: string;
+  androidKeyaliasPass?: string;
+  androidTargetSdkVersion?: string;
+  androidSymbolType?: string;
+
+  dockerCpuLimit?: string;
+  dockerMemoryLimit?: string;
+  dockerIsolationMode?: string;
+  dockerWorkspacePath?: string;
+  containerRegistryRepository?: string;
+  containerRegistryImageVersion?: string;
+  runAsHostUser?: string;
+  chownFilesTo?: string;
+
+  sshAgent?: string;
+  sshPublicKeysDirectoryPath?: string;
+  gitPrivateToken?: string;
+
+  providerStrategy?: string;
+  awsStackName?: string;
+  kubeConfig?: string;
+  kubeVolume?: string;
+  kubeVolumeSize?: string;
+  kubeStorageClass?: string;
+  containerCpu?: string;
+  containerMemory?: string;
+  cacheKey?: string;
+  watchToEnd?: string;
+  allowDirtyBuild?: boolean;
+  skipActivation?: string;
+  cloneDepth?: string;
+
+  readInputFromOverrideList?: string;
+  readInputOverrideCommand?: string;
+  postBuildSteps?: string;
+  preBuildSteps?: string;
+  customJob?: string;
+
+  unityLicensingServer?: string;
+
+  cacheUnityInstallationOnMac?: boolean;
+  unityHubVersionOnMac?: string;
+
+  mode?: string;
+
+  [key: string]: unknown;
+}
+
+/**
+ * Converts kebab-case CLI flags to camelCase keys matching the Input class
+ * property names, then injects them into Cli.options so the existing
+ * Input.getInput() / OrchestratorOptions.getInput() chain picks them up.
+ */
+export function mapCliArgumentsToInput(cliArguments: CliArguments): void {
+  // Disable GitHub Actions input reading when in CLI mode
+  GitHub.githubInputEnabled = false;
+
+  // The existing Cli.options mechanism is used by Input.getInput() to query
+  // CLI-provided values. We set it directly.
+  const mapped: Record<string, unknown> = {};
+
+  for (const [key, value] of Object.entries(cliArguments)) {
+    if (value !== undefined && key !== '_' && key !== '$0') {
+      mapped[key] = typeof value === 'boolean' ? String(value) : value;
+    }
+  }
+
+  // Ensure mode is set so Cli.isCliMode returns true
+  if (!mapped['mode']) {
+    mapped['mode'] = 'cli';
+  }
+
+  Cli.options = mapped;
+}

src/index-enterprise-features.test.ts

@@ -0,0 +1,606 @@
+/**
+ * Integration wiring tests for enterprise features in index.ts
+ *
+ * These tests verify the conditional gating logic in runMain():
+ * - Each enterprise feature is only invoked when its gate condition is met
+ * - Services are NOT called when their feature is disabled (the default)
+ * - The order of operations is correct (restore before build, save after build)
+ */
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+import { BuildParameters } from './model';
+
+// ---------------------------------------------------------------------------
+// Service mocks — must be declared before importing index.ts (jest hoists them)
+// ---------------------------------------------------------------------------
+
+const mockChildWorkspaceService = {
+  buildConfig: jest.fn().mockReturnValue({ enabled: true, workspaceName: 'Test' }),
+  initializeWorkspace: jest.fn().mockReturnValue(false),
+  getWorkspaceSize: jest.fn().mockReturnValue('0 B'),
+  saveWorkspace: jest.fn(),
+};
+
+const mockSubmoduleProfileService = {
+  createInitPlan: jest.fn().mockResolvedValue([]),
+  execute: jest.fn().mockResolvedValue(''),
+};
+
+const mockLfsAgentService = {
+  configure: jest.fn().mockResolvedValue(''),
+};
+
+const mockLocalCacheService = {
+  resolveCacheRoot: jest.fn().mockReturnValue('/cache'),
+  generateCacheKey: jest.fn().mockReturnValue('key-1'),
+  restoreLfsCache: jest.fn().mockResolvedValue(true),
+  restoreLibraryCache: jest.fn().mockResolvedValue(true),
+  saveLibraryCache: jest.fn().mockResolvedValue(''),
+  saveLfsCache: jest.fn().mockResolvedValue(''),
+};
+
+const mockGitHooksService = {
+  installHooks: jest.fn().mockResolvedValue(''),
+  configureSkipList: jest.fn().mockReturnValue({ LEFTHOOK_EXCLUDE: 'pre-commit' }),
+};
+
+// Mock the dynamic import() targets — jest.mock with factory functions.
+// The services are imported dynamically via `await import(...)` in index.ts,
+// so we mock the module path and return the mock objects as named exports.
+jest.mock('./model/orchestrator/services/cache/child-workspace-service', () => ({
+  ChildWorkspaceService: mockChildWorkspaceService,
+}));
+
+jest.mock('./model/orchestrator/services/submodule/submodule-profile-service', () => ({
+  SubmoduleProfileService: mockSubmoduleProfileService,
+}));
+
+jest.mock('./model/orchestrator/services/lfs/lfs-agent-service', () => ({
+  LfsAgentService: mockLfsAgentService,
+}));
+
+jest.mock('./model/orchestrator/services/cache/local-cache-service', () => ({
+  LocalCacheService: mockLocalCacheService,
+}));
+
+jest.mock('./model/orchestrator/services/hooks/git-hooks-service', () => ({
+  GitHooksService: mockGitHooksService,
+}));
+
+// Mock all non-enterprise dependencies to isolate the wiring logic
+jest.mock('@actions/core');
+jest.mock('./model', () => ({
+  Action: {
+    checkCompatibility: jest.fn(),
+    workspace: '/workspace',
+    actionFolder: '/action',
+  },
+  BuildParameters: {
+    create: jest.fn(),
+  },
+  Cache: {
+    verify: jest.fn(),
+  },
+  Orchestrator: {
+    run: jest.fn().mockResolvedValue(''),
+  },
+  Docker: {
+    run: jest.fn().mockResolvedValue(0),
+  },
+  ImageTag: jest.fn().mockImplementation(() => ({
+    toString: () => 'mock-image:latest',
+  })),
+  Output: {
+    setBuildVersion: jest.fn().mockResolvedValue(''),
+    setAndroidVersionCode: jest.fn().mockResolvedValue(''),
+    setEngineExitCode: jest.fn().mockResolvedValue(''),
+  },
+}));
+
+jest.mock('./model/cli/cli', () => ({
+  Cli: {
+    InitCliMode: jest.fn().mockReturnValue(false),
+  },
+}));
+
+jest.mock('./model/mac-builder', () => ({
+  __esModule: true,
+  default: {
+    run: jest.fn().mockResolvedValue(0),
+  },
+}));
+
+jest.mock('./model/platform-setup', () => ({
+  __esModule: true,
+  default: {
+    setup: jest.fn().mockResolvedValue(''),
+  },
+}));
+
+const mockedBuildParametersCreate = BuildParameters.create as jest.Mock;
+
+interface EnterpriseBuildParametersOverrides {
+  providerStrategy?: string;
+  childWorkspacesEnabled?: boolean;
+  childWorkspaceName?: string;
+  childWorkspaceCacheRoot?: string;
+  childWorkspacePreserveGit?: boolean;
+  childWorkspaceSeparateLibrary?: boolean;
+  submoduleProfilePath?: string;
+  submoduleVariantPath?: string;
+  submoduleToken?: string;
+  gitPrivateToken?: string;
+  lfsTransferAgent?: string;
+  lfsTransferAgentArgs?: string;
+  lfsStoragePaths?: string;
+  localCacheEnabled?: boolean;
+  localCacheRoot?: string;
+  localCacheLibrary?: boolean;
+  localCacheLfs?: boolean;
+  gitHooksEnabled?: boolean;
+  gitHooksSkipList?: string;
+  gitHooksRunBeforeBuild?: string;
+}
+
+function createMockBuildParameters(overrides: EnterpriseBuildParametersOverrides = {}) {
+  return {
+    // Required base properties
+    providerStrategy: 'local',
+    targetPlatform: 'StandaloneLinux64',
+    editorVersion: '2021.3.1f1',
+    buildVersion: '1.0.0',
+    androidVersionCode: '1',
+    projectPath: '.',
+    branch: 'main',
+    runnerTempPath: '/tmp',
+
+    // Enterprise features - all disabled by default
+    childWorkspacesEnabled: false,
+    childWorkspaceName: '',
+    childWorkspaceCacheRoot: '',
+    childWorkspacePreserveGit: true,
+    childWorkspaceSeparateLibrary: true,
+    submoduleProfilePath: '',
+    submoduleVariantPath: '',
+    submoduleToken: '',
+    gitPrivateToken: '',
+    lfsTransferAgent: '',
+    lfsTransferAgentArgs: '',
+    lfsStoragePaths: '',
+    localCacheEnabled: false,
+    localCacheRoot: '',
+    localCacheLibrary: true,
+    localCacheLfs: false,
+    gitHooksEnabled: false,
+    gitHooksSkipList: '',
+    gitHooksRunBeforeBuild: '',
+
+    ...overrides,
+  };
+}
+
+/**
+ * The entry point (runMain) is invoked by importing index.ts.
+ * Since it calls `runMain()` at module scope, we need to re-import it
+ * for each test. jest.isolateModules() handles this.
+ */
+async function runIndex(overrides: EnterpriseBuildParametersOverrides = {}): Promise<void> {
+  mockedBuildParametersCreate.mockResolvedValue(createMockBuildParameters(overrides));
+
+  return new Promise<void>((resolve) => {
+    jest.isolateModules(() => {
+      require('./index');
+
+      // runMain() is async; give it a tick to complete
+      // We use setImmediate to ensure all microtasks from the dynamic imports resolve
+    });
+
+    // Allow all promises and microtasks to settle
+    setTimeout(resolve, 100);
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('index.ts enterprise feature wiring', () => {
+  const originalPlatform = process.platform;
+  const originalEnvironment = { ...process.env };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.GITHUB_WORKSPACE = '/workspace';
+
+    // Force linux platform so Docker.run is used (not MacBuilder)
+    Object.defineProperty(process, 'platform', { value: 'linux' });
+  });
+
+  afterEach(() => {
+    Object.defineProperty(process, 'platform', { value: originalPlatform });
+    process.env = { ...originalEnvironment };
+  });
+
+  // -----------------------------------------------------------------------
+  // GitHooksService gating
+  // -----------------------------------------------------------------------
+
+  describe('GitHooksService gating', () => {
+    it('should NOT call GitHooksService when gitHooksEnabled is false (default)', async () => {
+      await runIndex({ gitHooksEnabled: false });
+
+      expect(mockGitHooksService.installHooks).not.toHaveBeenCalled();
+      expect(mockGitHooksService.configureSkipList).not.toHaveBeenCalled();
+    });
+
+    it('should call installHooks when gitHooksEnabled is true', async () => {
+      await runIndex({ gitHooksEnabled: true });
+
+      expect(mockGitHooksService.installHooks).toHaveBeenCalledWith('/workspace');
+    });
+
+    it('should call configureSkipList when gitHooksEnabled and gitHooksSkipList is set', async () => {
+      await runIndex({
+        gitHooksEnabled: true,
+        gitHooksSkipList: 'pre-commit,pre-push',
+      });
+
+      expect(mockGitHooksService.configureSkipList).toHaveBeenCalledWith(['pre-commit', 'pre-push']);
+    });
+
+    it('should NOT call configureSkipList when gitHooksSkipList is empty', async () => {
+      await runIndex({
+        gitHooksEnabled: true,
+        gitHooksSkipList: '',
+      });
+
+      expect(mockGitHooksService.installHooks).toHaveBeenCalled();
+      expect(mockGitHooksService.configureSkipList).not.toHaveBeenCalled();
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // LocalCacheService gating
+  // -----------------------------------------------------------------------
+
+  describe('LocalCacheService gating', () => {
+    it('should NOT call LocalCacheService when localCacheEnabled is false (default)', async () => {
+      await runIndex({ localCacheEnabled: false });
+
+      expect(mockLocalCacheService.resolveCacheRoot).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.generateCacheKey).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLibraryCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLfsCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLibraryCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLfsCache).not.toHaveBeenCalled();
+    });
+
+    it('should call restore and save operations when localCacheEnabled is true', async () => {
+      await runIndex({
+        localCacheEnabled: true,
+        localCacheLibrary: true,
+        localCacheLfs: true,
+      });
+
+      expect(mockLocalCacheService.resolveCacheRoot).toHaveBeenCalled();
+      expect(mockLocalCacheService.generateCacheKey).toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLibraryCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLfsCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLibraryCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLfsCache).toHaveBeenCalled();
+    });
+
+    it('should only cache Library when localCacheLibrary is true and localCacheLfs is false', async () => {
+      await runIndex({
+        localCacheEnabled: true,
+        localCacheLibrary: true,
+        localCacheLfs: false,
+      });
+
+      expect(mockLocalCacheService.restoreLibraryCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLfsCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLibraryCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLfsCache).not.toHaveBeenCalled();
+    });
+
+    it('should only cache LFS when localCacheLfs is true and localCacheLibrary is false', async () => {
+      await runIndex({
+        localCacheEnabled: true,
+        localCacheLibrary: false,
+        localCacheLfs: true,
+      });
+
+      expect(mockLocalCacheService.restoreLibraryCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.restoreLfsCache).toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLibraryCache).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.saveLfsCache).toHaveBeenCalled();
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // ChildWorkspaceService gating
+  // -----------------------------------------------------------------------
+
+  describe('ChildWorkspaceService gating', () => {
+    it('should NOT call ChildWorkspaceService when childWorkspacesEnabled is false (default)', async () => {
+      await runIndex({ childWorkspacesEnabled: false });
+
+      expect(mockChildWorkspaceService.buildConfig).not.toHaveBeenCalled();
+      expect(mockChildWorkspaceService.initializeWorkspace).not.toHaveBeenCalled();
+      expect(mockChildWorkspaceService.saveWorkspace).not.toHaveBeenCalled();
+    });
+
+    it('should NOT call ChildWorkspaceService when childWorkspacesEnabled is true but childWorkspaceName is empty', async () => {
+      await runIndex({
+        childWorkspacesEnabled: true,
+        childWorkspaceName: '',
+      });
+
+      expect(mockChildWorkspaceService.buildConfig).not.toHaveBeenCalled();
+    });
+
+    it('should call buildConfig, initializeWorkspace, and saveWorkspace when enabled with a name', async () => {
+      mockChildWorkspaceService.buildConfig.mockReturnValue({ enabled: true, workspaceName: 'TurnOfWar' });
+
+      await runIndex({
+        childWorkspacesEnabled: true,
+        childWorkspaceName: 'TurnOfWar',
+        childWorkspaceCacheRoot: '/cache/workspaces',
+      });
+
+      expect(mockChildWorkspaceService.buildConfig).toHaveBeenCalledWith(
+        expect.objectContaining({
+          childWorkspacesEnabled: true,
+          childWorkspaceName: 'TurnOfWar',
+        }),
+      );
+      expect(mockChildWorkspaceService.initializeWorkspace).toHaveBeenCalled();
+      expect(mockChildWorkspaceService.getWorkspaceSize).toHaveBeenCalled();
+      expect(mockChildWorkspaceService.saveWorkspace).toHaveBeenCalled();
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // SubmoduleProfileService gating
+  // -----------------------------------------------------------------------
+
+  describe('SubmoduleProfileService gating', () => {
+    it('should NOT call SubmoduleProfileService when submoduleProfilePath is empty (default)', async () => {
+      await runIndex({ submoduleProfilePath: '' });
+
+      expect(mockSubmoduleProfileService.createInitPlan).not.toHaveBeenCalled();
+      expect(mockSubmoduleProfileService.execute).not.toHaveBeenCalled();
+    });
+
+    it('should call createInitPlan and execute when submoduleProfilePath is set', async () => {
+      await runIndex({
+        submoduleProfilePath: '/path/to/profile.yml',
+        submoduleVariantPath: '',
+        submoduleToken: 'my-token',
+      });
+
+      expect(mockSubmoduleProfileService.createInitPlan).toHaveBeenCalledWith('/path/to/profile.yml', '', '/workspace');
+      expect(mockSubmoduleProfileService.execute).toHaveBeenCalled();
+    });
+
+    it('should pass variant path when provided', async () => {
+      await runIndex({
+        submoduleProfilePath: '/path/to/profile.yml',
+        submoduleVariantPath: '/path/to/variant.yml',
+      });
+
+      expect(mockSubmoduleProfileService.createInitPlan).toHaveBeenCalledWith(
+        '/path/to/profile.yml',
+        '/path/to/variant.yml',
+        '/workspace',
+      );
+    });
+
+    it('should use submoduleToken for auth, falling back to gitPrivateToken', async () => {
+      await runIndex({
+        submoduleProfilePath: '/path/to/profile.yml',
+        submoduleToken: '',
+        gitPrivateToken: 'fallback-token',
+      });
+
+      expect(mockSubmoduleProfileService.execute).toHaveBeenCalledWith(
+        expect.anything(),
+        '/workspace',
+        'fallback-token',
+      );
+    });
+
+    it('should prefer submoduleToken over gitPrivateToken', async () => {
+      await runIndex({
+        submoduleProfilePath: '/path/to/profile.yml',
+        submoduleToken: 'specific-token',
+        gitPrivateToken: 'fallback-token',
+      });
+
+      expect(mockSubmoduleProfileService.execute).toHaveBeenCalledWith(
+        expect.anything(),
+        '/workspace',
+        'specific-token',
+      );
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // LfsAgentService gating
+  // -----------------------------------------------------------------------
+
+  describe('LfsAgentService gating', () => {
+    it('should NOT call LfsAgentService when lfsTransferAgent is empty (default)', async () => {
+      await runIndex({ lfsTransferAgent: '' });
+
+      expect(mockLfsAgentService.configure).not.toHaveBeenCalled();
+    });
+
+    it('should call configure when lfsTransferAgent is set', async () => {
+      await runIndex({
+        lfsTransferAgent: '/tools/elastic-git-storage',
+        lfsTransferAgentArgs: '--verbose',
+        lfsStoragePaths: '/path/a;/path/b',
+      });
+
+      expect(mockLfsAgentService.configure).toHaveBeenCalledWith(
+        '/tools/elastic-git-storage',
+        '--verbose',
+        ['/path/a', '/path/b'],
+        '/workspace',
+      );
+    });
+
+    it('should pass empty array when lfsStoragePaths is empty', async () => {
+      await runIndex({
+        lfsTransferAgent: '/tools/agent',
+        lfsStoragePaths: '',
+      });
+
+      expect(mockLfsAgentService.configure).toHaveBeenCalledWith('/tools/agent', '', [], '/workspace');
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // Order of operations (restore before build, save after build)
+  // -----------------------------------------------------------------------
+
+  describe('order of operations', () => {
+    it('should execute restore operations before build and save operations after build', async () => {
+      const callOrder: string[] = [];
+
+      // Track call order for each relevant operation
+      mockChildWorkspaceService.buildConfig.mockReturnValue({ enabled: true, workspaceName: 'Test' });
+      mockChildWorkspaceService.initializeWorkspace.mockImplementation(() => {
+        callOrder.push('child-workspace-restore');
+
+        return false;
+      });
+      mockChildWorkspaceService.getWorkspaceSize.mockImplementation(() => {
+        callOrder.push('child-workspace-size');
+
+        return '0 B';
+      });
+      mockSubmoduleProfileService.createInitPlan.mockImplementation(async () => {
+        callOrder.push('submodule-profile-plan');
+
+        return [];
+      });
+      mockSubmoduleProfileService.execute.mockImplementation(async () => {
+        callOrder.push('submodule-profile-execute');
+      });
+      mockLfsAgentService.configure.mockImplementation(async () => {
+        callOrder.push('lfs-agent-configure');
+      });
+      mockLocalCacheService.resolveCacheRoot.mockImplementation(() => {
+        callOrder.push('local-cache-resolve');
+
+        return '/cache';
+      });
+      mockLocalCacheService.generateCacheKey.mockImplementation(() => {
+        callOrder.push('local-cache-keygen');
+
+        return 'key-1';
+      });
+      mockLocalCacheService.restoreLfsCache.mockImplementation(async () => {
+        callOrder.push('local-cache-restore-lfs');
+
+        return true;
+      });
+      mockLocalCacheService.restoreLibraryCache.mockImplementation(async () => {
+        callOrder.push('local-cache-restore-library');
+
+        return true;
+      });
+      mockGitHooksService.installHooks.mockImplementation(async () => {
+        callOrder.push('git-hooks-install');
+      });
+      mockLocalCacheService.saveLibraryCache.mockImplementation(async () => {
+        callOrder.push('local-cache-save-library');
+      });
+      mockLocalCacheService.saveLfsCache.mockImplementation(async () => {
+        callOrder.push('local-cache-save-lfs');
+      });
+      mockChildWorkspaceService.saveWorkspace.mockImplementation(() => {
+        callOrder.push('child-workspace-save');
+      });
+
+      await runIndex({
+        childWorkspacesEnabled: true,
+        childWorkspaceName: 'TurnOfWar',
+        submoduleProfilePath: '/profile.yml',
+        lfsTransferAgent: '/tools/agent',
+        localCacheEnabled: true,
+        localCacheLfs: true,
+        localCacheLibrary: true,
+        gitHooksEnabled: true,
+      });
+
+      // Verify restore operations happen before save operations.
+      // The expected order from index.ts is:
+      // 1. Child workspace restore
+      // 2. Submodule profile init
+      // 3. LFS agent configure
+      // 4. Local cache restore (LFS then Library)
+      // 5. Git hooks install
+      // 6. [BUILD happens here - Docker.run or MacBuilder.run]
+      // 7. Local cache save (Library then LFS)
+      // 8. Child workspace save
+
+      const restoreOps = [
+        'child-workspace-restore',
+        'submodule-profile-plan',
+        'submodule-profile-execute',
+        'lfs-agent-configure',
+        'local-cache-restore-lfs',
+        'local-cache-restore-library',
+        'git-hooks-install',
+      ];
+
+      const saveOps = ['local-cache-save-library', 'local-cache-save-lfs', 'child-workspace-save'];
+
+      // All restore ops should appear before all save ops
+      for (const restoreOp of restoreOps) {
+        if (!callOrder.includes(restoreOp)) continue; // Skip if the operation wasn't called
+        for (const saveOp of saveOps) {
+          if (!callOrder.includes(saveOp)) continue;
+          expect(callOrder.indexOf(restoreOp)).toBeLessThan(callOrder.indexOf(saveOp));
+        }
+      }
+
+      // Child workspace save should be last
+      if (callOrder.includes('child-workspace-save') && callOrder.includes('local-cache-save-lfs')) {
+        expect(callOrder.indexOf('local-cache-save-lfs')).toBeLessThan(callOrder.indexOf('child-workspace-save'));
+      }
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // Non-local provider strategy
+  // -----------------------------------------------------------------------
+
+  describe('non-local provider strategy', () => {
+    it('should skip all enterprise features when providerStrategy is not local', async () => {
+      await runIndex({
+        providerStrategy: 'aws',
+        childWorkspacesEnabled: true,
+        childWorkspaceName: 'Test',
+        submoduleProfilePath: '/profile.yml',
+        lfsTransferAgent: '/tools/agent',
+        localCacheEnabled: true,
+        gitHooksEnabled: true,
+      });
+
+      // None of the enterprise services should be called because
+      // they are inside the `if (providerStrategy === 'local')` block
+      expect(mockChildWorkspaceService.buildConfig).not.toHaveBeenCalled();
+      expect(mockSubmoduleProfileService.createInitPlan).not.toHaveBeenCalled();
+      expect(mockLfsAgentService.configure).not.toHaveBeenCalled();
+      expect(mockLocalCacheService.resolveCacheRoot).not.toHaveBeenCalled();
+      expect(mockGitHooksService.installHooks).not.toHaveBeenCalled();
+    });
+  });
+});

src/index.ts

@@ -1,10 +1,18 @@
 import * as core from '@actions/core';
+import path from 'node:path';
 import { Action, BuildParameters, Cache, Orchestrator, Docker, ImageTag, Output } from './model';
 import { Cli } from './model/cli/cli';
 import MacBuilder from './model/mac-builder';
 import PlatformSetup from './model/platform-setup';
+import { BuildReliabilityService } from './model/orchestrator/services/reliability';
+import { TestWorkflowService } from './model/orchestrator/services/test-workflow';
 import { HotRunnerService } from './model/orchestrator/services/hot-runner';
 import { HotRunnerConfig } from './model/orchestrator/services/hot-runner/hot-runner-types';
+import { OutputService } from './model/orchestrator/services/output/output-service';
+import { OutputTypeRegistry } from './model/orchestrator/services/output/output-type-registry';
+import { ArtifactUploadHandler } from './model/orchestrator/services/output/artifact-upload-handler';
+import { IncrementalSyncService } from './model/orchestrator/services/sync';
+import { SyncStrategy } from './model/orchestrator/services/sync/sync-state';
 
 async function runMain() {
   try {
@@ -16,11 +24,55 @@ async function runMain() {
     Action.checkCompatibility();
     Cache.verify();
 
+    // Always configure git environment for CI reliability
+    BuildReliabilityService.configureGitEnvironment();
+
     const { workspace, actionFolder } = Action;
 
     const buildParameters = await BuildParameters.create();
+
+    // If a test suite path is provided, use the test workflow engine
+    // instead of the standard build execution path
+    if (buildParameters.testSuitePath) {
+      core.info('[TestWorkflow] Test suite path detected, using test workflow engine');
+      const results = await TestWorkflowService.executeTestSuite(buildParameters.testSuitePath, buildParameters);
+
+      const totalFailed = results.reduce((sum, r) => sum + r.failed, 0);
+      if (totalFailed > 0) {
+        core.setFailed(`Test workflow completed with ${totalFailed} failure(s)`);
+      } else {
+        core.info('[TestWorkflow] All test runs passed');
+      }
+
+      return;
+    }
+
     const baseImage = new ImageTag(buildParameters);
 
+    // Pre-build reliability checks
+    if (buildParameters.gitIntegrityCheck) {
+      core.info('Running git integrity checks...');
+
+      const isHealthy = BuildReliabilityService.checkGitIntegrity(workspace);
+      BuildReliabilityService.cleanStaleLockFiles(workspace);
+      BuildReliabilityService.validateSubmoduleBackingStores(workspace);
+
+      if (buildParameters.cleanReservedFilenames) {
+        BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
+      }
+
+      if (!isHealthy && buildParameters.gitAutoRecover) {
+        core.info('Git corruption detected, attempting automatic recovery...');
+        const recovered = BuildReliabilityService.recoverCorruptedRepo(workspace);
+        if (!recovered) {
+          core.warning('Automatic recovery failed. Build may encounter issues.');
+        }
+      }
+    } else if (buildParameters.cleanReservedFilenames) {
+      // cleanReservedFilenames can run independently of gitIntegrityCheck
+      BuildReliabilityService.cleanReservedFilenames(buildParameters.projectPath);
+    }
+
     let exitCode = -1;
 
     // Hot runner path: attempt to use a persistent Unity editor instance
@@ -62,17 +114,219 @@ async function runMain() {
       }
     } else if (buildParameters.providerStrategy === 'local') {
       core.info('Building locally');
+
+      // Child workspace isolation - restore cached workspace before any other setup
+      let childWorkspaceConfig: any;
+      if (buildParameters.childWorkspacesEnabled && buildParameters.childWorkspaceName) {
+        const { ChildWorkspaceService } = await import('./model/orchestrator/services/cache/child-workspace-service');
+        const cacheRoot =
+          buildParameters.childWorkspaceCacheRoot ||
+          path.join(buildParameters.runnerTempPath || process.env.RUNNER_TEMP || '', 'game-ci-workspaces');
+        childWorkspaceConfig = ChildWorkspaceService.buildConfig({
+          childWorkspacesEnabled: buildParameters.childWorkspacesEnabled,
+          childWorkspaceName: buildParameters.childWorkspaceName,
+          childWorkspaceCacheRoot: cacheRoot,
+          childWorkspacePreserveGit: buildParameters.childWorkspacePreserveGit,
+          childWorkspaceSeparateLibrary: buildParameters.childWorkspaceSeparateLibrary,
+        });
+        const projectFullPath = path.join(workspace, buildParameters.projectPath);
+        const restored = ChildWorkspaceService.initializeWorkspace(projectFullPath, childWorkspaceConfig);
+        core.info(
+          `Child workspace "${buildParameters.childWorkspaceName}": ${
+            restored ? 'restored from cache' : 'starting fresh'
+          }`,
+        );
+
+        // Log workspace size for resource tracking
+        const size = ChildWorkspaceService.getWorkspaceSize(projectFullPath);
+        core.info(`Child workspace size after restore: ${size}`);
+      }
+
+      // Submodule profile initialization
+      if (buildParameters.submoduleProfilePath) {
+        const { SubmoduleProfileService } = await import(
+          './model/orchestrator/services/submodule/submodule-profile-service'
+        );
+        core.info('Initializing submodules from profile...');
+        const plan = await SubmoduleProfileService.createInitPlan(
+          buildParameters.submoduleProfilePath,
+          buildParameters.submoduleVariantPath,
+          workspace,
+        );
+        await SubmoduleProfileService.execute(
+          plan,
+          workspace,
+          buildParameters.submoduleToken || buildParameters.gitPrivateToken,
+        );
+      }
+
+      // Configure custom LFS transfer agent
+      if (buildParameters.lfsTransferAgent) {
+        const { LfsAgentService } = await import('./model/orchestrator/services/lfs/lfs-agent-service');
+        core.info('Configuring custom LFS transfer agent...');
+        await LfsAgentService.configure(
+          buildParameters.lfsTransferAgent,
+          buildParameters.lfsTransferAgentArgs,
+          buildParameters.lfsStoragePaths ? buildParameters.lfsStoragePaths.split(';') : [],
+          workspace,
+        );
+      }
+
+      // Local build caching - restore
+      let cacheRoot = '';
+      let cacheKey = '';
+      if (buildParameters.localCacheEnabled) {
+        const { LocalCacheService } = await import('./model/orchestrator/services/cache/local-cache-service');
+        cacheRoot = LocalCacheService.resolveCacheRoot(buildParameters);
+        cacheKey = LocalCacheService.generateCacheKey(
+          buildParameters.targetPlatform,
+          buildParameters.editorVersion,
+          buildParameters.branch || '',
+        );
+        if (buildParameters.localCacheLfs) {
+          await LocalCacheService.restoreLfsCache(workspace, cacheRoot, cacheKey);
+        }
+        if (buildParameters.localCacheLibrary) {
+          const projectFullPath = path.join(workspace, buildParameters.projectPath);
+          await LocalCacheService.restoreLibraryCache(projectFullPath, cacheRoot, cacheKey);
+        }
+      }
+
+      // Git hooks — opt-in only. When disabled (default), do not touch hooks at all.
+      if (buildParameters.gitHooksEnabled) {
+        const { GitHooksService } = await import('./model/orchestrator/services/hooks/git-hooks-service');
+        await GitHooksService.installHooks(workspace);
+        if (buildParameters.gitHooksSkipList) {
+          const environment = GitHooksService.configureSkipList(buildParameters.gitHooksSkipList.split(','));
+          Object.assign(process.env, environment);
+        }
+      }
+
+      // Apply incremental sync strategy before build
+      const syncStrategy = buildParameters.syncStrategy as SyncStrategy;
+      if (syncStrategy !== 'full') {
+        core.info(`[Sync] Applying sync strategy: ${syncStrategy}`);
+        await applySyncStrategy(buildParameters, workspace);
+      }
+
+      await PlatformSetup.setup(buildParameters, actionFolder);
+      exitCode =
+        process.platform === 'darwin'
+          ? await MacBuilder.run(actionFolder)
+          : await Docker.run(baseImage.toString(), {
+              workspace,
+              actionFolder,
+              ...buildParameters,
+            });
+
+      // Local build caching - save
+      if (buildParameters.localCacheEnabled) {
+        const { LocalCacheService } = await import('./model/orchestrator/services/cache/local-cache-service');
+        if (buildParameters.localCacheLibrary) {
+          const projectFullPath = path.join(workspace, buildParameters.projectPath);
+          await LocalCacheService.saveLibraryCache(projectFullPath, cacheRoot, cacheKey);
+        }
+        if (buildParameters.localCacheLfs) {
+          await LocalCacheService.saveLfsCache(workspace, cacheRoot, cacheKey);
+        }
+      }
+
+      // Child workspace isolation - save workspace for next run
+      if (childWorkspaceConfig && childWorkspaceConfig.enabled) {
+        const { ChildWorkspaceService } = await import('./model/orchestrator/services/cache/child-workspace-service');
+        const projectFullPath = path.join(workspace, buildParameters.projectPath);
+        const preSaveSize = ChildWorkspaceService.getWorkspaceSize(projectFullPath);
+        core.info(`Child workspace size before save: ${preSaveSize}`);
+
+        ChildWorkspaceService.saveWorkspace(projectFullPath, childWorkspaceConfig);
+        core.info(`Child workspace "${buildParameters.childWorkspaceName}" saved to cache`);
+      }
+
+      // Revert overlays after job completion if configured
+      if (buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        core.info('[Sync] Reverting overlay changes after job completion');
+        try {
+          await IncrementalSyncService.revertOverlays(workspace, buildParameters.syncStatePath);
+        } catch (revertError) {
+          core.warning(`[Sync] Overlay revert failed: ${(revertError as Error).message}`);
+        }
+      }
       exitCode = await runColdBuild(buildParameters, baseImage, workspace, actionFolder);
     } else {
       await Orchestrator.run(buildParameters, baseImage.toString());
       exitCode = 0;
     }
 
+    // Post-build: archive and enforce retention
+    if (buildParameters.buildArchiveEnabled && exitCode === 0) {
+      core.info('Archiving build output...');
+      BuildReliabilityService.archiveBuildOutput(buildParameters.buildPath, buildParameters.buildArchivePath);
+      BuildReliabilityService.enforceRetention(buildParameters.buildArchivePath, buildParameters.buildArchiveRetention);
+    }
+
     // Set output
     await Output.setBuildVersion(buildParameters.buildVersion);
     await Output.setAndroidVersionCode(buildParameters.androidVersionCode);
     await Output.setEngineExitCode(exitCode);
 
+    // Artifact collection and upload (runs on both success and failure)
+    try {
+      // Register custom output types if provided
+      if (buildParameters.artifactCustomTypes) {
+        try {
+          const customTypes = JSON.parse(buildParameters.artifactCustomTypes);
+          if (Array.isArray(customTypes)) {
+            for (const ct of customTypes) {
+              OutputTypeRegistry.registerType({
+                name: ct.name,
+                defaultPath: ct.defaultPath || ct.pattern || `./${ct.name}/`,
+                description: ct.description || `Custom output type: ${ct.name}`,
+                builtIn: false,
+              });
+            }
+          }
+        } catch (parseError) {
+          core.warning(`Failed to parse artifactCustomTypes: ${(parseError as Error).message}`);
+        }
+      }
+
+      // Collect outputs and generate manifest
+      const manifestPath = path.join(buildParameters.projectPath, 'output-manifest.json');
+      const manifest = await OutputService.collectOutputs(
+        buildParameters.projectPath,
+        buildParameters.buildGuid,
+        buildParameters.artifactOutputTypes,
+        manifestPath,
+      );
+
+      core.setOutput('artifactManifestPath', manifestPath);
+
+      // Upload artifacts
+      const uploadConfig = ArtifactUploadHandler.parseConfig(
+        buildParameters.artifactUploadTarget,
+        buildParameters.artifactUploadPath || undefined,
+        buildParameters.artifactCompression,
+        buildParameters.artifactRetentionDays,
+      );
+
+      const uploadResult = await ArtifactUploadHandler.uploadArtifacts(
+        manifest,
+        uploadConfig,
+        buildParameters.projectPath,
+      );
+
+      if (!uploadResult.success) {
+        core.warning(
+          `Artifact upload completed with errors: ${uploadResult.entries
+            .filter((e) => !e.success)
+            .map((e) => `${e.type}: ${e.error}`)
+            .join('; ')}`,
+        );
+      }
+    } catch (artifactError) {
+      core.warning(`Artifact collection/upload failed: ${(artifactError as Error).message}`);
+    }
+
     if (exitCode !== 0) {
       core.setFailed(`Build failed with exit code ${exitCode}`);
     }
@@ -105,4 +359,58 @@ async function runColdBuild(
   }
 }
 
+/**
+ * Apply the configured sync strategy to the workspace before build.
+ */
+async function applySyncStrategy(buildParameters: BuildParameters, workspace: string): Promise<void> {
+  const strategy = buildParameters.syncStrategy as SyncStrategy;
+  const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspace, buildParameters.syncStatePath);
+
+  if (resolvedStrategy === 'full') {
+    core.info('[Sync] Resolved to full sync (no incremental state available)');
+
+    return;
+  }
+
+  switch (resolvedStrategy) {
+    case 'git-delta': {
+      const targetReference = buildParameters.gitSha || buildParameters.branch;
+      const changedFiles = await IncrementalSyncService.syncGitDelta(
+        workspace,
+        targetReference,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Git delta sync applied: ${changedFiles} file(s) changed`);
+      break;
+    }
+    case 'direct-input': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] direct-input strategy requires syncInputRef to be set');
+      }
+      const overlays = await IncrementalSyncService.applyDirectInput(
+        workspace,
+        buildParameters.syncInputRef,
+        buildParameters.syncStorageRemote || undefined,
+        buildParameters.syncStatePath,
+      );
+      core.info(`[Sync] Direct input applied: ${overlays.length} overlay(s)`);
+      break;
+    }
+    case 'storage-pull': {
+      if (!buildParameters.syncInputRef) {
+        throw new Error('[Sync] storage-pull strategy requires syncInputRef to be set');
+      }
+      const pulledFiles = await IncrementalSyncService.syncStoragePull(workspace, buildParameters.syncInputRef, {
+        rcloneRemote: buildParameters.syncStorageRemote || undefined,
+        syncRevertAfter: buildParameters.syncRevertAfter,
+        statePath: buildParameters.syncStatePath,
+      });
+      core.info(`[Sync] Storage pull complete: ${pulledFiles.length} file(s)`);
+      break;
+    }
+    default:
+      core.warning(`[Sync] Unknown sync strategy: ${resolvedStrategy}`);
+  }
+}
+
 runMain();

src/model/build-parameters.ts

@@ -54,6 +54,13 @@ class BuildParameters {
   public sshAgent!: string;
   public sshPublicKeysDirectoryPath!: string;
   public providerStrategy!: string;
+  public fallbackProviderStrategy!: string;
+  public runnerCheckEnabled!: boolean;
+  public runnerCheckLabels!: string[];
+  public runnerCheckMinAvailable!: number;
+  public retryOnFallback!: boolean;
+  public providerInitTimeout!: number;
+  public gitAuthMode!: string;
   public gitPrivateToken!: string;
   public awsStackName!: string;
   public awsEndpoint?: string;
@@ -106,6 +113,85 @@ class BuildParameters {
   public cacheUnityInstallationOnMac!: boolean;
   public unityHubVersionOnMac!: string;
   public dockerWorkspacePath!: string;
+  public submoduleProfilePath!: string;
+  public submoduleVariantPath!: string;
+  public submoduleToken!: string;
+  public localCacheEnabled!: boolean;
+  public localCacheRoot!: string;
+  public localCacheLibrary!: boolean;
+  public localCacheLfs!: boolean;
+  public childWorkspacesEnabled!: boolean;
+  public childWorkspaceName!: string;
+  public childWorkspaceCacheRoot!: string;
+  public childWorkspacePreserveGit!: boolean;
+  public childWorkspaceSeparateLibrary!: boolean;
+  public lfsTransferAgent!: string;
+  public lfsTransferAgentArgs!: string;
+  public lfsStoragePaths!: string;
+  public gitHooksEnabled!: boolean;
+  public gitHooksSkipList!: string;
+  public gitHooksRunBeforeBuild!: string;
+  public providerExecutable!: string;
+
+  // GCP Cloud Run (Experimental)
+  public gcpProject!: string;
+  public gcpRegion!: string;
+  public gcpStorageType!: string;
+  public gcpBucket!: string;
+  public gcpFilestoreIp!: string;
+  public gcpFilestoreShare!: string;
+  public gcpMachineType!: string;
+  public gcpDiskSizeGb!: string;
+  public gcpServiceAccount!: string;
+  public gcpVpcConnector!: string;
+
+  // Azure Container Instances (Experimental)
+  public azureResourceGroup!: string;
+  public azureLocation!: string;
+  public azureStorageType!: string;
+  public azureStorageAccount!: string;
+  public azureBlobContainer!: string;
+  public azureFileShareName!: string;
+  public azureSubscriptionId!: string;
+  public azureCpu!: string;
+  public azureMemoryGb!: string;
+  public azureDiskSizeGb!: string;
+  public azureSubnetId!: string;
+
+  // Remote PowerShell provider
+  public remotePowershellHost!: string;
+  public remotePowershellCredential!: string;
+  public remotePowershellTransport!: string;
+
+  // GitHub Actions provider
+  public githubActionsRepo!: string;
+  public githubActionsWorkflow!: string;
+  public githubActionsToken!: string;
+  public githubActionsRef!: string;
+
+  // GitLab CI provider
+  public gitlabProjectId!: string;
+  public gitlabTriggerToken!: string;
+  public gitlabApiUrl!: string;
+  public gitlabRef!: string;
+
+  // Ansible provider
+  public ansibleInventory!: string;
+  public ansiblePlaybook!: string;
+  public ansibleExtraVars!: string;
+  public ansibleVaultPassword!: string;
+  public gitIntegrityCheck!: boolean;
+  public gitAutoRecover!: boolean;
+  public cleanReservedFilenames!: boolean;
+  public buildArchiveEnabled!: boolean;
+  public buildArchivePath!: string;
+  public buildArchiveRetention!: number;
+
+  public testSuitePath!: string;
+  public testSuiteEvent!: string;
+  public testTaxonomyPath!: string;
+  public testResultFormat!: string;
+  public testResultPath!: string;
   public hotRunnerEnabled!: boolean;
   public hotRunnerTransport!: 'websocket' | 'grpc' | 'named-pipe';
   public hotRunnerHost!: string;
@@ -113,6 +199,17 @@ class BuildParameters {
   public hotRunnerHealthInterval!: number;
   public hotRunnerMaxIdle!: number;
   public hotRunnerFallbackToCold!: boolean;
+  public artifactOutputTypes!: string;
+  public artifactUploadTarget!: string;
+  public artifactUploadPath!: string;
+  public artifactCompression!: string;
+  public artifactRetentionDays!: string;
+  public artifactCustomTypes!: string;
+  public syncStrategy!: string;
+  public syncInputRef!: string;
+  public syncStorageRemote!: string;
+  public syncRevertAfter!: boolean;
+  public syncStatePath!: string;
 
   public static shouldUseRetainedWorkspaceMode(buildParameters: BuildParameters) {
     return buildParameters.maxRetainedWorkspaces > 0 && Orchestrator.lockedWorkspace !== ``;
@@ -201,6 +298,13 @@ class BuildParameters {
       containerRegistryRepository: Input.containerRegistryRepository,
       containerRegistryImageVersion: Input.containerRegistryImageVersion,
       providerStrategy: OrchestratorOptions.providerStrategy,
+      fallbackProviderStrategy: OrchestratorOptions.fallbackProviderStrategy,
+      runnerCheckEnabled: OrchestratorOptions.runnerCheckEnabled,
+      runnerCheckLabels: OrchestratorOptions.runnerCheckLabels,
+      runnerCheckMinAvailable: OrchestratorOptions.runnerCheckMinAvailable,
+      retryOnFallback: OrchestratorOptions.retryOnFallback,
+      providerInitTimeout: OrchestratorOptions.providerInitTimeout,
+      gitAuthMode: OrchestratorOptions.gitAuthMode,
       buildPlatform: OrchestratorOptions.buildPlatform,
       kubeConfig: OrchestratorOptions.kubeConfig,
       containerMemory: OrchestratorOptions.containerMemory,
@@ -235,6 +339,27 @@ class BuildParameters {
       inputPullCommand: OrchestratorOptions.inputPullCommand,
       pullInputList: OrchestratorOptions.pullInputList,
       kubeStorageClass: OrchestratorOptions.kubeStorageClass,
+      gcpProject: Input.gcpProject,
+      gcpRegion: Input.gcpRegion,
+      gcpStorageType: Input.gcpStorageType,
+      gcpBucket: Input.gcpBucket,
+      gcpFilestoreIp: Input.gcpFilestoreIp,
+      gcpFilestoreShare: Input.gcpFilestoreShare,
+      gcpMachineType: Input.gcpMachineType,
+      gcpDiskSizeGb: Input.gcpDiskSizeGb,
+      gcpServiceAccount: Input.gcpServiceAccount,
+      gcpVpcConnector: Input.gcpVpcConnector,
+      azureResourceGroup: Input.azureResourceGroup,
+      azureLocation: Input.azureLocation,
+      azureStorageType: Input.azureStorageType,
+      azureStorageAccount: Input.azureStorageAccount,
+      azureBlobContainer: Input.azureBlobContainer,
+      azureFileShareName: Input.azureFileShareName,
+      azureSubscriptionId: Input.azureSubscriptionId,
+      azureCpu: Input.azureCpu,
+      azureMemoryGb: Input.azureMemoryGb,
+      azureDiskSizeGb: Input.azureDiskSizeGb,
+      azureSubnetId: Input.azureSubnetId,
       cacheKey: OrchestratorOptions.cacheKey,
       maxRetainedWorkspaces: Number.parseInt(OrchestratorOptions.maxRetainedWorkspaces),
       useLargePackages: OrchestratorOptions.useLargePackages,
@@ -249,6 +374,59 @@ class BuildParameters {
       cacheUnityInstallationOnMac: Input.cacheUnityInstallationOnMac,
       unityHubVersionOnMac: Input.unityHubVersionOnMac,
       dockerWorkspacePath: Input.dockerWorkspacePath,
+      submoduleProfilePath: Input.submoduleProfilePath,
+      submoduleVariantPath: Input.submoduleVariantPath,
+      submoduleToken: Input.submoduleToken,
+      localCacheEnabled: Input.localCacheEnabled,
+      localCacheRoot: Input.localCacheRoot,
+      localCacheLibrary: Input.localCacheLibrary,
+      localCacheLfs: Input.localCacheLfs,
+      childWorkspacesEnabled: Input.childWorkspacesEnabled,
+      childWorkspaceName: Input.childWorkspaceName,
+      childWorkspaceCacheRoot: Input.childWorkspaceCacheRoot,
+      childWorkspacePreserveGit: Input.childWorkspacePreserveGit,
+      childWorkspaceSeparateLibrary: Input.childWorkspaceSeparateLibrary,
+      lfsTransferAgent: Input.lfsTransferAgent,
+      lfsTransferAgentArgs: Input.lfsTransferAgentArgs,
+      lfsStoragePaths: Input.lfsStoragePaths,
+      gitHooksEnabled: Input.gitHooksEnabled,
+      gitHooksSkipList: Input.gitHooksSkipList,
+      gitHooksRunBeforeBuild: Input.gitHooksRunBeforeBuild,
+      providerExecutable: Input.providerExecutable,
+
+      // Remote PowerShell provider
+      remotePowershellHost: Input.remotePowershellHost,
+      remotePowershellCredential: Input.remotePowershellCredential,
+      remotePowershellTransport: Input.remotePowershellTransport,
+
+      // GitHub Actions provider
+      githubActionsRepo: Input.githubActionsRepo,
+      githubActionsWorkflow: Input.githubActionsWorkflow,
+      githubActionsToken: Input.githubActionsToken,
+      githubActionsRef: Input.githubActionsRef,
+
+      // GitLab CI provider
+      gitlabProjectId: Input.gitlabProjectId,
+      gitlabTriggerToken: Input.gitlabTriggerToken,
+      gitlabApiUrl: Input.gitlabApiUrl,
+      gitlabRef: Input.gitlabRef,
+
+      // Ansible provider
+      ansibleInventory: Input.ansibleInventory,
+      ansiblePlaybook: Input.ansiblePlaybook,
+      ansibleExtraVars: Input.ansibleExtraVars,
+      ansibleVaultPassword: Input.ansibleVaultPassword,
+      gitIntegrityCheck: Input.gitIntegrityCheck,
+      gitAutoRecover: Input.gitAutoRecover,
+      cleanReservedFilenames: Input.cleanReservedFilenames,
+      buildArchiveEnabled: Input.buildArchiveEnabled,
+      buildArchivePath: Input.buildArchivePath,
+      buildArchiveRetention: Input.buildArchiveRetention,
+      testSuitePath: Input.testSuitePath,
+      testSuiteEvent: Input.testSuiteEvent,
+      testTaxonomyPath: Input.testTaxonomyPath,
+      testResultFormat: Input.testResultFormat,
+      testResultPath: Input.testResultPath,
       hotRunnerEnabled: Input.hotRunnerEnabled,
       hotRunnerTransport: Input.hotRunnerTransport,
       hotRunnerHost: Input.hotRunnerHost,
@@ -256,6 +434,17 @@ class BuildParameters {
       hotRunnerHealthInterval: Input.hotRunnerHealthInterval,
       hotRunnerMaxIdle: Input.hotRunnerMaxIdle,
       hotRunnerFallbackToCold: Input.hotRunnerFallbackToCold,
+      artifactOutputTypes: Input.artifactOutputTypes,
+      artifactUploadTarget: Input.artifactUploadTarget,
+      artifactUploadPath: Input.artifactUploadPath,
+      artifactCompression: Input.artifactCompression,
+      artifactRetentionDays: Input.artifactRetentionDays,
+      artifactCustomTypes: Input.artifactCustomTypes,
+      syncStrategy: Input.syncStrategy,
+      syncInputRef: Input.syncInputRef,
+      syncStorageRemote: Input.syncStorageRemote,
+      syncRevertAfter: Input.syncRevertAfter,
+      syncStatePath: Input.syncStatePath,
     };
   }
 

src/model/cli/cli.ts

@@ -12,6 +12,8 @@ import OrchestratorOptionsReader from '../orchestrator/options/orchestrator-opti
 import GitHub from '../github';
 import { OptionValues } from 'commander';
 import { InputKey } from '../input';
+import { SubmoduleProfileService } from '../orchestrator/services/submodule/submodule-profile-service';
+import { LfsAgentService } from '../orchestrator/services/lfs/lfs-agent-service';
 
 export class Cli {
   public static options: OptionValues | undefined;
@@ -53,6 +55,11 @@ export class Cli {
     program.option('--artifactName <artifactName>', 'caching artifact name');
     program.option('--select <select>', 'select a particular resource');
     program.option('--logFile <logFile>', 'output to log file (log stream only)');
+    program.option('--profilePath <profilePath>', 'path to submodule profile YAML');
+    program.option('--variantPath <variantPath>', 'path to submodule variant YAML');
+    program.option('--agentPath <agentPath>', 'path to custom LFS transfer agent');
+    program.option('--agentArgs <agentArgs>', 'arguments for custom LFS transfer agent');
+    program.option('--storagePaths <storagePaths>', 'semicolon-separated storage paths for LFS agent');
     program.parse(process.argv);
     Cli.options = program.opts();
 
@@ -172,4 +179,26 @@ export class Cli {
 
     return await Orchestrator.Provider.watchWorkflow();
   }
+
+  @CliFunction(`submodule-init`, `initializes submodules from a YAML profile`)
+  public static async SubmoduleInit(): Promise<void> {
+    const profilePath = Cli.options!['profilePath'];
+    const variantPath = Cli.options!['variantPath'] || '';
+    if (!profilePath) {
+      throw new Error('--profilePath is required for submodule-init');
+    }
+    const plan = await SubmoduleProfileService.createInitPlan(profilePath, variantPath, process.cwd());
+    await SubmoduleProfileService.execute(plan, process.cwd());
+  }
+
+  @CliFunction(`lfs-agent-configure`, `configures a custom LFS transfer agent`)
+  public static async LfsAgentConfigure(): Promise<void> {
+    const agentPath = Cli.options!['agentPath'];
+    if (!agentPath) {
+      throw new Error('--agentPath is required for lfs-agent-configure');
+    }
+    const agentArgs = Cli.options!['agentArgs'] || '';
+    const storagePaths = (Cli.options!['storagePaths'] || '').split(';').filter(Boolean);
+    await LfsAgentService.configure(agentPath, agentArgs, storagePaths, process.cwd());
+  }
 }

src/model/enterprise-inputs.test.ts

@@ -0,0 +1,509 @@
+/**
+ * Tests for enterprise input properties and their wiring into BuildParameters.
+ *
+ * Covers all 20 new input properties added for enterprise features:
+ * - Boolean inputs: localCacheEnabled, childWorkspacesEnabled, gitHooksEnabled,
+ *   localCacheLibrary, localCacheLfs, childWorkspacePreserveGit, childWorkspaceSeparateLibrary
+ * - String inputs: submoduleProfilePath, submoduleVariantPath, submoduleToken,
+ *   localCacheRoot, childWorkspaceName, childWorkspaceCacheRoot, lfsTransferAgent,
+ *   lfsTransferAgentArgs, lfsStoragePaths, providerExecutable, gitHooksSkipList,
+ *   gitHooksRunBeforeBuild
+ *
+ * Special attention to boolean inputs: GitHub Actions always passes inputs as strings,
+ * so 'false' must NOT evaluate as truthy (the #1 source of bugs).
+ */
+
+import * as core from '@actions/core';
+import Input from './input';
+import Versioning from './versioning';
+import BuildParameters from './build-parameters';
+
+// ---------------------------------------------------------------------------
+// Setup
+// ---------------------------------------------------------------------------
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+// ---------------------------------------------------------------------------
+// Part 1: Input getters — defaults and explicit values
+// ---------------------------------------------------------------------------
+
+describe('Enterprise Input properties', () => {
+  // -----------------------------------------------------------------------
+  // Boolean inputs — default and string parsing
+  // -----------------------------------------------------------------------
+
+  describe('localCacheEnabled', () => {
+    it('returns false by default', () => {
+      expect(Input.localCacheEnabled).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.localCacheEnabled).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.localCacheEnabled).toBe(false);
+    });
+
+    it('returns false when empty string is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('');
+      expect(Input.localCacheEnabled).toBe(false);
+    });
+  });
+
+  describe('localCacheLibrary', () => {
+    it('returns true by default (library caching on by default when cache enabled)', () => {
+      expect(Input.localCacheLibrary).toBe(true);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.localCacheLibrary).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.localCacheLibrary).toBe(false);
+    });
+  });
+
+  describe('localCacheLfs', () => {
+    it('returns false by default', () => {
+      expect(Input.localCacheLfs).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.localCacheLfs).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.localCacheLfs).toBe(false);
+    });
+  });
+
+  describe('childWorkspacesEnabled', () => {
+    it('returns false by default', () => {
+      expect(Input.childWorkspacesEnabled).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.childWorkspacesEnabled).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.childWorkspacesEnabled).toBe(false);
+    });
+
+    it('returns false when empty string is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('');
+      expect(Input.childWorkspacesEnabled).toBe(false);
+    });
+  });
+
+  describe('childWorkspacePreserveGit', () => {
+    it('returns true by default', () => {
+      expect(Input.childWorkspacePreserveGit).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.childWorkspacePreserveGit).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.childWorkspacePreserveGit).toBe(true);
+    });
+  });
+
+  describe('childWorkspaceSeparateLibrary', () => {
+    it('returns true by default', () => {
+      expect(Input.childWorkspaceSeparateLibrary).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.childWorkspaceSeparateLibrary).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.childWorkspaceSeparateLibrary).toBe(true);
+    });
+  });
+
+  describe('gitHooksEnabled', () => {
+    it('returns false by default', () => {
+      expect(Input.gitHooksEnabled).toBe(false);
+    });
+
+    it('returns true when string "true" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(Input.gitHooksEnabled).toBe(true);
+    });
+
+    it('returns false when string "false" is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(Input.gitHooksEnabled).toBe(false);
+    });
+
+    it('returns false when empty string is passed', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('');
+      expect(Input.gitHooksEnabled).toBe(false);
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // Boolean truthiness edge cases — the #1 source of bugs
+  // -----------------------------------------------------------------------
+
+  describe('boolean input string handling (edge cases)', () => {
+    // These tests verify that the === 'true' comparison is correct.
+    // In JavaScript, 'false' is truthy when used in a boolean context,
+    // but the Input class correctly uses === 'true' comparison.
+
+    const booleanInputs: Array<{
+      name: string;
+      getter: () => boolean;
+      defaultValue: boolean;
+    }> = [
+      { name: 'localCacheEnabled', getter: () => Input.localCacheEnabled, defaultValue: false },
+      { name: 'localCacheLfs', getter: () => Input.localCacheLfs, defaultValue: false },
+      { name: 'childWorkspacesEnabled', getter: () => Input.childWorkspacesEnabled, defaultValue: false },
+      { name: 'gitHooksEnabled', getter: () => Input.gitHooksEnabled, defaultValue: false },
+
+      // These default to true:
+      { name: 'localCacheLibrary', getter: () => Input.localCacheLibrary, defaultValue: true },
+      { name: 'childWorkspacePreserveGit', getter: () => Input.childWorkspacePreserveGit, defaultValue: true },
+      { name: 'childWorkspaceSeparateLibrary', getter: () => Input.childWorkspaceSeparateLibrary, defaultValue: true },
+    ];
+
+    test.each(booleanInputs)('$name: "false" string does NOT evaluate as truthy', ({ getter }) => {
+      jest.spyOn(core, 'getInput').mockReturnValue('false');
+      expect(getter()).toBe(false);
+    });
+
+    test.each(booleanInputs)('$name: "true" string evaluates as truthy', ({ getter }) => {
+      jest.spyOn(core, 'getInput').mockReturnValue('true');
+      expect(getter()).toBe(true);
+    });
+
+    test.each(booleanInputs)('$name: "TRUE" (uppercase) does NOT evaluate as true (case sensitive)', ({ getter }) => {
+      jest.spyOn(core, 'getInput').mockReturnValue('TRUE');
+      expect(getter()).toBe(false);
+    });
+
+    test.each(booleanInputs)('$name: "1" does NOT evaluate as true', ({ getter }) => {
+      jest.spyOn(core, 'getInput').mockReturnValue('1');
+      expect(getter()).toBe(false);
+    });
+
+    test.each(booleanInputs)('$name: "yes" does NOT evaluate as true', ({ getter }) => {
+      jest.spyOn(core, 'getInput').mockReturnValue('yes');
+      expect(getter()).toBe(false);
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // String inputs — defaults and explicit values
+  // -----------------------------------------------------------------------
+
+  describe('submoduleProfilePath', () => {
+    it('returns empty string by default', () => {
+      expect(Input.submoduleProfilePath).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('config/submodule-profiles/tow/ec/profile.yml');
+      expect(Input.submoduleProfilePath).toBe('config/submodule-profiles/tow/ec/profile.yml');
+    });
+  });
+
+  describe('submoduleVariantPath', () => {
+    it('returns empty string by default', () => {
+      expect(Input.submoduleVariantPath).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('config/submodule-profiles/tow/ec/server.yml');
+      expect(Input.submoduleVariantPath).toBe('config/submodule-profiles/tow/ec/server.yml');
+    });
+  });
+
+  describe('submoduleToken', () => {
+    it('returns empty string by default', () => {
+      expect(Input.submoduleToken).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('ghp_abc123');
+      expect(Input.submoduleToken).toBe('ghp_abc123');
+    });
+  });
+
+  describe('localCacheRoot', () => {
+    it('returns empty string by default', () => {
+      expect(Input.localCacheRoot).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('/d/cache/game-ci');
+      expect(Input.localCacheRoot).toBe('/d/cache/game-ci');
+    });
+  });
+
+  describe('childWorkspaceName', () => {
+    it('returns empty string by default', () => {
+      expect(Input.childWorkspaceName).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('TurnOfWarEndlessCrusade');
+      expect(Input.childWorkspaceName).toBe('TurnOfWarEndlessCrusade');
+    });
+  });
+
+  describe('childWorkspaceCacheRoot', () => {
+    it('returns empty string by default', () => {
+      expect(Input.childWorkspaceCacheRoot).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('/d/workspaces');
+      expect(Input.childWorkspaceCacheRoot).toBe('/d/workspaces');
+    });
+  });
+
+  describe('lfsTransferAgent', () => {
+    it('returns empty string by default', () => {
+      expect(Input.lfsTransferAgent).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('/tools/elastic-git-storage');
+      expect(Input.lfsTransferAgent).toBe('/tools/elastic-git-storage');
+    });
+  });
+
+  describe('lfsTransferAgentArgs', () => {
+    it('returns empty string by default', () => {
+      expect(Input.lfsTransferAgentArgs).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('--verbose --timeout=60');
+      expect(Input.lfsTransferAgentArgs).toBe('--verbose --timeout=60');
+    });
+  });
+
+  describe('lfsStoragePaths', () => {
+    it('returns empty string by default', () => {
+      expect(Input.lfsStoragePaths).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('/storage/primary;/storage/secondary');
+      expect(Input.lfsStoragePaths).toBe('/storage/primary;/storage/secondary');
+    });
+  });
+
+  describe('providerExecutable', () => {
+    it('returns empty string by default', () => {
+      expect(Input.providerExecutable).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('/usr/local/bin/custom-provider');
+      expect(Input.providerExecutable).toBe('/usr/local/bin/custom-provider');
+    });
+  });
+
+  describe('gitHooksSkipList', () => {
+    it('returns empty string by default', () => {
+      expect(Input.gitHooksSkipList).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('pre-commit,pre-push');
+      expect(Input.gitHooksSkipList).toBe('pre-commit,pre-push');
+    });
+  });
+
+  describe('gitHooksRunBeforeBuild', () => {
+    it('returns empty string by default', () => {
+      expect(Input.gitHooksRunBeforeBuild).toBe('');
+    });
+
+    it('takes input from workflow', () => {
+      jest.spyOn(core, 'getInput').mockReturnValue('pre-commit');
+      expect(Input.gitHooksRunBeforeBuild).toBe('pre-commit');
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Part 2: BuildParameters.create() maps new inputs to properties
+// ---------------------------------------------------------------------------
+
+const testLicense =
+  '<?xml version="1.0" encoding="UTF-8"?><root>\n    <License id="Terms">\n        <MachineBindings>\n            <Binding Key="1" Value="576562626572264761624c65526f7578"/>\n            <Binding Key="2" Value="576562626572264761624c65526f7578"/>\n        </MachineBindings>\n        <MachineID Value="D7nTUnjNAmtsUMcnoyrqkgIbYdM="/>\n        <SerialHash Value="2033b8ac3e6faa3742ca9f0bfae44d18f2a96b80"/>\n        <Features>\n            <Feature Value="33"/>\n            <Feature Value="1"/>\n            <Feature Value="12"/>\n            <Feature Value="2"/>\n            <Feature Value="24"/>\n            <Feature Value="3"/>\n            <Feature Value="36"/>\n            <Feature Value="17"/>\n            <Feature Value="19"/>\n            <Feature Value="62"/>\n        </Features>\n        <DeveloperData Value="AQAAAEY0LUJHUlgtWEQ0RS1aQ1dWLUM1SlctR0RIQg=="/>\n        <SerialMasked Value="F4-BGRX-XD4E-ZCWV-C5JW-XXXX"/>\n        <StartDate Value="2021-02-08T00:00:00"/>\n        <UpdateDate Value="2021-02-09T00:34:57"/>\n        <InitialActivationDate Value="2021-02-08T00:34:56"/>\n        <LicenseVersion Value="6.x"/>\n        <ClientProvidedVersion Value="2018.4.30f1"/>\n        <AlwaysOnline Value="false"/>\n        <Entitlements>\n            <Entitlement Ns="unity_editor" Tag="UnityPersonal" Type="EDITOR" ValidTo="9999-12-31T00:00:00"/>\n            <Entitlement Ns="unity_editor" Tag="DarkSkin" Type="EDITOR_FEATURE" ValidTo="9999-12-31T00:00:00"/>\n        </Entitlements>\n    </License>\n<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments"/><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/><Reference URI="#Terms"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><DigestValue>m0Db8UK+ktnOLJBtHybkfetpcKo=</DigestValue></Reference></SignedInfo><SignatureValue>o/pUbSQAukz7+ZYAWhnA0AJbIlyyCPL7bKVEM2lVqbrXt7cyey+umkCXamuOgsWPVUKBMkXtMH8L\n5etLmD0getWIhTGhzOnDCk+gtIPfL4jMo9tkEuOCROQAXCci23VFscKcrkB+3X6h4wEOtA2APhOY\nB+wvC794o8/82ffjP79aVAi57rp3Wmzx+9pe9yMwoJuljAy2sc2tIMgdQGWVmOGBpQm3JqsidyzI\nJWG2kjnc7pDXK9pwYzXoKiqUqqrut90d+kQqRyv7MSZXR50HFqD/LI69h68b7P8Bjo3bPXOhNXGR\n9YCoemH6EkfCJxp2gIjzjWW+l2Hj2EsFQi8YXw==</SignatureValue></Signature></root>';
+
+describe('BuildParameters.create() enterprise property mapping', () => {
+  beforeEach(() => {
+    jest.spyOn(Versioning, 'determineBuildVersion').mockImplementation(async () => '1.3.37');
+    process.env.UNITY_LICENSE = testLicense;
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it('maps submoduleProfilePath from Input', async () => {
+    jest.spyOn(Input, 'submoduleProfilePath', 'get').mockReturnValue('/path/to/profile.yml');
+    const parameters = await BuildParameters.create();
+    expect(parameters.submoduleProfilePath).toBe('/path/to/profile.yml');
+  });
+
+  it('maps submoduleVariantPath from Input', async () => {
+    jest.spyOn(Input, 'submoduleVariantPath', 'get').mockReturnValue('/path/to/variant.yml');
+    const parameters = await BuildParameters.create();
+    expect(parameters.submoduleVariantPath).toBe('/path/to/variant.yml');
+  });
+
+  it('maps submoduleToken from Input', async () => {
+    jest.spyOn(Input, 'submoduleToken', 'get').mockReturnValue('ghp_token123');
+    const parameters = await BuildParameters.create();
+    expect(parameters.submoduleToken).toBe('ghp_token123');
+  });
+
+  it('maps localCacheEnabled from Input', async () => {
+    jest.spyOn(Input, 'localCacheEnabled', 'get').mockReturnValue(true);
+    const parameters = await BuildParameters.create();
+    expect(parameters.localCacheEnabled).toBe(true);
+  });
+
+  it('maps localCacheRoot from Input', async () => {
+    jest.spyOn(Input, 'localCacheRoot', 'get').mockReturnValue('/d/cache');
+    const parameters = await BuildParameters.create();
+    expect(parameters.localCacheRoot).toBe('/d/cache');
+  });
+
+  it('maps localCacheLibrary from Input', async () => {
+    jest.spyOn(Input, 'localCacheLibrary', 'get').mockReturnValue(false);
+    const parameters = await BuildParameters.create();
+    expect(parameters.localCacheLibrary).toBe(false);
+  });
+
+  it('maps localCacheLfs from Input', async () => {
+    jest.spyOn(Input, 'localCacheLfs', 'get').mockReturnValue(true);
+    const parameters = await BuildParameters.create();
+    expect(parameters.localCacheLfs).toBe(true);
+  });
+
+  it('maps childWorkspacesEnabled from Input', async () => {
+    jest.spyOn(Input, 'childWorkspacesEnabled', 'get').mockReturnValue(true);
+    const parameters = await BuildParameters.create();
+    expect(parameters.childWorkspacesEnabled).toBe(true);
+  });
+
+  it('maps childWorkspaceName from Input', async () => {
+    jest.spyOn(Input, 'childWorkspaceName', 'get').mockReturnValue('TurnOfWar');
+    const parameters = await BuildParameters.create();
+    expect(parameters.childWorkspaceName).toBe('TurnOfWar');
+  });
+
+  it('maps childWorkspaceCacheRoot from Input', async () => {
+    jest.spyOn(Input, 'childWorkspaceCacheRoot', 'get').mockReturnValue('/cache/workspaces');
+    const parameters = await BuildParameters.create();
+    expect(parameters.childWorkspaceCacheRoot).toBe('/cache/workspaces');
+  });
+
+  it('maps childWorkspacePreserveGit from Input', async () => {
+    jest.spyOn(Input, 'childWorkspacePreserveGit', 'get').mockReturnValue(false);
+    const parameters = await BuildParameters.create();
+    expect(parameters.childWorkspacePreserveGit).toBe(false);
+  });
+
+  it('maps childWorkspaceSeparateLibrary from Input', async () => {
+    jest.spyOn(Input, 'childWorkspaceSeparateLibrary', 'get').mockReturnValue(false);
+    const parameters = await BuildParameters.create();
+    expect(parameters.childWorkspaceSeparateLibrary).toBe(false);
+  });
+
+  it('maps lfsTransferAgent from Input', async () => {
+    jest.spyOn(Input, 'lfsTransferAgent', 'get').mockReturnValue('/tools/elastic-git-storage');
+    const parameters = await BuildParameters.create();
+    expect(parameters.lfsTransferAgent).toBe('/tools/elastic-git-storage');
+  });
+
+  it('maps lfsTransferAgentArgs from Input', async () => {
+    jest.spyOn(Input, 'lfsTransferAgentArgs', 'get').mockReturnValue('--verbose');
+    const parameters = await BuildParameters.create();
+    expect(parameters.lfsTransferAgentArgs).toBe('--verbose');
+  });
+
+  it('maps lfsStoragePaths from Input', async () => {
+    jest.spyOn(Input, 'lfsStoragePaths', 'get').mockReturnValue('/path/a;/path/b');
+    const parameters = await BuildParameters.create();
+    expect(parameters.lfsStoragePaths).toBe('/path/a;/path/b');
+  });
+
+  it('maps gitHooksEnabled from Input', async () => {
+    jest.spyOn(Input, 'gitHooksEnabled', 'get').mockReturnValue(true);
+    const parameters = await BuildParameters.create();
+    expect(parameters.gitHooksEnabled).toBe(true);
+  });
+
+  it('maps gitHooksSkipList from Input', async () => {
+    jest.spyOn(Input, 'gitHooksSkipList', 'get').mockReturnValue('pre-commit,pre-push');
+    const parameters = await BuildParameters.create();
+    expect(parameters.gitHooksSkipList).toBe('pre-commit,pre-push');
+  });
+
+  it('maps gitHooksRunBeforeBuild from Input', async () => {
+    jest.spyOn(Input, 'gitHooksRunBeforeBuild', 'get').mockReturnValue('pre-commit');
+    const parameters = await BuildParameters.create();
+    expect(parameters.gitHooksRunBeforeBuild).toBe('pre-commit');
+  });
+
+  it('maps providerExecutable from Input', async () => {
+    jest.spyOn(Input, 'providerExecutable', 'get').mockReturnValue('/usr/local/bin/provider');
+    const parameters = await BuildParameters.create();
+    expect(parameters.providerExecutable).toBe('/usr/local/bin/provider');
+  });
+
+  // Test that all enterprise properties have correct defaults when not explicitly set
+  it('has correct defaults for all enterprise properties', async () => {
+    const parameters = await BuildParameters.create();
+
+    expect(parameters.submoduleProfilePath).toBe('');
+    expect(parameters.submoduleVariantPath).toBe('');
+    expect(parameters.submoduleToken).toBe('');
+    expect(parameters.localCacheEnabled).toBe(false);
+    expect(parameters.localCacheRoot).toBe('');
+    expect(parameters.localCacheLibrary).toBe(true);
+    expect(parameters.localCacheLfs).toBe(false);
+    expect(parameters.childWorkspacesEnabled).toBe(false);
+    expect(parameters.childWorkspaceName).toBe('');
+    expect(parameters.childWorkspaceCacheRoot).toBe('');
+    expect(parameters.childWorkspacePreserveGit).toBe(true);
+    expect(parameters.childWorkspaceSeparateLibrary).toBe(true);
+    expect(parameters.lfsTransferAgent).toBe('');
+    expect(parameters.lfsTransferAgentArgs).toBe('');
+    expect(parameters.lfsStoragePaths).toBe('');
+    expect(parameters.gitHooksEnabled).toBe(false);
+    expect(parameters.gitHooksSkipList).toBe('');
+    expect(parameters.gitHooksRunBeforeBuild).toBe('');
+    expect(parameters.providerExecutable).toBe('');
+  });
+});

src/model/input.ts

@@ -241,6 +241,28 @@ class Input {
     return Input.getInput('dockerWorkspacePath') ?? '/github/workspace';
   }
 
+  static get syncStrategy(): string {
+    return Input.getInput('syncStrategy') ?? 'full';
+  }
+
+  static get syncInputRef(): string {
+    return Input.getInput('syncInputRef') ?? '';
+  }
+
+  static get syncStorageRemote(): string {
+    return Input.getInput('syncStorageRemote') ?? '';
+  }
+
+  static get syncRevertAfter(): boolean {
+    const input = Input.getInput('syncRevertAfter') ?? 'true';
+
+    return input === 'true';
+  }
+
+  static get syncStatePath(): string {
+    return Input.getInput('syncStatePath') ?? '.game-ci/sync-state.json';
+  }
+
   static get dockerCpuLimit(): string {
     return Input.getInput('dockerCpuLimit') ?? os.cpus().length.toString();
   }
@@ -278,16 +300,290 @@ class Input {
     return Input.getInput('containerRegistryImageVersion') ?? '3';
   }
 
+  static get artifactOutputTypes(): string {
+    return Input.getInput('artifactOutputTypes') ?? 'build,logs,test-results';
+  }
+
+  static get artifactUploadTarget(): string {
+    return Input.getInput('artifactUploadTarget') ?? 'github-artifacts';
+  }
+
+  static get artifactUploadPath(): string {
+    return Input.getInput('artifactUploadPath') ?? '';
+  }
+
+  static get artifactCompression(): string {
+    return Input.getInput('artifactCompression') ?? 'gzip';
+  }
+
+  static get artifactRetentionDays(): string {
+    return Input.getInput('artifactRetentionDays') ?? '30';
+  }
+
+  static get artifactCustomTypes(): string {
+    return Input.getInput('artifactCustomTypes') ?? '';
+  }
+
   static get skipActivation(): string {
     return Input.getInput('skipActivation')?.toLowerCase() ?? 'false';
   }
 
+  static get submoduleProfilePath(): string {
+    return Input.getInput('submoduleProfilePath') ?? '';
+  }
+
+  static get submoduleVariantPath(): string {
+    return Input.getInput('submoduleVariantPath') ?? '';
+  }
+
+  static get submoduleToken(): string {
+    return Input.getInput('submoduleToken') ?? '';
+  }
+
+  static get localCacheEnabled(): boolean {
+    return (Input.getInput('localCacheEnabled') ?? 'false') === 'true';
+  }
+
+  static get localCacheRoot(): string {
+    return Input.getInput('localCacheRoot') ?? '';
+  }
+
+  static get localCacheLibrary(): boolean {
+    return (Input.getInput('localCacheLibrary') ?? 'true') === 'true';
+  }
+
+  static get localCacheLfs(): boolean {
+    return (Input.getInput('localCacheLfs') ?? 'false') === 'true';
+  }
+
+  static get childWorkspacesEnabled(): boolean {
+    return (Input.getInput('childWorkspacesEnabled') ?? 'false') === 'true';
+  }
+
+  static get childWorkspaceName(): string {
+    return Input.getInput('childWorkspaceName') ?? '';
+  }
+
+  static get childWorkspaceCacheRoot(): string {
+    return Input.getInput('childWorkspaceCacheRoot') ?? '';
+  }
+
+  static get childWorkspacePreserveGit(): boolean {
+    return (Input.getInput('childWorkspacePreserveGit') ?? 'true') === 'true';
+  }
+
+  static get childWorkspaceSeparateLibrary(): boolean {
+    return (Input.getInput('childWorkspaceSeparateLibrary') ?? 'true') === 'true';
+  }
+
+  static get lfsTransferAgent(): string {
+    return Input.getInput('lfsTransferAgent') ?? '';
+  }
+
+  static get lfsTransferAgentArgs(): string {
+    return Input.getInput('lfsTransferAgentArgs') ?? '';
+  }
+
+  static get lfsStoragePaths(): string {
+    return Input.getInput('lfsStoragePaths') ?? '';
+  }
+
+  static get gitHooksEnabled(): boolean {
+    return (Input.getInput('gitHooksEnabled') ?? 'false') === 'true';
+  }
+
+  static get gitHooksSkipList(): string {
+    return Input.getInput('gitHooksSkipList') ?? '';
+  }
+
+  static get gitHooksRunBeforeBuild(): string {
+    return Input.getInput('gitHooksRunBeforeBuild') ?? '';
+  }
+
+  static get providerExecutable(): string {
+    return Input.getInput('providerExecutable') ?? '';
+  }
+
+  // GCP Cloud Run (Experimental)
+  static get gcpProject(): string {
+    return Input.getInput('gcpProject') ?? '';
+  }
+
+  static get gcpRegion(): string {
+    return Input.getInput('gcpRegion') ?? '';
+  }
+
+  static get gcpStorageType(): string {
+    return Input.getInput('gcpStorageType') ?? 'gcs-fuse';
+  }
+
+  static get gcpBucket(): string {
+    return Input.getInput('gcpBucket') ?? '';
+  }
+
+  static get gcpFilestoreIp(): string {
+    return Input.getInput('gcpFilestoreIp') ?? '';
+  }
+
+  static get gcpFilestoreShare(): string {
+    return Input.getInput('gcpFilestoreShare') ?? '/share1';
+  }
+
+  static get gcpMachineType(): string {
+    return Input.getInput('gcpMachineType') ?? 'e2-standard-4';
+  }
+
+  static get gcpDiskSizeGb(): string {
+    return Input.getInput('gcpDiskSizeGb') ?? '100';
+  }
+
+  static get gcpServiceAccount(): string {
+    return Input.getInput('gcpServiceAccount') ?? '';
+  }
+
+  static get gcpVpcConnector(): string {
+    return Input.getInput('gcpVpcConnector') ?? '';
+  }
+
+  // Azure Container Instances (Experimental)
+  static get azureResourceGroup(): string {
+    return Input.getInput('azureResourceGroup') ?? '';
+  }
+
+  static get azureLocation(): string {
+    return Input.getInput('azureLocation') ?? '';
+  }
+
+  static get azureStorageType(): string {
+    return Input.getInput('azureStorageType') ?? 'azure-files';
+  }
+
+  static get azureStorageAccount(): string {
+    return Input.getInput('azureStorageAccount') ?? '';
+  }
+
+  static get azureBlobContainer(): string {
+    return Input.getInput('azureBlobContainer') ?? 'unity-builds';
+  }
+
+  static get azureFileShareName(): string {
+    return Input.getInput('azureFileShareName') ?? 'unity-builds';
+  }
+
+  static get azureSubscriptionId(): string {
+    return Input.getInput('azureSubscriptionId') ?? '';
+  }
+
+  static get azureCpu(): string {
+    return Input.getInput('azureCpu') ?? '4';
+  }
+
+  static get azureMemoryGb(): string {
+    return Input.getInput('azureMemoryGb') ?? '16';
+  }
+
+  static get azureDiskSizeGb(): string {
+    return Input.getInput('azureDiskSizeGb') ?? '100';
+  }
+
+  static get azureSubnetId(): string {
+    return Input.getInput('azureSubnetId') ?? '';
+  }
+
+  // ### ### ###
+  // Remote PowerShell provider
+  // ### ### ###
+
+  static get remotePowershellHost(): string {
+    return Input.getInput('remotePowershellHost') ?? '';
+  }
+
+  static get remotePowershellCredential(): string {
+    return Input.getInput('remotePowershellCredential') ?? '';
+  }
+
+  static get remotePowershellTransport(): string {
+    return Input.getInput('remotePowershellTransport') ?? 'wsman';
+  }
+
+  // ### ### ###
+  // GitHub Actions provider
+  // ### ### ###
+
+  static get githubActionsRepo(): string {
+    return Input.getInput('githubActionsRepo') ?? '';
+  }
+
+  static get githubActionsWorkflow(): string {
+    return Input.getInput('githubActionsWorkflow') ?? '';
+  }
+
+  static get githubActionsToken(): string {
+    return Input.getInput('githubActionsToken') ?? '';
+  }
+
+  static get githubActionsRef(): string {
+    return Input.getInput('githubActionsRef') ?? 'main';
+  }
+
+  // ### ### ###
+  // GitLab CI provider
+  // ### ### ###
+
+  static get gitlabProjectId(): string {
+    return Input.getInput('gitlabProjectId') ?? '';
+  }
+
+  static get gitlabTriggerToken(): string {
+    return Input.getInput('gitlabTriggerToken') ?? '';
+  }
+
+  static get gitlabApiUrl(): string {
+    return Input.getInput('gitlabApiUrl') ?? 'https://gitlab.com';
+  }
+
+  static get gitlabRef(): string {
+    return Input.getInput('gitlabRef') ?? 'main';
+  }
+
+  // ### ### ###
+  // Ansible provider
+  // ### ### ###
+
+  static get ansibleInventory(): string {
+    return Input.getInput('ansibleInventory') ?? '';
+  }
+
+  static get ansiblePlaybook(): string {
+    return Input.getInput('ansiblePlaybook') ?? '';
+  }
+
+  static get ansibleExtraVars(): string {
+    return Input.getInput('ansibleExtraVars') ?? '';
+  }
+
+  static get ansibleVaultPassword(): string {
+    return Input.getInput('ansibleVaultPassword') ?? '';
+  }
+
+  static get gitIntegrityCheck(): boolean {
+    const input = Input.getInput('gitIntegrityCheck') ?? 'false';
+
+    return input === 'true';
+  }
+
   static get hotRunnerEnabled(): boolean {
     const input = Input.getInput('hotRunnerEnabled') ?? false;
 
     return input === 'true';
   }
 
+  static get gitAutoRecover(): boolean {
+    const input = Input.getInput('gitAutoRecover') ?? 'false';
+
+    return input === 'true';
+  }
+
   static get hotRunnerTransport(): 'websocket' | 'grpc' | 'named-pipe' {
     return (Input.getInput('hotRunnerTransport') ?? 'websocket') as 'websocket' | 'grpc' | 'named-pipe';
   }
@@ -314,6 +610,46 @@ class Input {
     return input === 'true';
   }
 
+  static get cleanReservedFilenames(): boolean {
+    const input = Input.getInput('cleanReservedFilenames') ?? 'false';
+
+    return input === 'true';
+  }
+
+  static get buildArchiveEnabled(): boolean {
+    const input = Input.getInput('buildArchiveEnabled') ?? 'false';
+
+    return input === 'true';
+  }
+
+  static get buildArchivePath(): string {
+    return Input.getInput('buildArchivePath') ?? './build-archives';
+  }
+
+  static get buildArchiveRetention(): number {
+    return Number.parseInt(Input.getInput('buildArchiveRetention') ?? '30', 10);
+  }
+
+  static get testSuitePath(): string {
+    return Input.getInput('testSuitePath') ?? '';
+  }
+
+  static get testSuiteEvent(): string {
+    return Input.getInput('testSuiteEvent') ?? '';
+  }
+
+  static get testTaxonomyPath(): string {
+    return Input.getInput('testTaxonomyPath') ?? '';
+  }
+
+  static get testResultFormat(): string {
+    return Input.getInput('testResultFormat') ?? 'junit';
+  }
+
+  static get testResultPath(): string {
+    return Input.getInput('testResultPath') ?? './test-results';
+  }
+
   public static ToEnvVarFormat(input: string) {
     if (input.toUpperCase() === input) {
       return input;

src/model/orchestrator/options/orchestrator-folders-auth.test.ts

@@ -0,0 +1,140 @@
+import { OrchestratorFolders } from './orchestrator-folders';
+
+jest.mock('../orchestrator', () => ({
+  __esModule: true,
+  default: {
+    buildParameters: {
+      orchestratorRepoName: 'game-ci/unity-builder',
+      githubRepo: 'myorg/myrepo',
+      gitPrivateToken: 'ghp_test123',
+      gitAuthMode: 'header',
+      buildGuid: 'test-guid',
+      projectPath: '',
+      buildPath: 'Builds',
+      cacheKey: 'test-cache',
+    },
+    lockedWorkspace: '',
+  },
+}));
+
+jest.mock('./orchestrator-options', () => ({
+  __esModule: true,
+  default: {
+    useSharedBuilder: false,
+  },
+}));
+
+jest.mock('../services/core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+
+const mockOrchestrator = require('../orchestrator').default;
+
+describe('OrchestratorFolders git auth', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('useHeaderAuth', () => {
+    it('should return true when gitAuthMode is header', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      expect(OrchestratorFolders.useHeaderAuth).toBe(true);
+    });
+
+    it('should return true when gitAuthMode is undefined (default)', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = undefined;
+      expect(OrchestratorFolders.useHeaderAuth).toBe(true);
+    });
+
+    it('should return false when gitAuthMode is url', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'url';
+      expect(OrchestratorFolders.useHeaderAuth).toBe(false);
+    });
+  });
+
+  describe('unityBuilderRepoUrl', () => {
+    it('should not include token in URL when using header auth', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      const url = OrchestratorFolders.unityBuilderRepoUrl;
+      expect(url).toBe('https://github.com/game-ci/unity-builder.git');
+      expect(url).not.toContain('ghp_test123');
+    });
+
+    it('should include token in URL when using url auth (legacy)', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'url';
+      const url = OrchestratorFolders.unityBuilderRepoUrl;
+      expect(url).toBe('https://ghp_test123@github.com/game-ci/unity-builder.git');
+    });
+  });
+
+  describe('targetBuildRepoUrl', () => {
+    it('should not include token in URL when using header auth', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      const url = OrchestratorFolders.targetBuildRepoUrl;
+      expect(url).toBe('https://github.com/myorg/myrepo.git');
+      expect(url).not.toContain('ghp_test123');
+    });
+
+    it('should include token in URL when using url auth (legacy)', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'url';
+      const url = OrchestratorFolders.targetBuildRepoUrl;
+      expect(url).toBe('https://ghp_test123@github.com/myorg/myrepo.git');
+    });
+  });
+
+  describe('gitAuthConfigScript', () => {
+    it('should emit http.extraHeader commands in header mode', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      const script = OrchestratorFolders.gitAuthConfigScript;
+      expect(script).toContain('http.extraHeader');
+      expect(script).toContain('GIT_PRIVATE_TOKEN');
+      expect(script).toContain('Authorization: Basic');
+    });
+
+    it('should emit no-op comment in url mode', () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'url';
+      const script = OrchestratorFolders.gitAuthConfigScript;
+      expect(script).toContain('legacy');
+      expect(script).not.toContain('http.extraHeader');
+    });
+  });
+
+  describe('configureGitAuth', () => {
+    it('should run git config with http.extraHeader in header mode', async () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      mockOrchestrator.buildParameters.gitPrivateToken = 'ghp_test123';
+      const { OrchestratorSystem } = require('../services/core/orchestrator-system');
+
+      await OrchestratorFolders.configureGitAuth();
+
+      // Verify the base64 encoding and extraHeader config are correct
+      const expectedEncoded = Buffer.from('x-access-token:ghp_test123').toString('base64');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining(expectedEncoded));
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('.extraHeader'));
+    });
+
+    it('should not run git config in url mode', async () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'url';
+      const { OrchestratorSystem } = require('../services/core/orchestrator-system');
+
+      await OrchestratorFolders.configureGitAuth();
+
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('should not run git config when no token is available', async () => {
+      mockOrchestrator.buildParameters.gitAuthMode = 'header';
+      mockOrchestrator.buildParameters.gitPrivateToken = '';
+      const originalEnv = process.env.GIT_PRIVATE_TOKEN;
+      delete process.env.GIT_PRIVATE_TOKEN;
+      const { OrchestratorSystem } = require('../services/core/orchestrator-system');
+
+      await OrchestratorFolders.configureGitAuth();
+
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalled();
+      if (originalEnv !== undefined) process.env.GIT_PRIVATE_TOKEN = originalEnv;
+    });
+  });
+});

src/model/orchestrator/options/orchestrator-folders.test.ts

@@ -0,0 +1,162 @@
+import { OrchestratorFolders } from './orchestrator-folders';
+
+// Mock Orchestrator
+jest.mock('../orchestrator', () => ({
+  __esModule: true,
+  default: {
+    buildParameters: {
+      buildGuid: 'test-guid-abc',
+      cacheKey: 'my-cache-key',
+      projectPath: 'test-project',
+      buildPath: 'Builds',
+      maxRetainedWorkspaces: 0,
+      gitPrivateToken: 'ghp_test123',
+      gitAuthMode: 'url',
+      orchestratorRepoName: 'game-ci/unity-builder',
+      githubRepo: 'user/my-game',
+    },
+    lockedWorkspace: '',
+  },
+}));
+
+jest.mock('../../build-parameters', () => ({
+  __esModule: true,
+  default: {
+    shouldUseRetainedWorkspaceMode: jest.fn().mockReturnValue(false),
+  },
+}));
+
+jest.mock('./orchestrator-options', () => ({
+  __esModule: true,
+  default: {
+    useSharedBuilder: false,
+  },
+}));
+
+// Normalize paths for cross-platform test compatibility
+const normalize = (p: string) => p.replace(/\\/g, '/');
+
+describe('OrchestratorFolders', () => {
+  describe('static constants', () => {
+    it('repositoryFolder is "repo"', () => {
+      expect(OrchestratorFolders.repositoryFolder).toBe('repo');
+    });
+
+    it('buildVolumeFolder is "data"', () => {
+      expect(OrchestratorFolders.buildVolumeFolder).toBe('data');
+    });
+
+    it('cacheFolder is "cache"', () => {
+      expect(OrchestratorFolders.cacheFolder).toBe('cache');
+    });
+  });
+
+  describe('ToLinuxFolder', () => {
+    it('converts backslashes to forward slashes', () => {
+      expect(OrchestratorFolders.ToLinuxFolder('C:\\Users\\test\\project')).toBe('C:/Users/test/project');
+    });
+
+    it('preserves forward slashes', () => {
+      expect(OrchestratorFolders.ToLinuxFolder('/home/user/project')).toBe('/home/user/project');
+    });
+
+    it('handles mixed slashes', () => {
+      expect(OrchestratorFolders.ToLinuxFolder('some/path\\mixed/slashes\\here')).toBe('some/path/mixed/slashes/here');
+    });
+
+    it('handles empty string', () => {
+      expect(OrchestratorFolders.ToLinuxFolder('')).toBe('');
+    });
+  });
+
+  describe('path computations (non-retained workspace mode)', () => {
+    it('uniqueOrchestratorJobFolderAbsolute uses buildGuid', () => {
+      const result = normalize(OrchestratorFolders.uniqueOrchestratorJobFolderAbsolute);
+      expect(result).toBe('/data/test-guid-abc');
+    });
+
+    it('cacheFolderForAllFull returns /data/cache', () => {
+      const result = normalize(OrchestratorFolders.cacheFolderForAllFull);
+      expect(result).toBe('/data/cache');
+    });
+
+    it('cacheFolderForCacheKeyFull includes cache key', () => {
+      const result = normalize(OrchestratorFolders.cacheFolderForCacheKeyFull);
+      expect(result).toBe('/data/cache/my-cache-key');
+    });
+
+    it('repoPathAbsolute is under job folder', () => {
+      const result = normalize(OrchestratorFolders.repoPathAbsolute);
+      expect(result).toBe('/data/test-guid-abc/repo');
+    });
+
+    it('projectPathAbsolute includes project path', () => {
+      const result = normalize(OrchestratorFolders.projectPathAbsolute);
+      expect(result).toBe('/data/test-guid-abc/repo/test-project');
+    });
+
+    it('libraryFolderAbsolute is under project path', () => {
+      const result = normalize(OrchestratorFolders.libraryFolderAbsolute);
+      expect(result).toBe('/data/test-guid-abc/repo/test-project/Library');
+    });
+
+    it('projectBuildFolderAbsolute uses buildPath', () => {
+      const result = normalize(OrchestratorFolders.projectBuildFolderAbsolute);
+      expect(result).toBe('/data/test-guid-abc/repo/Builds');
+    });
+
+    it('lfsFolderAbsolute is under .git/lfs', () => {
+      const result = normalize(OrchestratorFolders.lfsFolderAbsolute);
+      expect(result).toBe('/data/test-guid-abc/repo/.git/lfs');
+    });
+
+    it('lfsCacheFolderFull is under cache key', () => {
+      const result = normalize(OrchestratorFolders.lfsCacheFolderFull);
+      expect(result).toBe('/data/cache/my-cache-key/lfs');
+    });
+
+    it('libraryCacheFolderFull is under cache key', () => {
+      const result = normalize(OrchestratorFolders.libraryCacheFolderFull);
+      expect(result).toBe('/data/cache/my-cache-key/Library');
+    });
+  });
+
+  describe('builderPathAbsolute', () => {
+    it('uses job folder when shared builder is disabled', () => {
+      const result = normalize(OrchestratorFolders.builderPathAbsolute);
+      expect(result).toBe('/data/test-guid-abc/builder');
+    });
+  });
+
+  describe('repo URLs', () => {
+    it('unityBuilderRepoUrl includes token and repo name', () => {
+      const url = OrchestratorFolders.unityBuilderRepoUrl;
+      expect(url).toBe('https://ghp_test123@github.com/game-ci/unity-builder.git');
+    });
+
+    it('targetBuildRepoUrl includes token and github repo', () => {
+      const url = OrchestratorFolders.targetBuildRepoUrl;
+      expect(url).toBe('https://ghp_test123@github.com/user/my-game.git');
+    });
+  });
+
+  describe('purgeRemoteCaching', () => {
+    it('returns false when env var is not set', () => {
+      const original = process.env.PURGE_REMOTE_BUILDER_CACHE;
+      delete process.env.PURGE_REMOTE_BUILDER_CACHE;
+      expect(OrchestratorFolders.purgeRemoteCaching).toBe(false);
+      if (original !== undefined) process.env.PURGE_REMOTE_BUILDER_CACHE = original;
+    });
+
+    it('returns true when env var is set', () => {
+      const original = process.env.PURGE_REMOTE_BUILDER_CACHE;
+      process.env.PURGE_REMOTE_BUILDER_CACHE = 'true';
+      expect(OrchestratorFolders.purgeRemoteCaching).toBe(true);
+      if (original !== undefined) {
+        process.env.PURGE_REMOTE_BUILDER_CACHE = original;
+      } else {
+        delete process.env.PURGE_REMOTE_BUILDER_CACHE;
+      }
+    });
+  });
+});

src/model/orchestrator/options/orchestrator-folders.ts

@@ -72,14 +72,67 @@ export class OrchestratorFolders {
     return path.join(OrchestratorFolders.cacheFolderForCacheKeyFull, `Library`);
   }
 
+  /**
+   * Whether to use http.extraHeader for git authentication (secure, default)
+   * instead of embedding the token in clone URLs (legacy).
+   */
+  public static get useHeaderAuth(): boolean {
+    return Orchestrator.buildParameters.gitAuthMode !== 'url';
+  }
+
   public static get unityBuilderRepoUrl(): string {
+    if (OrchestratorFolders.useHeaderAuth) {
+      return `https://github.com/${Orchestrator.buildParameters.orchestratorRepoName}.git`;
+    }
+
     return `https://${Orchestrator.buildParameters.gitPrivateToken}@github.com/${Orchestrator.buildParameters.orchestratorRepoName}.git`;
   }
 
   public static get targetBuildRepoUrl(): string {
+    if (OrchestratorFolders.useHeaderAuth) {
+      return `https://github.com/${Orchestrator.buildParameters.githubRepo}.git`;
+    }
+
     return `https://${Orchestrator.buildParameters.gitPrivateToken}@github.com/${Orchestrator.buildParameters.githubRepo}.git`;
   }
 
+  /**
+   * Shell commands to configure git authentication via http.extraHeader.
+   * Uses GIT_PRIVATE_TOKEN env var so the token never appears in clone URLs or git config output.
+   * This is the same mechanism used by actions/checkout.
+   *
+   * Only emits commands when gitAuthMode is 'header' (default). In 'url' mode,
+   * returns a no-op comment since the token is already in the URL.
+   */
+  public static get gitAuthConfigScript(): string {
+    if (!OrchestratorFolders.useHeaderAuth) {
+      return `# git auth: using token-in-URL mode (legacy)`;
+    }
+
+    return `# git auth: configuring http.extraHeader (secure mode)
+if [ -n "$GIT_PRIVATE_TOKEN" ]; then
+  git config --global http.https://github.com/.extraHeader "Authorization: Basic $(printf '%s' "x-access-token:$GIT_PRIVATE_TOKEN" | base64 -w 0)"
+fi`;
+  }
+
+  /**
+   * Configure git authentication via http.extraHeader in the current Node process.
+   * For use in the remote-client where shell scripts aren't used.
+   * Only configures when gitAuthMode is 'header' (default).
+   */
+  public static async configureGitAuth(): Promise<void> {
+    if (!OrchestratorFolders.useHeaderAuth) return;
+
+    const token = Orchestrator.buildParameters.gitPrivateToken || process.env.GIT_PRIVATE_TOKEN || '';
+    if (!token) return;
+
+    const encoded = Buffer.from(`x-access-token:${token}`).toString('base64');
+    const { OrchestratorSystem } = await import('../services/core/orchestrator-system');
+    await OrchestratorSystem.Run(
+      `git config --global http.https://github.com/.extraHeader "Authorization: Basic ${encoded}"`,
+    );
+  }
+
   public static get buildVolumeFolder() {
     return 'data';
   }

src/model/orchestrator/options/orchestrator-guid.test.ts

@@ -0,0 +1,53 @@
+import OrchestratorNamespace from './orchestrator-guid';
+
+describe('OrchestratorNamespace', () => {
+  describe('generateGuid', () => {
+    it('generates a guid with correct format', () => {
+      const guid = OrchestratorNamespace.generateGuid('42', 'StandaloneLinux64');
+      // Format: {runNumber}-{platform}-{nanoid4}
+      expect(guid).toMatch(/^42-linux64-[a-z0-9]{4}$/);
+    });
+
+    it('strips "standalone" prefix from platform (case-insensitive)', () => {
+      const guid = OrchestratorNamespace.generateGuid('1', 'StandaloneWindows64');
+      expect(guid).toMatch(/^1-windows64-[a-z0-9]{4}$/);
+    });
+
+    it('lowercases platform name', () => {
+      const guid = OrchestratorNamespace.generateGuid('5', 'Android');
+      expect(guid).toMatch(/^5-android-[a-z0-9]{4}$/);
+    });
+
+    it('handles numeric run number', () => {
+      const guid = OrchestratorNamespace.generateGuid(100, 'iOS');
+      expect(guid).toMatch(/^100-ios-[a-z0-9]{4}$/);
+    });
+
+    it('generates unique guids on repeated calls', () => {
+      const guids = new Set<string>();
+      for (let i = 0; i < 20; i++) {
+        guids.add(OrchestratorNamespace.generateGuid('1', 'StandaloneLinux64'));
+      }
+      // With 4 alphanumeric chars (36^4 = ~1.7M possibilities), 20 calls should almost certainly be unique
+      expect(guids.size).toBeGreaterThan(1);
+    });
+
+    it('handles StandaloneOSX platform', () => {
+      const guid = OrchestratorNamespace.generateGuid('7', 'StandaloneOSX');
+      expect(guid).toMatch(/^7-osx-[a-z0-9]{4}$/);
+    });
+
+    it('handles WebGL platform (no standalone prefix)', () => {
+      const guid = OrchestratorNamespace.generateGuid('3', 'WebGL');
+      expect(guid).toMatch(/^3-webgl-[a-z0-9]{4}$/);
+    });
+
+    it('uses only lowercase alphanumeric characters in nanoid portion', () => {
+      for (let i = 0; i < 10; i++) {
+        const guid = OrchestratorNamespace.generateGuid('1', 'test');
+        const nanoidPart = guid.split('-').pop()!;
+        expect(nanoidPart).toMatch(/^[0-9a-z]{4}$/);
+      }
+    });
+  });
+});

src/model/orchestrator/options/orchestrator-options.ts

@@ -138,6 +138,36 @@ class OrchestratorOptions {
     return provider || 'local';
   }
 
+  static get fallbackProviderStrategy(): string {
+    return OrchestratorOptions.getInput('fallbackProviderStrategy') || '';
+  }
+
+  static get runnerCheckEnabled(): boolean {
+    return OrchestratorOptions.getInput('runnerCheckEnabled') === 'true';
+  }
+
+  static get runnerCheckLabels(): string[] {
+    const labels = OrchestratorOptions.getInput('runnerCheckLabels');
+
+    return labels ? labels.split(',').map((l) => l.trim()) : [];
+  }
+
+  static get runnerCheckMinAvailable(): number {
+    return Number(OrchestratorOptions.getInput('runnerCheckMinAvailable')) || 1;
+  }
+
+  static get retryOnFallback(): boolean {
+    return OrchestratorOptions.getInput('retryOnFallback') === 'true';
+  }
+
+  static get providerInitTimeout(): number {
+    return Number(OrchestratorOptions.getInput('providerInitTimeout')) || 0;
+  }
+
+  static get gitAuthMode(): string {
+    return OrchestratorOptions.getInput('gitAuthMode') || 'header';
+  }
+
   static get containerCpu(): string {
     return OrchestratorOptions.getInput('containerCpu') || `1024`;
   }
@@ -190,6 +220,10 @@ class OrchestratorOptions {
     return OrchestratorOptions.getInput('pullInputList')?.split(`,`) || [];
   }
 
+  static get secretSource(): string {
+    return OrchestratorOptions.getInput('secretSource') || '';
+  }
+
   static get inputPullCommand(): string {
     const value = OrchestratorOptions.getInput('inputPullCommand');
 

src/model/orchestrator/options/orchestrator-query-override.ts

@@ -1,6 +1,9 @@
+import * as core from '@actions/core';
 import Input from '../../input';
 import { GenericInputReader } from '../../input-readers/generic-input-reader';
 import OrchestratorOptions from './orchestrator-options';
+import { SecretSourceService, validateSecretKey } from '../services/secrets/secret-source-service';
+import OrchestratorLogger from '../services/core/orchestrator-logger';
 
 const formatFunction = (value: string, arguments_: any[]) => {
   for (const element of arguments_) {
@@ -13,8 +16,6 @@ const formatFunction = (value: string, arguments_: any[]) => {
 class OrchestratorQueryOverride {
   static queryOverrides: { [key: string]: string } | undefined;
 
-  // TODO accept premade secret sources or custom secret source definition yamls
-
   public static query(key: string, alternativeKey: string) {
     if (OrchestratorQueryOverride.queryOverrides && OrchestratorQueryOverride.queryOverrides[key] !== undefined) {
       return OrchestratorQueryOverride.queryOverrides[key];
@@ -49,14 +50,62 @@ class OrchestratorQueryOverride {
       throw new Error(`Should not be trying to run override query on ${query}`);
     }
 
-    return await GenericInputReader.Run(
+    // Validate the query key before interpolating it into a shell command
+    validateSecretKey(query);
+
+    const result = await GenericInputReader.Run(
       formatFunction(OrchestratorOptions.inputPullCommand, [{ key: 0, value: query }]),
     );
+
+    // Mask the fetched secret value so it does not appear in GitHub Actions logs
+    if (result && result.trim().length > 0) {
+      core.setSecret(result);
+    }
+
+    return result;
   }
 
+  /**
+   * Populate query overrides using either:
+   * 1. Premade/custom secret sources (via secretSource input), or
+   * 2. Shell command (via inputPullCommand, legacy approach)
+   *
+   * The secretSource input takes precedence if set. It supports:
+   * - Premade names: 'aws-secrets-manager', 'aws-parameter-store', 'gcp-secret-manager', 'azure-key-vault', 'env'
+   * - Custom commands: any string containing {0} placeholder
+   * - YAML file path: a path ending in .yml or .yaml containing custom source definitions
+   */
   public static async PopulateQueryOverrideInput() {
     const queries = OrchestratorOptions.pullInputList;
     OrchestratorQueryOverride.queryOverrides = {};
+
+    const secretSource = OrchestratorOptions.secretSource;
+
+    // Use SecretSourceService if secretSource is configured
+    if (secretSource) {
+      OrchestratorLogger.log(`Using secret source: ${secretSource}`);
+
+      // YAML file: load definitions and use the first source
+      if (secretSource.endsWith('.yml') || secretSource.endsWith('.yaml')) {
+        const definitions = SecretSourceService.loadFromYaml(secretSource);
+        if (definitions.length > 0) {
+          OrchestratorLogger.log(`Loaded ${definitions.length} secret source(s) from ${secretSource}`);
+          for (const key of queries) {
+            OrchestratorQueryOverride.queryOverrides[key] = await SecretSourceService.fetchSecret(definitions[0], key);
+          }
+        }
+
+        return;
+      }
+
+      // Premade or custom command source
+      const results = await SecretSourceService.fetchAll(secretSource, queries);
+      Object.assign(OrchestratorQueryOverride.queryOverrides, results);
+
+      return;
+    }
+
+    // Legacy: use inputPullCommand if set
     for (const element of queries) {
       if (OrchestratorQueryOverride.shouldUseOverride(element)) {
         OrchestratorQueryOverride.queryOverrides[element] = await OrchestratorQueryOverride.queryOverride(element);

src/model/orchestrator/orchestrator.ts

@@ -13,6 +13,12 @@ import OrchestratorEnvironmentVariable from './options/orchestrator-environment-
 import TestOrchestrator from './providers/test';
 import LocalOrchestrator from './providers/local';
 import LocalDockerOrchestrator from './providers/docker';
+import GcpCloudRunProvider from './providers/gcp-cloud-run';
+import AzureAciProvider from './providers/azure-aci';
+import RemotePowershellProvider from './providers/remote-powershell';
+import GitHubActionsProvider from './providers/github-actions';
+import GitLabCIProvider from './providers/gitlab-ci';
+import AnsibleProvider from './providers/ansible';
 import loadProvider from './providers/provider-loader';
 import GitHub from '../github';
 import SharedWorkspaceLocking from './services/core/shared-workspace-locking';
@@ -20,6 +26,7 @@ import { FollowLogStreamService } from './services/core/follow-log-stream-servic
 import OrchestratorResult from './services/core/orchestrator-result';
 import OrchestratorOptions from './options/orchestrator-options';
 import ResourceTracking from './services/core/resource-tracking';
+import { RunnerAvailabilityService } from './services/core/runner-availability-service';
 
 class Orchestrator {
   public static Provider: ProviderInterface;
@@ -76,6 +83,42 @@ class Orchestrator {
   private static async setupSelectedBuildPlatform() {
     OrchestratorLogger.log(`Orchestrator platform selected ${Orchestrator.buildParameters.providerStrategy}`);
 
+    // Check runner availability and apply fallback if needed
+    if (Orchestrator.buildParameters.runnerCheckEnabled && Orchestrator.buildParameters.fallbackProviderStrategy) {
+      const owner = OrchestratorOptions.githubOwner;
+      const repo = OrchestratorOptions.githubRepoName;
+      const token = Orchestrator.buildParameters.gitPrivateToken || process.env.GITHUB_TOKEN || '';
+
+      OrchestratorLogger.log(
+        `Checking runner availability (labels: [${Orchestrator.buildParameters.runnerCheckLabels.join(', ')}], min: ${
+          Orchestrator.buildParameters.runnerCheckMinAvailable
+        })`,
+      );
+
+      const result = await RunnerAvailabilityService.checkAvailability(
+        owner,
+        repo,
+        token,
+        Orchestrator.buildParameters.runnerCheckLabels,
+        Orchestrator.buildParameters.runnerCheckMinAvailable,
+      );
+
+      OrchestratorLogger.log(
+        `Runner check: ${result.totalRunners} total, ${result.matchingRunners} matching, ${result.idleRunners} idle — ${result.reason}`,
+      );
+
+      if (result.shouldFallback) {
+        const original = Orchestrator.buildParameters.providerStrategy;
+        const fallback = Orchestrator.buildParameters.fallbackProviderStrategy;
+        OrchestratorLogger.log(`Falling back from '${original}' to '${fallback}' — ${result.reason}`);
+        Orchestrator.buildParameters.providerStrategy = fallback;
+        core.setOutput('providerFallbackUsed', 'true');
+        core.setOutput('providerFallbackReason', result.reason);
+      } else {
+        core.setOutput('providerFallbackUsed', 'false');
+      }
+    }
+
     // Detect LocalStack endpoints and handle AWS provider appropriately
     // AWS_FORCE_PROVIDER options:
     //   - 'aws': Force AWS provider (requires LocalStack Pro with ECS support)
@@ -129,6 +172,17 @@ class Orchestrator {
     // Store whether we should validate AWS templates (used by aws-local mode)
     Orchestrator.validateAwsTemplates = validateAwsTemplates;
 
+    // Check for CLI provider executable
+    if (Orchestrator.buildParameters.providerExecutable) {
+      const { default: CliProvider } = await import('./providers/cli');
+      Orchestrator.Provider = new CliProvider(
+        Orchestrator.buildParameters.providerExecutable,
+        Orchestrator.buildParameters,
+      );
+      OrchestratorLogger.log(`Using CLI provider executable: ${Orchestrator.buildParameters.providerExecutable}`);
+      return;
+    }
+
     switch (provider) {
       case 'k8s':
         Orchestrator.Provider = new Kubernetes(Orchestrator.buildParameters);
@@ -158,6 +212,25 @@ class Orchestrator {
       case 'local':
         Orchestrator.Provider = new LocalOrchestrator();
         break;
+      case 'gcp-cloud-run':
+        OrchestratorLogger.log('⚠ EXPERIMENTAL: GCP Cloud Run Jobs provider');
+        Orchestrator.Provider = new GcpCloudRunProvider(Orchestrator.buildParameters);
+        break;
+      case 'azure-aci':
+        OrchestratorLogger.log('⚠ EXPERIMENTAL: Azure Container Instances provider');
+        Orchestrator.Provider = new AzureAciProvider(Orchestrator.buildParameters);
+      case 'remote-powershell':
+        Orchestrator.Provider = new RemotePowershellProvider(Orchestrator.buildParameters);
+        break;
+      case 'github-actions':
+        Orchestrator.Provider = new GitHubActionsProvider(Orchestrator.buildParameters);
+        break;
+      case 'gitlab-ci':
+        Orchestrator.Provider = new GitLabCIProvider(Orchestrator.buildParameters);
+        break;
+      case 'ansible':
+        Orchestrator.Provider = new AnsibleProvider(Orchestrator.buildParameters);
+        break;
       default:
         // Try to load provider using the dynamic loader for unknown providers
         try {
@@ -182,6 +255,30 @@ class Orchestrator {
     if (baseImage.includes(`undefined`)) {
       throw new Error(`baseImage is undefined`);
     }
+
+    try {
+      return await Orchestrator.runWithProvider(buildParameters, baseImage);
+    } catch (primaryError: any) {
+      // Retry on fallback provider if enabled and a fallback is configured
+      const fallback = buildParameters.fallbackProviderStrategy;
+      const alreadyOnFallback = buildParameters.providerStrategy === fallback;
+      if (buildParameters.retryOnFallback && fallback && !alreadyOnFallback) {
+        OrchestratorLogger.log(
+          `Primary provider '${buildParameters.providerStrategy}' failed: ${primaryError.message}`,
+        );
+        OrchestratorLogger.log(`Retrying build on fallback provider '${fallback}'...`);
+        buildParameters.providerStrategy = fallback;
+        core.setOutput('providerFallbackUsed', 'true');
+        core.setOutput('providerFallbackReason', `Primary provider failed: ${primaryError.message}`);
+
+        return await Orchestrator.runWithProvider(buildParameters, baseImage);
+      }
+
+      throw primaryError;
+    }
+  }
+
+  private static async runWithProvider(buildParameters: BuildParameters, baseImage: string) {
     await Orchestrator.setup(buildParameters);
 
     // When aws-local mode is enabled, validate AWS CloudFormation templates
@@ -189,12 +286,10 @@ class Orchestrator {
     if (Orchestrator.validateAwsTemplates) {
       await Orchestrator.validateAwsCloudFormationTemplates();
     }
-    await Orchestrator.Provider.setupWorkflow(
-      Orchestrator.buildParameters.buildGuid,
-      Orchestrator.buildParameters,
-      Orchestrator.buildParameters.branch,
-      Orchestrator.defaultSecrets,
-    );
+
+    // Setup workflow with optional init timeout
+    await Orchestrator.setupWorkflowWithTimeout();
+
     try {
       if (buildParameters.maxRetainedWorkspaces > 0) {
         Orchestrator.lockedWorkspace = SharedWorkspaceLocking.NewWorkspaceName();
@@ -275,6 +370,39 @@ class Orchestrator {
     }
   }
 
+  /**
+   * Runs setupWorkflow with an optional timeout. If providerInitTimeout is set and the
+   * provider takes longer than that to initialize, throws an error that triggers
+   * retry-on-fallback (if enabled).
+   */
+  private static async setupWorkflowWithTimeout() {
+    const timeoutSeconds = Orchestrator.buildParameters.providerInitTimeout;
+
+    const setupPromise = Orchestrator.Provider.setupWorkflow(
+      Orchestrator.buildParameters.buildGuid,
+      Orchestrator.buildParameters,
+      Orchestrator.buildParameters.branch,
+      Orchestrator.defaultSecrets,
+    );
+
+    if (timeoutSeconds <= 0) {
+      await setupPromise;
+
+      return;
+    }
+
+    OrchestratorLogger.log(`Provider init timeout: ${timeoutSeconds}s`);
+
+    const timeoutPromise = new Promise<never>((_, reject) => {
+      setTimeout(
+        () => reject(new Error(`Provider initialization timed out after ${timeoutSeconds}s`)),
+        timeoutSeconds * 1000,
+      );
+    });
+
+    await Promise.race([setupPromise, timeoutPromise]);
+  }
+
   private static async updateStatusWithBuildParameters() {
     const content = { ...Orchestrator.buildParameters };
     content.gitPrivateToken = ``;

src/model/orchestrator/providers/ansible/ansible-provider.test.ts

@@ -0,0 +1,291 @@
+import AnsibleProvider from '.';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import * as core from '@actions/core';
+
+jest.mock('../../services/core/orchestrator-system');
+jest.mock('../../services/core/orchestrator-logger');
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(() => ''),
+}));
+
+const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
+const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
+const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
+
+function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
+  return {
+    ansibleInventory: '/etc/ansible/hosts',
+    ansiblePlaybook: '/playbooks/unity-build.yml',
+    ansibleExtraVars: '',
+    ansibleVaultPassword: '',
+    ...overrides,
+  } as BuildParameters;
+}
+
+describe('AnsibleProvider', () => {
+  let provider: AnsibleProvider;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    provider = new AnsibleProvider(createBuildParameters());
+  });
+
+  describe('constructor', () => {
+    it('initializes with all provided parameters', () => {
+      const params = createBuildParameters({
+        ansibleInventory: '/custom/inventory',
+        ansiblePlaybook: '/custom/playbook.yml',
+        ansibleExtraVars: '{"key":"value"}',
+        ansibleVaultPassword: '/vault/pass',
+      });
+      const p = new AnsibleProvider(params);
+      expect(p).toBeDefined();
+    });
+
+    it('handles missing optional parameters gracefully', () => {
+      const params = createBuildParameters({
+        ansiblePlaybook: undefined,
+        ansibleExtraVars: undefined,
+        ansibleVaultPassword: undefined,
+      });
+      const p = new AnsibleProvider(params);
+      expect(p).toBeDefined();
+    });
+  });
+
+  describe('setupWorkflow', () => {
+    it('verifies ansible binary, ansible-playbook binary, and inventory exist', async () => {
+      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible --version
+      mockRun.mockResolvedValueOnce('/usr/bin/ansible-playbook'); // ansible-playbook check
+      mockRun.mockResolvedValueOnce(''); // test -e inventory
+
+      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
+
+      expect(mockRun).toHaveBeenCalledTimes(3);
+      expect(mockRun.mock.calls[0][0]).toContain('ansible --version');
+      expect(mockRun.mock.calls[1][0]).toContain('ansible-playbook');
+      expect(mockRun.mock.calls[2][0]).toContain('test -e "/etc/ansible/hosts"');
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ansible'));
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ansible-playbook binary verified'));
+    });
+
+    it('throws when inventory is not configured', async () => {
+      const params = createBuildParameters({ ansibleInventory: '' });
+      provider = new AnsibleProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'ansibleInventory is required',
+      );
+    });
+
+    it('throws when ansible binary is not found on PATH', async () => {
+      mockRun.mockRejectedValueOnce(new Error('command not found: ansible'));
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'Ansible not found on PATH',
+      );
+    });
+
+    it('throws when ansible-playbook binary is not found', async () => {
+      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible version OK
+      mockRun.mockRejectedValueOnce(new Error('command not found')); // ansible-playbook missing
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'ansible-playbook not found on PATH',
+      );
+
+      expect(core.error).toHaveBeenCalledWith('ansible-playbook not found. Install Ansible or ensure it is in PATH.');
+    });
+
+    it('throws when inventory file does not exist', async () => {
+      mockRun.mockResolvedValueOnce('ansible [core 2.14.0]'); // ansible version OK
+      mockRun.mockResolvedValueOnce('/usr/bin/ansible-playbook'); // ansible-playbook OK
+      mockRun.mockRejectedValueOnce(new Error('test -e failed')); // inventory missing
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'Inventory not found: /etc/ansible/hosts',
+      );
+    });
+  });
+
+  describe('runTaskInWorkflow', () => {
+    it('constructs ansible-playbook command with correct variables and returns output', async () => {
+      mockRun.mockResolvedValueOnce('PLAY [build] *****\nok: [server1]\nPLAY RECAP');
+
+      const result = await provider.runTaskInWorkflow(
+        'guid-run1',
+        'unityci/editor:2021.3',
+        'echo build',
+        '/mount',
+        '/workspace',
+        [],
+        [],
+      );
+
+      expect(result).toContain('PLAY [build]');
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('ansible-playbook');
+      expect(command).toContain('-i "/etc/ansible/hosts"');
+      expect(command).toContain('"/playbooks/unity-build.yml"');
+      expect(command).toContain('--no-color');
+      expect(command).toContain('build_guid');
+      expect(command).toContain('guid-run1');
+      expect(command).toContain('build_image');
+      expect(command).toContain('unityci/editor:2021.3');
+      expect(command).toContain('build_commands');
+      expect(command).toContain('mount_dir');
+      expect(command).toContain('working_dir');
+    });
+
+    it('throws when playbook is not configured', async () => {
+      const params = createBuildParameters({ ansiblePlaybook: '' });
+      provider = new AnsibleProvider(params);
+
+      await expect(provider.runTaskInWorkflow('guid-nopb', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'ansiblePlaybook is required',
+      );
+    });
+
+    it('passes environment variables as extra-vars in snake_case', async () => {
+      mockRun.mockResolvedValueOnce('ok');
+
+      const env = [
+        { name: 'UNITY_LICENSE', value: 'lic-data' },
+        { name: 'BUILD_TARGET', value: 'Linux64' },
+      ];
+
+      await provider.runTaskInWorkflow('guid-env', 'img', 'cmd', '/m', '/w', env as any, []);
+
+      const command = mockRun.mock.calls[0][0];
+      // Environment variable names are lowercased as Ansible variables
+      expect(command).toContain('unity_license');
+      expect(command).toContain('lic-data');
+      expect(command).toContain('build_target');
+      expect(command).toContain('Linux64');
+    });
+
+    it('merges user-provided extra vars from JSON string', async () => {
+      const params = createBuildParameters({
+        ansibleExtraVars: JSON.stringify({ custom_var: 'custom_value', another: '42' }),
+      });
+      provider = new AnsibleProvider(params);
+      mockRun.mockResolvedValueOnce('ok');
+
+      await provider.runTaskInWorkflow('guid-extra', 'img', 'cmd', '/m', '/w', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('custom_var');
+      expect(command).toContain('custom_value');
+      expect(command).toContain('another');
+    });
+
+    it('logs warning when extra vars JSON is invalid but continues', async () => {
+      const params = createBuildParameters({ ansibleExtraVars: 'not-valid-json{{{' });
+      provider = new AnsibleProvider(params);
+      mockRun.mockResolvedValueOnce('ok');
+
+      await provider.runTaskInWorkflow('guid-badjson', 'img', 'cmd', '/m', '/w', [], []);
+
+      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to parse ansibleExtraVars'));
+    });
+
+    it('includes vault password file flag when configured', async () => {
+      const params = createBuildParameters({ ansibleVaultPassword: '/secure/vault-pass.txt' });
+      provider = new AnsibleProvider(params);
+      mockRun.mockResolvedValueOnce('ok');
+
+      await provider.runTaskInWorkflow('guid-vault', 'img', 'cmd', '/m', '/w', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('--vault-password-file "/secure/vault-pass.txt"');
+    });
+
+    it('does not include vault password flag when not configured', async () => {
+      mockRun.mockResolvedValueOnce('ok');
+
+      await provider.runTaskInWorkflow('guid-novault', 'img', 'cmd', '/m', '/w', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).not.toContain('--vault-password-file');
+    });
+
+    it('prefixes secrets as environment variables in the command', async () => {
+      mockRun.mockResolvedValueOnce('ok');
+
+      const secrets = [
+        { ParameterKey: 'key1', EnvironmentVariable: 'SECRET_TOKEN', ParameterValue: 'tok-abc' },
+        { ParameterKey: 'key2', EnvironmentVariable: 'DEPLOY_KEY', ParameterValue: 'dk-xyz' },
+      ];
+
+      await provider.runTaskInWorkflow('guid-secrets', 'img', 'cmd', '/m', '/w', [], secrets as any);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toMatch(/^SECRET_TOKEN='tok-abc'/);
+      expect(command).toContain("DEPLOY_KEY='dk-xyz'");
+      expect(command).toContain('ansible-playbook');
+    });
+
+    it('throws and logs warning when playbook execution fails', async () => {
+      const execError = new Error('UNREACHABLE! Host unreachable');
+      mockRun.mockRejectedValueOnce(execError);
+
+      await expect(provider.runTaskInWorkflow('guid-hostfail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'UNREACHABLE',
+      );
+
+      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Playbook failed'));
+    });
+  });
+
+  describe('cleanupWorkflow', () => {
+    it('completes without error and logs cleanup message', async () => {
+      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('returns empty string (no-op)', async () => {
+      const result = await provider.garbageCollect('', false, 0, false, false);
+      expect(result).toBe('');
+    });
+  });
+
+  describe('listResources', () => {
+    it('returns inventory path as a resource when configured', async () => {
+      const resources = await provider.listResources();
+
+      expect(resources).toHaveLength(1);
+      expect(resources[0].Name).toBe('/etc/ansible/hosts');
+    });
+
+    it('returns empty array when inventory is not configured', async () => {
+      const params = createBuildParameters({ ansibleInventory: '' });
+      provider = new AnsibleProvider(params);
+
+      const resources = await provider.listResources();
+      expect(resources).toEqual([]);
+    });
+  });
+
+  describe('listWorkflow', () => {
+    it('returns empty array (not implemented)', async () => {
+      const workflows = await provider.listWorkflow();
+      expect(workflows).toEqual([]);
+    });
+  });
+
+  describe('watchWorkflow', () => {
+    it('returns empty string (not implemented)', async () => {
+      const result = await provider.watchWorkflow();
+      expect(result).toBe('');
+    });
+  });
+});

src/model/orchestrator/providers/ansible/index.ts

@@ -0,0 +1,197 @@
+import * as core from '@actions/core';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import { ProviderInterface } from '../provider-interface';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+
+/**
+ * Ansible provider — executes Unity builds via Ansible playbooks
+ * against managed inventory.
+ *
+ * Use case: Teams with existing Ansible infrastructure for server
+ * management who want to leverage their inventory for build distribution.
+ */
+class AnsibleProvider implements ProviderInterface {
+  private buildParameters: BuildParameters;
+  private inventory: string;
+  private playbook: string;
+  private extraVariables: string;
+  private vaultPassword: string;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.inventory = buildParameters.ansibleInventory || '';
+    this.playbook = buildParameters.ansiblePlaybook || '';
+    this.extraVariables = buildParameters.ansibleExtraVars || '';
+    this.vaultPassword = buildParameters.ansibleVaultPassword || '';
+  }
+
+  async setupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildGuid: string,
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[Ansible] Setting up playbook execution`);
+
+    if (!this.inventory) {
+      throw new Error('ansibleInventory is required for the ansible provider');
+    }
+
+    // Verify ansible is available
+    try {
+      const version = await OrchestratorSystem.Run('ansible --version | head -1');
+      OrchestratorLogger.log(`[Ansible] ${version.trim()}`);
+    } catch (error: any) {
+      throw new Error(`Ansible not found on PATH: ${error.message || error}`);
+    }
+
+    // Verify ansible-playbook binary exists (may be separate from ansible)
+    try {
+      await OrchestratorSystem.Run('command -v ansible-playbook || which ansible-playbook || where ansible-playbook');
+      OrchestratorLogger.log(`[Ansible] ansible-playbook binary verified`);
+    } catch (error: any) {
+      core.error('ansible-playbook not found. Install Ansible or ensure it is in PATH.');
+      throw new Error(`ansible-playbook not found on PATH: ${error.message || error}`);
+    }
+
+    // Verify inventory exists
+    try {
+      await OrchestratorSystem.Run(`test -e "${this.inventory}"`);
+    } catch {
+      throw new Error(`Inventory not found: ${this.inventory}`);
+    }
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[Ansible] Running playbook against inventory ${this.inventory}`);
+
+    if (!this.playbook) {
+      throw new Error(
+        'ansiblePlaybook is required — no default playbook is provided yet. ' +
+          'Provide a playbook that accepts build_guid, build_image, build_commands, mount_dir, and working_dir variables.',
+      );
+    }
+
+    // Build extra-vars JSON
+    // These use snake_case because they are Ansible variable names passed to playbooks
+    const playbookVariables: Record<string, string> = {
+      // eslint-disable-next-line camelcase
+      build_guid: buildGuid,
+      // eslint-disable-next-line camelcase
+      build_image: image,
+      // eslint-disable-next-line camelcase
+      build_commands: commands,
+      // eslint-disable-next-line camelcase
+      mount_dir: mountdir,
+      // eslint-disable-next-line camelcase
+      working_dir: workingdir,
+    };
+
+    for (const element of environment) {
+      playbookVariables[element.name.toLowerCase()] = element.value;
+    }
+
+    // Merge user-provided extra vars
+    if (this.extraVariables) {
+      try {
+        const userVariables = JSON.parse(this.extraVariables);
+        Object.assign(playbookVariables, userVariables);
+      } catch {
+        OrchestratorLogger.logWarning(`[Ansible] Failed to parse ansibleExtraVars as JSON, using as-is`);
+      }
+    }
+
+    const extraVariablesJson = JSON.stringify(playbookVariables).replace(/'/g, "'\\''");
+
+    // Build ansible-playbook command
+    const commandParts = [
+      'ansible-playbook',
+      `-i "${this.inventory}"`,
+      `"${this.playbook}"`,
+      `-e '${extraVariablesJson}'`,
+      '--no-color',
+    ];
+
+    if (this.vaultPassword) {
+      commandParts.push(`--vault-password-file "${this.vaultPassword}"`);
+    }
+
+    // Add secret variables as extra environment
+    const environmentPrefix = secrets
+      .map((secret) => `${secret.EnvironmentVariable}='${secret.ParameterValue}'`)
+      .join(' ');
+
+    const fullCommand = environmentPrefix ? `${environmentPrefix} ${commandParts.join(' ')}` : commandParts.join(' ');
+
+    try {
+      const output = await OrchestratorSystem.Run(fullCommand);
+      OrchestratorLogger.log(`[Ansible] Playbook completed successfully`);
+
+      return output;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[Ansible] Playbook failed: ${error.message || error}`);
+      throw error;
+    }
+  }
+
+  async cleanupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[Ansible] Cleanup complete`);
+  }
+
+  async garbageCollect(
+    // eslint-disable-next-line no-unused-vars
+    filter: string,
+    // eslint-disable-next-line no-unused-vars
+    previewOnly: boolean,
+    // eslint-disable-next-line no-unused-vars
+    olderThan: Number,
+    // eslint-disable-next-line no-unused-vars
+    fullCache: boolean,
+    // eslint-disable-next-line no-unused-vars
+    baseDependencies: boolean,
+  ): Promise<string> {
+    return '';
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    if (!this.inventory) return [];
+
+    const resource = new ProviderResource();
+    resource.Name = this.inventory;
+
+    return [resource];
+  }
+
+  async listWorkflow(): Promise<ProviderWorkflow[]> {
+    return [];
+  }
+
+  async watchWorkflow(): Promise<string> {
+    return '';
+  }
+}
+export default AnsibleProvider;

src/model/orchestrator/providers/azure-aci/index.ts

@@ -0,0 +1,536 @@
+/**
+ * Azure Container Instances (ACI) Provider (Experimental)
+ *
+ * Executes Unity builds as Azure Container Instances with configurable storage backends.
+ *
+ * Storage types:
+ *   - azure-files:     SMB file share mount via Azure Files. Up to 100 TiB per share,
+ *                       premium throughput. Default.
+ *                       Requires: azureStorageAccount, azureFileShareName
+ *   - blob-copy:       Copy artifacts in/out of Azure Blob Storage before/after the build.
+ *                       No mount overhead, simpler.
+ *                       Requires: azureStorageAccount, azureBlobContainer
+ *   - azure-files-nfs: NFS 4.1 file share mount. True POSIX semantics, no SMB lock overhead,
+ *                       better for Unity Library caching (many small random reads).
+ *                       Requires: azureStorageAccount, azureFileShareName, Premium FileStorage,
+ *                       VNet integration (azureSubnetId)
+ *   - in-memory:       emptyDir volume (tmpfs). Fastest I/O but volatile, size limited by
+ *                       container memory allocation.
+ *
+ * Prerequisites:
+ *   - Azure CLI authenticated (az login or service principal)
+ *   - A resource group for build resources
+ *   - Contributor role on the resource group
+ *
+ * @experimental This provider is experimental. APIs and behavior may change.
+ */
+
+import { ProviderInterface } from '../provider-interface';
+import BuildParameters from '../../../build-parameters';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import { Input } from '../../..';
+import ResourceTracking from '../../services/core/resource-tracking';
+
+type AzureStorageType = 'azure-files' | 'blob-copy' | 'azure-files-nfs' | 'in-memory';
+
+class AzureAciProvider implements ProviderInterface {
+  private readonly resourceGroup: string;
+  private readonly location: string;
+  private readonly storageType: AzureStorageType;
+  private readonly storageAccount: string;
+  private readonly blobContainer: string;
+  private readonly fileShareName: string;
+  private readonly subscriptionId: string;
+  private readonly cpu: number;
+  private readonly memoryGb: number;
+  private readonly diskSizeGb: number;
+  private readonly subnetId: string;
+  private buildParameters: BuildParameters;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.resourceGroup = buildParameters.azureResourceGroup || process.env.AZURE_RESOURCE_GROUP || '';
+    this.location = buildParameters.azureLocation || Input.region || 'eastus';
+    this.storageType = (buildParameters.azureStorageType || 'azure-files') as AzureStorageType;
+    this.storageAccount = buildParameters.azureStorageAccount || process.env.AZURE_STORAGE_ACCOUNT || '';
+    this.blobContainer = buildParameters.azureBlobContainer || 'unity-builds';
+    this.fileShareName = buildParameters.azureFileShareName || 'unity-builds';
+    this.subscriptionId = buildParameters.azureSubscriptionId || process.env.AZURE_SUBSCRIPTION_ID || '';
+    this.cpu = Number.parseInt(buildParameters.azureCpu || '4', 10);
+    this.memoryGb = Number.parseInt(buildParameters.azureMemoryGb || '16', 10);
+    this.diskSizeGb = Number.parseInt(buildParameters.azureDiskSizeGb || '100', 10);
+    this.subnetId = buildParameters.azureSubnetId || '';
+
+    OrchestratorLogger.log('[Azure ACI] Provider initialized (EXPERIMENTAL)');
+    OrchestratorLogger.log(`[Azure ACI] Resource Group: ${this.resourceGroup || '(not set)'}`);
+    OrchestratorLogger.log(`[Azure ACI] Location: ${this.location}`);
+    OrchestratorLogger.log(`[Azure ACI] Storage: ${this.storageType}`);
+    OrchestratorLogger.log(`[Azure ACI] Resources: ${this.cpu} CPU, ${this.memoryGb}GB RAM`);
+
+    this.validateStorageConfig();
+  }
+
+  private validateStorageConfig(): void {
+    switch (this.storageType) {
+      case 'azure-files':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning(
+            '[Azure ACI] Storage type "azure-files" requires azureStorageAccount to be set.',
+          );
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] File Share: ${this.storageAccount}/${this.fileShareName} (SMB)`);
+        }
+        break;
+      case 'azure-files-nfs':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning(
+            '[Azure ACI] Storage type "azure-files-nfs" requires azureStorageAccount (Premium FileStorage).',
+          );
+        }
+        if (!this.subnetId) {
+          OrchestratorLogger.logWarning('[Azure ACI] NFS file shares require VNet integration. Set azureSubnetId.');
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] File Share: ${this.storageAccount}/${this.fileShareName} (NFS 4.1)`);
+        }
+        break;
+      case 'blob-copy':
+        if (!this.storageAccount) {
+          OrchestratorLogger.logWarning('[Azure ACI] Storage type "blob-copy" requires azureStorageAccount to be set.');
+        } else {
+          OrchestratorLogger.log(`[Azure ACI] Blob container: ${this.storageAccount}/${this.blobContainer}`);
+        }
+        break;
+      case 'in-memory':
+        OrchestratorLogger.log(
+          `[Azure ACI] In-memory volume (emptyDir): limited by ${this.memoryGb}GB container memory`,
+        );
+        break;
+      default:
+        OrchestratorLogger.logWarning(
+          `[Azure ACI] Unknown storage type '${this.storageType}'. Valid: azure-files, blob-copy, azure-files-nfs, in-memory`,
+        );
+    }
+
+    if (!this.resourceGroup) {
+      OrchestratorLogger.logWarning(
+        '[Azure ACI] No resource group specified. Set azureResourceGroup input or AZURE_RESOURCE_GROUP env var.',
+      );
+    }
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log(`[Azure ACI] Setting up workflow for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('azure-aci setup');
+
+    // Verify Azure CLI is available
+    try {
+      await OrchestratorSystem.Run('az version --output json', false, true);
+      OrchestratorLogger.log('[Azure ACI] Azure CLI detected');
+    } catch {
+      throw new Error(
+        '[Azure ACI] Azure CLI not found. Install Azure CLI: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli',
+      );
+    }
+
+    if (this.subscriptionId) {
+      await OrchestratorSystem.Run(`az account set --subscription="${this.subscriptionId}"`);
+    }
+
+    // Ensure resource group exists
+    if (this.resourceGroup) {
+      try {
+        await OrchestratorSystem.Run(`az group show --name "${this.resourceGroup}" --output json`, false, true);
+        OrchestratorLogger.log(`[Azure ACI] Resource group ${this.resourceGroup} exists`);
+      } catch {
+        OrchestratorLogger.log(`[Azure ACI] Creating resource group ${this.resourceGroup}`);
+        await OrchestratorSystem.Run(`az group create --name "${this.resourceGroup}" --location "${this.location}"`);
+      }
+    }
+
+    // Storage-specific setup
+    switch (this.storageType) {
+      case 'azure-files':
+        await this.setupStorageAccount('Standard_LRS', 'StorageV2');
+        await this.setupFileShare();
+        break;
+      case 'azure-files-nfs':
+        await this.setupStorageAccount('Premium_LRS', 'FileStorage');
+        await this.setupNfsFileShare();
+        break;
+      case 'blob-copy':
+        await this.setupStorageAccount('Standard_LRS', 'StorageV2');
+        await this.setupBlobContainer();
+        break;
+      case 'in-memory':
+        // No storage setup needed
+        break;
+    }
+  }
+
+  private async setupStorageAccount(sku: string, kind: string): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+
+    try {
+      await OrchestratorSystem.Run(
+        `az storage account show --name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+      OrchestratorLogger.log(`[Azure ACI] Storage account ${this.storageAccount} exists`);
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating storage account ${this.storageAccount} (${sku}, ${kind})`);
+      await OrchestratorSystem.Run(
+        `az storage account create --name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --location "${this.location}" --sku ${sku} --kind ${kind}`,
+      );
+    }
+  }
+
+  private async setupFileShare(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage share-rm show --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating file share ${this.fileShareName} (${this.diskSizeGb}GB)`);
+      await OrchestratorSystem.Run(
+        `az storage share-rm create --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --quota ${this.diskSizeGb}`,
+      );
+    }
+  }
+
+  private async setupNfsFileShare(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage share-rm show --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating NFS file share ${this.fileShareName} (${this.diskSizeGb}GB)`);
+      await OrchestratorSystem.Run(
+        `az storage share-rm create --storage-account "${this.storageAccount}" --name "${this.fileShareName}" --resource-group "${this.resourceGroup}" --quota ${this.diskSizeGb} --enabled-protocols NFS`,
+      );
+    }
+  }
+
+  private async setupBlobContainer(): Promise<void> {
+    if (!this.storageAccount || !this.resourceGroup) return;
+    try {
+      await OrchestratorSystem.Run(
+        `az storage container show --name "${this.blobContainer}" --account-name "${this.storageAccount}" --output json`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.log(`[Azure ACI] Creating blob container ${this.blobContainer}`);
+      await OrchestratorSystem.Run(
+        `az storage container create --name "${this.blobContainer}" --account-name "${this.storageAccount}"`,
+      );
+    }
+  }
+
+  private async getStorageKey(): Promise<string> {
+    if (!this.storageAccount || !this.resourceGroup) return '';
+    try {
+      const keyJson = await OrchestratorSystem.Run(
+        `az storage account keys list --account-name "${this.storageAccount}" --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+      const keys = JSON.parse(keyJson);
+      return keys[0]?.value || '';
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[Azure ACI] Could not get storage key: ${error.message}`);
+      return '';
+    }
+  }
+
+  private async buildVolumeFlags(mountdir: string): Promise<string> {
+    switch (this.storageType) {
+      case 'azure-files': {
+        const storageKey = await this.getStorageKey();
+        if (!storageKey) return '';
+        return [
+          `--azure-file-volume-account-name "${this.storageAccount}"`,
+          `--azure-file-volume-account-key "${storageKey}"`,
+          `--azure-file-volume-share-name "${this.fileShareName}"`,
+          `--azure-file-volume-mount-path "${mountdir}"`,
+        ].join(' ');
+      }
+
+      case 'azure-files-nfs': {
+        // ACI NFS mount uses a YAML deployment template; for CLI we use the same
+        // azure-file-volume flags but the share must be NFS-enabled and
+        // the container must be in a VNet
+        const storageKey = await this.getStorageKey();
+        if (!storageKey) return '';
+        return [
+          `--azure-file-volume-account-name "${this.storageAccount}"`,
+          `--azure-file-volume-account-key "${storageKey}"`,
+          `--azure-file-volume-share-name "${this.fileShareName}"`,
+          `--azure-file-volume-mount-path "${mountdir}"`,
+        ].join(' ');
+      }
+
+      case 'in-memory':
+        // ACI emptyDir volumes require YAML deployment; for simplicity we skip
+        // the volume mount and let the container use its own filesystem
+        OrchestratorLogger.log('[Azure ACI] In-memory mode: using container filesystem (no persistent mount)');
+        return '';
+
+      case 'blob-copy':
+        // No volume mount — artifacts are copied in/out via az storage blob commands
+        return '';
+
+      default:
+        return '';
+    }
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[Azure ACI] Running task for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('azure-aci task');
+
+    const containerName = `unity-build-${buildGuid}`
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, '-')
+      .slice(0, 63);
+
+    // Build environment variable flags
+    const allEnvVars = [
+      ...environment.map((env) => `${env.name}=${env.value}`),
+      ...secrets.map((s) => `${s.EnvironmentVariable}=${s.ParameterValue}`),
+    ];
+    const envFlag = allEnvVars.length > 0 ? `--environment-variables ${allEnvVars.map((e) => `"${e}"`).join(' ')}` : '';
+
+    // Build volume flags based on storage type
+    const volumeFlags = await this.buildVolumeFlags(mountdir);
+
+    const subnetFlag = this.subnetId ? `--subnet "${this.subnetId}"` : '';
+
+    // For blob-copy, wrap the user command with copy-in/copy-out steps
+    let effectiveCommands = commands;
+    if (this.storageType === 'blob-copy' && this.storageAccount && commands) {
+      effectiveCommands = [
+        `az storage blob download-batch --destination "${mountdir}" --source "${this.blobContainer}" --account-name "${this.storageAccount}" 2>/dev/null || true`,
+        commands,
+        `az storage blob upload-batch --source "${mountdir}" --destination "${this.blobContainer}" --account-name "${this.storageAccount}" --overwrite`,
+      ].join(' && ');
+    }
+
+    const commandFlag = effectiveCommands
+      ? `--command-line "/bin/sh -c '${effectiveCommands.replace(/'/g, "'\\''")}'"`
+      : '';
+
+    const createCmd = [
+      'az container create',
+      `--resource-group "${this.resourceGroup}"`,
+      `--name "${containerName}"`,
+      `--image "${image}"`,
+      `--location "${this.location}"`,
+      `--cpu ${this.cpu}`,
+      `--memory ${this.memoryGb}`,
+      '--restart-policy Never',
+      '--os-type Linux',
+      volumeFlags,
+      envFlag,
+      subnetFlag,
+      commandFlag,
+      '--output json',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    try {
+      await OrchestratorSystem.Run(createCmd);
+      OrchestratorLogger.log(
+        `[Azure ACI] Container ${containerName} created (storage: ${this.storageType}), waiting for completion...`,
+      );
+    } catch (error: any) {
+      throw new Error(`[Azure ACI] Failed to create container: ${error.message}`);
+    }
+
+    const output = await this.waitForContainerCompletion(containerName);
+    return output;
+  }
+
+  private async waitForContainerCompletion(containerName: string): Promise<string> {
+    const maxWaitMs = 24 * 60 * 60 * 1000;
+    const pollIntervalMs = 15_000;
+    const startTime = Date.now();
+    let lastLogLength = 0;
+
+    while (Date.now() - startTime < maxWaitMs) {
+      try {
+        const stateJson = await OrchestratorSystem.Run(
+          `az container show --resource-group "${this.resourceGroup}" --name "${containerName}" --output json`,
+          false,
+          true,
+        );
+
+        const state = JSON.parse(stateJson);
+        const containerState =
+          state.containers?.[0]?.instanceView?.currentState?.state || state.instanceView?.state || 'Unknown';
+        const provisioningState = state.provisioningState || 'Unknown';
+
+        // Stream logs incrementally
+        try {
+          const logs = await OrchestratorSystem.Run(
+            `az container logs --resource-group "${this.resourceGroup}" --name "${containerName}"`,
+            false,
+            true,
+          );
+          if (logs && logs.length > lastLogLength) {
+            const newLogs = logs.slice(lastLogLength);
+            for (const line of newLogs.split('\n')) {
+              if (line.trim()) {
+                OrchestratorLogger.log(`[Build] ${line}`);
+              }
+            }
+            lastLogLength = logs.length;
+          }
+        } catch {
+          // Logs may not be available yet
+        }
+
+        if (containerState === 'Terminated' || provisioningState === 'Succeeded') {
+          const exitCode = state.containers?.[0]?.instanceView?.currentState?.exitCode;
+          if (exitCode !== undefined && exitCode !== 0) {
+            throw new Error(`[Azure ACI] Container exited with code ${exitCode}`);
+          }
+          OrchestratorLogger.log('[Azure ACI] Container completed successfully');
+          try {
+            return await OrchestratorSystem.Run(
+              `az container logs --resource-group "${this.resourceGroup}" --name "${containerName}"`,
+              false,
+              true,
+            );
+          } catch {
+            return '';
+          }
+        }
+
+        if (provisioningState === 'Failed') {
+          const detail =
+            state.containers?.[0]?.instanceView?.currentState?.detailStatus ||
+            state.containers?.[0]?.instanceView?.events?.map((e: any) => e.message).join('; ') ||
+            'Unknown error';
+          throw new Error(`[Azure ACI] Container provisioning failed: ${detail}`);
+        }
+      } catch (error: any) {
+        if (error.message?.includes('Container provisioning failed') || error.message?.includes('exited with code')) {
+          throw error;
+        }
+        OrchestratorLogger.logWarning(`[Azure ACI] Polling error: ${error.message}`);
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+
+    throw new Error('[Azure ACI] Container execution timed out after 24 hours');
+  }
+
+  async cleanupWorkflow(
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log('[Azure ACI] Cleaning up workflow');
+  }
+
+  async garbageCollect(
+    filter: string,
+    previewOnly: boolean,
+    olderThan: Number,
+    fullCache: boolean,
+    baseDependencies: boolean,
+  ): Promise<string> {
+    OrchestratorLogger.log('[Azure ACI] Garbage collecting old container groups');
+
+    try {
+      const containersJson = await OrchestratorSystem.Run(
+        `az container list --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+
+      const containers = JSON.parse(containersJson || '[]');
+      const cutoffDate = new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - Number(olderThan));
+
+      let deletedCount = 0;
+      for (const container of containers) {
+        const name = container.name || '';
+        if (!name.startsWith('unity-build-')) continue;
+
+        const createdAt = new Date(container.tags?.createdAt || container.properties?.provisioningState || 0);
+        const state = container.containers?.[0]?.instanceView?.currentState?.state || '';
+
+        if (state === 'Terminated' || createdAt < cutoffDate) {
+          if (previewOnly) {
+            OrchestratorLogger.log(`[Azure ACI] Would delete: ${name}`);
+          } else {
+            await OrchestratorSystem.Run(
+              `az container delete --resource-group "${this.resourceGroup}" --name "${name}" --yes`,
+            );
+            deletedCount++;
+          }
+        }
+      }
+
+      return `Garbage collected ${deletedCount} Azure container instances`;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[Azure ACI] Garbage collection failed: ${error.message}`);
+      return '';
+    }
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    try {
+      const containersJson = await OrchestratorSystem.Run(
+        `az container list --resource-group "${this.resourceGroup}" --output json`,
+        false,
+        true,
+      );
+
+      const containers = JSON.parse(containersJson || '[]');
+      return containers
+        .filter((c: any) => (c.name || '').startsWith('unity-build-'))
+        .map((c: any) => ({ Name: c.name || '' }));
+    } catch {
+      return [];
+    }
+  }
+
+  listWorkflow(): Promise<ProviderWorkflow[]> {
+    throw new Error('[Azure ACI] listWorkflow not implemented for this experimental provider');
+  }
+
+  async watchWorkflow(): Promise<string> {
+    throw new Error('[Azure ACI] watchWorkflow not implemented for this experimental provider');
+  }
+}
+
+export default AzureAciProvider;

src/model/orchestrator/providers/cli/cli-provider-protocol.ts

@@ -0,0 +1,20 @@
+export interface CliProviderRequest {
+  command: CliProviderSubcommand;
+  params: Record<string, any>;
+}
+
+export interface CliProviderResponse {
+  success: boolean;
+  result?: any;
+  error?: string;
+  output?: string;
+}
+
+export type CliProviderSubcommand =
+  | 'setup-workflow'
+  | 'cleanup-workflow'
+  | 'run-task'
+  | 'garbage-collect'
+  | 'list-resources'
+  | 'list-workflow'
+  | 'watch-workflow';

src/model/orchestrator/providers/cli/cli-provider.test.ts

@@ -0,0 +1,532 @@
+import { EventEmitter } from 'events';
+import { ProviderLoader } from '../provider-loader';
+
+// Mock child_process
+jest.mock('child_process', () => ({
+  spawn: jest.fn(),
+  exec: jest.fn(),
+}));
+
+// Mock @actions/core to prevent GitHub Actions API calls
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(() => ''),
+}));
+
+// Mock provider-git-manager (required by provider-loader)
+jest.mock('../provider-git-manager');
+
+import { spawn } from 'child_process';
+import * as core from '@actions/core';
+import CliProvider from './cli-provider';
+
+const mockSpawn = spawn as jest.MockedFunction<typeof spawn>;
+
+/**
+ * Creates a mock child process with stdin, stdout, stderr as EventEmitters.
+ */
+function createMockChildProcess() {
+  const child = new EventEmitter() as any;
+  child.stdin = { write: jest.fn(), end: jest.fn() };
+  child.stdout = new EventEmitter();
+  child.stderr = new EventEmitter();
+  child.kill = jest.fn();
+
+  return child;
+}
+
+describe('CliProvider', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('constructor', () => {
+    it('validates that executable path is non-empty', () => {
+      expect(() => new CliProvider('', {} as any)).toThrow('executablePath must be a non-empty string');
+    });
+
+    it('validates that executable path is not just whitespace', () => {
+      expect(() => new CliProvider('   ', {} as any)).toThrow('executablePath must be a non-empty string');
+    });
+
+    it('accepts a valid executable path', () => {
+      const provider = new CliProvider('/usr/bin/my-provider', {} as any);
+      expect(provider).toBeDefined();
+    });
+  });
+
+  describe('request serialization', () => {
+    it('sends JSON request to stdin with correct command and params', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      // Simulate successful response
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: [] }) + '\n'));
+      child.emit('close', 0);
+
+      await promise;
+
+      expect(child.stdin.write).toHaveBeenCalledTimes(1);
+      const writtenData = child.stdin.write.mock.calls[0][0];
+      const parsed = JSON.parse(writtenData);
+      expect(parsed.command).toBe('list-resources');
+      expect(parsed.params).toEqual({});
+      expect(child.stdin.end).toHaveBeenCalled();
+    });
+
+    it('serializes setupWorkflow params correctly', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.setupWorkflow('guid-123', { editorVersion: '2022.3' } as any, 'main', []);
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: {} }) + '\n'));
+      child.emit('close', 0);
+
+      await promise;
+
+      const writtenData = child.stdin.write.mock.calls[0][0];
+      const parsed = JSON.parse(writtenData);
+      expect(parsed.command).toBe('setup-workflow');
+      expect(parsed.params.buildGuid).toBe('guid-123');
+      expect(parsed.params.branchName).toBe('main');
+    });
+  });
+
+  describe('response parsing', () => {
+    it('resolves on successful JSON response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      const resources = [{ Name: 'resource-1' }, { Name: 'resource-2' }];
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: resources }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toEqual(resources);
+    });
+
+    it('rejects on error JSON response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.garbageCollect('', false, 30, false, false);
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: false, error: 'something went wrong' }) + '\n'));
+      child.emit('close', 1);
+
+      await expect(promise).rejects.toThrow('something went wrong');
+    });
+
+    it('rejects when process exits with non-zero code and no JSON response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listWorkflow();
+
+      child.stderr.emit('data', Buffer.from('segfault\n'));
+      child.emit('close', 139);
+
+      await expect(promise).rejects.toThrow('exited with code 139');
+    });
+
+    it('resolves when process exits with code 0 and no JSON response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      child.stdout.emit('data', Buffer.from('some plain text output\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      // listResources falls back to empty array when result is missing
+      expect(result).toEqual([]);
+    });
+
+    it('rejects on spawn error', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/nonexistent/path', {} as any);
+      const promise = provider.listResources();
+
+      child.emit('error', new Error('ENOENT'));
+
+      await expect(promise).rejects.toThrow('failed to spawn executable');
+    });
+  });
+
+  describe('runTaskInWorkflow', () => {
+    it('forwards non-JSON stdout lines as build output and returns final response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      // Simulate build output followed by JSON response
+      child.stdout.emit('data', Buffer.from('Building project...\nCompiling scripts...\n'));
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, output: 'Build succeeded' }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('Build succeeded');
+    });
+
+    it('rejects on run-task failure', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      child.stdout.emit(
+        'data',
+        Buffer.from(JSON.stringify({ success: false, error: 'Build failed: compilation errors' }) + '\n'),
+      );
+      child.emit('close', 1);
+
+      await expect(promise).rejects.toThrow('Build failed: compilation errors');
+    });
+
+    it('returns collected output lines when no JSON response and exit code 0', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      child.stdout.emit('data', Buffer.from('line 1\nline 2\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('line 1\nline 2');
+    });
+
+    it('rejects on spawn error', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/nonexistent/path', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      child.emit('error', new Error('ENOENT'));
+
+      await expect(promise).rejects.toThrow('failed to spawn executable');
+    });
+  });
+
+  describe('cleanupWorkflow', () => {
+    it('sends cleanup-workflow command and returns result', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.cleanupWorkflow({ editorVersion: '2022.3' } as any, 'main', []);
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: 'cleaned' }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('cleaned');
+
+      const parsed = JSON.parse(child.stdin.write.mock.calls[0][0]);
+      expect(parsed.command).toBe('cleanup-workflow');
+      expect(parsed.params.branchName).toBe('main');
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('sends garbage-collect command with correct params', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.garbageCollect('filter*', true, 30, false, true);
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, output: '3 items removed' }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('3 items removed');
+
+      const parsed = JSON.parse(child.stdin.write.mock.calls[0][0]);
+      expect(parsed.command).toBe('garbage-collect');
+      expect(parsed.params.filter).toBe('filter*');
+      expect(parsed.params.previewOnly).toBe(true);
+      expect(parsed.params.olderThan).toBe(30);
+      expect(parsed.params.baseDependencies).toBe(true);
+    });
+
+    it('returns empty string when response has no output', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.garbageCollect('', false, 7, false, false);
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('');
+    });
+  });
+
+  describe('listWorkflow', () => {
+    it('returns workflow list from response', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listWorkflow();
+
+      const workflows = [{ Name: 'wf-1' }];
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: workflows }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toEqual(workflows);
+    });
+
+    it('returns empty array when result is missing', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listWorkflow();
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe('watchWorkflow', () => {
+    it('forwards streaming output and resolves on success', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.watchWorkflow();
+
+      child.stdout.emit('data', Buffer.from('watching...\nstatus: running\n'));
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, output: 'completed' }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('completed');
+
+      const parsed = JSON.parse(child.stdin.write.mock.calls[0][0]);
+      expect(parsed.command).toBe('watch-workflow');
+    });
+
+    it('rejects on watch-workflow failure', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.watchWorkflow();
+
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: false, error: 'lost connection' }) + '\n'));
+      child.emit('close', 1);
+
+      await expect(promise).rejects.toThrow('lost connection');
+    });
+
+    it('rejects on spawn error', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.watchWorkflow();
+
+      child.emit('error', new Error('ENOENT'));
+
+      await expect(promise).rejects.toThrow('failed to spawn executable');
+    });
+
+    it('resolves with collected output when exit code 0 and no JSON', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.watchWorkflow();
+
+      child.stdout.emit('data', Buffer.from('line A\nline B\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('line A\nline B');
+    });
+  });
+
+  describe('stderr forwarding', () => {
+    it('forwards stderr lines to logger during execute', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      child.stderr.emit('data', Buffer.from('warning: something\n'));
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, result: [] }) + '\n'));
+      child.emit('close', 0);
+
+      await promise;
+      // stderr content included in error message if process fails
+      // Here it succeeds, so we just verify no rejection
+    });
+
+    it('includes stderr in error message when process fails without JSON', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      child.stderr.emit('data', Buffer.from('fatal: segfault\n'));
+      child.emit('close', 1);
+
+      await expect(promise).rejects.toThrow('fatal: segfault');
+    });
+  });
+
+  describe('timeout handling', () => {
+    beforeEach(() => {
+      jest.useFakeTimers();
+    });
+
+    afterEach(() => {
+      jest.useRealTimers();
+    });
+
+    it('rejects and kills process when execute command times out', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.listResources();
+
+      // Advance past the 300s default timeout
+      jest.advanceTimersByTime(301_000);
+
+      await expect(promise).rejects.toThrow('timed out');
+      expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+    });
+
+    it('rejects and kills process when runTaskInWorkflow times out', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      // Advance past the 2-hour timeout (7_200_000ms)
+      jest.advanceTimersByTime(7_200_001);
+
+      await expect(promise).rejects.toThrow('run-task timed out');
+      expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+      expect(core.error).toHaveBeenCalledWith(expect.stringContaining('CLI provider timed out after 120 minutes'));
+    });
+
+    it('rejects and kills process when watchWorkflow times out', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.watchWorkflow();
+
+      // Advance past the 1-hour timeout (3_600_000ms)
+      jest.advanceTimersByTime(3_600_001);
+
+      await expect(promise).rejects.toThrow('watch-workflow timed out');
+      expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+      expect(core.error).toHaveBeenCalledWith(expect.stringContaining('CLI provider timed out after 60 minutes'));
+    });
+
+    it('escalates to SIGKILL after grace period on runTaskInWorkflow timeout', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      // Trigger the timeout
+      jest.advanceTimersByTime(7_200_001);
+
+      await expect(promise).rejects.toThrow('timed out');
+
+      // SIGTERM was sent
+      expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+
+      // Advance past the 10s grace period — SIGKILL should fire
+      jest.advanceTimersByTime(10_001);
+      expect(child.kill).toHaveBeenCalledWith('SIGKILL');
+    });
+
+    it('does not send SIGKILL if process exits before grace period', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      // Trigger the timeout
+      jest.advanceTimersByTime(7_200_001);
+
+      await expect(promise).rejects.toThrow('timed out');
+
+      // Process exits voluntarily after SIGTERM
+      child.emit('close', 143);
+
+      // Advance past the grace period — SIGKILL should NOT fire because process already exited
+      jest.advanceTimersByTime(10_001);
+      expect(child.kill).toHaveBeenCalledWith('SIGTERM');
+      // SIGKILL should not have been called because the close event cleared the timer
+      expect(child.kill).not.toHaveBeenCalledWith('SIGKILL');
+    });
+
+    it('clears timeout when runTaskInWorkflow completes normally', async () => {
+      const child = createMockChildProcess();
+      mockSpawn.mockReturnValue(child);
+
+      const provider = new CliProvider('/path/to/exe', {} as any);
+      const promise = provider.runTaskInWorkflow('guid', 'image', 'cmd', '/mnt', '/work', [], []);
+
+      // Process completes before timeout
+      child.stdout.emit('data', Buffer.from(JSON.stringify({ success: true, output: 'done' }) + '\n'));
+      child.emit('close', 0);
+
+      const result = await promise;
+      expect(result).toBe('done');
+
+      // Advance far past timeout — should NOT reject
+      jest.advanceTimersByTime(8_000_000);
+      expect(child.kill).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('available providers list', () => {
+    it('includes cli in the available providers', () => {
+      const providers = ProviderLoader.getAvailableProviders();
+      expect(providers).toContain('cli');
+    });
+  });
+});

src/model/orchestrator/providers/cli/cli-provider.ts

@@ -0,0 +1,406 @@
+import { spawn, ChildProcess } from 'child_process';
+import * as core from '@actions/core';
+import { ProviderInterface } from '../provider-interface';
+import BuildParameters from '../../../build-parameters';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import { CliProviderRequest, CliProviderResponse, CliProviderSubcommand } from './cli-provider-protocol';
+
+const DEFAULT_TIMEOUT_MS = 300_000; // 300 seconds
+const RUN_TASK_TIMEOUT_MS = 7_200_000; // 2 hours
+const WATCH_WORKFLOW_TIMEOUT_MS = 3_600_000; // 1 hour
+const SIGKILL_GRACE_MS = 10_000; // 10 seconds grace period before SIGKILL
+
+/**
+ * Gracefully kill a child process: SIGTERM first, then SIGKILL after a grace period.
+ */
+function gracefulKill(child: ChildProcess, graceMs: number = SIGKILL_GRACE_MS): void {
+  child.kill('SIGTERM');
+
+  const forceKillTimer = setTimeout(() => {
+    try {
+      child.kill('SIGKILL');
+    } catch {
+      // Process may already be dead
+    }
+  }, graceMs);
+
+  // Clear the force-kill timer if the process exits on its own
+  child.on('close', () => {
+    clearTimeout(forceKillTimer);
+  });
+}
+
+class CliProvider implements ProviderInterface {
+  private readonly executablePath: string;
+  private readonly buildParameters: BuildParameters;
+
+  constructor(executablePath: string, buildParameters: BuildParameters) {
+    if (!executablePath || executablePath.trim() === '') {
+      throw new Error('CliProvider: executablePath must be a non-empty string');
+    }
+    this.executablePath = executablePath;
+    this.buildParameters = buildParameters;
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<any> {
+    const response = await this.execute('setup-workflow', {
+      buildGuid,
+      buildParameters,
+      branchName,
+      defaultSecretsArray,
+    });
+
+    return response.result;
+  }
+
+  async cleanupWorkflow(
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<any> {
+    const response = await this.execute('cleanup-workflow', {
+      buildParameters,
+      branchName,
+      defaultSecretsArray,
+    });
+
+    return response.result;
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    const request: CliProviderRequest = {
+      command: 'run-task',
+      params: {
+        buildGuid,
+        image,
+        commands,
+        mountdir,
+        workingdir,
+        environment,
+        secrets,
+      },
+    };
+
+    const timeoutMs = RUN_TASK_TIMEOUT_MS;
+
+    return new Promise<string>((resolve, reject) => {
+      const child = spawn(this.executablePath, ['run-task'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: process.platform === 'win32',
+      });
+
+      let lastJsonResponse: CliProviderResponse | undefined;
+      const outputLines: string[] = [];
+      let stderrOutput = '';
+      let timedOut = false;
+
+      // Set up timeout to prevent indefinite hangs
+      const timer = setTimeout(() => {
+        timedOut = true;
+        const minutes = Math.round(timeoutMs / 60_000);
+        const message = `CLI provider timed out after ${minutes} minutes. The external provider may be unresponsive.`;
+        core.error(message);
+        gracefulKill(child);
+        reject(new Error(`CliProvider run-task timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+
+      child.stdin.write(JSON.stringify(request));
+      child.stdin.end();
+
+      child.stdout.on('data', (data: Buffer) => {
+        const lines = data.toString().split('\n');
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+
+          // Try to parse as JSON response
+          try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed === 'object' && parsed !== null && 'success' in parsed) {
+              lastJsonResponse = parsed as CliProviderResponse;
+              continue;
+            }
+          } catch {
+            // Not JSON — treat as build output
+          }
+
+          // Forward non-JSON lines as real-time build output
+          OrchestratorLogger.log(trimmed);
+          outputLines.push(trimmed);
+        }
+      });
+
+      child.stderr.on('data', (data: Buffer) => {
+        const text = data.toString();
+        stderrOutput += text;
+        // Forward stderr to logger
+        for (const line of text.split('\n')) {
+          const trimmed = line.trim();
+          if (trimmed) {
+            OrchestratorLogger.log(`[cli-provider stderr] ${trimmed}`);
+          }
+        }
+      });
+
+      child.on('error', (error: Error) => {
+        clearTimeout(timer);
+        if (!timedOut) {
+          reject(new Error(`CliProvider: failed to spawn executable '${this.executablePath}': ${error.message}`));
+        }
+      });
+
+      child.on('close', (code: number | null) => {
+        clearTimeout(timer);
+        if (timedOut) return;
+
+        if (lastJsonResponse) {
+          if (lastJsonResponse.success) {
+            resolve(lastJsonResponse.output || outputLines.join('\n'));
+          } else {
+            reject(
+              new Error(`CliProvider run-task failed: ${lastJsonResponse.error || 'Unknown error from CLI provider'}`),
+            );
+          }
+        } else if (code === 0) {
+          resolve(outputLines.join('\n'));
+        } else {
+          reject(
+            new Error(`CliProvider run-task exited with code ${code}${stderrOutput ? ': ' + stderrOutput.trim() : ''}`),
+          );
+        }
+      });
+    });
+  }
+
+  async garbageCollect(
+    filter: string,
+    previewOnly: boolean,
+    olderThan: Number,
+    fullCache: boolean,
+    baseDependencies: boolean,
+  ): Promise<string> {
+    const response = await this.execute('garbage-collect', {
+      filter,
+      previewOnly,
+      olderThan,
+      fullCache,
+      baseDependencies,
+    });
+
+    return response.output || '';
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    const response = await this.execute('list-resources', {});
+
+    return (response.result as ProviderResource[]) || [];
+  }
+
+  async listWorkflow(): Promise<ProviderWorkflow[]> {
+    const response = await this.execute('list-workflow', {});
+
+    return (response.result as ProviderWorkflow[]) || [];
+  }
+
+  async watchWorkflow(): Promise<string> {
+    const request: CliProviderRequest = {
+      command: 'watch-workflow',
+      params: {},
+    };
+
+    const timeoutMs = WATCH_WORKFLOW_TIMEOUT_MS;
+
+    return new Promise<string>((resolve, reject) => {
+      const child = spawn(this.executablePath, ['watch-workflow'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: process.platform === 'win32',
+      });
+
+      let lastJsonResponse: CliProviderResponse | undefined;
+      const outputLines: string[] = [];
+      let timedOut = false;
+
+      // Set up timeout to prevent indefinite hangs
+      const timer = setTimeout(() => {
+        timedOut = true;
+        const minutes = Math.round(timeoutMs / 60_000);
+        const message = `CLI provider timed out after ${minutes} minutes. The external provider may be unresponsive.`;
+        core.error(message);
+        gracefulKill(child);
+        reject(new Error(`CliProvider watch-workflow timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+
+      child.stdin.write(JSON.stringify(request));
+      child.stdin.end();
+
+      child.stdout.on('data', (data: Buffer) => {
+        const lines = data.toString().split('\n');
+        for (const line of lines) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+
+          try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed === 'object' && parsed !== null && 'success' in parsed) {
+              lastJsonResponse = parsed as CliProviderResponse;
+              continue;
+            }
+          } catch {
+            // Not JSON
+          }
+
+          OrchestratorLogger.log(trimmed);
+          outputLines.push(trimmed);
+        }
+      });
+
+      child.stderr.on('data', (data: Buffer) => {
+        for (const line of data.toString().split('\n')) {
+          const trimmed = line.trim();
+          if (trimmed) {
+            OrchestratorLogger.log(`[cli-provider stderr] ${trimmed}`);
+          }
+        }
+      });
+
+      child.on('error', (error: Error) => {
+        clearTimeout(timer);
+        if (!timedOut) {
+          reject(new Error(`CliProvider: failed to spawn executable '${this.executablePath}': ${error.message}`));
+        }
+      });
+
+      child.on('close', (code: number | null) => {
+        clearTimeout(timer);
+        if (timedOut) return;
+
+        if (lastJsonResponse) {
+          if (lastJsonResponse.success) {
+            resolve(lastJsonResponse.output || outputLines.join('\n'));
+          } else {
+            reject(new Error(`CliProvider watch-workflow failed: ${lastJsonResponse.error || 'Unknown error'}`));
+          }
+        } else if (code === 0) {
+          resolve(outputLines.join('\n'));
+        } else {
+          reject(new Error(`CliProvider watch-workflow exited with code ${code}`));
+        }
+      });
+    });
+  }
+
+  /**
+   * Execute a CLI provider subcommand with a default timeout.
+   * Timeout applies a graceful SIGTERM followed by SIGKILL after a grace period.
+   */
+  private execute(
+    command: CliProviderSubcommand,
+    params: Record<string, any>,
+    timeoutMs: number = DEFAULT_TIMEOUT_MS,
+  ): Promise<CliProviderResponse> {
+    const request: CliProviderRequest = { command, params };
+
+    return new Promise<CliProviderResponse>((resolve, reject) => {
+      const child = spawn(this.executablePath, [command], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: process.platform === 'win32',
+      });
+
+      let stdoutData = '';
+      let stderrData = '';
+      let timedOut = false;
+
+      // Set up timeout with graceful kill
+      const timer = setTimeout(() => {
+        timedOut = true;
+        gracefulKill(child);
+        reject(new Error(`CliProvider: command '${command}' timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+
+      child.stdin.write(JSON.stringify(request));
+      child.stdin.end();
+
+      child.stdout.on('data', (data: Buffer) => {
+        stdoutData += data.toString();
+      });
+
+      child.stderr.on('data', (data: Buffer) => {
+        const text = data.toString();
+        stderrData += text;
+        // Forward stderr to logger
+        for (const line of text.split('\n')) {
+          const trimmed = line.trim();
+          if (trimmed) {
+            OrchestratorLogger.log(`[cli-provider stderr] ${trimmed}`);
+          }
+        }
+      });
+
+      child.on('error', (error: Error) => {
+        clearTimeout(timer);
+        if (!timedOut) {
+          reject(new Error(`CliProvider: failed to spawn executable '${this.executablePath}': ${error.message}`));
+        }
+      });
+
+      child.on('close', (code: number | null) => {
+        clearTimeout(timer);
+        if (timedOut) return;
+
+        // Find the last JSON line in stdout
+        const lines = stdoutData.split('\n').filter((l) => l.trim());
+        let response: CliProviderResponse | undefined;
+
+        for (let i = lines.length - 1; i >= 0; i--) {
+          try {
+            const parsed = JSON.parse(lines[i].trim());
+            if (typeof parsed === 'object' && parsed !== null && 'success' in parsed) {
+              response = parsed as CliProviderResponse;
+              break;
+            }
+          } catch {
+            // Not valid JSON, skip
+          }
+        }
+
+        if (response) {
+          if (response.success) {
+            resolve(response);
+          } else {
+            reject(new Error(`CliProvider ${command} failed: ${response.error || 'Unknown error from CLI provider'}`));
+          }
+        } else if (code === 0) {
+          // No JSON response but exit code 0 — treat as success with raw output
+          resolve({ success: true, output: stdoutData.trim() });
+        } else {
+          reject(
+            new Error(
+              `CliProvider ${command} exited with code ${code}` +
+                (stderrData ? `: ${stderrData.trim()}` : '') +
+                (!stderrData && stdoutData ? `: ${stdoutData.trim()}` : ''),
+            ),
+          );
+        }
+      });
+    });
+  }
+}
+
+export default CliProvider;

src/model/orchestrator/providers/cli/index.ts

@@ -0,0 +1 @@
+export { default } from './cli-provider';

src/model/orchestrator/providers/gcp-cloud-run/index.ts

@@ -0,0 +1,435 @@
+/**
+ * Google Cloud Run Jobs Provider (Experimental)
+ *
+ * Executes Unity builds as Cloud Run Jobs with configurable storage backends.
+ *
+ * Storage types:
+ *   - gcs-fuse:   Mount a GCS bucket as a POSIX filesystem via GCS FUSE sidecar.
+ *                  Unlimited size, best for large sequential reads/writes.
+ *                  Requires: gcpBucket
+ *   - gcs-copy:   Copy artifacts in/out of GCS before/after the build via gsutil.
+ *                  No mount overhead, simpler, works everywhere.
+ *                  Requires: gcpBucket
+ *   - nfs:        Mount a Filestore NFS share. True POSIX semantics, good random I/O,
+ *                  up to 100 TiB. Best for Library caching (many small random reads).
+ *                  Requires: gcpFilestoreIp, gcpFilestoreShare
+ *   - in-memory:  tmpfs volume (emptyDir). Fastest I/O but volatile and limited to 32 GiB.
+ *                  Good for scratch/temp space during builds.
+ *
+ * Prerequisites:
+ *   - Google Cloud SDK authenticated (GOOGLE_APPLICATION_CREDENTIALS or gcloud auth)
+ *   - Cloud Run Jobs API enabled
+ *   - Service account with roles: Cloud Run Admin, Storage Admin, Logs Viewer
+ *
+ * @experimental This provider is experimental. APIs and behavior may change.
+ */
+
+import { ProviderInterface } from '../provider-interface';
+import BuildParameters from '../../../build-parameters';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import { Input } from '../../..';
+import ResourceTracking from '../../services/core/resource-tracking';
+
+type GcpStorageType = 'gcs-fuse' | 'gcs-copy' | 'nfs' | 'in-memory';
+
+class GcpCloudRunProvider implements ProviderInterface {
+  private readonly project: string;
+  private readonly region: string;
+  private readonly storageType: GcpStorageType;
+  private readonly bucket: string;
+  private readonly filestoreIp: string;
+  private readonly filestoreShare: string;
+  private readonly machineType: string;
+  private readonly diskSizeGb: number;
+  private readonly serviceAccount: string;
+  private readonly vpcConnector: string;
+  private buildParameters: BuildParameters;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.project = buildParameters.gcpProject || process.env.GOOGLE_CLOUD_PROJECT || process.env.GCLOUD_PROJECT || '';
+    this.region = buildParameters.gcpRegion || Input.region || 'us-central1';
+    this.storageType = (buildParameters.gcpStorageType || 'gcs-fuse') as GcpStorageType;
+    this.bucket = buildParameters.gcpBucket || '';
+    this.filestoreIp = buildParameters.gcpFilestoreIp || '';
+    this.filestoreShare = buildParameters.gcpFilestoreShare || '/share1';
+    this.machineType = buildParameters.gcpMachineType || 'e2-standard-4';
+    this.diskSizeGb = Number.parseInt(buildParameters.gcpDiskSizeGb || '100', 10);
+    this.serviceAccount = buildParameters.gcpServiceAccount || '';
+    this.vpcConnector = buildParameters.gcpVpcConnector || '';
+
+    OrchestratorLogger.log('[GCP Cloud Run] Provider initialized (EXPERIMENTAL)');
+    OrchestratorLogger.log(`[GCP Cloud Run] Project: ${this.project || '(auto-detect)'}`);
+    OrchestratorLogger.log(`[GCP Cloud Run] Region: ${this.region}`);
+    OrchestratorLogger.log(`[GCP Cloud Run] Storage: ${this.storageType}`);
+
+    this.validateStorageConfig();
+  }
+
+  private validateStorageConfig(): void {
+    switch (this.storageType) {
+      case 'gcs-fuse':
+      case 'gcs-copy':
+        if (!this.bucket) {
+          OrchestratorLogger.logWarning(
+            `[GCP Cloud Run] Storage type '${this.storageType}' requires gcpBucket to be set.`,
+          );
+        } else {
+          OrchestratorLogger.log(`[GCP Cloud Run] Bucket: gs://${this.bucket}`);
+        }
+        break;
+      case 'nfs':
+        if (!this.filestoreIp) {
+          OrchestratorLogger.logWarning('[GCP Cloud Run] Storage type "nfs" requires gcpFilestoreIp to be set.');
+        } else {
+          OrchestratorLogger.log(`[GCP Cloud Run] Filestore: ${this.filestoreIp}:${this.filestoreShare}`);
+        }
+        if (!this.vpcConnector) {
+          OrchestratorLogger.logWarning(
+            '[GCP Cloud Run] NFS storage usually requires gcpVpcConnector for private network access to Filestore.',
+          );
+        }
+        break;
+      case 'in-memory':
+        OrchestratorLogger.log(`[GCP Cloud Run] In-memory volume: ${Math.min(this.diskSizeGb, 32)} GiB (max 32)`);
+        break;
+      default:
+        OrchestratorLogger.logWarning(
+          `[GCP Cloud Run] Unknown storage type '${this.storageType}'. Valid: gcs-fuse, gcs-copy, nfs, in-memory`,
+        );
+    }
+
+    if (!this.project) {
+      OrchestratorLogger.logWarning(
+        '[GCP Cloud Run] No project specified. Set gcpProject input or GOOGLE_CLOUD_PROJECT env var.',
+      );
+    }
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log(`[GCP Cloud Run] Setting up workflow for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('gcp-cloud-run setup');
+
+    // Verify gcloud CLI is available
+    try {
+      await OrchestratorSystem.Run('gcloud --version', false, true);
+      OrchestratorLogger.log('[GCP Cloud Run] gcloud CLI detected');
+    } catch {
+      throw new Error(
+        '[GCP Cloud Run] gcloud CLI not found. Install Google Cloud SDK: https://cloud.google.com/sdk/docs/install',
+      );
+    }
+
+    // Verify Cloud Run Jobs API is enabled
+    try {
+      const projectFlag = this.project ? `--project=${this.project}` : '';
+      await OrchestratorSystem.Run(
+        `gcloud services list --enabled --filter="name:run.googleapis.com" ${projectFlag} --format="value(name)"`,
+        false,
+        true,
+      );
+    } catch {
+      OrchestratorLogger.logWarning(
+        '[GCP Cloud Run] Could not verify Cloud Run API status. Ensure run.googleapis.com is enabled.',
+      );
+    }
+
+    // Storage-specific setup
+    if ((this.storageType === 'gcs-fuse' || this.storageType === 'gcs-copy') && this.bucket) {
+      await this.ensureBucketExists();
+    }
+  }
+
+  private async ensureBucketExists(): Promise<void> {
+    try {
+      await OrchestratorSystem.Run(
+        `gcloud storage buckets describe gs://${this.bucket} --format="value(name)"`,
+        false,
+        true,
+      );
+      OrchestratorLogger.log(`[GCP Cloud Run] Bucket gs://${this.bucket} exists`);
+    } catch {
+      OrchestratorLogger.log(`[GCP Cloud Run] Creating bucket gs://${this.bucket}`);
+      const projectFlag = this.project ? `--project=${this.project}` : '';
+      await OrchestratorSystem.Run(
+        `gcloud storage buckets create gs://${this.bucket} --location=${this.region} ${projectFlag}`,
+      );
+    }
+  }
+
+  private buildVolumeFlags(mountdir: string): { volumeFlags: string; mountFlags: string } {
+    switch (this.storageType) {
+      case 'gcs-fuse':
+        if (!this.bucket) return { volumeFlags: '', mountFlags: '' };
+        return {
+          volumeFlags: `--add-volume=name=gcs-fuse,type=cloud-storage,bucket=${this.bucket}`,
+          mountFlags: `--add-volume-mount=volume=gcs-fuse,mount-path=${mountdir}`,
+        };
+
+      case 'nfs':
+        if (!this.filestoreIp) return { volumeFlags: '', mountFlags: '' };
+        return {
+          volumeFlags: `--add-volume=name=nfs-vol,type=nfs,location=${this.filestoreIp}:${this.filestoreShare}`,
+          mountFlags: `--add-volume-mount=volume=nfs-vol,mount-path=${mountdir}`,
+        };
+
+      case 'in-memory': {
+        const sizeGib = Math.min(this.diskSizeGb, 32);
+        return {
+          volumeFlags: `--add-volume=name=tmpfs-vol,type=in-memory,size-limit=${sizeGib}Gi`,
+          mountFlags: `--add-volume-mount=volume=tmpfs-vol,mount-path=${mountdir}`,
+        };
+      }
+
+      case 'gcs-copy':
+        // No volume mount — artifacts are copied in/out via gsutil commands
+        return { volumeFlags: '', mountFlags: '' };
+
+      default:
+        return { volumeFlags: '', mountFlags: '' };
+    }
+  }
+
+  private async copyArtifactsIn(mountdir: string): Promise<void> {
+    if (this.storageType !== 'gcs-copy' || !this.bucket) return;
+    OrchestratorLogger.log(`[GCP Cloud Run] Copying artifacts from gs://${this.bucket} to ${mountdir}`);
+    try {
+      await OrchestratorSystem.Run(`gcloud storage cp -r "gs://${this.bucket}/*" "${mountdir}/" || true`, false, true);
+    } catch {
+      OrchestratorLogger.log('[GCP Cloud Run] No existing artifacts to restore (bucket may be empty)');
+    }
+  }
+
+  private async copyArtifactsOut(mountdir: string): Promise<void> {
+    if (this.storageType !== 'gcs-copy' || !this.bucket) return;
+    OrchestratorLogger.log(`[GCP Cloud Run] Uploading artifacts from ${mountdir} to gs://${this.bucket}`);
+    await OrchestratorSystem.Run(`gcloud storage cp -r "${mountdir}/*" "gs://${this.bucket}/"`, false, true);
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[GCP Cloud Run] Running task for build ${buildGuid}`);
+    ResourceTracking.logAllocationSummary('gcp-cloud-run task');
+
+    const jobName = `unity-build-${buildGuid}`
+      .toLowerCase()
+      .replace(/[^a-z0-9-]/g, '-')
+      .slice(0, 63);
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+
+    // Build environment variable flags
+    const envFlags = environment
+      .map((env) => `${env.name}=${env.value}`)
+      .concat(secrets.map((s) => `${s.EnvironmentVariable}=${s.ParameterValue}`));
+    const envString = envFlags.length > 0 ? `--set-env-vars="${envFlags.join(',')}"` : '';
+
+    // Build storage volume flags
+    const { volumeFlags, mountFlags } = this.buildVolumeFlags(mountdir);
+
+    // For gcs-copy, wrap the user command with copy-in/copy-out steps
+    let effectiveCommands = commands;
+    if (this.storageType === 'gcs-copy' && this.bucket && commands) {
+      effectiveCommands = [
+        `gcloud storage cp -r "gs://${this.bucket}/*" "${mountdir}/" 2>/dev/null || true`,
+        commands,
+        `gcloud storage cp -r "${mountdir}/*" "gs://${this.bucket}/"`,
+      ].join(' && ');
+    }
+
+    const saFlag = this.serviceAccount ? `--service-account=${this.serviceAccount}` : '';
+    const vpcFlag = this.vpcConnector ? `--vpc-connector=${this.vpcConnector}` : '';
+
+    // Create the Cloud Run Job
+    const createCmd = [
+      'gcloud run jobs create',
+      jobName,
+      `--image=${image}`,
+      `--region=${this.region}`,
+      '--task-timeout=86400s',
+      '--max-retries=0',
+      '--cpu=4',
+      '--memory=16Gi',
+      volumeFlags,
+      mountFlags,
+      envString,
+      saFlag,
+      vpcFlag,
+      projectFlag,
+      '--format=json',
+      '--quiet',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    try {
+      await OrchestratorSystem.Run(createCmd);
+      OrchestratorLogger.log(`[GCP Cloud Run] Job ${jobName} created`);
+    } catch (error: any) {
+      if (error.message?.includes('already exists')) {
+        OrchestratorLogger.log(`[GCP Cloud Run] Job ${jobName} already exists, updating...`);
+        const updateCmd = createCmd.replace('jobs create', 'jobs update');
+        await OrchestratorSystem.Run(updateCmd);
+      } else {
+        throw error;
+      }
+    }
+
+    // Override the command if provided
+    if (effectiveCommands) {
+      const updateCmd = [
+        'gcloud run jobs update',
+        jobName,
+        `--region=${this.region}`,
+        '--command="/bin/sh"',
+        `--args="-c,${effectiveCommands}"`,
+        projectFlag,
+        '--quiet',
+      ]
+        .filter(Boolean)
+        .join(' ');
+
+      await OrchestratorSystem.Run(updateCmd);
+    }
+
+    // Execute the job
+    OrchestratorLogger.log(`[GCP Cloud Run] Executing job ${jobName} (storage: ${this.storageType})...`);
+    const executeCmd = [
+      'gcloud run jobs execute',
+      jobName,
+      `--region=${this.region}`,
+      projectFlag,
+      '--wait',
+      '--format=json',
+      '--quiet',
+    ]
+      .filter(Boolean)
+      .join(' ');
+
+    let output = '';
+    try {
+      output = await OrchestratorSystem.Run(executeCmd);
+      OrchestratorLogger.log('[GCP Cloud Run] Job execution completed');
+    } catch (error: any) {
+      await this.streamJobLogs(jobName);
+      throw new Error(`[GCP Cloud Run] Job execution failed: ${error.message}`);
+    }
+
+    await this.streamJobLogs(jobName);
+    return output;
+  }
+
+  private async streamJobLogs(jobName: string): Promise<void> {
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+    try {
+      const logs = await OrchestratorSystem.Run(
+        `gcloud logging read "resource.type=cloud_run_job AND resource.labels.job_name=${jobName}" ${projectFlag} --limit=1000 --format="value(textPayload)" --order=asc`,
+        false,
+        true,
+      );
+      if (logs) {
+        for (const line of logs.split('\n')) {
+          if (line.trim()) {
+            OrchestratorLogger.log(`[Build] ${line}`);
+          }
+        }
+      }
+    } catch {
+      OrchestratorLogger.logWarning('[GCP Cloud Run] Could not retrieve job logs');
+    }
+  }
+
+  async cleanupWorkflow(
+    buildParameters: BuildParameters,
+    branchName: string,
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ) {
+    OrchestratorLogger.log('[GCP Cloud Run] Cleaning up workflow');
+  }
+
+  async garbageCollect(
+    filter: string,
+    previewOnly: boolean,
+    olderThan: Number,
+    fullCache: boolean,
+    baseDependencies: boolean,
+  ): Promise<string> {
+    OrchestratorLogger.log('[GCP Cloud Run] Garbage collecting old jobs');
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+
+    try {
+      const jobsJson = await OrchestratorSystem.Run(
+        `gcloud run jobs list --region=${this.region} ${projectFlag} --filter="metadata.name~unity-build-" --format="json(metadata.name,metadata.creationTimestamp)"`,
+        false,
+        true,
+      );
+
+      const jobs = JSON.parse(jobsJson || '[]');
+      const cutoffDate = new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - Number(olderThan));
+
+      let deletedCount = 0;
+      for (const job of jobs) {
+        const createdAt = new Date(job.metadata?.creationTimestamp || 0);
+        if (createdAt < cutoffDate) {
+          const name = job.metadata?.name;
+          if (previewOnly) {
+            OrchestratorLogger.log(`[GCP Cloud Run] Would delete: ${name}`);
+          } else {
+            await OrchestratorSystem.Run(
+              `gcloud run jobs delete ${name} --region=${this.region} ${projectFlag} --quiet`,
+            );
+            deletedCount++;
+          }
+        }
+      }
+
+      return `Garbage collected ${deletedCount} Cloud Run jobs`;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[GCP Cloud Run] Garbage collection failed: ${error.message}`);
+      return '';
+    }
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    const projectFlag = this.project ? `--project=${this.project}` : '';
+    try {
+      const jobsJson = await OrchestratorSystem.Run(
+        `gcloud run jobs list --region=${this.region} ${projectFlag} --filter="metadata.name~unity-build-" --format="json(metadata.name)"`,
+        false,
+        true,
+      );
+
+      const jobs = JSON.parse(jobsJson || '[]');
+      return jobs.map((job: any) => ({ Name: job.metadata?.name || '' }));
+    } catch {
+      return [];
+    }
+  }
+
+  listWorkflow(): Promise<ProviderWorkflow[]> {
+    throw new Error('[GCP Cloud Run] listWorkflow not implemented for this experimental provider');
+  }
+
+  async watchWorkflow(): Promise<string> {
+    throw new Error('[GCP Cloud Run] watchWorkflow not implemented for this experimental provider');
+  }
+}
+
+export default GcpCloudRunProvider;

src/model/orchestrator/providers/github-actions/github-actions-provider.test.ts

@@ -0,0 +1,333 @@
+import GitHubActionsProvider from '.';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import * as core from '@actions/core';
+
+jest.mock('../../services/core/orchestrator-system');
+jest.mock('../../services/core/orchestrator-logger');
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(() => ''),
+}));
+
+const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
+const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
+
+function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
+  return {
+    githubActionsRepo: 'owner/repo',
+    githubActionsWorkflow: 'build.yml',
+    githubActionsToken: 'ghp_test_token_123',
+    githubActionsRef: 'main',
+    ...overrides,
+  } as BuildParameters;
+}
+
+// Override setTimeout to execute callbacks immediately so polling loops complete fast
+const originalSetTimeout = global.setTimeout;
+beforeAll(() => {
+  global.setTimeout = ((fn: (...args: any[]) => void, _ms?: number, ...args: any[]) => {
+    return originalSetTimeout(fn, 0, ...args);
+  }) as any;
+});
+afterAll(() => {
+  global.setTimeout = originalSetTimeout;
+});
+
+describe('GitHubActionsProvider', () => {
+  let provider: GitHubActionsProvider;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    provider = new GitHubActionsProvider(createBuildParameters());
+  });
+
+  describe('constructor', () => {
+    it('sets default ref to main when not specified', () => {
+      const params = createBuildParameters({ githubActionsRef: undefined });
+      const p = new GitHubActionsProvider(params);
+      expect(p).toBeDefined();
+    });
+
+    it('uses provided ref when specified', () => {
+      const params = createBuildParameters({ githubActionsRef: 'develop' });
+      const p = new GitHubActionsProvider(params);
+      expect(p).toBeDefined();
+    });
+  });
+
+  describe('setupWorkflow', () => {
+    it('verifies workflow exists via gh api and logs success', async () => {
+      mockRun.mockResolvedValueOnce('12345\n');
+
+      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
+
+      expect(mockRun).toHaveBeenCalledTimes(1);
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('gh api repos/owner/repo/actions/workflows/build.yml');
+      expect(command).toContain("--jq '.id'");
+      expect(command).toContain('GH_TOKEN=ghp_test_token_123');
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Workflow verified'));
+    });
+
+    it('throws when repo is not configured', async () => {
+      const params = createBuildParameters({ githubActionsRepo: '' });
+      provider = new GitHubActionsProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'githubActionsRepo and githubActionsWorkflow are required',
+      );
+    });
+
+    it('throws when workflow is not configured', async () => {
+      const params = createBuildParameters({ githubActionsWorkflow: '' });
+      provider = new GitHubActionsProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'githubActionsRepo and githubActionsWorkflow are required',
+      );
+    });
+
+    it('throws when token is missing', async () => {
+      const params = createBuildParameters({ githubActionsToken: '' });
+      provider = new GitHubActionsProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'githubActionsToken is required',
+      );
+    });
+
+    it('throws descriptive error when workflow verification fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('Not Found'));
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'Failed to verify workflow build.yml in owner/repo',
+      );
+    });
+  });
+
+  describe('runTaskInWorkflow', () => {
+    it('dispatches workflow with correct inputs and returns logs on success', async () => {
+      // Dispatch succeeds
+      mockRun.mockResolvedValueOnce('');
+      // First poll finds the run
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 99001, status: 'in_progress' }));
+      // Status poll returns completed
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' }));
+      // Log fetch succeeds
+      mockRun.mockResolvedValueOnce('Build output log content here');
+
+      const result = await provider.runTaskInWorkflow(
+        'guid-abc',
+        'unityci/editor:2021.3',
+        'echo build',
+        '/mount',
+        '/work',
+        [],
+        [],
+      );
+
+      expect(result).toBe('Build output log content here');
+
+      // Verify dispatch command
+      const dispatchCommand = mockRun.mock.calls[0][0];
+      expect(dispatchCommand).toContain('dispatches');
+      expect(dispatchCommand).toContain('-X POST');
+      expect(dispatchCommand).toContain("ref='main'");
+
+      // Verify log fetch command
+      const logCommand = mockRun.mock.calls[3][0];
+      expect(logCommand).toContain('gh run view');
+      expect(logCommand).toContain('--log');
+      expect(logCommand).toContain('--repo owner/repo');
+    });
+
+    it('base64 encodes commands in the inputs payload', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 100, status: 'completed' })); // run found
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // status
+      mockRun.mockResolvedValueOnce('logs'); // logs
+
+      await provider.runTaskInWorkflow('guid-1', 'image:latest', 'echo hello && build', '/mnt', '/w', [], []);
+
+      const dispatchCommand = mockRun.mock.calls[0][0];
+      const expectedB64 = Buffer.from('echo hello && build').toString('base64');
+      expect(dispatchCommand).toContain(expectedB64);
+    });
+
+    it('includes environment variables as JSON input', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 200, status: 'completed' })); // run found
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // status
+      mockRun.mockResolvedValueOnce('logs'); // logs
+
+      const env = [
+        { name: 'UNITY_LICENSE', value: 'license-data' },
+        { name: 'BUILD_TARGET', value: 'StandaloneWindows64' },
+      ];
+
+      await provider.runTaskInWorkflow('guid-2', 'img', 'cmd', '/m', '/w', env as any, []);
+
+      const dispatchCommand = mockRun.mock.calls[0][0];
+      expect(dispatchCommand).toContain('UNITY_LICENSE');
+      expect(dispatchCommand).toContain('BUILD_TARGET');
+    });
+
+    it('throws when workflow dispatch fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('403 Forbidden'));
+
+      await expect(provider.runTaskInWorkflow('guid-err', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Failed to dispatch workflow',
+      );
+    });
+
+    it('throws when workflow run does not start within timeout', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch succeeds
+
+      // All 30 poll attempts fail
+      for (let i = 0; i < 30; i++) {
+        mockRun.mockRejectedValueOnce(new Error('not found'));
+      }
+
+      await expect(provider.runTaskInWorkflow('guid-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Workflow run did not start within',
+      );
+    });
+
+    it('throws when workflow run fails with non-success conclusion', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 300, status: 'in_progress' })); // run appears
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'failure' })); // fails
+
+      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Workflow run failed with conclusion: failure',
+      );
+    });
+
+    it('returns fallback message when log fetch fails', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 400, status: 'completed' })); // run appears
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'success' })); // completes
+      mockRun.mockRejectedValueOnce(new Error('logs unavailable')); // log fetch fails
+
+      const result = await provider.runTaskInWorkflow('guid-nologs', 'img', 'cmd', '/m', '/w', [], []);
+
+      expect(result).toContain('completed successfully');
+      expect(result).toContain('logs unavailable');
+    });
+
+    it('handles cancelled workflow run conclusion', async () => {
+      mockRun.mockResolvedValueOnce(''); // dispatch
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 500, status: 'in_progress' })); // run
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'completed', conclusion: 'cancelled' })); // cancelled
+
+      await expect(provider.runTaskInWorkflow('guid-cancel', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Workflow run failed with conclusion: cancelled',
+      );
+    });
+
+    it('throws timeout error when polling exceeds maximum duration', async () => {
+      // Save real Date.now
+      const realDateNow = Date.now;
+      let callCount = 0;
+
+      // dispatch succeeds
+      mockRun.mockResolvedValueOnce('');
+      // run appears
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 600, status: 'in_progress' }));
+      // Status always returns in_progress
+      mockRun.mockImplementation(() => Promise.resolve(JSON.stringify({ status: 'in_progress' })));
+
+      // First call returns normal time, subsequent calls simulate 5 hours elapsed
+      Date.now = () => {
+        callCount++;
+        if (callCount <= 2) return realDateNow.call(Date);
+        return realDateNow.call(Date) + 14_400_001; // 4 hours + 1ms
+      };
+
+      try {
+        await expect(provider.runTaskInWorkflow('guid-poll-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+          'did not complete within 4 hours',
+        );
+
+        expect(core.error).toHaveBeenCalledWith(expect.stringContaining('did not complete within 4 hours'));
+      } finally {
+        Date.now = realDateNow;
+      }
+    });
+  });
+
+  describe('cleanupWorkflow', () => {
+    it('completes without error and logs cleanup message', async () => {
+      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('returns empty string (no-op)', async () => {
+      const result = await provider.garbageCollect('', false, 0, false, false);
+      expect(result).toBe('');
+    });
+  });
+
+  describe('listResources', () => {
+    it('returns runner names from the repository', async () => {
+      mockRun.mockResolvedValueOnce('runner-1\nrunner-2\nrunner-3\n');
+
+      const resources = await provider.listResources();
+
+      expect(resources).toHaveLength(3);
+      expect(resources[0].Name).toBe('runner-1');
+      expect(resources[1].Name).toBe('runner-2');
+      expect(resources[2].Name).toBe('runner-3');
+    });
+
+    it('returns empty array when repo or token is missing', async () => {
+      const params = createBuildParameters({ githubActionsRepo: '' });
+      provider = new GitHubActionsProvider(params);
+
+      const resources = await provider.listResources();
+      expect(resources).toEqual([]);
+      expect(mockRun).not.toHaveBeenCalled();
+    });
+
+    it('returns empty array when API call fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('API error'));
+
+      const resources = await provider.listResources();
+      expect(resources).toEqual([]);
+    });
+  });
+
+  describe('listWorkflow', () => {
+    it('returns recent workflow run names', async () => {
+      mockRun.mockResolvedValueOnce('Build Unity\nRun Tests\n');
+
+      const workflows = await provider.listWorkflow();
+
+      expect(workflows).toHaveLength(2);
+      expect(workflows[0].Name).toBe('Build Unity');
+      expect(workflows[1].Name).toBe('Run Tests');
+    });
+
+    it('returns empty array when credentials missing', async () => {
+      const params = createBuildParameters({ githubActionsToken: '' });
+      provider = new GitHubActionsProvider(params);
+
+      const workflows = await provider.listWorkflow();
+      expect(workflows).toEqual([]);
+    });
+  });
+
+  describe('watchWorkflow', () => {
+    it('returns message when no active run exists', async () => {
+      const result = await provider.watchWorkflow();
+      expect(result).toBe('No active run to watch');
+    });
+  });
+});

src/model/orchestrator/providers/github-actions/index.ts

@@ -0,0 +1,284 @@
+import * as core from '@actions/core';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import { ProviderInterface } from '../provider-interface';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+
+const MAX_POLLING_DURATION_MS = 14_400_000; // 4 hours
+
+/**
+ * GitHub Actions provider — triggers builds as workflow_dispatch events
+ * on a target repository via the GitHub API.
+ *
+ * Use case: Distribute builds across orgs, use specialized runner pools,
+ * or trigger builds in repos with Unity licenses.
+ */
+class GitHubActionsProvider implements ProviderInterface {
+  private buildParameters: BuildParameters;
+  private repo: string;
+  private workflow: string;
+  private token: string;
+  private ref: string;
+  private runId: number = 0;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.repo = buildParameters.githubActionsRepo || '';
+    this.workflow = buildParameters.githubActionsWorkflow || '';
+    this.token = buildParameters.githubActionsToken || '';
+    this.ref = buildParameters.githubActionsRef || 'main';
+  }
+
+  async setupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildGuid: string,
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[GitHubActions] Setting up workflow dispatch to ${this.repo}`);
+
+    if (!this.repo || !this.workflow) {
+      throw new Error('githubActionsRepo and githubActionsWorkflow are required for the github-actions provider');
+    }
+
+    if (!this.token) {
+      throw new Error('githubActionsToken is required (PAT with actions:write scope)');
+    }
+
+    // Verify repository and workflow exist
+    try {
+      const result = await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/workflows/${this.workflow} --jq '.id'`,
+      );
+      OrchestratorLogger.log(`[GitHubActions] Workflow verified: ${this.workflow} (ID: ${result.trim()})`);
+    } catch (error: any) {
+      throw new Error(`Failed to verify workflow ${this.workflow} in ${this.repo}: ${error.message || error}`);
+    }
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    // eslint-disable-next-line no-unused-vars
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[GitHubActions] Dispatching workflow ${this.workflow} on ${this.repo}@${this.ref}`);
+
+    // Build inputs payload
+    const inputs: Record<string, string> = {
+      buildGuid,
+      image,
+      commands: Buffer.from(commands).toString('base64'),
+      mountdir,
+      workingdir,
+    };
+
+    // Add environment variables as a JSON input
+    if (environment.length > 0) {
+      inputs.environment = JSON.stringify(environment.map((element) => ({ name: element.name, value: element.value })));
+    }
+
+    // Record the time before dispatch to identify the run
+    const beforeDispatch = new Date().toISOString();
+
+    // Dispatch the workflow
+    const inputsJson = JSON.stringify(inputs).replace(/'/g, "'\\''");
+    try {
+      await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/workflows/${this.workflow}/dispatches -X POST -f ref='${this.ref}' -f "inputs=${inputsJson}"`,
+      );
+      OrchestratorLogger.log(`[GitHubActions] Workflow dispatched`);
+    } catch (error: any) {
+      throw new Error(`Failed to dispatch workflow: ${error.message || error}`);
+    }
+
+    // Poll for the run to appear
+    OrchestratorLogger.log(`[GitHubActions] Waiting for workflow run to start...`);
+    let attempts = 0;
+    const maxAttempts = 30;
+
+    while (attempts < maxAttempts) {
+      attempts++;
+      await new Promise((resolve) => setTimeout(resolve, 10_000));
+
+      try {
+        const runsJson = await OrchestratorSystem.Run(
+          `GH_TOKEN=${this.token} gh api "repos/${this.repo}/actions/workflows/${this.workflow}/runs?created=>${beforeDispatch}&per_page=5" --jq '.workflow_runs[0] | {id, status, conclusion}'`,
+          true,
+        );
+
+        const run = JSON.parse(runsJson.trim());
+        if (run.id) {
+          this.runId = run.id;
+          OrchestratorLogger.log(`[GitHubActions] Run started: ${this.runId} (status: ${run.status})`);
+          break;
+        }
+      } catch {
+        // Run not yet available
+      }
+    }
+
+    if (!this.runId) {
+      throw new Error(`Workflow run did not start within ${maxAttempts * 10}s`);
+    }
+
+    // Poll until completion and stream logs (with maximum duration guard)
+    let status = 'in_progress';
+    const pollingStartTime = Date.now();
+    const runUrl = `https://github.com/${this.repo}/actions/runs/${this.runId}`;
+
+    while (status === 'in_progress' || status === 'queued') {
+      const elapsedMs = Date.now() - pollingStartTime;
+      if (elapsedMs >= MAX_POLLING_DURATION_MS) {
+        const hours = Math.round(MAX_POLLING_DURATION_MS / 3_600_000);
+        const message = `GitHub Actions workflow did not complete within ${hours} hours. Run URL: ${runUrl}`;
+        core.error(message);
+        throw new Error(message);
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, 15_000));
+
+      try {
+        const statusJson = await OrchestratorSystem.Run(
+          `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runs/${this.runId} --jq '{status, conclusion}'`,
+          true,
+        );
+
+        const result = JSON.parse(statusJson.trim());
+        status = result.status;
+
+        if (status === 'completed') {
+          OrchestratorLogger.log(`[GitHubActions] Run ${this.runId} completed: ${result.conclusion}`);
+
+          if (result.conclusion !== 'success') {
+            throw new Error(`Workflow run failed with conclusion: ${result.conclusion}`);
+          }
+
+          break;
+        }
+
+        OrchestratorLogger.log(`[GitHubActions] Run ${this.runId} status: ${status}`);
+      } catch (error: any) {
+        if (error.message && error.message.includes('conclusion')) {
+          throw error;
+        }
+        if (error.message && error.message.includes('did not complete within')) {
+          throw error;
+        }
+        OrchestratorLogger.logWarning(`[GitHubActions] Status check error: ${error.message || error}`);
+      }
+    }
+
+    // Fetch logs
+    try {
+      const logs = await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh run view ${this.runId} --repo ${this.repo} --log`,
+        true,
+      );
+
+      return logs;
+    } catch {
+      return `Run ${this.runId} completed successfully (logs unavailable)`;
+    }
+  }
+
+  async cleanupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[GitHubActions] Cleanup complete (no resources to tear down)`);
+  }
+
+  async garbageCollect(
+    // eslint-disable-next-line no-unused-vars
+    filter: string,
+    // eslint-disable-next-line no-unused-vars
+    previewOnly: boolean,
+    // eslint-disable-next-line no-unused-vars
+    olderThan: Number,
+    // eslint-disable-next-line no-unused-vars
+    fullCache: boolean,
+    // eslint-disable-next-line no-unused-vars
+    baseDependencies: boolean,
+  ): Promise<string> {
+    return '';
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    if (!this.repo || !this.token) return [];
+
+    try {
+      const runnersJson = await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runners --jq '.runners[] | .name'`,
+        true,
+      );
+
+      return runnersJson
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map((name) => {
+          const resource = new ProviderResource();
+          resource.Name = name.trim();
+
+          return resource;
+        });
+    } catch {
+      return [];
+    }
+  }
+
+  async listWorkflow(): Promise<ProviderWorkflow[]> {
+    if (!this.repo || !this.token) return [];
+
+    try {
+      const runsJson = await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh api repos/${this.repo}/actions/runs?per_page=10 --jq '.workflow_runs[] | .name'`,
+        true,
+      );
+
+      return runsJson
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map((name) => {
+          const workflow = new ProviderWorkflow();
+          workflow.Name = name.trim();
+
+          return workflow;
+        });
+    } catch {
+      return [];
+    }
+  }
+
+  async watchWorkflow(): Promise<string> {
+    if (!this.runId) return 'No active run to watch';
+
+    try {
+      return await OrchestratorSystem.Run(
+        `GH_TOKEN=${this.token} gh run watch ${this.runId} --repo ${this.repo}`,
+        true,
+      );
+    } catch {
+      return '';
+    }
+  }
+}
+export default GitHubActionsProvider;

src/model/orchestrator/providers/gitlab-ci/gitlab-ci-provider.test.ts

@@ -0,0 +1,329 @@
+import GitLabCIProvider from '.';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import * as core from '@actions/core';
+
+jest.mock('../../services/core/orchestrator-system');
+jest.mock('../../services/core/orchestrator-logger');
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(() => ''),
+}));
+
+const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
+const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
+const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
+
+function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
+  return {
+    gitlabProjectId: 'my-group/my-project',
+    gitlabTriggerToken: 'glptt-test-token-456',
+    gitlabApiUrl: 'https://gitlab.example.com',
+    gitlabRef: 'main',
+    ...overrides,
+  } as BuildParameters;
+}
+
+// Override setTimeout to execute callbacks immediately so polling loops complete fast
+const originalSetTimeout = global.setTimeout;
+beforeAll(() => {
+  global.setTimeout = ((fn: (...args: any[]) => void, _ms?: number, ...args: any[]) => {
+    return originalSetTimeout(fn, 0, ...args);
+  }) as any;
+});
+afterAll(() => {
+  global.setTimeout = originalSetTimeout;
+});
+
+describe('GitLabCIProvider', () => {
+  let provider: GitLabCIProvider;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    provider = new GitLabCIProvider(createBuildParameters());
+  });
+
+  describe('constructor', () => {
+    it('strips trailing slashes from apiUrl', () => {
+      const params = createBuildParameters({ gitlabApiUrl: 'https://gitlab.example.com///' });
+      const p = new GitLabCIProvider(params);
+      expect(p).toBeDefined();
+    });
+
+    it('defaults apiUrl to https://gitlab.com when not provided', () => {
+      const params = createBuildParameters({ gitlabApiUrl: undefined });
+      const p = new GitLabCIProvider(params);
+      expect(p).toBeDefined();
+    });
+
+    it('defaults ref to main when not provided', () => {
+      const params = createBuildParameters({ gitlabRef: undefined });
+      const p = new GitLabCIProvider(params);
+      expect(p).toBeDefined();
+    });
+  });
+
+  describe('setupWorkflow', () => {
+    it('verifies project access via curl and logs success', async () => {
+      mockRun.mockResolvedValueOnce('');
+
+      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
+
+      expect(mockRun).toHaveBeenCalledTimes(1);
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('curl -sf');
+      expect(command).toContain('PRIVATE-TOKEN: glptt-test-token-456');
+      expect(command).toContain('gitlab.example.com/api/v4/projects/');
+      expect(command).toContain(encodeURIComponent('my-group/my-project'));
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Project access verified'));
+    });
+
+    it('throws when projectId is not configured', async () => {
+      const params = createBuildParameters({ gitlabProjectId: '' });
+      provider = new GitLabCIProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'gitlabProjectId and gitlabTriggerToken are required',
+      );
+    });
+
+    it('throws when triggerToken is not configured', async () => {
+      const params = createBuildParameters({ gitlabTriggerToken: '' });
+      provider = new GitLabCIProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'gitlabProjectId and gitlabTriggerToken are required',
+      );
+    });
+
+    it('throws descriptive error when project access check fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('401 Unauthorized'));
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'Failed to access GitLab project my-group/my-project',
+      );
+    });
+  });
+
+  describe('runTaskInWorkflow', () => {
+    it('triggers pipeline and returns job logs on success', async () => {
+      // Pipeline trigger response
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5001, status: 'pending' }));
+      // Status poll returns success
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
+      // Jobs list
+      mockRun.mockResolvedValueOnce(
+        JSON.stringify([
+          { id: 10001, name: 'build-unity', status: 'success' },
+          { id: 10002, name: 'test-unity', status: 'success' },
+        ]),
+      );
+      // Job traces
+      mockRun.mockResolvedValueOnce('Building Unity project...\nDone.');
+      mockRun.mockResolvedValueOnce('Running tests...\nAll passed.');
+
+      const result = await provider.runTaskInWorkflow(
+        'guid-gl1',
+        'unityci/editor:2021.3',
+        'echo build',
+        '/mount',
+        '/work',
+        [],
+        [],
+      );
+
+      expect(result).toContain('build-unity');
+      expect(result).toContain('test-unity');
+      expect(result).toContain('Building Unity project');
+      expect(result).toContain('Running tests');
+
+      // Verify trigger command
+      const triggerCommand = mockRun.mock.calls[0][0];
+      expect(triggerCommand).toContain('trigger/pipeline');
+      expect(triggerCommand).toContain(`token=${createBuildParameters().gitlabTriggerToken}`);
+      expect(triggerCommand).toContain('ref=main');
+    });
+
+    it('passes build variables including base64-encoded commands', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5002, status: 'success' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify([]));
+
+      await provider.runTaskInWorkflow(
+        'guid-vars',
+        'ubuntu:20.04',
+        'make build',
+        '/mnt/data',
+        '/workspace',
+        [{ name: 'UNITY_VERSION', value: '2021.3.1f1' } as any],
+        [],
+      );
+
+      const triggerCommand = mockRun.mock.calls[0][0];
+      const expectedB64 = Buffer.from('make build').toString('base64');
+      expect(triggerCommand).toContain(`variables[BUILD_COMMANDS]=${expectedB64}`);
+      expect(triggerCommand).toContain('variables[BUILD_GUID]=guid-vars');
+      expect(triggerCommand).toContain('variables[BUILD_IMAGE]=ubuntu:20.04');
+      expect(triggerCommand).toContain('variables[MOUNT_DIR]=/mnt/data');
+      expect(triggerCommand).toContain('variables[WORKING_DIR]=/workspace');
+      expect(triggerCommand).toContain('variables[UNITY_VERSION]=2021.3.1f1');
+    });
+
+    it('throws when pipeline trigger fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('404 Not Found'));
+
+      await expect(provider.runTaskInWorkflow('guid-err', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Failed to trigger pipeline',
+      );
+    });
+
+    it('throws when pipeline finishes with failure status', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5003, status: 'pending' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'failed' }));
+
+      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Pipeline 5003 finished with status: failed',
+      );
+    });
+
+    it('throws when pipeline is canceled', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5004, status: 'pending' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'canceled' }));
+
+      await expect(provider.runTaskInWorkflow('guid-cancel', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Pipeline 5004 finished with status: canceled',
+      );
+    });
+
+    it('handles job log fetch failures gracefully', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5005, status: 'success' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify([{ id: 20001, name: 'build', status: 'success' }]));
+      // Job trace fetch fails
+      mockRun.mockRejectedValueOnce(new Error('trace unavailable'));
+
+      const result = await provider.runTaskInWorkflow('guid-nologs', 'img', 'cmd', '/m', '/w', [], []);
+
+      expect(result).toContain('build');
+      expect(result).toContain('logs unavailable');
+    });
+
+    it('returns fallback message when entire job fetch fails', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5006, status: 'success' }));
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
+      // Jobs list fails
+      mockRun.mockRejectedValueOnce(new Error('API error'));
+
+      const result = await provider.runTaskInWorkflow('guid-noapi', 'img', 'cmd', '/m', '/w', [], []);
+
+      expect(result).toContain('Pipeline 5006 completed successfully');
+      expect(result).toContain('logs unavailable');
+    });
+
+    it('continues polling through status check errors until completion', async () => {
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5007, status: 'pending' }));
+      // First status check fails
+      mockRun.mockRejectedValueOnce(new Error('network blip'));
+      // Second status check succeeds
+      mockRun.mockResolvedValueOnce(JSON.stringify({ status: 'success' }));
+      // Jobs/logs
+      mockRun.mockResolvedValueOnce(JSON.stringify([]));
+
+      await provider.runTaskInWorkflow('guid-retry', 'img', 'cmd', '/m', '/w', [], []);
+
+      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Status check error'));
+    });
+
+    it('throws timeout error when polling exceeds maximum duration', async () => {
+      const realDateNow = Date.now;
+      let callCount = 0;
+
+      // Trigger pipeline succeeds
+      mockRun.mockResolvedValueOnce(JSON.stringify({ id: 5008, status: 'running' }));
+      // Status always returns running
+      mockRun.mockImplementation(() => Promise.resolve(JSON.stringify({ status: 'running' })));
+
+      // After first call, simulate 5 hours elapsed
+      Date.now = () => {
+        callCount++;
+        if (callCount <= 1) return realDateNow.call(Date);
+        return realDateNow.call(Date) + 14_400_001; // 4 hours + 1ms
+      };
+
+      try {
+        await expect(provider.runTaskInWorkflow('guid-poll-timeout', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+          'did not complete within 4 hours',
+        );
+
+        expect(core.error).toHaveBeenCalledWith(expect.stringContaining('did not complete within 4 hours'));
+      } finally {
+        Date.now = realDateNow;
+      }
+    });
+  });
+
+  describe('cleanupWorkflow', () => {
+    it('completes without error and logs cleanup message', async () => {
+      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleanup complete'));
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('returns empty string (no-op)', async () => {
+      const result = await provider.garbageCollect('', false, 0, false, false);
+      expect(result).toBe('');
+    });
+  });
+
+  describe('listResources', () => {
+    it('returns empty array (not implemented)', async () => {
+      const resources = await provider.listResources();
+      expect(resources).toEqual([]);
+    });
+  });
+
+  describe('listWorkflow', () => {
+    it('returns recent pipeline names when credentials are available', async () => {
+      mockRun.mockResolvedValueOnce(
+        JSON.stringify([
+          { id: 100, status: 'success' },
+          { id: 101, status: 'failed' },
+        ]),
+      );
+
+      const workflows = await provider.listWorkflow();
+
+      expect(workflows).toHaveLength(2);
+      expect(workflows[0].Name).toBe('Pipeline #100 (success)');
+      expect(workflows[1].Name).toBe('Pipeline #101 (failed)');
+    });
+
+    it('returns empty array when credentials are missing', async () => {
+      const params = createBuildParameters({ gitlabProjectId: '' });
+      provider = new GitLabCIProvider(params);
+
+      const workflows = await provider.listWorkflow();
+      expect(workflows).toEqual([]);
+      expect(mockRun).not.toHaveBeenCalled();
+    });
+
+    it('returns empty array when API call fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('API error'));
+
+      const workflows = await provider.listWorkflow();
+      expect(workflows).toEqual([]);
+    });
+  });
+
+  describe('watchWorkflow', () => {
+    it('returns empty string (not implemented)', async () => {
+      const result = await provider.watchWorkflow();
+      expect(result).toBe('');
+    });
+  });
+});

src/model/orchestrator/providers/gitlab-ci/index.ts

@@ -0,0 +1,224 @@
+import * as core from '@actions/core';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import { ProviderInterface } from '../provider-interface';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+
+const MAX_POLLING_DURATION_MS = 14_400_000; // 4 hours
+
+/**
+ * GitLab CI provider — triggers builds as GitLab CI pipelines
+ * via the GitLab API.
+ *
+ * Use case: Teams using GitLab CI, hybrid GitHub/GitLab setups,
+ * or GitLab runners with Unity licenses.
+ */
+class GitLabCIProvider implements ProviderInterface {
+  private buildParameters: BuildParameters;
+  private projectId: string;
+  private triggerToken: string;
+  private apiUrl: string;
+  private ref: string;
+  private pipelineId: number = 0;
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.projectId = buildParameters.gitlabProjectId || '';
+    this.triggerToken = buildParameters.gitlabTriggerToken || '';
+    this.apiUrl = (buildParameters.gitlabApiUrl || 'https://gitlab.com').replace(/\/+$/, '');
+    this.ref = buildParameters.gitlabRef || 'main';
+  }
+
+  async setupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildGuid: string,
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[GitLabCI] Setting up pipeline trigger for project ${this.projectId}`);
+
+    if (!this.projectId || !this.triggerToken) {
+      throw new Error('gitlabProjectId and gitlabTriggerToken are required for the gitlab-ci provider');
+    }
+
+    // Verify project access
+    const encodedProject = encodeURIComponent(this.projectId);
+    try {
+      await OrchestratorSystem.Run(
+        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}" -o /dev/null`,
+      );
+      OrchestratorLogger.log(`[GitLabCI] Project access verified`);
+    } catch (error: any) {
+      throw new Error(`Failed to access GitLab project ${this.projectId}: ${error.message || error}`);
+    }
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    // eslint-disable-next-line no-unused-vars
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[GitLabCI] Triggering pipeline on project ${this.projectId}@${this.ref}`);
+
+    const encodedProject = encodeURIComponent(this.projectId);
+
+    // Build variables for the pipeline
+    const pipelineVariables: string[] = [
+      `-f "variables[BUILD_GUID]=${buildGuid}"`,
+      `-f "variables[BUILD_IMAGE]=${image}"`,
+      `-f "variables[BUILD_COMMANDS]=${Buffer.from(commands).toString('base64')}"`,
+      `-f "variables[MOUNT_DIR]=${mountdir}"`,
+      `-f "variables[WORKING_DIR]=${workingdir}"`,
+    ];
+
+    for (const element of environment) {
+      pipelineVariables.push(`-f "variables[${element.name}]=${element.value}"`);
+    }
+
+    // Trigger pipeline
+    try {
+      const response = await OrchestratorSystem.Run(
+        `curl -sf -X POST "${this.apiUrl}/api/v4/projects/${encodedProject}/trigger/pipeline" -f "token=${
+          this.triggerToken
+        }" -f "ref=${this.ref}" ${pipelineVariables.join(' ')}`,
+      );
+
+      const pipeline = JSON.parse(response);
+      this.pipelineId = pipeline.id;
+      OrchestratorLogger.log(`[GitLabCI] Pipeline triggered: ${this.pipelineId} (status: ${pipeline.status})`);
+    } catch (error: any) {
+      throw new Error(`Failed to trigger pipeline: ${error.message || error}`);
+    }
+
+    // Poll until completion (with maximum duration guard)
+    let status = 'pending';
+    const terminalStatuses = new Set(['success', 'failed', 'canceled', 'skipped']);
+    const pollingStartTime = Date.now();
+    const pipelineUrl = `${this.apiUrl}/${this.projectId}/-/pipelines/${this.pipelineId}`;
+
+    while (!terminalStatuses.has(status)) {
+      const elapsedMs = Date.now() - pollingStartTime;
+      if (elapsedMs >= MAX_POLLING_DURATION_MS) {
+        const hours = Math.round(MAX_POLLING_DURATION_MS / 3_600_000);
+        const message = `GitLab CI pipeline did not complete within ${hours} hours. Pipeline URL: ${pipelineUrl}`;
+        core.error(message);
+        throw new Error(message);
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, 15_000));
+
+      try {
+        const statusResponse = await OrchestratorSystem.Run(
+          `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines/${this.pipelineId}"`,
+          true,
+        );
+
+        const pipelineStatus = JSON.parse(statusResponse);
+        status = pipelineStatus.status;
+        OrchestratorLogger.log(`[GitLabCI] Pipeline ${this.pipelineId} status: ${status}`);
+      } catch (error: any) {
+        OrchestratorLogger.logWarning(`[GitLabCI] Status check error: ${error.message || error}`);
+      }
+    }
+
+    if (status !== 'success') {
+      throw new Error(`Pipeline ${this.pipelineId} finished with status: ${status}`);
+    }
+
+    // Fetch job logs
+    try {
+      const jobsResponse = await OrchestratorSystem.Run(
+        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines/${this.pipelineId}/jobs"`,
+        true,
+      );
+
+      const jobs = JSON.parse(jobsResponse);
+      const logs: string[] = [];
+
+      for (const job of jobs) {
+        try {
+          const jobLog = await OrchestratorSystem.Run(
+            `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/jobs/${job.id}/trace"`,
+            true,
+          );
+          logs.push(`=== Job: ${job.name} (${job.status}) ===\n${jobLog}`);
+        } catch {
+          logs.push(`=== Job: ${job.name} (${job.status}) === (logs unavailable)`);
+        }
+      }
+
+      return logs.join('\n\n');
+    } catch {
+      return `Pipeline ${this.pipelineId} completed successfully (logs unavailable)`;
+    }
+  }
+
+  async cleanupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[GitLabCI] Cleanup complete`);
+  }
+
+  async garbageCollect(
+    // eslint-disable-next-line no-unused-vars
+    filter: string,
+    // eslint-disable-next-line no-unused-vars
+    previewOnly: boolean,
+    // eslint-disable-next-line no-unused-vars
+    olderThan: Number,
+    // eslint-disable-next-line no-unused-vars
+    fullCache: boolean,
+    // eslint-disable-next-line no-unused-vars
+    baseDependencies: boolean,
+  ): Promise<string> {
+    return '';
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    return [];
+  }
+
+  async listWorkflow(): Promise<ProviderWorkflow[]> {
+    if (!this.projectId || !this.triggerToken) return [];
+
+    try {
+      const encodedProject = encodeURIComponent(this.projectId);
+      const response = await OrchestratorSystem.Run(
+        `curl -sf -H "PRIVATE-TOKEN: ${this.triggerToken}" "${this.apiUrl}/api/v4/projects/${encodedProject}/pipelines?per_page=10"`,
+        true,
+      );
+
+      return JSON.parse(response).map((pipeline: any) => {
+        const workflow = new ProviderWorkflow();
+        workflow.Name = `Pipeline #${pipeline.id} (${pipeline.status})`;
+
+        return workflow;
+      });
+    } catch {
+      return [];
+    }
+  }
+
+  async watchWorkflow(): Promise<string> {
+    return '';
+  }
+}
+export default GitLabCIProvider;

src/model/orchestrator/providers/provider-loader.ts

@@ -58,10 +58,13 @@ export default async function loadProvider(
         const providerModuleMap: Record<string, string> = {
           aws: './aws',
           k8s: './k8s',
+          cli: './cli',
           test: './test',
           'local-docker': './docker',
           'local-system': './local',
           local: './local',
+          'gcp-cloud-run': './gcp-cloud-run',
+          'azure-aci': './azure-aci',
         };
 
         modulePath = providerModuleMap[providerSource] || providerSource;
@@ -136,7 +139,7 @@ export class ProviderLoader {
    * @returns string[] - Array of available provider names
    */
   static getAvailableProviders(): string[] {
-    return ['aws', 'k8s', 'test', 'local-docker', 'local-system', 'local'];
+    return ['aws', 'k8s', 'cli', 'test', 'local-docker', 'local-system', 'local', 'gcp-cloud-run', 'azure-aci'];
   }
 
   /**

src/model/orchestrator/providers/provider-selection.test.ts

@@ -0,0 +1,164 @@
+import BuildParameters from '../../build-parameters';
+import RemotePowershellProvider from './remote-powershell';
+import GitHubActionsProvider from './github-actions';
+import GitLabCIProvider from './gitlab-ci';
+import AnsibleProvider from './ansible';
+
+/**
+ * Tests for provider selection logic in Orchestrator.setProvider.
+ *
+ * These tests verify that the correct provider class is instantiated based on
+ * the providerStrategy field in BuildParameters. Rather than invoking the full
+ * Orchestrator.setProvider (which has heavy dependencies on OrchestratorOptions,
+ * AWS detection, etc.), we test the provider constructors directly to verify
+ * they produce the right provider type from the same build parameters the
+ * orchestrator switch statement uses.
+ */
+describe('Provider Selection', () => {
+  describe('remote-powershell provider', () => {
+    it('creates RemotePowershellProvider from build parameters', () => {
+      const params = {
+        providerStrategy: 'remote-powershell',
+        remotePowershellHost: 'build-server.local',
+        remotePowershellTransport: 'wsman',
+        remotePowershellCredential: 'user:pass',
+      } as BuildParameters;
+
+      const provider = new RemotePowershellProvider(params);
+
+      expect(provider).toBeInstanceOf(RemotePowershellProvider);
+      expect(provider.constructor.name).toBe('RemotePowershellProvider');
+    });
+  });
+
+  describe('github-actions provider', () => {
+    it('creates GitHubActionsProvider from build parameters', () => {
+      const params = {
+        providerStrategy: 'github-actions',
+        githubActionsRepo: 'org/repo',
+        githubActionsWorkflow: 'ci.yml',
+        githubActionsToken: 'ghp_token',
+        githubActionsRef: 'main',
+      } as BuildParameters;
+
+      const provider = new GitHubActionsProvider(params);
+
+      expect(provider).toBeInstanceOf(GitHubActionsProvider);
+      expect(provider.constructor.name).toBe('GitHubActionsProvider');
+    });
+  });
+
+  describe('gitlab-ci provider', () => {
+    it('creates GitLabCIProvider from build parameters', () => {
+      const params = {
+        providerStrategy: 'gitlab-ci',
+        gitlabProjectId: 'group/project',
+        gitlabTriggerToken: 'glptt-token',
+        gitlabApiUrl: 'https://gitlab.com',
+        gitlabRef: 'main',
+      } as BuildParameters;
+
+      const provider = new GitLabCIProvider(params);
+
+      expect(provider).toBeInstanceOf(GitLabCIProvider);
+      expect(provider.constructor.name).toBe('GitLabCIProvider');
+    });
+  });
+
+  describe('ansible provider', () => {
+    it('creates AnsibleProvider from build parameters', () => {
+      const params = {
+        providerStrategy: 'ansible',
+        ansibleInventory: '/etc/ansible/hosts',
+        ansiblePlaybook: '/playbooks/build.yml',
+        ansibleExtraVars: '',
+        ansibleVaultPassword: '',
+      } as BuildParameters;
+
+      const provider = new AnsibleProvider(params);
+
+      expect(provider).toBeInstanceOf(AnsibleProvider);
+      expect(provider.constructor.name).toBe('AnsibleProvider');
+    });
+  });
+
+  describe('provider strategy routing', () => {
+    it('each provider strategy maps to a distinct provider class', () => {
+      const strategies: Record<string, new (params: BuildParameters) => any> = {
+        'remote-powershell': RemotePowershellProvider,
+        'github-actions': GitHubActionsProvider,
+        'gitlab-ci': GitLabCIProvider,
+        ansible: AnsibleProvider,
+      };
+
+      const params = {
+        remotePowershellHost: 'host',
+        remotePowershellTransport: 'wsman',
+        remotePowershellCredential: '',
+        githubActionsRepo: 'org/repo',
+        githubActionsWorkflow: 'ci.yml',
+        githubActionsToken: 'token',
+        githubActionsRef: 'main',
+        gitlabProjectId: 'proj',
+        gitlabTriggerToken: 'tok',
+        gitlabApiUrl: 'https://gitlab.com',
+        gitlabRef: 'main',
+        ansibleInventory: '/inv',
+        ansiblePlaybook: '/pb.yml',
+        ansibleExtraVars: '',
+        ansibleVaultPassword: '',
+      } as BuildParameters;
+
+      const instances = Object.entries(strategies).map(([strategy, ProviderClass]) => {
+        const provider = new ProviderClass(params);
+        return { strategy, className: provider.constructor.name };
+      });
+
+      // Verify all four strategies produce different provider classes
+      const classNames = instances.map((i) => i.className);
+      const uniqueClassNames = new Set(classNames);
+      expect(uniqueClassNames.size).toBe(4);
+
+      // Verify expected mapping
+      expect(instances.find((i) => i.strategy === 'remote-powershell')!.className).toBe('RemotePowershellProvider');
+      expect(instances.find((i) => i.strategy === 'github-actions')!.className).toBe('GitHubActionsProvider');
+      expect(instances.find((i) => i.strategy === 'gitlab-ci')!.className).toBe('GitLabCIProvider');
+      expect(instances.find((i) => i.strategy === 'ansible')!.className).toBe('AnsibleProvider');
+    });
+
+    it('all providers implement ProviderInterface methods', () => {
+      const params = {
+        remotePowershellHost: 'host',
+        githubActionsRepo: 'org/repo',
+        githubActionsWorkflow: 'ci.yml',
+        githubActionsToken: 'token',
+        gitlabProjectId: 'proj',
+        gitlabTriggerToken: 'tok',
+        ansibleInventory: '/inv',
+      } as BuildParameters;
+
+      const providers = [
+        new RemotePowershellProvider(params),
+        new GitHubActionsProvider(params),
+        new GitLabCIProvider(params),
+        new AnsibleProvider(params),
+      ];
+
+      const requiredMethods = [
+        'setupWorkflow',
+        'runTaskInWorkflow',
+        'cleanupWorkflow',
+        'garbageCollect',
+        'listResources',
+        'listWorkflow',
+        'watchWorkflow',
+      ];
+
+      for (const provider of providers) {
+        for (const method of requiredMethods) {
+          expect(typeof (provider as any)[method]).toBe('function');
+        }
+      }
+    });
+  });
+});

src/model/orchestrator/providers/remote-powershell/index.ts

@@ -0,0 +1,166 @@
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorEnvironmentVariable from '../../options/orchestrator-environment-variable';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+import { ProviderInterface } from '../provider-interface';
+import OrchestratorSecret from '../../options/orchestrator-secret';
+import { ProviderResource } from '../provider-resource';
+import { ProviderWorkflow } from '../provider-workflow';
+
+/**
+ * Remote PowerShell provider — executes Unity builds on remote machines
+ * via PowerShell Remoting (WinRM or SSH).
+ *
+ * Use case: Teams with dedicated build machines not part of a CI system.
+ */
+class RemotePowershellProvider implements ProviderInterface {
+  private buildParameters: BuildParameters;
+  private host: string;
+  private transport: string;
+  private credential: string;
+  private sessionId: string = '';
+
+  constructor(buildParameters: BuildParameters) {
+    this.buildParameters = buildParameters;
+    this.host = buildParameters.remotePowershellHost || '';
+    this.transport = buildParameters.remotePowershellTransport || 'wsman';
+    this.credential = buildParameters.remotePowershellCredential || '';
+  }
+
+  async setupWorkflow(
+    buildGuid: string,
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[RemotePowershell] Setting up remote session to ${this.host} via ${this.transport}`);
+
+    if (!this.host) {
+      throw new Error('remotePowershellHost is required for the remote-powershell provider');
+    }
+
+    // Test connectivity
+    const testCommand = this.buildPwshCommand(`Test-WSMan -ComputerName "${this.host}" -ErrorAction Stop`);
+    try {
+      await OrchestratorSystem.Run(testCommand);
+      OrchestratorLogger.log(`[RemotePowershell] Connection test passed`);
+    } catch (error: any) {
+      throw new Error(`Failed to connect to remote host ${this.host}: ${error.message || error}`);
+    }
+
+    this.sessionId = buildGuid;
+    OrchestratorLogger.log(`[RemotePowershell] Session ${this.sessionId} ready`);
+  }
+
+  async runTaskInWorkflow(
+    buildGuid: string,
+    image: string,
+    commands: string,
+    mountdir: string,
+    workingdir: string,
+    environment: OrchestratorEnvironmentVariable[],
+    secrets: OrchestratorSecret[],
+  ): Promise<string> {
+    OrchestratorLogger.log(`[RemotePowershell] Executing task on ${this.host}`);
+
+    // Build environment variable block for remote session
+    const environmentBlock = environment.map((element) => `$env:${element.name} = '${element.value}'`).join('; ');
+
+    const secretBlock = secrets
+      .map((secret) => `$env:${secret.EnvironmentVariable} = '${secret.ParameterValue}'`)
+      .join('; ');
+
+    // Wrap commands for remote execution
+    const remoteScript = [environmentBlock, secretBlock, `Set-Location "${workingdir}"`, commands]
+      .filter(Boolean)
+      .join('; ');
+
+    const invokeCommand = this.buildInvokeCommand(remoteScript);
+
+    try {
+      const output = await OrchestratorSystem.Run(invokeCommand);
+      OrchestratorLogger.log(`[RemotePowershell] Task completed successfully`);
+
+      return output;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[RemotePowershell] Task failed: ${error.message || error}`);
+      throw error;
+    }
+  }
+
+  async cleanupWorkflow(
+    // eslint-disable-next-line no-unused-vars
+    buildParameters: BuildParameters,
+    // eslint-disable-next-line no-unused-vars
+    branchName: string,
+    // eslint-disable-next-line no-unused-vars
+    defaultSecretsArray: { ParameterKey: string; EnvironmentVariable: string; ParameterValue: string }[],
+  ): Promise<void> {
+    OrchestratorLogger.log(`[RemotePowershell] Cleaning up session ${this.sessionId}`);
+
+    // Remote sessions are stateless per invocation — no cleanup needed
+  }
+
+  async garbageCollect(
+    // eslint-disable-next-line no-unused-vars
+    filter: string,
+    // eslint-disable-next-line no-unused-vars
+    previewOnly: boolean,
+    // eslint-disable-next-line no-unused-vars
+    olderThan: Number,
+    // eslint-disable-next-line no-unused-vars
+    fullCache: boolean,
+    // eslint-disable-next-line no-unused-vars
+    baseDependencies: boolean,
+  ): Promise<string> {
+    OrchestratorLogger.log(`[RemotePowershell] Garbage collection not supported for remote PowerShell provider`);
+
+    return '';
+  }
+
+  async listResources(): Promise<ProviderResource[]> {
+    const resource = new ProviderResource();
+    resource.Name = this.host;
+
+    return [resource];
+  }
+
+  async listWorkflow(): Promise<ProviderWorkflow[]> {
+    return [];
+  }
+
+  async watchWorkflow(): Promise<string> {
+    return '';
+  }
+
+  private buildPwshCommand(script: string): string {
+    return `pwsh -NoProfile -NonInteractive -Command "${script.replace(/"/g, '\\"')}"`;
+  }
+
+  private buildInvokeCommand(remoteScript: string): string {
+    const escapedScript = remoteScript.replace(/"/g, '\\"').replace(/'/g, "''");
+
+    if (this.transport === 'ssh') {
+      return `pwsh -NoProfile -NonInteractive -Command "Invoke-Command -HostName '${this.host}' -ScriptBlock { ${escapedScript} }"`;
+    }
+
+    // WinRM (default)
+    // Split on the FIRST colon only — passwords may contain colons
+    let credentialPart = '';
+    if (this.credential) {
+      const colonIndex = this.credential.indexOf(':');
+      if (colonIndex === -1) {
+        throw new Error('remotePowershellCredential must be in "username:password" format (no colon found)');
+      }
+      const user = this.credential.substring(0, colonIndex);
+      const pass = this.credential.substring(colonIndex + 1);
+      credentialPart = `-Credential (New-Object PSCredential('${user}', (ConvertTo-SecureString '${pass}' -AsPlainText -Force)))`;
+    }
+
+    return `pwsh -NoProfile -NonInteractive -Command "Invoke-Command -ComputerName '${this.host}' ${credentialPart} -ScriptBlock { ${escapedScript} }"`;
+  }
+}
+export default RemotePowershellProvider;

src/model/orchestrator/providers/remote-powershell/remote-powershell-provider.test.ts

@@ -0,0 +1,264 @@
+import RemotePowershellProvider from '.';
+import BuildParameters from '../../../build-parameters';
+import { OrchestratorSystem } from '../../services/core/orchestrator-system';
+import OrchestratorLogger from '../../services/core/orchestrator-logger';
+
+jest.mock('../../services/core/orchestrator-system');
+jest.mock('../../services/core/orchestrator-logger');
+
+const mockRun = OrchestratorSystem.Run as jest.MockedFunction<typeof OrchestratorSystem.Run>;
+const mockLog = OrchestratorLogger.log as jest.MockedFunction<typeof OrchestratorLogger.log>;
+const mockLogWarning = OrchestratorLogger.logWarning as jest.MockedFunction<typeof OrchestratorLogger.logWarning>;
+
+function createBuildParameters(overrides: Partial<BuildParameters> = {}): BuildParameters {
+  return {
+    remotePowershellHost: 'build-server-01.internal',
+    remotePowershellTransport: 'wsman',
+    remotePowershellCredential: 'admin:P@ssw0rd!',
+    ...overrides,
+  } as BuildParameters;
+}
+
+describe('RemotePowershellProvider', () => {
+  let provider: RemotePowershellProvider;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    provider = new RemotePowershellProvider(createBuildParameters());
+  });
+
+  describe('constructor', () => {
+    it('defaults transport to wsman when not specified', () => {
+      const params = createBuildParameters({ remotePowershellTransport: undefined });
+      const p = new RemotePowershellProvider(params);
+      expect(p).toBeDefined();
+    });
+
+    it('accepts ssh transport', () => {
+      const params = createBuildParameters({ remotePowershellTransport: 'ssh' });
+      const p = new RemotePowershellProvider(params);
+      expect(p).toBeDefined();
+    });
+  });
+
+  describe('setupWorkflow', () => {
+    it('tests WinRM connectivity via Test-WSMan and logs success', async () => {
+      mockRun.mockResolvedValueOnce('wsman output');
+
+      await provider.setupWorkflow('guid-123', createBuildParameters(), 'main', []);
+
+      expect(mockRun).toHaveBeenCalledTimes(1);
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('pwsh -NoProfile -NonInteractive');
+      expect(command).toContain('Test-WSMan');
+      expect(command).toContain('build-server-01.internal');
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Connection test passed'));
+    });
+
+    it('sets session ID to the build GUID', async () => {
+      mockRun.mockResolvedValueOnce('');
+
+      await provider.setupWorkflow('my-build-guid', createBuildParameters(), 'main', []);
+
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('my-build-guid'));
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('ready'));
+    });
+
+    it('throws when host is not configured', async () => {
+      const params = createBuildParameters({ remotePowershellHost: '' });
+      provider = new RemotePowershellProvider(params);
+
+      await expect(provider.setupWorkflow('guid-123', params, 'main', [])).rejects.toThrow(
+        'remotePowershellHost is required',
+      );
+    });
+
+    it('throws descriptive error when connectivity test fails', async () => {
+      mockRun.mockRejectedValueOnce(new Error('WinRM service not running'));
+
+      await expect(provider.setupWorkflow('guid-123', createBuildParameters(), 'main', [])).rejects.toThrow(
+        'Failed to connect to remote host build-server-01.internal',
+      );
+    });
+  });
+
+  describe('runTaskInWorkflow', () => {
+    it('constructs WinRM Invoke-Command with credential and returns output', async () => {
+      mockRun.mockResolvedValueOnce('Build succeeded!');
+
+      const result = await provider.runTaskInWorkflow(
+        'guid-run1',
+        'unused-image',
+        'Unity.exe -batchmode -buildTarget Win64',
+        '/mount',
+        'C:\\Projects\\MyGame',
+        [],
+        [],
+      );
+
+      expect(result).toBe('Build succeeded!');
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('pwsh -NoProfile -NonInteractive');
+      expect(command).toContain("Invoke-Command -ComputerName 'build-server-01.internal'");
+      expect(command).toContain('-Credential');
+      expect(command).toContain('New-Object PSCredential');
+      expect(command).toContain('-ScriptBlock');
+      expect(command).toContain('Set-Location');
+    });
+
+    it('constructs SSH Invoke-Command when transport is ssh', async () => {
+      const params = createBuildParameters({ remotePowershellTransport: 'ssh' });
+      provider = new RemotePowershellProvider(params);
+      mockRun.mockResolvedValueOnce('SSH build output');
+
+      const result = await provider.runTaskInWorkflow('guid-ssh', 'img', 'build', '/m', '/w', [], []);
+
+      expect(result).toBe('SSH build output');
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain("Invoke-Command -HostName 'build-server-01.internal'");
+      expect(command).not.toContain('-ComputerName');
+      expect(command).not.toContain('-Credential');
+    });
+
+    it('includes environment variables in the remote script block', async () => {
+      mockRun.mockResolvedValueOnce('output');
+
+      const env = [
+        { name: 'UNITY_LICENSE', value: 'license-data-abc' },
+        { name: 'BUILD_TARGET', value: 'StandaloneWindows64' },
+      ];
+
+      await provider.runTaskInWorkflow('guid-env', 'img', 'build-cmd', '/m', '/w', env as any, []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('$env:UNITY_LICENSE');
+      expect(command).toContain('$env:BUILD_TARGET');
+    });
+
+    it('includes secrets in the remote script block', async () => {
+      mockRun.mockResolvedValueOnce('output');
+
+      const secrets = [{ ParameterKey: 'key1', EnvironmentVariable: 'SECRET_KEY', ParameterValue: 'secret-val-123' }];
+
+      await provider.runTaskInWorkflow('guid-sec', 'img', 'build-cmd', '/m', '/w', [], secrets as any);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('$env:SECRET_KEY');
+    });
+
+    it('does not include credential in plaintext log output when using WinRM', async () => {
+      mockRun.mockResolvedValueOnce('output');
+
+      await provider.runTaskInWorkflow('guid-cred', 'img', 'cmd', '/m', '/w', [], []);
+
+      // The credential is used via ConvertTo-SecureString, not logged directly
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('ConvertTo-SecureString');
+      expect(command).toContain('-AsPlainText -Force');
+    });
+
+    it('omits credential part when no credential is configured (WinRM)', async () => {
+      const params = createBuildParameters({ remotePowershellCredential: '' });
+      provider = new RemotePowershellProvider(params);
+      mockRun.mockResolvedValueOnce('output');
+
+      await provider.runTaskInWorkflow('guid-nocred', 'img', 'cmd', '/m', '/w', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain("Invoke-Command -ComputerName 'build-server-01.internal'");
+      expect(command).not.toContain('-Credential');
+      expect(command).not.toContain('PSCredential');
+    });
+
+    it('throws and logs warning when remote execution fails', async () => {
+      const execError = new Error('Remote execution failed: access denied');
+      mockRun.mockRejectedValueOnce(execError);
+
+      await expect(provider.runTaskInWorkflow('guid-fail', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'Remote execution failed',
+      );
+
+      expect(mockLogWarning).toHaveBeenCalledWith(expect.stringContaining('Task failed'));
+    });
+
+    it('preserves passwords containing colons when splitting credentials', async () => {
+      const params = createBuildParameters({
+        remotePowershellCredential: 'admin:P@ss:w0rd:with:colons!',
+      });
+      provider = new RemotePowershellProvider(params);
+      mockRun.mockResolvedValueOnce('output');
+
+      await provider.runTaskInWorkflow('guid-colon', 'img', 'cmd', '/m', '/w', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain("PSCredential('admin'");
+      expect(command).toContain("ConvertTo-SecureString 'P@ss:w0rd:with:colons!'");
+    });
+
+    it('throws when credential has no colon separator', async () => {
+      const params = createBuildParameters({
+        remotePowershellCredential: 'nocolonhere',
+      });
+      provider = new RemotePowershellProvider(params);
+
+      await expect(provider.runTaskInWorkflow('guid-badcred', 'img', 'cmd', '/m', '/w', [], [])).rejects.toThrow(
+        'username:password',
+      );
+    });
+
+    it('sets working directory in the remote script', async () => {
+      mockRun.mockResolvedValueOnce('output');
+
+      await provider.runTaskInWorkflow('guid-wd', 'img', 'cmd', '/m', 'D:\\Builds\\Project', [], []);
+
+      const command = mockRun.mock.calls[0][0];
+      expect(command).toContain('Set-Location');
+      expect(command).toContain('D:\\Builds\\Project');
+    });
+  });
+
+  describe('cleanupWorkflow', () => {
+    it('completes without error and logs session cleanup', async () => {
+      // Setup first to set sessionId
+      mockRun.mockResolvedValueOnce('');
+      await provider.setupWorkflow('guid-cleanup', createBuildParameters(), 'main', []);
+
+      await provider.cleanupWorkflow(createBuildParameters(), 'main', []);
+
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('Cleaning up session'));
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('returns empty string and logs not-supported message', async () => {
+      const result = await provider.garbageCollect('', false, 0, false, false);
+      expect(result).toBe('');
+      expect(mockLog).toHaveBeenCalledWith(expect.stringContaining('not supported'));
+    });
+  });
+
+  describe('listResources', () => {
+    it('returns the configured host as a resource', async () => {
+      const resources = await provider.listResources();
+
+      expect(resources).toHaveLength(1);
+      expect(resources[0].Name).toBe('build-server-01.internal');
+    });
+  });
+
+  describe('listWorkflow', () => {
+    it('returns empty array (not implemented)', async () => {
+      const workflows = await provider.listWorkflow();
+      expect(workflows).toEqual([]);
+    });
+  });
+
+  describe('watchWorkflow', () => {
+    it('returns empty string (not implemented)', async () => {
+      const result = await provider.watchWorkflow();
+      expect(result).toBe('');
+    });
+  });
+});

src/model/orchestrator/remote-client/index.ts

@@ -15,15 +15,24 @@ import BuildParameters from '../../build-parameters';
 import { Cli } from '../../cli/cli';
 import OrchestratorOptions from '../options/orchestrator-options';
 import ResourceTracking from '../services/core/resource-tracking';
+import { IncrementalSyncService } from '../services/sync';
+import { SyncStrategy } from '../services/sync/sync-state';
 
 export class RemoteClient {
   @CliFunction(`remote-cli-pre-build`, `sets up a repository, usually before a game-ci build`)
   static async setupRemoteClient() {
     OrchestratorLogger.log(`bootstrap game ci orchestrator...`);
     await ResourceTracking.logDiskUsageSnapshot('remote-cli-pre-build (start)');
-    if (!(await RemoteClient.handleRetainedWorkspace())) {
+
+    const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+
+    if (syncStrategy !== 'full') {
+      OrchestratorLogger.log(`[Sync] Using incremental sync strategy: ${syncStrategy}`);
+      await RemoteClient.handleIncrementalSync(syncStrategy);
+    } else if (!(await RemoteClient.handleRetainedWorkspace())) {
       await RemoteClient.bootstrapRepository();
     }
+
     await RemoteClient.replaceLargePackageReferencesWithSharedReferences();
     await RemoteClient.runCustomHookFiles(`before-build`);
   }
@@ -157,6 +166,20 @@ export class RemoteClient {
 
       await RemoteClient.runCustomHookFiles(`after-build`);
 
+      // Revert sync overlays if configured
+      const syncStrategy = (Orchestrator.buildParameters.syncStrategy || 'full') as SyncStrategy;
+      if (Orchestrator.buildParameters.syncRevertAfter && syncStrategy !== 'full') {
+        try {
+          OrchestratorLogger.log('[Sync] Reverting overlay changes after job completion');
+          await IncrementalSyncService.revertOverlays(
+            OrchestratorFolders.repoPathAbsolute,
+            Orchestrator.buildParameters.syncStatePath,
+          );
+        } catch (revertError: any) {
+          RemoteClientLogger.logWarning(`[Sync] Overlay revert failed: ${revertError.message}`);
+        }
+      }
+
       // WIP - need to give the pod permissions to create config map
       await RemoteClientLogger.handleLogManagementPostJob();
     } catch (error: any) {
@@ -229,6 +252,78 @@ export class RemoteClient {
       RemoteClientLogger.log(JSON.stringify(error, undefined, 4));
     }
   }
+
+  /**
+   * Handle incremental sync strategies (git-delta, direct-input, storage-pull).
+   *
+   * For git-delta: requires an existing workspace with sync state; fetches and applies
+   * only changed files.
+   *
+   * For direct-input and storage-pull: requires an existing workspace; applies overlay
+   * content on top.
+   *
+   * Falls back to full bootstrapRepository() if incremental sync cannot proceed.
+   */
+  private static async handleIncrementalSync(strategy: SyncStrategy): Promise<void> {
+    const buildParameters = Orchestrator.buildParameters;
+    const workspacePath = OrchestratorFolders.repoPathAbsolute;
+    const statePath = buildParameters.syncStatePath;
+
+    // Resolve strategy — may fall back to 'full' if no state exists
+    const resolvedStrategy = IncrementalSyncService.resolveStrategy(strategy, workspacePath, statePath);
+
+    if (resolvedStrategy === 'full') {
+      OrchestratorLogger.log('[Sync] Falling back to full bootstrap');
+      if (!(await RemoteClient.handleRetainedWorkspace())) {
+        await RemoteClient.bootstrapRepository();
+      }
+
+      return;
+    }
+
+    switch (resolvedStrategy) {
+      case 'git-delta': {
+        const targetReference = buildParameters.gitSha || buildParameters.branch;
+        OrchestratorLogger.log(`[Sync] Git delta sync to ${targetReference}`);
+        const changedFiles = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference, statePath);
+        OrchestratorLogger.log(`[Sync] Git delta complete: ${changedFiles} file(s) updated`);
+        break;
+      }
+      case 'direct-input': {
+        const inputReference = buildParameters.syncInputRef;
+        if (!inputReference) {
+          throw new Error('[Sync] direct-input strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Applying direct input: ${inputReference}`);
+        await IncrementalSyncService.applyDirectInput(
+          workspacePath,
+          inputReference,
+          buildParameters.syncStorageRemote || undefined,
+          statePath,
+        );
+        break;
+      }
+      case 'storage-pull': {
+        const storageUri = buildParameters.syncInputRef;
+        if (!storageUri) {
+          throw new Error('[Sync] storage-pull strategy requires syncInputRef');
+        }
+        OrchestratorLogger.log(`[Sync] Storage pull from: ${storageUri}`);
+        await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+          rcloneRemote: buildParameters.syncStorageRemote || undefined,
+          syncRevertAfter: buildParameters.syncRevertAfter,
+          statePath,
+        });
+        break;
+      }
+      default:
+        OrchestratorLogger.logWarning(`[Sync] Unknown strategy: ${resolvedStrategy}, falling back to full`);
+        if (!(await RemoteClient.handleRetainedWorkspace())) {
+          await RemoteClient.bootstrapRepository();
+        }
+    }
+  }
+
   public static async bootstrapRepository() {
     await OrchestratorSystem.Run(
       `mkdir -p ${OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.uniqueOrchestratorJobFolderAbsolute)}`,
@@ -237,6 +332,23 @@ export class RemoteClient {
       `mkdir -p ${OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.cacheFolderForCacheKeyFull)}`,
     );
     await RemoteClient.cloneRepoWithoutLFSFiles();
+
+    // Initialize submodules from profile if configured
+    if (Orchestrator.buildParameters.submoduleProfilePath) {
+      const { SubmoduleProfileService } = await import('../services/submodule/submodule-profile-service');
+      RemoteClientLogger.log('Initializing submodules from profile...');
+      const plan = await SubmoduleProfileService.createInitPlan(
+        Orchestrator.buildParameters.submoduleProfilePath,
+        Orchestrator.buildParameters.submoduleVariantPath,
+        OrchestratorFolders.repoPathAbsolute,
+      );
+      await SubmoduleProfileService.execute(
+        plan,
+        OrchestratorFolders.repoPathAbsolute,
+        Orchestrator.buildParameters.submoduleToken || Orchestrator.buildParameters.gitPrivateToken,
+      );
+    }
+
     await RemoteClient.sizeOfFolder(
       'repo before lfs cache pull',
       OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.repoPathAbsolute),
@@ -251,6 +363,19 @@ export class RemoteClient {
       `${lfsHashes.lfsGuidSum}`,
     );
     await RemoteClient.sizeOfFolder('repo after lfs cache pull', OrchestratorFolders.repoPathAbsolute);
+
+    // Configure custom LFS transfer agent if specified
+    if (Orchestrator.buildParameters.lfsTransferAgent) {
+      const { LfsAgentService } = await import('../services/lfs/lfs-agent-service');
+      RemoteClientLogger.log('Configuring custom LFS transfer agent...');
+      await LfsAgentService.configure(
+        Orchestrator.buildParameters.lfsTransferAgent,
+        Orchestrator.buildParameters.lfsTransferAgentArgs,
+        Orchestrator.buildParameters.lfsStoragePaths ? Orchestrator.buildParameters.lfsStoragePaths.split(';') : [],
+        OrchestratorFolders.repoPathAbsolute,
+      );
+    }
+
     await RemoteClient.pullLatestLFS();
     await RemoteClient.sizeOfFolder('repo before lfs git pull', OrchestratorFolders.repoPathAbsolute);
     await Caching.PushToCache(
@@ -302,6 +427,7 @@ export class RemoteClient {
 
     RemoteClientLogger.log(`Initializing source repository for cloning with caching of LFS files`);
     await OrchestratorSystem.Run(`git config --global advice.detachedHead false`);
+    await OrchestratorFolders.configureGitAuth();
     RemoteClientLogger.log(`Cloning the repository being built:`);
     await OrchestratorSystem.Run(`git config --global filter.lfs.smudge "git-lfs smudge --skip -- %f"`);
     await OrchestratorSystem.Run(`git config --global filter.lfs.process "git-lfs filter-process --skip"`);
@@ -411,12 +537,7 @@ export class RemoteClient {
       const gitPrivateToken = process.env.GIT_PRIVATE_TOKEN;
       if (gitPrivateToken) {
         RemoteClientLogger.log(`Attempting to pull LFS files with GIT_PRIVATE_TOKEN...`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."https://github.com/".insteadOf || true`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."ssh://git@github.com/".insteadOf || true`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."git@github.com".insteadOf || true`);
-        await OrchestratorSystem.Run(
-          `git config --global url."https://${gitPrivateToken}@github.com/".insteadOf "https://github.com/"`,
-        );
+        await RemoteClient.configureTokenAuth(gitPrivateToken);
         await OrchestratorSystem.Run(`git lfs pull`, true);
         await OrchestratorSystem.Run(`git lfs checkout || true`, true);
         RemoteClientLogger.log(`Successfully pulled LFS files with GIT_PRIVATE_TOKEN`);
@@ -432,12 +553,7 @@ export class RemoteClient {
       const githubToken = process.env.GITHUB_TOKEN;
       if (githubToken) {
         RemoteClientLogger.log(`Attempting to pull LFS files with GITHUB_TOKEN fallback...`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."https://github.com/".insteadOf || true`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."ssh://git@github.com/".insteadOf || true`);
-        await OrchestratorSystem.Run(`git config --global --unset-all url."git@github.com".insteadOf || true`);
-        await OrchestratorSystem.Run(
-          `git config --global url."https://${githubToken}@github.com/".insteadOf "https://github.com/"`,
-        );
+        await RemoteClient.configureTokenAuth(githubToken);
         await OrchestratorSystem.Run(`git lfs pull`, true);
         await OrchestratorSystem.Run(`git lfs checkout || true`, true);
         RemoteClientLogger.log(`Successfully pulled LFS files with GITHUB_TOKEN`);
@@ -501,4 +617,25 @@ export class RemoteClient {
 
     return false;
   }
+
+  /**
+   * Configure git authentication for a token. In header mode (default), uses
+   * http.extraHeader so the token never appears in URLs or git config output.
+   * In url mode (legacy), uses url.insteadOf to embed the token in URLs.
+   */
+  private static async configureTokenAuth(token: string): Promise<void> {
+    if (OrchestratorFolders.useHeaderAuth) {
+      const encoded = Buffer.from(`x-access-token:${token}`).toString('base64');
+      await OrchestratorSystem.Run(
+        `git config --global http.https://github.com/.extraHeader "Authorization: Basic ${encoded}"`,
+      );
+    } else {
+      await OrchestratorSystem.Run(`git config --global --unset-all url."https://github.com/".insteadOf || true`);
+      await OrchestratorSystem.Run(`git config --global --unset-all url."ssh://git@github.com/".insteadOf || true`);
+      await OrchestratorSystem.Run(`git config --global --unset-all url."git@github.com".insteadOf || true`);
+      await OrchestratorSystem.Run(
+        `git config --global url."https://${token}@github.com/".insteadOf "https://github.com/"`,
+      );
+    }
+  }
 }

src/model/orchestrator/services/cache/child-workspace-service.test.ts

@@ -0,0 +1,458 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { ChildWorkspaceService, ChildWorkspaceConfig } from './child-workspace-service';
+
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+function createConfig(overrides: Partial<ChildWorkspaceConfig> = {}): ChildWorkspaceConfig {
+  return {
+    enabled: true,
+    workspaceName: 'TurnOfWar',
+    parentCacheRoot: '/cache/workspaces',
+    preserveGitDirectory: true,
+    separateLibraryCache: true,
+    ...overrides,
+  };
+}
+
+describe('ChildWorkspaceService', () => {
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  describe('initializeWorkspace', () => {
+    it('should return false when no cached workspace exists', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = ChildWorkspaceService.initializeWorkspace('/project', createConfig());
+
+      expect(result).toBe(false);
+    });
+
+    it('should return false when cached workspace is empty', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation(
+        (p: string) => String(p) === path.join('/cache/workspaces', 'TurnOfWar'),
+      );
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([]);
+
+      const result = ChildWorkspaceService.initializeWorkspace('/project', createConfig());
+
+      expect(result).toBe(false);
+      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/cache/workspaces', 'TurnOfWar'), {
+        recursive: true,
+        force: true,
+      });
+    });
+
+    it('should restore workspace via atomic move when cache exists', () => {
+      const cachedPath = path.join('/cache/workspaces', 'TurnOfWar');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === cachedPath) return true;
+        if (String(p) === '/project') return false;
+        if (String(p) === '/') return true;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['Assets', '.git', 'Library']);
+
+      const config = createConfig({ separateLibraryCache: false });
+      const result = ChildWorkspaceService.initializeWorkspace('/project', config);
+
+      expect(result).toBe(true);
+      expect(mockFs.renameSync).toHaveBeenCalledWith(cachedPath, '/project');
+    });
+
+    it('should remove existing target path before restoring', () => {
+      const cachedPath = path.join('/cache/workspaces', 'TurnOfWar');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === cachedPath) return true;
+        if (String(p) === '/project') return true;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['Assets']);
+
+      const config = createConfig({ separateLibraryCache: false });
+      const result = ChildWorkspaceService.initializeWorkspace('/project', config);
+
+      expect(result).toBe(true);
+      expect(mockFs.rmSync).toHaveBeenCalledWith('/project', { recursive: true, force: true });
+    });
+
+    it('should restore Library cache separately when configured', () => {
+      const cachedPath = path.join('/cache/workspaces', 'TurnOfWar');
+      const libraryBackupPath = path.join('/cache/workspaces', 'TurnOfWar-Library');
+      const libraryDestination = path.join('/project', 'Library');
+
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === cachedPath) return true;
+        if (String(p) === '/project') return false;
+        if (String(p) === libraryBackupPath) return true;
+        if (String(p) === libraryDestination) return false;
+
+        return true; // parent dirs
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['Assets', 'ProjectSettings']);
+
+      const result = ChildWorkspaceService.initializeWorkspace('/project', createConfig());
+
+      expect(result).toBe(true);
+
+      // Should have been called twice: once for workspace, once for Library
+      expect(mockFs.renameSync).toHaveBeenCalledTimes(2);
+      expect(mockFs.renameSync).toHaveBeenCalledWith(cachedPath, '/project');
+      expect(mockFs.renameSync).toHaveBeenCalledWith(libraryBackupPath, libraryDestination);
+    });
+
+    it('should return false and log warning on error', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Access denied');
+      });
+
+      const result = ChildWorkspaceService.initializeWorkspace('/project', createConfig());
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('saveWorkspace', () => {
+    it('should skip save when project path does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      ChildWorkspaceService.saveWorkspace('/project', createConfig());
+
+      expect(mockFs.renameSync).not.toHaveBeenCalled();
+    });
+
+    it('should save workspace via atomic move', () => {
+      const cachedPath = path.join('/cache/workspaces', 'TurnOfWar');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === '/project') return true;
+        if (String(p) === path.join('/project', 'Library')) return false;
+        if (String(p) === '/cache/workspaces') return true;
+        if (String(p) === cachedPath) return false;
+
+        return false;
+      });
+
+      const config = createConfig({ separateLibraryCache: false });
+      ChildWorkspaceService.saveWorkspace('/project', config);
+
+      expect(mockFs.renameSync).toHaveBeenCalledWith('/project', cachedPath);
+    });
+
+    it('should remove .git directory when preserveGit is false', () => {
+      const gitDirectory = path.join('/project', '.git');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === '/project') return true;
+        if (String(p) === gitDirectory) return true;
+        if (String(p) === path.join('/project', 'Library')) return false;
+        if (String(p) === '/cache/workspaces') return true;
+
+        return false;
+      });
+
+      const config = createConfig({ preserveGitDirectory: false, separateLibraryCache: false });
+      ChildWorkspaceService.saveWorkspace('/project', config);
+
+      expect(mockFs.rmSync).toHaveBeenCalledWith(gitDirectory, { recursive: true, force: true });
+    });
+
+    it('should not remove .git directory when preserveGit is true', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === '/project') return true;
+        if (String(p) === path.join('/project', 'Library')) return false;
+        if (String(p) === '/cache/workspaces') return true;
+
+        return false;
+      });
+
+      const config = createConfig({ preserveGitDirectory: true, separateLibraryCache: false });
+      ChildWorkspaceService.saveWorkspace('/project', config);
+
+      // rmSync should not have been called with .git path
+      const rmSyncCalls = (mockFs.rmSync as jest.Mock).mock.calls;
+      const gitRmCalls = rmSyncCalls.filter((call: any[]) => String(call[0]).includes('.git'));
+      expect(gitRmCalls).toHaveLength(0);
+    });
+
+    it('should remove existing cached workspace before saving', () => {
+      const cachedPath = path.join('/cache/workspaces', 'TurnOfWar');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === '/project') return true;
+        if (String(p) === path.join('/project', 'Library')) return false;
+        if (String(p) === '/cache/workspaces') return true;
+        if (String(p) === cachedPath) return true;
+
+        return false;
+      });
+
+      const config = createConfig({ separateLibraryCache: false });
+      ChildWorkspaceService.saveWorkspace('/project', config);
+
+      expect(mockFs.rmSync).toHaveBeenCalledWith(cachedPath, { recursive: true, force: true });
+      expect(mockFs.renameSync).toHaveBeenCalledWith('/project', cachedPath);
+    });
+
+    it('should save Library separately when separateLibraryCache is true', () => {
+      const libraryPath = path.join('/project', 'Library');
+      const libraryBackupPath = path.join('/cache/workspaces', 'TurnOfWar-Library');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === '/project') return true;
+        if (String(p) === libraryPath) return true;
+        if (String(p) === libraryBackupPath) return false;
+        if (String(p) === '/cache/workspaces') return true;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['ScriptAssemblies', 'ShaderCache']);
+
+      ChildWorkspaceService.saveWorkspace('/project', createConfig());
+
+      expect(mockFs.renameSync).toHaveBeenCalledWith(libraryPath, libraryBackupPath);
+    });
+
+    it('should handle save errors gracefully', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.renameSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Cross-device link');
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([]);
+
+      // Should not throw
+      ChildWorkspaceService.saveWorkspace('/project', createConfig({ separateLibraryCache: false }));
+    });
+  });
+
+  describe('restoreLibraryCache', () => {
+    it('should return false when no Library backup exists', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = ChildWorkspaceService.restoreLibraryCache('/project', createConfig());
+
+      expect(result).toBe(false);
+    });
+
+    it('should return false when Library backup is empty', () => {
+      const libraryBackup = path.join('/cache/workspaces', 'TurnOfWar-Library');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => String(p) === libraryBackup);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([]);
+
+      const result = ChildWorkspaceService.restoreLibraryCache('/project', createConfig());
+
+      expect(result).toBe(false);
+      expect(mockFs.rmSync).toHaveBeenCalledWith(libraryBackup, { recursive: true, force: true });
+    });
+
+    it('should restore Library via atomic move', () => {
+      const libraryBackup = path.join('/cache/workspaces', 'TurnOfWar-Library');
+      const libraryDestination = path.join('/project', 'Library');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === libraryBackup) return true;
+        if (String(p) === libraryDestination) return false;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['ScriptAssemblies']);
+
+      const result = ChildWorkspaceService.restoreLibraryCache('/project', createConfig());
+
+      expect(result).toBe(true);
+      expect(mockFs.renameSync).toHaveBeenCalledWith(libraryBackup, libraryDestination);
+    });
+
+    it('should use custom libraryBackupPath when provided', () => {
+      const customBackup = '/custom/library/cache';
+      const libraryDestination = path.join('/project', 'Library');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === customBackup) return true;
+        if (String(p) === libraryDestination) return false;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['ScriptAssemblies']);
+
+      const config = createConfig({ libraryBackupPath: customBackup });
+      const result = ChildWorkspaceService.restoreLibraryCache('/project', config);
+
+      expect(result).toBe(true);
+      expect(mockFs.renameSync).toHaveBeenCalledWith(customBackup, libraryDestination);
+    });
+
+    it('should remove existing Library directory before restore', () => {
+      const libraryBackup = path.join('/cache/workspaces', 'TurnOfWar-Library');
+      const libraryDestination = path.join('/project', 'Library');
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        if (String(p) === libraryBackup) return true;
+        if (String(p) === libraryDestination) return true;
+
+        return false;
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['ScriptAssemblies']);
+
+      ChildWorkspaceService.restoreLibraryCache('/project', createConfig());
+
+      expect(mockFs.rmSync).toHaveBeenCalledWith(libraryDestination, { recursive: true, force: true });
+    });
+  });
+
+  describe('getWorkspaceSize', () => {
+    it('should return "0 B" for non-existent directory', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = ChildWorkspaceService.getWorkspaceSize('/nonexistent');
+
+      expect(result).toBe('0 B');
+    });
+
+    it('should calculate and format directory size', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([
+        { name: 'file1.txt', isDirectory: () => false, isFile: () => true },
+        { name: 'file2.bin', isDirectory: () => false, isFile: () => true },
+      ]);
+      (mockFs.statSync as jest.Mock).mockReturnValue({ size: 1024 * 1024 }); // 1 MB each
+
+      const result = ChildWorkspaceService.getWorkspaceSize('/workspace');
+
+      expect(result).toBe('2.00 MB');
+    });
+
+    it('should return "unknown" when existsSync throws', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      const result = ChildWorkspaceService.getWorkspaceSize('/workspace');
+
+      expect(result).toBe('unknown');
+    });
+
+    it('should recurse into subdirectories', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      let callCount = 0;
+      (mockFs.readdirSync as jest.Mock).mockImplementation(() => {
+        callCount++;
+        if (callCount === 1) {
+          return [
+            { name: 'subdir', isDirectory: () => true, isFile: () => false },
+            { name: 'root.txt', isDirectory: () => false, isFile: () => true },
+          ];
+        }
+
+        return [{ name: 'nested.txt', isDirectory: () => false, isFile: () => true }];
+      });
+      (mockFs.statSync as jest.Mock).mockReturnValue({ size: 512 });
+
+      const result = ChildWorkspaceService.getWorkspaceSize('/workspace');
+
+      expect(result).toBe('1.00 KB');
+    });
+  });
+
+  describe('cleanStaleWorkspaces', () => {
+    it('should skip when cache root does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      ChildWorkspaceService.cleanStaleWorkspaces('/nonexistent', 7);
+
+      expect(mockFs.readdirSync).not.toHaveBeenCalled();
+    });
+
+    it('should remove workspaces older than retention period', () => {
+      const now = Date.now();
+      const tenDaysAgo = now - 10 * 24 * 60 * 60 * 1000;
+      const oneDayAgo = now - 1 * 24 * 60 * 60 * 1000;
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockImplementation((directoryPath: string) => {
+        if (String(directoryPath) === '/cache') {
+          return ['old-workspace', 'recent-workspace'];
+        }
+
+        return [];
+      });
+      (mockFs.statSync as jest.Mock).mockImplementation((filePath: string) => ({
+        isDirectory: () => true,
+        mtimeMs: String(filePath).includes('old') ? tenDaysAgo : oneDayAgo,
+        size: 0,
+      }));
+
+      ChildWorkspaceService.cleanStaleWorkspaces('/cache', 7);
+
+      expect(mockFs.rmSync).toHaveBeenCalledTimes(1);
+      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/cache', 'old-workspace'), {
+        recursive: true,
+        force: true,
+      });
+    });
+
+    it('should not remove workspaces newer than retention period', () => {
+      const oneDayAgo = Date.now() - 1 * 24 * 60 * 60 * 1000;
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['recent-workspace']);
+      (mockFs.statSync as jest.Mock).mockReturnValue({
+        isDirectory: () => true,
+        mtimeMs: oneDayAgo,
+      });
+
+      ChildWorkspaceService.cleanStaleWorkspaces('/cache', 7);
+
+      expect(mockFs.rmSync).not.toHaveBeenCalled();
+    });
+
+    it('should handle errors during cleanup gracefully', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['broken-workspace']);
+      (mockFs.statSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Access denied');
+      });
+
+      // Should not throw
+      ChildWorkspaceService.cleanStaleWorkspaces('/cache', 7);
+    });
+  });
+
+  describe('buildConfig', () => {
+    it('should build config from build parameters', () => {
+      const config = ChildWorkspaceService.buildConfig({
+        childWorkspacesEnabled: true,
+        childWorkspaceName: 'Shell',
+        childWorkspaceCacheRoot: '/d/cache',
+        childWorkspacePreserveGit: false,
+        childWorkspaceSeparateLibrary: true,
+      });
+
+      expect(config).toEqual({
+        enabled: true,
+        workspaceName: 'Shell',
+        parentCacheRoot: '/d/cache',
+        preserveGitDirectory: false,
+        separateLibraryCache: true,
+      });
+    });
+
+    it('should build config with defaults from disabled state', () => {
+      const config = ChildWorkspaceService.buildConfig({
+        childWorkspacesEnabled: false,
+        childWorkspaceName: '',
+        childWorkspaceCacheRoot: '',
+        childWorkspacePreserveGit: true,
+        childWorkspaceSeparateLibrary: true,
+      });
+
+      expect(config.enabled).toBe(false);
+    });
+  });
+});

src/model/orchestrator/services/cache/child-workspace-service.ts

@@ -0,0 +1,373 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+export interface ChildWorkspaceConfig {
+  enabled: boolean;
+
+  /** Name for this child workspace, used as cache key (e.g., "TurnOfWar", "Shell") */
+  workspaceName: string;
+
+  /** Parent directory for cached child workspaces. Should be on same NTFS volume for O(1) restore. */
+  parentCacheRoot: string;
+
+  /** Keep .git directory in cached workspace for delta operations (default: true) */
+  preserveGitDirectory: boolean;
+
+  /** Cache Library/ independently from workspace (default: true) */
+  separateLibraryCache: boolean;
+
+  /** Override location for Library cache. Defaults to parentCacheRoot/<workspaceName>/Library-cache */
+  libraryBackupPath?: string;
+}
+
+/**
+ * Child workspace isolation service for enterprise-scale CI builds.
+ *
+ * Instead of building in the git checkout directory, this service:
+ * 1. Keeps the root workspace lean (no LFS files in the checkout dir)
+ * 2. Creates isolated child workspaces per product/build-target
+ * 3. Each child workspace gets its own submodule profile, LFS hydration, and Library folder
+ * 4. After build, the child workspace (.git preserved) is moved to a parent-level backup directory
+ * 5. On next CI run, the child workspace is restored via atomic filesystem move (O(1) on NTFS)
+ * 6. Library folders are cached separately for independent restore
+ *
+ * This is orders of magnitude faster than actions/cache for 50GB+ workspaces.
+ */
+export class ChildWorkspaceService {
+  /**
+   * Initialize child workspace by restoring from cache if available.
+   * Uses atomic filesystem move (rename) for O(1) restore on same volume.
+   *
+   * @param projectPath - Target path where the workspace should live during build
+   * @param config - Child workspace configuration
+   * @returns true if restored from cache, false if starting fresh
+   */
+  static initializeWorkspace(projectPath: string, config: ChildWorkspaceConfig): boolean {
+    const cachedWorkspacePath = path.join(config.parentCacheRoot, config.workspaceName);
+
+    try {
+      if (!fs.existsSync(cachedWorkspacePath)) {
+        OrchestratorLogger.log(`[ChildWorkspace] No cached workspace found at ${cachedWorkspacePath}, starting fresh`);
+
+        return false;
+      }
+
+      // Verify the cached workspace has content
+      const entries = fs.readdirSync(cachedWorkspacePath);
+      if (entries.length === 0) {
+        OrchestratorLogger.log(`[ChildWorkspace] Cached workspace at ${cachedWorkspacePath} is empty, starting fresh`);
+        fs.rmSync(cachedWorkspacePath, { recursive: true, force: true });
+
+        return false;
+      }
+
+      // If the target path already exists, remove it to make way for the move
+      if (fs.existsSync(projectPath)) {
+        OrchestratorLogger.log(`[ChildWorkspace] Removing existing target path: ${projectPath}`);
+        fs.rmSync(projectPath, { recursive: true, force: true });
+      }
+
+      // Ensure parent directory of project path exists
+      const parentDirectory = path.dirname(projectPath);
+      if (!fs.existsSync(parentDirectory)) {
+        fs.mkdirSync(parentDirectory, { recursive: true });
+      }
+
+      // Atomic move (rename) - O(1) on NTFS when on same volume
+      OrchestratorLogger.log(`[ChildWorkspace] Restoring workspace: ${cachedWorkspacePath} -> ${projectPath}`);
+      fs.renameSync(cachedWorkspacePath, projectPath);
+      OrchestratorLogger.log(`[ChildWorkspace] Workspace restored via atomic move`);
+
+      // Restore Library cache separately if configured
+      if (config.separateLibraryCache) {
+        ChildWorkspaceService.restoreLibraryCache(projectPath, config);
+      }
+
+      return true;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Workspace restore failed: ${error.message}. Starting fresh.`);
+
+      return false;
+    }
+  }
+
+  /**
+   * Save child workspace after build for reuse on next CI run.
+   * Moves the entire workspace to the cache directory via atomic filesystem move.
+   *
+   * @param projectPath - Path to the workspace to save
+   * @param config - Child workspace configuration
+   */
+  static saveWorkspace(projectPath: string, config: ChildWorkspaceConfig): void {
+    const cachedWorkspacePath = path.join(config.parentCacheRoot, config.workspaceName);
+
+    try {
+      if (!fs.existsSync(projectPath)) {
+        OrchestratorLogger.log(`[ChildWorkspace] Project path ${projectPath} does not exist, skipping save`);
+
+        return;
+      }
+
+      // Remove .git directory if not preserving it (saves space but loses delta capability)
+      if (!config.preserveGitDirectory) {
+        const gitDirectory = path.join(projectPath, '.git');
+        if (fs.existsSync(gitDirectory)) {
+          OrchestratorLogger.log(`[ChildWorkspace] Removing .git directory (preserveGit=false)`);
+          fs.rmSync(gitDirectory, { recursive: true, force: true });
+        }
+      }
+
+      // If separateLibraryCache, move Library/ to its own backup path before saving workspace
+      if (config.separateLibraryCache) {
+        ChildWorkspaceService.saveLibraryCache(projectPath, config);
+      }
+
+      // Ensure parent cache root exists
+      if (!fs.existsSync(config.parentCacheRoot)) {
+        fs.mkdirSync(config.parentCacheRoot, { recursive: true });
+      }
+
+      // Remove any existing cached workspace to make room
+      if (fs.existsSync(cachedWorkspacePath)) {
+        OrchestratorLogger.log(`[ChildWorkspace] Removing previous cached workspace: ${cachedWorkspacePath}`);
+        fs.rmSync(cachedWorkspacePath, { recursive: true, force: true });
+      }
+
+      // Atomic move (rename) - O(1) on NTFS when on same volume
+      OrchestratorLogger.log(`[ChildWorkspace] Saving workspace: ${projectPath} -> ${cachedWorkspacePath}`);
+      fs.renameSync(projectPath, cachedWorkspacePath);
+      OrchestratorLogger.log(`[ChildWorkspace] Workspace saved via atomic move`);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Workspace save failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Restore Library folder from separate cache location.
+   *
+   * @param projectPath - Path to the workspace where Library should be restored
+   * @param config - Child workspace configuration
+   * @returns true if Library was restored from cache
+   */
+  static restoreLibraryCache(projectPath: string, config: ChildWorkspaceConfig): boolean {
+    const libraryBackup = ChildWorkspaceService.resolveLibraryBackupPath(config);
+    const libraryDestination = path.join(projectPath, 'Library');
+
+    try {
+      if (!fs.existsSync(libraryBackup)) {
+        OrchestratorLogger.log(`[ChildWorkspace] No Library cache found at ${libraryBackup}`);
+
+        return false;
+      }
+
+      const entries = fs.readdirSync(libraryBackup);
+      if (entries.length === 0) {
+        OrchestratorLogger.log(`[ChildWorkspace] Library cache at ${libraryBackup} is empty`);
+        fs.rmSync(libraryBackup, { recursive: true, force: true });
+
+        return false;
+      }
+
+      // Remove existing Library directory if present
+      if (fs.existsSync(libraryDestination)) {
+        fs.rmSync(libraryDestination, { recursive: true, force: true });
+      }
+
+      // Atomic move
+      OrchestratorLogger.log(`[ChildWorkspace] Restoring Library cache: ${libraryBackup} -> ${libraryDestination}`);
+      fs.renameSync(libraryBackup, libraryDestination);
+      OrchestratorLogger.log(`[ChildWorkspace] Library cache restored`);
+
+      return true;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Library cache restore failed: ${error.message}`);
+
+      return false;
+    }
+  }
+
+  /**
+   * Save Library folder to a separate cache location for independent restore.
+   * Moves Library/ out of the workspace before workspace save.
+   *
+   * @param projectPath - Path to the workspace containing Library/
+   * @param config - Child workspace configuration
+   */
+  private static saveLibraryCache(projectPath: string, config: ChildWorkspaceConfig): void {
+    const libraryPath = path.join(projectPath, 'Library');
+    const libraryBackup = ChildWorkspaceService.resolveLibraryBackupPath(config);
+
+    try {
+      if (!fs.existsSync(libraryPath)) {
+        OrchestratorLogger.log(`[ChildWorkspace] No Library folder to cache`);
+
+        return;
+      }
+
+      const entries = fs.readdirSync(libraryPath);
+      if (entries.length === 0) {
+        OrchestratorLogger.log(`[ChildWorkspace] Library folder is empty, skipping cache`);
+
+        return;
+      }
+
+      // Ensure parent of backup path exists
+      const backupParent = path.dirname(libraryBackup);
+      if (!fs.existsSync(backupParent)) {
+        fs.mkdirSync(backupParent, { recursive: true });
+      }
+
+      // Remove existing Library backup
+      if (fs.existsSync(libraryBackup)) {
+        fs.rmSync(libraryBackup, { recursive: true, force: true });
+      }
+
+      // Atomic move
+      OrchestratorLogger.log(`[ChildWorkspace] Caching Library: ${libraryPath} -> ${libraryBackup}`);
+      fs.renameSync(libraryPath, libraryBackup);
+      OrchestratorLogger.log(`[ChildWorkspace] Library cached separately`);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Library cache save failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Calculate the total size of a directory in human-readable format.
+   *
+   * @param directoryPath - Path to the directory to measure
+   * @returns Human-readable size string (e.g., "1.23 GB", "456.78 MB")
+   */
+  static getWorkspaceSize(directoryPath: string): string {
+    try {
+      if (!fs.existsSync(directoryPath)) {
+        return '0 B';
+      }
+
+      const totalBytes = ChildWorkspaceService.calculateDirectorySize(directoryPath);
+
+      return ChildWorkspaceService.formatBytes(totalBytes);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Failed to calculate workspace size: ${error.message}`);
+
+      return 'unknown';
+    }
+  }
+
+  /**
+   * Clean stale child workspaces that haven't been used within the retention period.
+   *
+   * @param parentCacheRoot - Root directory containing cached workspaces
+   * @param retentionDays - Maximum age in days before a workspace is considered stale
+   */
+  static cleanStaleWorkspaces(parentCacheRoot: string, retentionDays: number): void {
+    try {
+      if (!fs.existsSync(parentCacheRoot)) {
+        OrchestratorLogger.log(`[ChildWorkspace] Cache root ${parentCacheRoot} does not exist, nothing to clean`);
+
+        return;
+      }
+
+      const now = Date.now();
+      const maxAgeMs = retentionDays * 24 * 60 * 60 * 1000;
+      const entries = fs.readdirSync(parentCacheRoot);
+      let removedCount = 0;
+      let freedBytes = 0;
+
+      for (const entry of entries) {
+        const entryPath = path.join(parentCacheRoot, entry);
+        try {
+          const stat = fs.statSync(entryPath);
+          if (stat.isDirectory() && now - stat.mtimeMs > maxAgeMs) {
+            const size = ChildWorkspaceService.calculateDirectorySize(entryPath);
+            fs.rmSync(entryPath, { recursive: true, force: true });
+            removedCount++;
+            freedBytes += size;
+            OrchestratorLogger.log(
+              `[ChildWorkspace] Cleaned stale workspace: ${entry} (age: ${Math.floor(
+                (now - stat.mtimeMs) / (24 * 60 * 60 * 1000),
+              )} days)`,
+            );
+          }
+        } catch (error: any) {
+          OrchestratorLogger.logWarning(`[ChildWorkspace] Failed to clean ${entryPath}: ${error.message}`);
+        }
+      }
+
+      OrchestratorLogger.log(
+        `[ChildWorkspace] Cleanup complete: ${removedCount} stale workspaces removed, ${ChildWorkspaceService.formatBytes(
+          freedBytes,
+        )} freed`,
+      );
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[ChildWorkspace] Stale workspace cleanup failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Build a ChildWorkspaceConfig from build parameters and action inputs.
+   */
+  static buildConfig(parameters: {
+    childWorkspacesEnabled: boolean;
+    childWorkspaceName: string;
+    childWorkspaceCacheRoot: string;
+    childWorkspacePreserveGit: boolean;
+    childWorkspaceSeparateLibrary: boolean;
+  }): ChildWorkspaceConfig {
+    return {
+      enabled: parameters.childWorkspacesEnabled,
+      workspaceName: parameters.childWorkspaceName,
+      parentCacheRoot: parameters.childWorkspaceCacheRoot,
+      preserveGitDirectory: parameters.childWorkspacePreserveGit,
+      separateLibraryCache: parameters.childWorkspaceSeparateLibrary,
+    };
+  }
+
+  /**
+   * Resolve the Library backup path from config, using a default if not overridden.
+   */
+  private static resolveLibraryBackupPath(config: ChildWorkspaceConfig): string {
+    if (config.libraryBackupPath) {
+      return config.libraryBackupPath;
+    }
+
+    return path.join(config.parentCacheRoot, `${config.workspaceName}-Library`);
+  }
+
+  /**
+   * Recursively calculate total size of a directory in bytes.
+   */
+  private static calculateDirectorySize(directoryPath: string): number {
+    let totalSize = 0;
+
+    try {
+      const entries = fs.readdirSync(directoryPath, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(directoryPath, entry.name);
+        if (entry.isDirectory()) {
+          totalSize += ChildWorkspaceService.calculateDirectorySize(fullPath);
+        } else if (entry.isFile()) {
+          totalSize += fs.statSync(fullPath).size;
+        }
+      }
+    } catch {
+      // Permission errors or race conditions — return what we have
+    }
+
+    return totalSize;
+  }
+
+  /**
+   * Format bytes into human-readable string.
+   */
+  private static formatBytes(bytes: number): string {
+    if (bytes === 0) return '0 B';
+
+    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const k = 1024;
+    const index = Math.floor(Math.log(bytes) / Math.log(k));
+    const value = bytes / Math.pow(k, index);
+
+    return `${value.toFixed(2)} ${units[index]}`;
+  }
+}

src/model/orchestrator/services/cache/local-cache-service.test.ts

@@ -0,0 +1,272 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { LocalCacheService } from './local-cache-service';
+
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('LocalCacheService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('generateCacheKey', () => {
+    it('should generate a key from platform, version, and branch', () => {
+      const key = LocalCacheService.generateCacheKey('StandaloneLinux64', '2021.3.1f1', 'main');
+      expect(key).toBe('StandaloneLinux64-2021_3_1f1-main');
+    });
+
+    it('should sanitize non-alphanumeric characters except hyphens', () => {
+      const key = LocalCacheService.generateCacheKey('WebGL', '2022.3.0f1', 'feature/my-branch');
+      expect(key).toBe('WebGL-2022_3_0f1-feature_my-branch');
+    });
+
+    it('should handle empty branch', () => {
+      const key = LocalCacheService.generateCacheKey('StandaloneWindows64', '2021.3.1f1', '');
+      expect(key).toBe('StandaloneWindows64-2021_3_1f1-');
+    });
+
+    it('should handle dots in version string', () => {
+      const key = LocalCacheService.generateCacheKey('Android', '6000.0.23f1', 'main');
+      expect(key).toBe('Android-6000_0_23f1-main');
+    });
+
+    it('should preserve hyphens in platform names', () => {
+      const key = LocalCacheService.generateCacheKey('Standalone-Linux64', '2021.3.1f1', 'main');
+      expect(key).toBe('Standalone-Linux64-2021_3_1f1-main');
+    });
+  });
+
+  describe('resolveCacheRoot', () => {
+    const originalEnv = process.env;
+
+    beforeEach(() => {
+      process.env = { ...originalEnv };
+    });
+
+    afterEach(() => {
+      process.env = originalEnv;
+    });
+
+    it('should use localCacheRoot when set', () => {
+      const result = LocalCacheService.resolveCacheRoot({ localCacheRoot: '/custom/cache' });
+      expect(result).toBe('/custom/cache');
+    });
+
+    it('should use RUNNER_TEMP when localCacheRoot is empty', () => {
+      process.env.RUNNER_TEMP = '/tmp/runner';
+      const result = LocalCacheService.resolveCacheRoot({ localCacheRoot: '' });
+      expect(result).toBe(path.join('/tmp/runner', 'game-ci-cache'));
+    });
+
+    it('should fall back to .game-ci/cache when neither is set', () => {
+      delete process.env.RUNNER_TEMP;
+      const result = LocalCacheService.resolveCacheRoot({ localCacheRoot: '' });
+      expect(result).toBe(path.join(process.cwd(), '.game-ci', 'cache'));
+    });
+  });
+
+  describe('restoreLibraryCache', () => {
+    it('should return false on cache miss (directory does not exist)', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const result = await LocalCacheService.restoreLibraryCache('/project', '/cache', 'key1');
+      expect(result).toBe(false);
+    });
+
+    it('should return false when cache directory has no tar files', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['readme.txt', 'info.json']);
+      const result = await LocalCacheService.restoreLibraryCache('/project', '/cache', 'key1');
+      expect(result).toBe(false);
+    });
+
+    it('should restore from the latest tar file on cache hit', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['lib-1000.tar', 'lib-2000.tar']);
+      (mockFs.statSync as jest.Mock).mockImplementation((filePath: string) => ({
+        mtimeMs: String(filePath).includes('lib-2000') ? 2000 : 1000,
+      }));
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      const result = await LocalCacheService.restoreLibraryCache('/project', '/cache', 'key1');
+
+      expect(result).toBe(true);
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('lib-2000.tar'), true);
+    });
+
+    it('should return false and log warning on error', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      const result = await LocalCacheService.restoreLibraryCache('/project', '/cache', 'key1');
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('saveLibraryCache', () => {
+    it('should skip save when Library folder does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      await LocalCacheService.saveLibraryCache('/project', '/cache', 'key1');
+      expect(mockFs.mkdirSync).not.toHaveBeenCalled();
+    });
+
+    it('should skip save when Library folder is empty', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([]);
+      await LocalCacheService.saveLibraryCache('/project', '/cache', 'key1');
+      expect(mockFs.mkdirSync).not.toHaveBeenCalled();
+    });
+
+    it('should create cache directory and save tar', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockImplementation((dirPath: string) => {
+        if (String(dirPath).includes('Library') && !String(dirPath).includes('cache')) {
+          return ['file1.asset', 'file2.asset'];
+        }
+        return [];
+      });
+      (mockFs.statSync as jest.Mock).mockReturnValue({ mtimeMs: Date.now() });
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      await LocalCacheService.saveLibraryCache('/project', '/cache', 'key1');
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith(path.join('/cache', 'key1', 'Library'), { recursive: true });
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('tar -cf'), true);
+    });
+  });
+
+  describe('restoreLfsCache', () => {
+    it('should return false on cache miss', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const result = await LocalCacheService.restoreLfsCache('/repo', '/cache', 'key1');
+      expect(result).toBe(false);
+    });
+
+    it('should return false when no tar files exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['readme.txt']);
+      const result = await LocalCacheService.restoreLfsCache('/repo', '/cache', 'key1');
+      expect(result).toBe(false);
+    });
+
+    it('should restore from latest tar on hit', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['lfs-100.tar', 'lfs-200.tar']);
+      (mockFs.statSync as jest.Mock).mockImplementation((filePath: string) => ({
+        mtimeMs: String(filePath).includes('lfs-200') ? 200 : 100,
+      }));
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const result = await LocalCacheService.restoreLfsCache('/repo', '/cache', 'key1');
+
+      expect(result).toBe(true);
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('lfs-200.tar'), true);
+    });
+  });
+
+  describe('saveLfsCache', () => {
+    it('should skip when .git/lfs does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      await LocalCacheService.saveLfsCache('/repo', '/cache', 'key1');
+      expect(mockFs.mkdirSync).not.toHaveBeenCalled();
+    });
+
+    it('should skip when .git/lfs is empty', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([]);
+      await LocalCacheService.saveLfsCache('/repo', '/cache', 'key1');
+      expect(mockFs.mkdirSync).not.toHaveBeenCalled();
+    });
+
+    it('should create cache directory and save tar when lfs has content', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockImplementation((dirPath: string) => {
+        if (String(dirPath).includes('lfs') && !String(dirPath).includes('cache')) {
+          return ['objects', 'tmp'];
+        }
+        return [];
+      });
+      (mockFs.statSync as jest.Mock).mockReturnValue({ mtimeMs: Date.now() });
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      await LocalCacheService.saveLfsCache('/repo', '/cache', 'key1');
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith(path.join('/cache', 'key1', 'lfs'), { recursive: true });
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('tar -cf'), true);
+    });
+
+    it('should handle save errors gracefully', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Disk full');
+      });
+
+      // Should not throw
+      await LocalCacheService.saveLfsCache('/repo', '/cache', 'key1');
+    });
+  });
+
+  describe('garbageCollect', () => {
+    it('should skip when cache root does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      await LocalCacheService.garbageCollect('/nonexistent');
+    });
+
+    it('should remove directories older than maxAgeDays', async () => {
+      const now = Date.now();
+      const eightDaysAgo = now - 8 * 24 * 60 * 60 * 1000;
+      const oneDayAgo = now - 1 * 24 * 60 * 60 * 1000;
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['old-cache', 'recent-cache']);
+      (mockFs.statSync as jest.Mock).mockImplementation((filePath: string) => ({
+        isDirectory: () => true,
+        mtimeMs: String(filePath).includes('old') ? eightDaysAgo : oneDayAgo,
+      }));
+      (mockFs.rmSync as jest.Mock).mockReturnValue(undefined);
+
+      await LocalCacheService.garbageCollect('/cache', 7);
+
+      expect(mockFs.rmSync).toHaveBeenCalledTimes(1);
+      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/cache', 'old-cache'), { recursive: true, force: true });
+    });
+
+    it('should not remove directories newer than maxAgeDays', async () => {
+      const oneDayAgo = Date.now() - 1 * 24 * 60 * 60 * 1000;
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['recent-cache']);
+      (mockFs.statSync as jest.Mock).mockReturnValue({
+        isDirectory: () => true,
+        mtimeMs: oneDayAgo,
+      });
+
+      await LocalCacheService.garbageCollect('/cache', 7);
+
+      expect(mockFs.rmSync).not.toHaveBeenCalled();
+    });
+  });
+});

src/model/orchestrator/services/cache/local-cache-service.ts

@@ -0,0 +1,273 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+export class LocalCacheService {
+  /**
+   * Resolve the cache root directory based on build parameters and environment.
+   * Priority: localCacheRoot > RUNNER_TEMP/game-ci-cache > .game-ci/cache
+   */
+  static resolveCacheRoot(buildParameters: { localCacheRoot: string }): string {
+    if (buildParameters.localCacheRoot) {
+      return buildParameters.localCacheRoot;
+    }
+
+    if (process.env.RUNNER_TEMP) {
+      return path.join(process.env.RUNNER_TEMP, 'game-ci-cache');
+    }
+
+    return path.join(process.cwd(), '.game-ci', 'cache');
+  }
+
+  /**
+   * Generate a sanitized cache key from build parameters.
+   * Non-alphanumeric characters (except hyphens) are replaced with underscores.
+   */
+  static generateCacheKey(targetPlatform: string, unityVersion: string, branch: string): string {
+    const raw = `${targetPlatform}-${unityVersion}-${branch}`;
+
+    return raw.replace(/[^a-zA-Z0-9-]/g, '_');
+  }
+
+  /**
+   * Restore Unity Library cache from the local filesystem.
+   * Returns true if cache was restored, false on cache miss.
+   */
+  static async restoreLibraryCache(projectPath: string, cacheRoot: string, cacheKey: string): Promise<boolean> {
+    const cachePath = path.join(cacheRoot, cacheKey, 'Library');
+
+    try {
+      if (!fs.existsSync(cachePath)) {
+        OrchestratorLogger.log(`[LocalCache] Library cache miss: ${cachePath}`);
+
+        return false;
+      }
+
+      const files = fs.readdirSync(cachePath).filter((f) => f.endsWith('.tar'));
+      if (files.length === 0) {
+        OrchestratorLogger.log(`[LocalCache] Library cache miss (no tar files): ${cachePath}`);
+
+        return false;
+      }
+
+      // Find the latest tar file by modification time
+      let latestFile = files[0];
+      let latestMtime = fs.statSync(path.join(cachePath, files[0])).mtimeMs;
+      for (let i = 1; i < files.length; i++) {
+        const mtime = fs.statSync(path.join(cachePath, files[i])).mtimeMs;
+        if (mtime > latestMtime) {
+          latestMtime = mtime;
+          latestFile = files[i];
+        }
+      }
+
+      const tarPath = path.join(cachePath, latestFile);
+      const libraryDest = path.join(projectPath, 'Library');
+
+      // Ensure destination exists
+      fs.mkdirSync(libraryDest, { recursive: true });
+
+      OrchestratorLogger.log(`[LocalCache] Library cache hit: restoring from ${tarPath}`);
+      await OrchestratorSystem.Run(`tar -xf "${tarPath}" -C "${projectPath}"`, true);
+      OrchestratorLogger.log(`[LocalCache] Library cache restored successfully`);
+
+      return true;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] Library cache restore failed: ${error.message}`);
+
+      return false;
+    }
+  }
+
+  /**
+   * Save Unity Library folder to the local cache as a tar archive.
+   * Keeps only the latest 2 cache entries.
+   */
+  static async saveLibraryCache(projectPath: string, cacheRoot: string, cacheKey: string): Promise<void> {
+    const libraryPath = path.join(projectPath, 'Library');
+
+    try {
+      if (!fs.existsSync(libraryPath)) {
+        OrchestratorLogger.log(`[LocalCache] Library folder does not exist, skipping save`);
+
+        return;
+      }
+
+      const entries = fs.readdirSync(libraryPath);
+      if (entries.length === 0) {
+        OrchestratorLogger.log(`[LocalCache] Library folder is empty, skipping save`);
+
+        return;
+      }
+
+      const cachePath = path.join(cacheRoot, cacheKey, 'Library');
+      fs.mkdirSync(cachePath, { recursive: true });
+
+      const timestamp = Date.now();
+      const tarName = `lib-${timestamp}.tar`;
+      const tarPath = path.join(cachePath, tarName);
+
+      OrchestratorLogger.log(`[LocalCache] Saving Library cache to ${tarPath}`);
+      await OrchestratorSystem.Run(`tar -cf "${tarPath}" -C "${projectPath}" Library`, true);
+      OrchestratorLogger.log(`[LocalCache] Library cache saved successfully`);
+
+      // Clean up old entries - keep latest 2
+      await LocalCacheService.cleanupOldEntries(cachePath, 2);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] Library cache save failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Restore LFS cache from the local filesystem.
+   * Returns true if cache was restored, false on cache miss.
+   */
+  static async restoreLfsCache(repoPath: string, cacheRoot: string, cacheKey: string): Promise<boolean> {
+    const cachePath = path.join(cacheRoot, cacheKey, 'lfs');
+
+    try {
+      if (!fs.existsSync(cachePath)) {
+        OrchestratorLogger.log(`[LocalCache] LFS cache miss: ${cachePath}`);
+
+        return false;
+      }
+
+      const files = fs.readdirSync(cachePath).filter((f) => f.endsWith('.tar'));
+      if (files.length === 0) {
+        OrchestratorLogger.log(`[LocalCache] LFS cache miss (no tar files): ${cachePath}`);
+
+        return false;
+      }
+
+      // Find the latest tar file by modification time
+      let latestFile = files[0];
+      let latestMtime = fs.statSync(path.join(cachePath, files[0])).mtimeMs;
+      for (let i = 1; i < files.length; i++) {
+        const mtime = fs.statSync(path.join(cachePath, files[i])).mtimeMs;
+        if (mtime > latestMtime) {
+          latestMtime = mtime;
+          latestFile = files[i];
+        }
+      }
+
+      const tarPath = path.join(cachePath, latestFile);
+      const lfsDest = path.join(repoPath, '.git', 'lfs');
+
+      // Ensure destination exists
+      fs.mkdirSync(lfsDest, { recursive: true });
+
+      OrchestratorLogger.log(`[LocalCache] LFS cache hit: restoring from ${tarPath}`);
+      await OrchestratorSystem.Run(`tar -xf "${tarPath}" -C "${path.join(repoPath, '.git')}"`, true);
+      OrchestratorLogger.log(`[LocalCache] LFS cache restored successfully`);
+
+      return true;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] LFS cache restore failed: ${error.message}`);
+
+      return false;
+    }
+  }
+
+  /**
+   * Save .git/lfs folder to the local cache as a tar archive.
+   * Keeps only the latest 2 cache entries.
+   */
+  static async saveLfsCache(repoPath: string, cacheRoot: string, cacheKey: string): Promise<void> {
+    const lfsPath = path.join(repoPath, '.git', 'lfs');
+
+    try {
+      if (!fs.existsSync(lfsPath)) {
+        OrchestratorLogger.log(`[LocalCache] LFS folder does not exist, skipping save`);
+
+        return;
+      }
+
+      const entries = fs.readdirSync(lfsPath);
+      if (entries.length === 0) {
+        OrchestratorLogger.log(`[LocalCache] LFS folder is empty, skipping save`);
+
+        return;
+      }
+
+      const cachePath = path.join(cacheRoot, cacheKey, 'lfs');
+      fs.mkdirSync(cachePath, { recursive: true });
+
+      const timestamp = Date.now();
+      const tarName = `lfs-${timestamp}.tar`;
+      const tarPath = path.join(cachePath, tarName);
+
+      OrchestratorLogger.log(`[LocalCache] Saving LFS cache to ${tarPath}`);
+      await OrchestratorSystem.Run(`tar -cf "${tarPath}" -C "${path.join(repoPath, '.git')}" lfs`, true);
+      OrchestratorLogger.log(`[LocalCache] LFS cache saved successfully`);
+
+      // Clean up old entries - keep latest 2
+      await LocalCacheService.cleanupOldEntries(cachePath, 2);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] LFS cache save failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Remove cache entries older than maxAgeDays from the cache root.
+   */
+  static async garbageCollect(cacheRoot: string, maxAgeDays: number = 7): Promise<void> {
+    try {
+      if (!fs.existsSync(cacheRoot)) {
+        OrchestratorLogger.log(`[LocalCache] Cache root does not exist, nothing to collect`);
+
+        return;
+      }
+
+      const now = Date.now();
+      const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1000;
+      const entries = fs.readdirSync(cacheRoot);
+      let removedCount = 0;
+
+      for (const entry of entries) {
+        const entryPath = path.join(cacheRoot, entry);
+        try {
+          const stat = fs.statSync(entryPath);
+          if (stat.isDirectory() && now - stat.mtimeMs > maxAgeMs) {
+            fs.rmSync(entryPath, { recursive: true, force: true });
+            removedCount++;
+            OrchestratorLogger.log(`[LocalCache] Garbage collected: ${entryPath}`);
+          }
+        } catch (error: any) {
+          OrchestratorLogger.logWarning(`[LocalCache] Failed to garbage collect ${entryPath}: ${error.message}`);
+        }
+      }
+
+      OrchestratorLogger.log(`[LocalCache] Garbage collection complete: ${removedCount} entries removed`);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] Garbage collection failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Clean up old tar files in a cache directory, keeping only the latest N.
+   */
+  private static async cleanupOldEntries(cachePath: string, keepCount: number): Promise<void> {
+    try {
+      const files = fs
+        .readdirSync(cachePath)
+        .filter((f) => f.endsWith('.tar'))
+        .map((f) => ({
+          name: f,
+          mtime: fs.statSync(path.join(cachePath, f)).mtimeMs,
+        }))
+        .sort((a, b) => b.mtime - a.mtime);
+
+      if (files.length > keepCount) {
+        const toRemove = files.slice(keepCount);
+        for (const file of toRemove) {
+          const filePath = path.join(cachePath, file.name);
+          fs.unlinkSync(filePath);
+          OrchestratorLogger.log(`[LocalCache] Cleaned up old cache entry: ${filePath}`);
+        }
+      }
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[LocalCache] Cleanup of old entries failed: ${error.message}`);
+    }
+  }
+}

src/model/orchestrator/services/core/follow-log-stream-service.test.ts

@@ -0,0 +1,147 @@
+import { FollowLogStreamService } from './follow-log-stream-service';
+import * as core from '@actions/core';
+import GitHub from '../../../github';
+
+// Mock dependencies
+jest.mock('../../../github', () => ({
+  __esModule: true,
+  default: {
+    updateGitHubCheck: jest.fn(),
+    githubInputEnabled: false,
+  },
+}));
+
+jest.mock('@actions/core', () => ({
+  warning: jest.fn(),
+  setOutput: jest.fn(),
+  setFailed: jest.fn(),
+  error: jest.fn(),
+  getInput: jest.fn().mockReturnValue(''),
+}));
+
+jest.mock('../../orchestrator', () => ({
+  __esModule: true,
+  default: {
+    buildParameters: {
+      logId: 'test-log-id-123',
+    },
+  },
+}));
+
+jest.mock('../../options/orchestrator-statics', () => ({
+  OrchestratorStatics: {
+    logPrefix: 'TEST',
+  },
+}));
+
+jest.mock('./orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+  },
+}));
+
+describe('FollowLogStreamService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    FollowLogStreamService.Reset();
+    FollowLogStreamService.errors = '';
+  });
+
+  describe('Reset', () => {
+    it('resets DidReceiveEndOfTransmission to false', () => {
+      FollowLogStreamService.DidReceiveEndOfTransmission = true;
+      FollowLogStreamService.Reset();
+      expect(FollowLogStreamService.DidReceiveEndOfTransmission).toBe(false);
+    });
+  });
+
+  describe('handleIteration', () => {
+    it('detects end of transmission marker', () => {
+      const result = FollowLogStreamService.handleIteration('---test-log-id-123', true, false, '');
+      expect(FollowLogStreamService.DidReceiveEndOfTransmission).toBe(true);
+      expect(result.shouldReadLogs).toBe(false);
+    });
+
+    it('does not trigger end of transmission for non-matching log ID', () => {
+      const result = FollowLogStreamService.handleIteration('---different-log-id', true, false, '');
+      expect(FollowLogStreamService.DidReceiveEndOfTransmission).toBe(false);
+      expect(result.shouldReadLogs).toBe(true);
+    });
+
+    it('detects Library rebuild message', () => {
+      FollowLogStreamService.handleIteration(
+        'Rebuilding Library because the asset database could not be found!',
+        true,
+        false,
+        '',
+      );
+      expect(GitHub.updateGitHubCheck).toHaveBeenCalledWith('Library was not found, importing new Library', '');
+      expect(core.warning).toHaveBeenCalledWith('LIBRARY NOT FOUND!');
+      expect(core.setOutput).toHaveBeenCalledWith('library-found', 'false');
+    });
+
+    it('detects Build succeeded message', () => {
+      FollowLogStreamService.handleIteration('Build succeeded', true, false, '');
+      expect(GitHub.updateGitHubCheck).toHaveBeenCalledWith('Build succeeded', 'Build succeeded');
+      expect(core.setOutput).toHaveBeenCalledWith('build-result', 'success');
+    });
+
+    it('detects Build fail message', () => {
+      FollowLogStreamService.handleIteration('Build fail', true, false, '');
+      expect(GitHub.updateGitHubCheck).toHaveBeenCalled();
+      expect(core.setOutput).toHaveBeenCalledWith('build-result', 'failed');
+      expect(core.setFailed).toHaveBeenCalledWith('unity build failed');
+      expect(core.error).toHaveBeenCalledWith('BUILD FAILED!');
+    });
+
+    it('accumulates error messages with "error " pattern', () => {
+      FollowLogStreamService.handleIteration('error CS0001: Something went wrong', true, false, '');
+      expect(FollowLogStreamService.errors).toContain('error CS0001: Something went wrong');
+      expect(core.error).toHaveBeenCalled();
+    });
+
+    it('accumulates error messages with "error: " pattern', () => {
+      FollowLogStreamService.handleIteration('Fatal Error: Out of memory', true, false, '');
+      expect(FollowLogStreamService.errors).toContain('Fatal Error: Out of memory');
+    });
+
+    it('accumulates "command failed: " messages', () => {
+      FollowLogStreamService.handleIteration('command failed: git pull', true, false, '');
+      expect(FollowLogStreamService.errors).toContain('command failed: git pull');
+    });
+
+    it('accumulates "invalid " messages', () => {
+      FollowLogStreamService.handleIteration('invalid configuration value', true, false, '');
+      expect(FollowLogStreamService.errors).toContain('invalid configuration value');
+    });
+
+    it('accumulates "cannot be found" messages', () => {
+      FollowLogStreamService.handleIteration('Assembly cannot be found', true, false, '');
+      expect(FollowLogStreamService.errors).toContain('Assembly cannot be found');
+    });
+
+    it('appends message to output', () => {
+      const result = FollowLogStreamService.handleIteration('Some normal log line', true, false, 'previous output\n');
+      expect(result.output).toContain('Some normal log line');
+      expect(result.output).toContain('previous output');
+    });
+
+    it('preserves shouldCleanup value', () => {
+      const result = FollowLogStreamService.handleIteration('normal message', true, true, '');
+      expect(result.shouldCleanup).toBe(true);
+    });
+
+    it('does not change shouldReadLogs for normal messages', () => {
+      const result = FollowLogStreamService.handleIteration('Just a regular build log', true, false, '');
+      expect(result.shouldReadLogs).toBe(true);
+    });
+
+    it('includes accumulated errors in Build fail GitHub check message', () => {
+      FollowLogStreamService.errors = '\nprevious error';
+      FollowLogStreamService.handleIteration('Build fail', true, false, '');
+      const updateCall = (GitHub.updateGitHubCheck as jest.Mock).mock.calls[0];
+      expect(updateCall[0]).toContain('previous error');
+    });
+  });
+});

src/model/orchestrator/services/core/runner-availability-service.test.ts

@@ -0,0 +1,318 @@
+import { RunnerAvailabilityService } from './runner-availability-service';
+
+// Mock @octokit/core
+jest.mock('@octokit/core', () => ({
+  Octokit: jest.fn().mockImplementation(() => ({
+    request: jest.fn(),
+  })),
+}));
+
+jest.mock('./orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+import { Octokit } from '@octokit/core';
+
+const MockedOctokit = Octokit as jest.MockedClass<typeof Octokit>;
+
+function createMockRunners(runners: Array<{ name: string; status: string; busy: boolean; labels: string[] }>) {
+  return runners.map((r, i) => ({
+    id: i + 1,
+    name: r.name,
+    status: r.status,
+    busy: r.busy,
+    labels: r.labels.map((l) => ({ name: l })),
+  }));
+}
+
+describe('RunnerAvailabilityService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('checkAvailability', () => {
+    it('should skip check and not fallback when no token is provided', async () => {
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', '', [], 1);
+      expect(result.shouldFallback).toBe(false);
+      expect(result.reason).toContain('No GitHub token');
+    });
+
+    it('should fallback when no runners are registered', async () => {
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners: [] } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(true);
+      expect(result.reason).toContain('No runners registered');
+      expect(result.totalRunners).toBe(0);
+    });
+
+    it('should not fallback when enough idle runners are available', async () => {
+      const runners = createMockRunners([
+        { name: 'runner-1', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
+        { name: 'runner-2', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(false);
+      expect(result.idleRunners).toBe(2);
+      expect(result.totalRunners).toBe(2);
+    });
+
+    it('should fallback when all runners are busy', async () => {
+      const runners = createMockRunners([
+        { name: 'runner-1', status: 'online', busy: true, labels: ['self-hosted'] },
+        { name: 'runner-2', status: 'online', busy: true, labels: ['self-hosted'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(true);
+      expect(result.idleRunners).toBe(0);
+      expect(result.matchingRunners).toBe(2);
+    });
+
+    it('should fallback when all runners are offline', async () => {
+      const runners = createMockRunners([
+        { name: 'runner-1', status: 'offline', busy: false, labels: ['self-hosted'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(true);
+      expect(result.idleRunners).toBe(0);
+    });
+
+    it('should filter runners by required labels', async () => {
+      const runners = createMockRunners([
+        { name: 'linux-runner', status: 'online', busy: false, labels: ['self-hosted', 'linux'] },
+        { name: 'windows-runner', status: 'online', busy: false, labels: ['self-hosted', 'windows'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability(
+        'owner',
+        'repo',
+        'token',
+        ['self-hosted', 'linux'],
+        1,
+      );
+
+      expect(result.shouldFallback).toBe(false);
+      expect(result.matchingRunners).toBe(1);
+      expect(result.idleRunners).toBe(1);
+      expect(result.totalRunners).toBe(2);
+    });
+
+    it('should fallback when no runners match required labels', async () => {
+      const runners = createMockRunners([
+        { name: 'windows-runner', status: 'online', busy: false, labels: ['self-hosted', 'windows'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability(
+        'owner',
+        'repo',
+        'token',
+        ['self-hosted', 'linux'],
+        1,
+      );
+
+      expect(result.shouldFallback).toBe(true);
+      expect(result.matchingRunners).toBe(0);
+      expect(result.idleRunners).toBe(0);
+    });
+
+    it('should respect minAvailable threshold', async () => {
+      const runners = createMockRunners([{ name: 'runner-1', status: 'online', busy: false, labels: ['self-hosted'] }]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      // Need 2, have 1 — should fallback
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 2);
+      expect(result.shouldFallback).toBe(true);
+      expect(result.idleRunners).toBe(1);
+    });
+
+    it('should be case-insensitive for label matching', async () => {
+      const runners = createMockRunners([
+        { name: 'runner-1', status: 'online', busy: false, labels: ['Self-Hosted', 'Linux'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability(
+        'owner',
+        'repo',
+        'token',
+        ['self-hosted', 'linux'],
+        1,
+      );
+      expect(result.shouldFallback).toBe(false);
+      expect(result.matchingRunners).toBe(1);
+    });
+
+    it('should not fallback on API error (fail-open)', async () => {
+      const mockRequest = jest.fn().mockRejectedValue(new Error('403 Forbidden'));
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(false);
+      expect(result.reason).toContain('Runner check failed');
+    });
+
+    it('should count only online+idle runners', async () => {
+      const runners = createMockRunners([
+        { name: 'idle', status: 'online', busy: false, labels: ['self-hosted'] },
+        { name: 'busy', status: 'online', busy: true, labels: ['self-hosted'] },
+        { name: 'offline', status: 'offline', busy: false, labels: ['self-hosted'] },
+      ]);
+      const mockRequest = jest.fn().mockResolvedValue({ status: 200, data: { runners } });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+      expect(result.shouldFallback).toBe(false);
+      expect(result.totalRunners).toBe(3);
+      expect(result.matchingRunners).toBe(3);
+      expect(result.idleRunners).toBe(1);
+    });
+  });
+
+  describe('pagination limits', () => {
+    it('should stop paginating after reaching the page limit', async () => {
+      // Return full pages (100 runners each) to force continued pagination
+      let callCount = 0;
+      const mockRequest = jest.fn().mockImplementation(() => {
+        callCount++;
+        const runners = createMockRunners(
+          Array.from({ length: 100 }, (_, i) => ({
+            name: `runner-${callCount}-${i}`,
+            status: 'online' as const,
+            busy: false,
+            labels: ['self-hosted'],
+          })),
+        );
+
+        return Promise.resolve({ status: 200, data: { runners } });
+      });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+
+      // Should have called at most 100 pages (the MAX_PAGINATION_PAGES limit)
+      expect(mockRequest).toHaveBeenCalledTimes(100);
+      // Should still have runners from the pages it did fetch
+      expect(result.totalRunners).toBe(10000);
+      expect(result.shouldFallback).toBe(false);
+    });
+
+    it('should stop paginating on rate limit (HTTP 403)', async () => {
+      let callCount = 0;
+      const mockRequest = jest.fn().mockImplementation(() => {
+        callCount++;
+        if (callCount === 2) {
+          // Octokit throws for non-2xx responses
+          const error: any = new Error('API rate limit exceeded');
+          error.status = 403;
+          error.response = {
+            status: 403,
+            headers: { 'x-ratelimit-reset': String(Math.floor(Date.now() / 1000) + 3600) },
+          };
+
+          return Promise.reject(error);
+        }
+        const runners = createMockRunners(
+          Array.from({ length: 100 }, (_, i) => ({
+            name: `runner-${i}`,
+            status: 'online' as const,
+            busy: false,
+            labels: ['self-hosted'],
+          })),
+        );
+
+        return Promise.resolve({ status: 200, data: { runners } });
+      });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+
+      // Should have stopped at page 2 (rate limited)
+      expect(mockRequest).toHaveBeenCalledTimes(2);
+      // Should use the 100 runners from the first page
+      expect(result.totalRunners).toBe(100);
+      expect(result.shouldFallback).toBe(false);
+    });
+
+    it('should stop paginating on rate limit (HTTP 429)', async () => {
+      let callCount = 0;
+      const mockRequest = jest.fn().mockImplementation(() => {
+        callCount++;
+        if (callCount === 1) {
+          // Octokit throws for non-2xx responses
+          const error: any = new Error('Too Many Requests');
+          error.status = 429;
+          error.response = { status: 429, headers: {} };
+
+          return Promise.reject(error);
+        }
+
+        return Promise.resolve({ status: 200, data: { runners: [] } });
+      });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+
+      // Should have stopped at first page (rate limited immediately)
+      expect(mockRequest).toHaveBeenCalledTimes(1);
+      // No runners found — should fallback
+      expect(result.totalRunners).toBe(0);
+      expect(result.shouldFallback).toBe(true);
+    });
+
+    it('should handle pagination timeout gracefully', async () => {
+      // Mock Date.now to simulate timeout
+      const originalDateNow = Date.now;
+      let callCount = 0;
+
+      const mockRequest = jest.fn().mockImplementation(() => {
+        callCount++;
+        // After first call, advance time past the timeout
+        if (callCount >= 2) {
+          Date.now = jest.fn(() => originalDateNow() + 31_000);
+        }
+        const runners = createMockRunners(
+          Array.from({ length: 100 }, (_, i) => ({
+            name: `runner-${callCount}-${i}`,
+            status: 'online' as const,
+            busy: false,
+            labels: ['self-hosted'],
+          })),
+        );
+
+        return Promise.resolve({ status: 200, data: { runners } });
+      });
+      MockedOctokit.mockImplementation(() => ({ request: mockRequest } as any));
+
+      const result = await RunnerAvailabilityService.checkAvailability('owner', 'repo', 'token', [], 1);
+
+      // Should have stopped after timeout was detected (2 pages: first succeeds, second triggers timeout check)
+      expect(mockRequest.mock.calls.length).toBeLessThanOrEqual(3);
+      // Should have runners from pages fetched before timeout
+      expect(result.totalRunners).toBeGreaterThan(0);
+
+      // Restore
+      Date.now = originalDateNow;
+    });
+  });
+});

src/model/orchestrator/services/core/runner-availability-service.ts

@@ -0,0 +1,205 @@
+import { Octokit } from '@octokit/core';
+import OrchestratorLogger from './orchestrator-logger';
+
+interface GitHubRunner {
+  id: number;
+  name: string;
+  status: 'online' | 'offline';
+  busy: boolean;
+  labels: Array<{ name: string }>;
+}
+
+interface RunnerCheckResult {
+  shouldFallback: boolean;
+  reason: string;
+  totalRunners: number;
+  matchingRunners: number;
+  idleRunners: number;
+}
+
+/**
+ * Maximum number of pages to fetch when paginating through GitHub API results.
+ * 100 pages * 100 per page = 10,000 runners maximum.
+ */
+const MAX_PAGINATION_PAGES = 100;
+
+/**
+ * Total timeout in milliseconds for the pagination loop.
+ * Prevents indefinite API calls if GitHub is slow or pagination is unexpectedly deep.
+ */
+const PAGINATION_TIMEOUT_MS = 30_000;
+
+/**
+ * Checks GitHub Actions runner availability to support automatic provider fallback.
+ *
+ * When a user configures `runnerCheckEnabled: true` with a `fallbackProviderStrategy`,
+ * this service queries the GitHub API for runner status before the build starts.
+ * If insufficient runners are available, the orchestrator routes to the fallback provider.
+ */
+export class RunnerAvailabilityService {
+  /**
+   * Check if enough runners are available to handle the build.
+   *
+   * @param owner - GitHub repository owner
+   * @param repo - GitHub repository name
+   * @param token - GitHub token with repo/actions scope
+   * @param requiredLabels - Labels runners must have (empty = any runner)
+   * @param minAvailable - Minimum idle runners required
+   * @returns RunnerCheckResult with decision and diagnostics
+   */
+  static async checkAvailability(
+    owner: string,
+    repo: string,
+    token: string,
+    requiredLabels: string[],
+    minAvailable: number,
+  ): Promise<RunnerCheckResult> {
+    if (!token) {
+      return {
+        shouldFallback: false,
+        reason: 'No GitHub token available — skipping runner check',
+        totalRunners: 0,
+        matchingRunners: 0,
+        idleRunners: 0,
+      };
+    }
+
+    try {
+      const octokit = new Octokit({ auth: token });
+
+      // Fetch all runners for the repository
+      const runners = await RunnerAvailabilityService.fetchRunners(octokit, owner, repo);
+
+      if (runners.length === 0) {
+        return {
+          shouldFallback: true,
+          reason: 'No runners registered for this repository',
+          totalRunners: 0,
+          matchingRunners: 0,
+          idleRunners: 0,
+        };
+      }
+
+      // Filter by required labels
+      const matching = RunnerAvailabilityService.filterByLabels(runners, requiredLabels);
+
+      // Count idle (online + not busy)
+      const idle = matching.filter((r) => r.status === 'online' && !r.busy);
+
+      const result: RunnerCheckResult = {
+        shouldFallback: idle.length < minAvailable,
+        reason:
+          idle.length >= minAvailable
+            ? `${idle.length} idle runner(s) available (need ${minAvailable})`
+            : `Only ${idle.length} idle runner(s) available, need ${minAvailable}`,
+        totalRunners: runners.length,
+        matchingRunners: matching.length,
+        idleRunners: idle.length,
+      };
+
+      return result;
+    } catch (error: any) {
+      // If the API call fails (permissions, rate limit, etc.), don't block the build
+      OrchestratorLogger.log(`Runner availability check failed: ${error.message}`);
+
+      return {
+        shouldFallback: false,
+        reason: `Runner check failed (${error.message}) — proceeding with primary provider`,
+        totalRunners: 0,
+        matchingRunners: 0,
+        idleRunners: 0,
+      };
+    }
+  }
+
+  /**
+   * Fetch all runners for a repository, handling pagination.
+   *
+   * Includes defensive limits:
+   * - Maximum page count (MAX_PAGINATION_PAGES) to prevent infinite loops
+   * - Total timeout (PAGINATION_TIMEOUT_MS) to prevent indefinite API calls
+   * - Rate-limit detection (HTTP 403/429 with X-RateLimit-Remaining header)
+   */
+  private static async fetchRunners(octokit: Octokit, owner: string, repo: string): Promise<GitHubRunner[]> {
+    const allRunners: GitHubRunner[] = [];
+    let page = 1;
+    const perPage = 100;
+    const startTime = Date.now();
+
+    while (page <= MAX_PAGINATION_PAGES) {
+      // Check total timeout
+      if (Date.now() - startTime > PAGINATION_TIMEOUT_MS) {
+        OrchestratorLogger.logWarning(
+          `[RunnerAvailability] Pagination timeout reached after ${page - 1} pages and ${Date.now() - startTime}ms. ` +
+            `Using ${allRunners.length} runners found so far.`,
+        );
+        break;
+      }
+
+      let response: any;
+      try {
+        response = await octokit.request('GET /repos/{owner}/{repo}/actions/runners', {
+          owner,
+          repo,
+          per_page: perPage,
+          page,
+        });
+      } catch (requestError: any) {
+        // Octokit throws for non-2xx responses. Check if this is a rate limit error.
+        const status = requestError.status ?? requestError.response?.status;
+        if (status === 403 || status === 429) {
+          const resetTime =
+            requestError.response?.headers?.['x-ratelimit-reset'] ?? requestError.headers?.['x-ratelimit-reset'];
+          const resetMessage = resetTime
+            ? ` Resets at ${new Date(Number.parseInt(String(resetTime), 10) * 1000).toISOString()}`
+            : '';
+          OrchestratorLogger.logWarning(
+            `[RunnerAvailability] GitHub API rate limit reached (HTTP ${status}).${resetMessage} ` +
+              `Using ${allRunners.length} runners found so far.`,
+          );
+          break;
+        }
+        // Re-throw non-rate-limit errors to be handled by the outer catch
+        throw requestError;
+      }
+
+      const runners = (response.data.runners || []) as GitHubRunner[];
+      allRunners.push(...runners);
+
+      if (runners.length < perPage) break;
+      page++;
+    }
+
+    if (page > MAX_PAGINATION_PAGES) {
+      OrchestratorLogger.logWarning(
+        `[RunnerAvailability] Maximum pagination limit reached (${MAX_PAGINATION_PAGES} pages). ` +
+          `Using ${allRunners.length} runners found so far.`,
+      );
+    }
+
+    if (allRunners.length === 0) {
+      OrchestratorLogger.log(
+        '[RunnerAvailability] No runners found. Possible causes: ' +
+          'wrong token permissions (needs repo or actions scope), ' +
+          'no self-hosted runners registered, ' +
+          'or runners are registered at the organization level instead of the repository.',
+      );
+    }
+
+    return allRunners;
+  }
+
+  /**
+   * Filter runners by required labels. A runner matches if it has ALL required labels.
+   * If requiredLabels is empty, all runners match.
+   */
+  private static filterByLabels(runners: GitHubRunner[], requiredLabels: string[]): GitHubRunner[] {
+    if (requiredLabels.length === 0) return runners;
+
+    return runners.filter((runner) => {
+      const runnerLabelNames = runner.labels.map((l) => l.name.toLowerCase());
+
+      return requiredLabels.every((required) => runnerLabelNames.includes(required.toLowerCase()));
+    });
+  }
+}

src/model/orchestrator/services/core/task-parameter-serializer.test.ts

@@ -0,0 +1,207 @@
+import { TaskParameterSerializer } from './task-parameter-serializer';
+
+// Mock dependencies that TaskParameterSerializer uses internally
+jest.mock('@actions/core', () => ({
+  getInput: jest.fn().mockReturnValue(''),
+  setOutput: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+}));
+
+jest.mock('../../options/orchestrator-options', () => ({
+  __esModule: true,
+  default: {
+    getInput: jest.fn().mockReturnValue(undefined),
+    ToEnvVarFormat: (input: string) => {
+      if (input.toUpperCase() === input) {
+        return input;
+      }
+      return input
+        .replace(/([A-Z])/g, ' $1')
+        .trim()
+        .toUpperCase()
+        .replace(/ /g, '_');
+    },
+  },
+}));
+
+jest.mock('../../options/orchestrator-options-reader', () => ({
+  __esModule: true,
+  default: {
+    GetProperties: jest.fn().mockReturnValue([]),
+  },
+}));
+
+jest.mock('../../options/orchestrator-query-override', () => ({
+  __esModule: true,
+  default: {
+    queryOverrides: undefined,
+  },
+}));
+
+jest.mock('../hooks/command-hook-service', () => ({
+  CommandHookService: {
+    getHooks: jest.fn().mockReturnValue([]),
+    getSecrets: jest.fn().mockReturnValue([]),
+  },
+}));
+
+jest.mock('../../../input', () => ({
+  __esModule: true,
+  default: {},
+}));
+
+jest.mock('../../../github', () => ({
+  __esModule: true,
+  default: {
+    githubInputEnabled: false,
+  },
+}));
+
+describe('TaskParameterSerializer', () => {
+  describe('ToEnvVarFormat', () => {
+    it('converts camelCase to UPPER_SNAKE_CASE', () => {
+      expect(TaskParameterSerializer.ToEnvVarFormat('targetPlatform')).toBe('TARGET_PLATFORM');
+    });
+
+    it('converts single word to uppercase', () => {
+      expect(TaskParameterSerializer.ToEnvVarFormat('version')).toBe('VERSION');
+    });
+
+    it('preserves already-uppercase strings', () => {
+      expect(TaskParameterSerializer.ToEnvVarFormat('AWS_REGION')).toBe('AWS_REGION');
+    });
+
+    it('handles multi-word camelCase', () => {
+      expect(TaskParameterSerializer.ToEnvVarFormat('buildPlatformTarget')).toBe('BUILD_PLATFORM_TARGET');
+    });
+
+    it('handles string starting with uppercase', () => {
+      expect(TaskParameterSerializer.ToEnvVarFormat('BuildGuid')).toBe('BUILD_GUID');
+    });
+  });
+
+  describe('UndoEnvVarFormat', () => {
+    it('converts UPPER_SNAKE_CASE back to camelCase', () => {
+      expect(TaskParameterSerializer.UndoEnvVarFormat('TARGET_PLATFORM')).toBe('targetPlatform');
+    });
+
+    it('handles single word', () => {
+      expect(TaskParameterSerializer.UndoEnvVarFormat('VERSION')).toBe('version');
+    });
+
+    it('handles multiple underscores', () => {
+      expect(TaskParameterSerializer.UndoEnvVarFormat('BUILD_PLATFORM_TARGET')).toBe('buildPlatformTarget');
+    });
+  });
+
+  describe('round-trip conversion', () => {
+    it('ToEnvVarFormat -> UndoEnvVarFormat returns original for simple camelCase', () => {
+      const original = 'targetPlatform';
+      const envVar = TaskParameterSerializer.ToEnvVarFormat(original);
+      const roundTrip = TaskParameterSerializer.UndoEnvVarFormat(envVar);
+      expect(roundTrip).toBe(original);
+    });
+
+    it('round-trips multi-word keys', () => {
+      const original = 'cacheKey';
+      const envVar = TaskParameterSerializer.ToEnvVarFormat(original);
+      const roundTrip = TaskParameterSerializer.UndoEnvVarFormat(envVar);
+      expect(roundTrip).toBe(original);
+    });
+  });
+
+  describe('uniqBy', () => {
+    it('removes duplicates by key function', () => {
+      const items = [
+        { name: 'A', value: '1' },
+        { name: 'B', value: '2' },
+        { name: 'A', value: '3' },
+      ];
+      const result = TaskParameterSerializer.uniqBy(items, (x) => x.name);
+      expect(result).toHaveLength(2);
+      expect(result[0].value).toBe('1');
+      expect(result[1].value).toBe('2');
+    });
+
+    it('returns all items when no duplicates', () => {
+      const items = [
+        { name: 'A', value: '1' },
+        { name: 'B', value: '2' },
+        { name: 'C', value: '3' },
+      ];
+      const result = TaskParameterSerializer.uniqBy(items, (x) => x.name);
+      expect(result).toHaveLength(3);
+    });
+
+    it('handles empty array', () => {
+      const result = TaskParameterSerializer.uniqBy([], (x) => x.name);
+      expect(result).toHaveLength(0);
+    });
+
+    it('keeps first occurrence when duplicates exist', () => {
+      const items = [
+        { name: 'KEY', value: 'first' },
+        { name: 'KEY', value: 'second' },
+        { name: 'KEY', value: 'third' },
+      ];
+      const result = TaskParameterSerializer.uniqBy(items, (x) => x.name);
+      expect(result).toHaveLength(1);
+      expect(result[0].value).toBe('first');
+    });
+  });
+
+  describe('blockedParameterNames', () => {
+    it('contains expected blocked names', () => {
+      expect(TaskParameterSerializer.blockedParameterNames.has('0')).toBe(true);
+      expect(TaskParameterSerializer.blockedParameterNames.has('length')).toBe(true);
+      expect(TaskParameterSerializer.blockedParameterNames.has('prototype')).toBe(true);
+      expect(TaskParameterSerializer.blockedParameterNames.has('')).toBe(true);
+      expect(TaskParameterSerializer.blockedParameterNames.has('unityVersion')).toBe(true);
+      expect(TaskParameterSerializer.blockedParameterNames.has('CUSTOM_JOB')).toBe(true);
+    });
+
+    it('does not block valid parameter names', () => {
+      expect(TaskParameterSerializer.blockedParameterNames.has('targetPlatform')).toBe(false);
+      expect(TaskParameterSerializer.blockedParameterNames.has('buildGuid')).toBe(false);
+      expect(TaskParameterSerializer.blockedParameterNames.has('cacheKey')).toBe(false);
+    });
+  });
+
+  describe('readDefaultSecrets', () => {
+    it('returns an array', () => {
+      const secrets = TaskParameterSerializer.readDefaultSecrets();
+      expect(Array.isArray(secrets)).toBe(true);
+    });
+
+    it('includes secrets from environment when present', () => {
+      const originalSerial = process.env.UNITY_SERIAL;
+      process.env.UNITY_SERIAL = 'test-serial';
+
+      const secrets = TaskParameterSerializer.readDefaultSecrets();
+      const serialSecret = secrets.find((s) => s.ParameterKey === 'UNITY_SERIAL');
+      expect(serialSecret).toBeDefined();
+      expect(serialSecret?.ParameterValue).toBe('test-serial');
+
+      if (originalSerial !== undefined) {
+        process.env.UNITY_SERIAL = originalSerial;
+      } else {
+        delete process.env.UNITY_SERIAL;
+      }
+    });
+
+    it('excludes secrets not in environment', () => {
+      const originalSerial = process.env.UNITY_SERIAL;
+      delete process.env.UNITY_SERIAL;
+
+      const secrets = TaskParameterSerializer.readDefaultSecrets();
+      const serialSecret = secrets.find((s) => s.ParameterKey === 'UNITY_SERIAL');
+      expect(serialSecret).toBeUndefined();
+
+      if (originalSerial !== undefined) {
+        process.env.UNITY_SERIAL = originalSerial;
+      }
+    });
+  });
+});

src/model/orchestrator/services/hooks/git-hooks-service.test.ts

@@ -0,0 +1,405 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { GitHooksService } from './git-hooks-service';
+
+// Mock dependencies
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('GitHooksService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('detectHookFramework', () => {
+    it('should detect lefthook.yml', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+
+      const result = GitHooksService.detectHookFramework('/repo');
+      expect(result).toBe('lefthook');
+    });
+
+    it('should detect .lefthook.yml', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('.lefthook.yml');
+      });
+
+      const result = GitHooksService.detectHookFramework('/repo');
+      expect(result).toBe('lefthook');
+    });
+
+    it('should detect .husky directory', () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).endsWith('.husky');
+      });
+
+      const result = GitHooksService.detectHookFramework('/repo');
+      expect(result).toBe('husky');
+    });
+
+    it('should return none when no framework is detected', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = GitHooksService.detectHookFramework('/repo');
+      expect(result).toBe('none');
+    });
+  });
+
+  describe('detectUnityGitHooks', () => {
+    it('should return true when package is in manifest.json', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(
+        JSON.stringify({
+          dependencies: {
+            'com.frostebite.unitygithooks': 'https://github.com/frostebite/UnityGitHooks.git#1.0.5',
+          },
+        }),
+      );
+
+      expect(GitHooksService.detectUnityGitHooks('/repo')).toBe(true);
+    });
+
+    it('should return false when package is not in manifest.json', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(
+        JSON.stringify({
+          dependencies: {
+            'com.unity.textmeshpro': '3.0.6',
+          },
+        }),
+      );
+
+      expect(GitHooksService.detectUnityGitHooks('/repo')).toBe(false);
+    });
+
+    it('should return false when manifest.json does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      expect(GitHooksService.detectUnityGitHooks('/repo')).toBe(false);
+    });
+
+    it('should return false on read error', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      expect(GitHooksService.detectUnityGitHooks('/repo')).toBe(false);
+    });
+  });
+
+  describe('findUnityGitHooksPackagePath', () => {
+    it('should find versioned package directory', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue([
+        'com.unity.textmeshpro@3.0.6',
+        'com.frostebite.unitygithooks@1.0.5',
+        'com.unity.ugui@1.0.0',
+      ]);
+
+      const result = GitHooksService.findUnityGitHooksPackagePath('/repo');
+      expect(result).toContain('com.frostebite.unitygithooks@1.0.5');
+    });
+
+    it('should return empty string when package not in cache', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.unity.textmeshpro@3.0.6']);
+
+      const result = GitHooksService.findUnityGitHooksPackagePath('/repo');
+      expect(result).toBe('');
+    });
+
+    it('should return empty string when PackageCache does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = GitHooksService.findUnityGitHooksPackagePath('/repo');
+      expect(result).toBe('');
+    });
+  });
+
+  describe('initUnityGitHooks', () => {
+    it('should run the init script when found', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.frostebite.unitygithooks@1.0.5']);
+
+      await GitHooksService.initUnityGitHooks('/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('init-unity-lefthook.js'), true);
+    });
+
+    it('should skip when package not found in cache', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      await GitHooksService.initUnityGitHooks('/repo');
+
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('should warn when init script does not exist', async () => {
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        // PackageCache dir exists, but init script doesn't
+        return !String(p).includes('init-unity-lefthook');
+      });
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.frostebite.unitygithooks@1.0.5']);
+
+      await GitHooksService.initUnityGitHooks('/repo');
+
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('init script not found'));
+    });
+
+    it('should log warning on init failure', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.frostebite.unitygithooks@1.0.5']);
+      OrchestratorSystem.Run.mockRejectedValue(new Error('node not found'));
+
+      await GitHooksService.initUnityGitHooks('/repo');
+
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('init failed'));
+    });
+  });
+
+  describe('configureUnityGitHooksCIEnv', () => {
+    it('should disable background project mode', () => {
+      const env = GitHooksService.configureUnityGitHooksCIEnv();
+      expect(env.UNITY_GITHOOKS_BACKGROUND_PROJECT_ENABLED).toBe('false');
+    });
+
+    it('should set CI=true', () => {
+      const env = GitHooksService.configureUnityGitHooksCIEnv();
+      expect(env.CI).toBe('true');
+    });
+  });
+
+  describe('installHooks', () => {
+    it('should run npx lefthook install when lefthook is detected', async () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await GitHooksService.installHooks('/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(`cd "/repo" && npx lefthook install`, true);
+    });
+
+    it('should init Unity Git Hooks before installing lefthook when detected', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+      const callOrder: string[] = [];
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(
+        `{"dependencies":{"com.frostebite.unitygithooks":"https://github.com/frostebite/UnityGitHooks.git"}}`,
+      );
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.frostebite.unitygithooks@1.0.5']);
+
+      OrchestratorSystem.Run.mockImplementation((cmd: string) => {
+        if (cmd.includes('init-unity-lefthook')) {
+          callOrder.push('init');
+        } else if (cmd.includes('lefthook install')) {
+          callOrder.push('install');
+        }
+
+        return Promise.resolve('');
+      });
+
+      await GitHooksService.installHooks('/repo');
+
+      // Init should happen before install
+      expect(callOrder).toEqual(['init', 'install']);
+      expect(OrchestratorLogger.log).toHaveBeenCalledWith(expect.stringContaining('Unity Git Hooks (UPM) detected'));
+    });
+
+    it('should set CI env vars when Unity Git Hooks detected', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(`{"dependencies":{"com.frostebite.unitygithooks":"1.0.5"}}`);
+      (mockFs.readdirSync as jest.Mock).mockReturnValue(['com.frostebite.unitygithooks@1.0.5']);
+
+      await GitHooksService.installHooks('/repo');
+
+      expect(process.env.UNITY_GITHOOKS_BACKGROUND_PROJECT_ENABLED).toBe('false');
+    });
+
+    it('should run npx husky install when husky is detected', async () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).endsWith('.husky');
+      });
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await GitHooksService.installHooks('/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(`cd "/repo" && npx husky install`, true);
+    });
+
+    it('should log and return when no framework is detected', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+
+      await GitHooksService.installHooks('/repo');
+
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalled();
+      expect(OrchestratorLogger.log).toHaveBeenCalledWith(expect.stringContaining('No hook framework detected'));
+    });
+
+    it('should log warning on installation failure', async () => {
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+      OrchestratorSystem.Run.mockRejectedValue(new Error('npx not found'));
+
+      await GitHooksService.installHooks('/repo');
+
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Hook installation failed'));
+    });
+  });
+
+  describe('runHookGroups', () => {
+    it('should run each group via lefthook run', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      const results = await GitHooksService.runHookGroups('/repo', ['pre-commit', 'pre-push']);
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(`cd "/repo" && npx lefthook run pre-commit`, true);
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(`cd "/repo" && npx lefthook run pre-push`, true);
+      expect(results['pre-commit']).toBe(true);
+      expect(results['pre-push']).toBe(true);
+    });
+
+    it('should return empty results for empty groups', async () => {
+      const results = await GitHooksService.runHookGroups('/repo', []);
+      expect(results).toEqual({});
+    });
+
+    it('should warn and return empty if not using lefthook', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+
+      const results = await GitHooksService.runHookGroups('/repo', ['pre-commit']);
+
+      expect(results).toEqual({});
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('requires lefthook'));
+    });
+
+    it('should mark failed groups as false', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+
+      OrchestratorSystem.Run.mockResolvedValueOnce('') // pre-commit passes
+        .mockRejectedValueOnce(new Error('tests failed')); // pre-push fails
+
+      const results = await GitHooksService.runHookGroups('/repo', ['pre-commit', 'pre-push']);
+
+      expect(results['pre-commit']).toBe(true);
+      expect(results['pre-push']).toBe(false);
+    });
+
+    it('should log each group result', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+      (mockFs.existsSync as jest.Mock).mockImplementation((filePath: string) => {
+        return String(filePath).includes('lefthook.yml') && !String(filePath).startsWith('.');
+      });
+
+      OrchestratorSystem.Run.mockResolvedValueOnce('').mockRejectedValueOnce(new Error('check failed'));
+
+      await GitHooksService.runHookGroups('/repo', ['pre-commit', 'commit-msg']);
+
+      expect(OrchestratorLogger.log).toHaveBeenCalledWith(expect.stringContaining("'pre-commit' passed"));
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining("'commit-msg' failed"));
+    });
+  });
+
+  describe('configureSkipList', () => {
+    it('should return empty object for empty skip list', () => {
+      const result = GitHooksService.configureSkipList([]);
+      expect(result).toEqual({});
+    });
+
+    it('should return LEFTHOOK_EXCLUDE with comma-separated hooks', () => {
+      const result = GitHooksService.configureSkipList(['pre-commit', 'pre-push']);
+      expect(result.LEFTHOOK_EXCLUDE).toBe('pre-commit,pre-push');
+    });
+
+    it('should set HUSKY=0 when hooks are skipped', () => {
+      const result = GitHooksService.configureSkipList(['pre-commit']);
+      expect(result.HUSKY).toBe('0');
+    });
+
+    it('should handle single hook in skip list', () => {
+      const result = GitHooksService.configureSkipList(['commit-msg']);
+      expect(result.LEFTHOOK_EXCLUDE).toBe('commit-msg');
+      expect(result.HUSKY).toBe('0');
+    });
+  });
+
+  describe('disableHooks', () => {
+    it('should set core.hooksPath to an empty directory', async () => {
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await GitHooksService.disableHooks('/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/repo" config core.hooksPath'),
+        true,
+      );
+    });
+
+    it('should log warning on failure to disable hooks', async () => {
+      (mockFs.mkdirSync as jest.Mock).mockReturnValue(undefined);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+      OrchestratorSystem.Run.mockRejectedValue(new Error('git config failed'));
+
+      await GitHooksService.disableHooks('/repo');
+
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to disable hooks'));
+    });
+  });
+
+  describe('constants', () => {
+    it('should have correct package name', () => {
+      expect(GitHooksService.UNITY_GIT_HOOKS_PACKAGE).toBe('com.frostebite.unitygithooks');
+    });
+  });
+});

src/model/orchestrator/services/hooks/git-hooks-service.ts

@@ -0,0 +1,235 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+export class GitHooksService {
+  static readonly UNITY_GIT_HOOKS_PACKAGE = 'com.frostebite.unitygithooks';
+
+  /**
+   * Detect which git hook framework is configured in the repository.
+   * Checks for lefthook and husky configuration files.
+   */
+  static detectHookFramework(repoPath: string): 'lefthook' | 'husky' | 'none' {
+    // Check for lefthook config files
+    if (fs.existsSync(path.join(repoPath, 'lefthook.yml')) || fs.existsSync(path.join(repoPath, '.lefthook.yml'))) {
+      return 'lefthook';
+    }
+
+    // Check for husky directory
+    if (fs.existsSync(path.join(repoPath, '.husky'))) {
+      return 'husky';
+    }
+
+    return 'none';
+  }
+
+  /**
+   * Detect if Unity Git Hooks (com.frostebite.unitygithooks) is installed as a UPM package.
+   * Checks Packages/manifest.json for the package dependency.
+   */
+  static detectUnityGitHooks(repoPath: string): boolean {
+    const manifestPath = path.join(repoPath, 'Packages', 'manifest.json');
+    if (!fs.existsSync(manifestPath)) {
+      return false;
+    }
+
+    try {
+      const content = fs.readFileSync(manifestPath, 'utf8');
+
+      return content.includes(GitHooksService.UNITY_GIT_HOOKS_PACKAGE);
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Find the Unity Git Hooks package directory in the Library/PackageCache.
+   * Returns the path to the package directory, or empty string if not found.
+   */
+  static findUnityGitHooksPackagePath(repoPath: string): string {
+    const packageCacheDir = path.join(repoPath, 'Library', 'PackageCache');
+    if (!fs.existsSync(packageCacheDir)) {
+      return '';
+    }
+
+    try {
+      const entries = fs.readdirSync(packageCacheDir);
+      const match = entries.find((entry) => entry.startsWith(GitHooksService.UNITY_GIT_HOOKS_PACKAGE));
+      if (match) {
+        return path.join(packageCacheDir, match);
+      }
+    } catch {
+      // PackageCache not available
+    }
+
+    return '';
+  }
+
+  /**
+   * Initialize Unity Git Hooks by running its init script.
+   * This installs the required npm modules that the hooks depend on.
+   * Should be called before installHooks() when Unity Git Hooks is detected.
+   */
+  static async initUnityGitHooks(repoPath: string): Promise<void> {
+    const packagePath = GitHooksService.findUnityGitHooksPackagePath(repoPath);
+    if (!packagePath) {
+      OrchestratorLogger.log(`[GitHooks] Unity Git Hooks package not found in Library/PackageCache, skipping init`);
+
+      return;
+    }
+
+    const initScript = path.join(packagePath, '~js', 'init-unity-lefthook.js');
+    if (!fs.existsSync(initScript)) {
+      OrchestratorLogger.logWarning(`[GitHooks] Unity Git Hooks init script not found at ${initScript}`);
+
+      return;
+    }
+
+    OrchestratorLogger.log(`[GitHooks] Initializing Unity Git Hooks from ${packagePath}`);
+
+    try {
+      await OrchestratorSystem.Run(`cd "${repoPath}" && node "${initScript}"`, true);
+      OrchestratorLogger.log(`[GitHooks] Unity Git Hooks initialized successfully`);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[GitHooks] Unity Git Hooks init failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Configure CI-friendly environment variables for Unity Git Hooks.
+   * Disables background project mode (CI already has an isolated workspace)
+   * and sets other env vars appropriate for headless CI environments.
+   */
+  static configureUnityGitHooksCIEnv(): Record<string, string> {
+    return {
+      UNITY_GITHOOKS_BACKGROUND_PROJECT_ENABLED: 'false',
+      CI: 'true',
+    };
+  }
+
+  /**
+   * Install git hooks using the detected framework.
+   * If Unity Git Hooks is detected, initializes it first.
+   * Errors are caught and logged as warnings - hook installation should not fail the build.
+   */
+  static async installHooks(repoPath: string): Promise<void> {
+    const framework = GitHooksService.detectHookFramework(repoPath);
+
+    if (framework === 'none') {
+      OrchestratorLogger.log(`[GitHooks] No hook framework detected in ${repoPath}`);
+
+      return;
+    }
+
+    OrchestratorLogger.log(`[GitHooks] Detected hook framework: ${framework}`);
+
+    // If Unity Git Hooks is present, initialize it before installing hooks
+    if (framework === 'lefthook' && GitHooksService.detectUnityGitHooks(repoPath)) {
+      OrchestratorLogger.log(`[GitHooks] Unity Git Hooks (UPM) detected, running init`);
+
+      // Set CI-friendly env vars
+      const ciEnv = GitHooksService.configureUnityGitHooksCIEnv();
+      for (const [key, value] of Object.entries(ciEnv)) {
+        process.env[key] = value;
+      }
+
+      await GitHooksService.initUnityGitHooks(repoPath);
+    }
+
+    try {
+      if (framework === 'lefthook') {
+        await OrchestratorSystem.Run(`cd "${repoPath}" && npx lefthook install`, true);
+        OrchestratorLogger.log(`[GitHooks] Lefthook hooks installed`);
+      } else if (framework === 'husky') {
+        await OrchestratorSystem.Run(`cd "${repoPath}" && npx husky install`, true);
+        OrchestratorLogger.log(`[GitHooks] Husky hooks installed`);
+      }
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[GitHooks] Hook installation failed: ${error.message}`);
+    }
+  }
+
+  /**
+   * Explicitly run specific lefthook hook groups before the build.
+   * This allows CI to trigger pre-commit, pre-push, or other checks
+   * that would normally only run on git events.
+   *
+   * @param repoPath - Path to the repository
+   * @param hookGroups - Lefthook group names to run (e.g., ['pre-commit', 'pre-push'])
+   * @returns Map of group name to success/failure
+   */
+  static async runHookGroups(repoPath: string, hookGroups: string[]): Promise<Record<string, boolean>> {
+    const results: Record<string, boolean> = {};
+
+    if (hookGroups.length === 0) {
+      return results;
+    }
+
+    const framework = GitHooksService.detectHookFramework(repoPath);
+    if (framework !== 'lefthook') {
+      OrchestratorLogger.logWarning(`[GitHooks] runHookGroups requires lefthook, but detected: ${framework}`);
+
+      return results;
+    }
+
+    OrchestratorLogger.log(`[GitHooks] Running ${hookGroups.length} hook group(s): ${hookGroups.join(', ')}`);
+
+    for (const group of hookGroups) {
+      try {
+        await OrchestratorSystem.Run(`cd "${repoPath}" && npx lefthook run ${group}`, true);
+        OrchestratorLogger.log(`[GitHooks] Hook group '${group}' passed`);
+        results[group] = true;
+      } catch (error: any) {
+        OrchestratorLogger.logWarning(`[GitHooks] Hook group '${group}' failed: ${error.message}`);
+        results[group] = false;
+      }
+    }
+
+    return results;
+  }
+
+  /**
+   * Return environment variables that will skip the listed hooks.
+   * For lefthook: sets LEFTHOOK_EXCLUDE to a comma-separated list.
+   * For husky: sets HUSKY=0 to disable all hooks (husky does not support selective skipping).
+   * The caller is responsible for applying the returned env vars.
+   */
+  static configureSkipList(skipList: string[]): Record<string, string> {
+    if (skipList.length === 0) {
+      return {};
+    }
+
+    // Return both lefthook and husky env vars so the caller can apply whichever is relevant.
+    // Lefthook supports selective hook exclusion.
+    const env: Record<string, string> = {
+      LEFTHOOK_EXCLUDE: skipList.join(','),
+    };
+
+    // Husky only supports full disable (HUSKY=0), not selective skipping.
+    // If any hooks are in the skip list, disable husky entirely.
+    env.HUSKY = '0';
+
+    OrchestratorLogger.log(`[GitHooks] Skip list configured: ${skipList.join(', ')}`);
+
+    return env;
+  }
+
+  /**
+   * Disable all git hooks by pointing core.hooksPath to an empty temporary directory.
+   * This prevents any hooks from running during the build.
+   */
+  static async disableHooks(repoPath: string): Promise<void> {
+    try {
+      const emptyDir = path.join(os.tmpdir(), 'game-ci-empty-hooks');
+      fs.mkdirSync(emptyDir, { recursive: true });
+
+      await OrchestratorSystem.Run(`git -C "${repoPath}" config core.hooksPath "${emptyDir}"`, true);
+
+      OrchestratorLogger.log(`[GitHooks] Hooks disabled via core.hooksPath -> ${emptyDir}`);
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[GitHooks] Failed to disable hooks: ${error.message}`);
+    }
+  }
+}

src/model/orchestrator/services/lfs/elastic-git-storage-service.test.ts

@@ -0,0 +1,395 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import { ElasticGitStorageService } from './elastic-git-storage-service';
+
+jest.mock('node:fs');
+jest.mock('node:os');
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+jest.mock('./lfs-agent-service', () => ({
+  LfsAgentService: {
+    configure: jest.fn().mockResolvedValue(undefined),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+const mockOs = os as jest.Mocked<typeof os>;
+
+describe('ElasticGitStorageService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('parseAgentValue', () => {
+    it('should parse name without version', () => {
+      const result = ElasticGitStorageService.parseAgentValue('elastic-git-storage');
+      expect(result.name).toBe('elastic-git-storage');
+      expect(result.version).toBe('latest');
+    });
+
+    it('should parse name@version', () => {
+      const result = ElasticGitStorageService.parseAgentValue('elastic-git-storage@v1.0.0');
+      expect(result.name).toBe('elastic-git-storage');
+      expect(result.version).toBe('v1.0.0');
+    });
+
+    it('should parse name@latest', () => {
+      const result = ElasticGitStorageService.parseAgentValue('elastic-git-storage@latest');
+      expect(result.name).toBe('elastic-git-storage');
+      expect(result.version).toBe('latest');
+    });
+
+    it('should handle trailing @ as latest', () => {
+      const result = ElasticGitStorageService.parseAgentValue('elastic-git-storage@');
+      expect(result.name).toBe('elastic-git-storage');
+      expect(result.version).toBe('latest');
+    });
+
+    it('should handle whitespace', () => {
+      const result = ElasticGitStorageService.parseAgentValue('  elastic-git-storage@v2.0.0  ');
+      expect(result.name).toBe('elastic-git-storage');
+      expect(result.version).toBe('v2.0.0');
+    });
+  });
+
+  describe('isElasticGitStorage', () => {
+    it('should match exact name', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('elastic-git-storage')).toBe(true);
+    });
+
+    it('should match with .exe extension', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('elastic-git-storage.exe')).toBe(true);
+    });
+
+    it('should match with @version suffix', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('elastic-git-storage@v1.0.0')).toBe(true);
+    });
+
+    it('should match with @latest suffix', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('elastic-git-storage@latest')).toBe(true);
+    });
+
+    it('should match forward-slash path', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('/usr/local/bin/elastic-git-storage')).toBe(true);
+    });
+
+    it('should match backslash path', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('C:\\tools\\elastic-git-storage')).toBe(true);
+    });
+
+    it('should match path with .exe', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('C:\\tools\\elastic-git-storage.exe')).toBe(true);
+    });
+
+    it('should be case-insensitive', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('Elastic-Git-Storage')).toBe(true);
+    });
+
+    it('should handle whitespace', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('  elastic-git-storage  ')).toBe(true);
+    });
+
+    it('should not match other agent names', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('lfs-folderstore')).toBe(false);
+    });
+
+    it('should return false for empty string', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('')).toBe(false);
+    });
+
+    it('should not match partial names', () => {
+      expect(ElasticGitStorageService.isElasticGitStorage('my-elastic-git-storage-v2')).toBe(false);
+    });
+  });
+
+  describe('findInstalled', () => {
+    it('should find on PATH via which/where', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      OrchestratorSystem.Run.mockResolvedValue('/usr/local/bin/elastic-git-storage\n');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const result = await ElasticGitStorageService.findInstalled();
+      expect(result).toBe('/usr/local/bin/elastic-git-storage');
+    });
+
+    it('should use where on windows', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('win32');
+      OrchestratorSystem.Run.mockResolvedValue('C:\\tools\\elastic-git-storage.exe\n');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const result = await ElasticGitStorageService.findInstalled();
+      expect(result).toBe('C:\\tools\\elastic-git-storage.exe');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('where'), false, true);
+    });
+
+    it('should check common install locations when not on PATH', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('not found'));
+      (mockFs.existsSync as jest.Mock)
+        .mockReturnValueOnce(false) // RUNNER_TOOL_CACHE
+        .mockReturnValueOnce(true); // /usr/local/bin
+
+      const result = await ElasticGitStorageService.findInstalled();
+      expect(result).toBe('/usr/local/bin/elastic-git-storage');
+    });
+
+    it('should return empty string when not found anywhere', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('not found'));
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = await ElasticGitStorageService.findInstalled();
+      expect(result).toBe('');
+    });
+
+    it('should check windows-specific locations on win32', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('win32');
+      mockOs.homedir.mockReturnValue('C:\\Users\\runner');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('not found'));
+
+      const originalEnv = { ...process.env };
+      process.env.LOCALAPPDATA = 'C:\\Users\\runner\\AppData\\Local';
+      process.env.RUNNER_TOOL_CACHE = '';
+
+      (mockFs.existsSync as jest.Mock).mockImplementation((p: string) => {
+        return p.includes('AppData');
+      });
+
+      const result = await ElasticGitStorageService.findInstalled();
+      expect(result).toContain('elastic-git-storage.exe');
+
+      process.env = originalEnv;
+    });
+  });
+
+  describe('install', () => {
+    it('should download correct binary for linux amd64', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      OrchestratorSystem.Run.mockResolvedValue('');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const result = await ElasticGitStorageService.install('latest');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('elastic-git-storage_linux_amd64'));
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('chmod +x'));
+      expect(result).toContain('elastic-git-storage');
+    });
+
+    it('should download correct binary for darwin arm64', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('darwin');
+      mockOs.arch.mockReturnValue('arm64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      await ElasticGitStorageService.install('v1.2.0');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('elastic-git-storage_darwin_arm64'));
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('v1.2.0'));
+    });
+
+    it('should download .exe for windows', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('win32');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('C:\\temp');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      await ElasticGitStorageService.install('latest');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('elastic-git-storage_windows_amd64.exe'),
+      );
+      // Should NOT chmod on windows
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalledWith(expect.stringContaining('chmod'));
+    });
+
+    it('should use RUNNER_TOOL_CACHE for install dir when available', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      const originalCache = process.env.RUNNER_TOOL_CACHE;
+      process.env.RUNNER_TOOL_CACHE = '/opt/hostedtoolcache';
+
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const result = await ElasticGitStorageService.install('latest');
+      expect(result).toContain('hostedtoolcache');
+
+      if (originalCache === undefined) {
+        delete process.env.RUNNER_TOOL_CACHE;
+      } else {
+        process.env.RUNNER_TOOL_CACHE = originalCache;
+      }
+    });
+
+    it('should use latest release URL when version is latest', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      await ElasticGitStorageService.install('latest');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('/releases/latest/download/'));
+    });
+
+    it('should use tagged release URL when version is specified', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      await ElasticGitStorageService.install('v2.0.0');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('/releases/download/v2.0.0/'));
+    });
+
+    it('should return empty string on download failure', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('curl failed'));
+
+      const result = await ElasticGitStorageService.install('latest');
+      expect(result).toBe('');
+    });
+
+    it('should return empty string if binary not found after download', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = await ElasticGitStorageService.install('latest');
+      expect(result).toBe('');
+    });
+  });
+
+  describe('ensureAndConfigure', () => {
+    it('should use existing installation if found', async () => {
+      const { LfsAgentService } = require('./lfs-agent-service');
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      // findInstalled returns a result
+      OrchestratorSystem.Run.mockResolvedValue('/usr/local/bin/elastic-git-storage\n');
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const result = await ElasticGitStorageService.ensureAndConfigure('latest', '--verbose', ['/mnt/lfs'], '/repo');
+
+      expect(result).toBe('/usr/local/bin/elastic-git-storage');
+      expect(LfsAgentService.configure).toHaveBeenCalledWith(
+        '/usr/local/bin/elastic-git-storage',
+        '--verbose',
+        ['/mnt/lfs'],
+        '/repo',
+      );
+    });
+
+    it('should install when not found and configure', async () => {
+      const { LfsAgentService } = require('./lfs-agent-service');
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+
+      // findInstalled finds nothing
+      OrchestratorSystem.Run.mockRejectedValueOnce(new Error('not found')) // which
+        .mockResolvedValueOnce('') // curl download
+        .mockResolvedValueOnce(''); // chmod
+
+      (mockFs.existsSync as jest.Mock)
+        .mockReturnValueOnce(false) // RUNNER_TOOL_CACHE
+        .mockReturnValueOnce(false) // /usr/local/bin
+        .mockReturnValueOnce(false) // ~/.local/bin
+        .mockReturnValueOnce(true); // after install
+
+      const result = await ElasticGitStorageService.ensureAndConfigure('v1.0.0', '', [], '/repo');
+
+      expect(result).toContain('elastic-git-storage');
+      expect(LfsAgentService.configure).toHaveBeenCalled();
+    });
+
+    it('should return empty string when install fails', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+
+      // findInstalled finds nothing
+      OrchestratorSystem.Run.mockRejectedValue(new Error('not found'));
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const result = await ElasticGitStorageService.ensureAndConfigure('latest', '', [], '/repo');
+
+      expect(result).toBe('');
+    });
+
+    it('should use default version when empty string passed', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      mockOs.platform.mockReturnValue('linux');
+      mockOs.arch.mockReturnValue('x64');
+      mockOs.homedir.mockReturnValue('/home/runner');
+      mockOs.tmpdir.mockReturnValue('/tmp');
+
+      // findInstalled finds nothing
+      OrchestratorSystem.Run.mockRejectedValueOnce(new Error('not found'))
+        .mockResolvedValueOnce('')
+        .mockResolvedValueOnce('');
+
+      (mockFs.existsSync as jest.Mock)
+        .mockReturnValueOnce(false)
+        .mockReturnValueOnce(false)
+        .mockReturnValueOnce(false)
+        .mockReturnValueOnce(true);
+
+      await ElasticGitStorageService.ensureAndConfigure('', '', [], '/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('/releases/latest/download/'));
+    });
+  });
+
+  describe('constants', () => {
+    it('should have correct repo owner', () => {
+      expect(ElasticGitStorageService.REPO_OWNER).toBe('frostebite');
+    });
+
+    it('should have correct repo name', () => {
+      expect(ElasticGitStorageService.REPO_NAME).toBe('elastic-git-storage');
+    });
+
+    it('should have correct agent name', () => {
+      expect(ElasticGitStorageService.AGENT_NAME).toBe('elastic-git-storage');
+    });
+  });
+});

src/model/orchestrator/services/lfs/elastic-git-storage-service.ts

@@ -0,0 +1,211 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { LfsAgentService } from './lfs-agent-service';
+
+/**
+ * Built-in support for elastic-git-storage, a custom Git LFS transfer agent
+ * that supports multiple storage backends (local filesystem, WebDAV, rclone remotes).
+ *
+ * When `lfsTransferAgent` is set to 'elastic-git-storage', this service:
+ * 1. Checks if the agent is already installed on the system
+ * 2. If not, downloads it from the GitHub release page
+ * 3. Makes it executable
+ * 4. Delegates to LfsAgentService for git config setup
+ *
+ * @see https://github.com/frostebite/elastic-git-storage
+ */
+export class ElasticGitStorageService {
+  static readonly REPO_OWNER = 'frostebite';
+  static readonly REPO_NAME = 'elastic-git-storage';
+  static readonly AGENT_NAME = 'elastic-git-storage';
+
+  /**
+   * Parse an agent value that may include a version suffix.
+   * Supports formats like:
+   *   - 'elastic-git-storage' → { name: 'elastic-git-storage', version: 'latest' }
+   *   - 'elastic-git-storage@v1.0.0' → { name: 'elastic-git-storage', version: 'v1.0.0' }
+   *   - 'elastic-git-storage@latest' → { name: 'elastic-git-storage', version: 'latest' }
+   */
+  static parseAgentValue(agentValue: string): { name: string; version: string } {
+    const trimmed = agentValue.trim();
+    const atIndex = trimmed.indexOf('@');
+    if (atIndex > 0) {
+      return {
+        name: trimmed.substring(0, atIndex),
+        version: trimmed.substring(atIndex + 1) || 'latest',
+      };
+    }
+
+    return { name: trimmed, version: 'latest' };
+  }
+
+  /**
+   * Check if the given lfsTransferAgent value refers to elastic-git-storage.
+   * Matches the exact name (without path) or a path ending in the agent name.
+   * Also matches 'elastic-git-storage@version' format.
+   */
+  static isElasticGitStorage(agentValue: string): boolean {
+    if (!agentValue) return false;
+
+    const { name } = ElasticGitStorageService.parseAgentValue(agentValue);
+    const normalized = name.trim().toLowerCase();
+
+    return (
+      normalized === 'elastic-git-storage' ||
+      normalized === 'elastic-git-storage.exe' ||
+      normalized.endsWith('/elastic-git-storage') ||
+      normalized.endsWith('\\elastic-git-storage') ||
+      normalized.endsWith('/elastic-git-storage.exe') ||
+      normalized.endsWith('\\elastic-git-storage.exe')
+    );
+  }
+
+  /**
+   * Resolve the full path to the elastic-git-storage executable.
+   *
+   * Search order:
+   * 1. The provided path (if it's a full path and exists)
+   * 2. $PATH lookup via `which` / `where`
+   * 3. Known install locations ($RUNNER_TOOL_CACHE, /usr/local/bin, ~/.local/bin)
+   *
+   * @returns Full path to the executable, or empty string if not found
+   */
+  static async findInstalled(): Promise<string> {
+    // Check PATH
+    try {
+      const whichCmd = os.platform() === 'win32' ? 'where elastic-git-storage' : 'which elastic-git-storage';
+      const result = await OrchestratorSystem.Run(whichCmd, false, true);
+      const foundPath = result.trim().split('\n')[0].trim();
+      if (foundPath && fs.existsSync(foundPath)) {
+        return foundPath;
+      }
+    } catch {
+      // Not on PATH
+    }
+
+    // Check common install locations
+    const candidates = [
+      path.join(process.env.RUNNER_TOOL_CACHE || '', 'elastic-git-storage', 'elastic-git-storage'),
+      '/usr/local/bin/elastic-git-storage',
+      path.join(os.homedir(), '.local', 'bin', 'elastic-git-storage'),
+    ];
+
+    if (os.platform() === 'win32') {
+      candidates.push(
+        path.join(process.env.RUNNER_TOOL_CACHE || '', 'elastic-git-storage', 'elastic-git-storage.exe'),
+        path.join(process.env.LOCALAPPDATA || '', 'elastic-git-storage', 'elastic-git-storage.exe'),
+      );
+    }
+
+    for (const candidate of candidates) {
+      if (candidate && fs.existsSync(candidate)) {
+        return candidate;
+      }
+    }
+
+    return '';
+  }
+
+  /**
+   * Install elastic-git-storage from GitHub releases.
+   *
+   * @param version - Version to install (e.g., 'v1.0.0', 'latest')
+   * @returns Path to the installed executable
+   */
+  static async install(version: string = 'latest'): Promise<string> {
+    const platform = os.platform();
+    const arch = os.arch();
+
+    const osName = platform === 'win32' ? 'windows' : platform === 'darwin' ? 'darwin' : 'linux';
+    const archName = arch === 'x64' ? 'amd64' : arch === 'arm64' ? 'arm64' : 'amd64';
+    const ext = platform === 'win32' ? '.exe' : '';
+
+    const installDir = process.env.RUNNER_TOOL_CACHE
+      ? path.join(process.env.RUNNER_TOOL_CACHE, 'elastic-git-storage')
+      : path.join(os.tmpdir(), 'elastic-git-storage');
+
+    const binaryName = `elastic-git-storage${ext}`;
+    const installPath = path.join(installDir, binaryName);
+
+    OrchestratorLogger.log(`[ElasticGitStorage] Installing to ${installPath}`);
+
+    // Create install directory
+    fs.mkdirSync(installDir, { recursive: true });
+
+    // Build download URL
+    const releaseTag = version === 'latest' ? 'latest' : version;
+    const assetName = `elastic-git-storage_${osName}_${archName}${ext}`;
+
+    let downloadUrl: string;
+    if (releaseTag === 'latest') {
+      downloadUrl = `https://github.com/${ElasticGitStorageService.REPO_OWNER}/${ElasticGitStorageService.REPO_NAME}/releases/latest/download/${assetName}`;
+    } else {
+      downloadUrl = `https://github.com/${ElasticGitStorageService.REPO_OWNER}/${ElasticGitStorageService.REPO_NAME}/releases/download/${releaseTag}/${assetName}`;
+    }
+
+    OrchestratorLogger.log(`[ElasticGitStorage] Downloading from ${downloadUrl}`);
+
+    try {
+      await OrchestratorSystem.Run(`curl -fsSL -o "${installPath}" "${downloadUrl}"`);
+
+      if (platform !== 'win32') {
+        await OrchestratorSystem.Run(`chmod +x "${installPath}"`);
+      }
+
+      // Verify installation
+      if (!fs.existsSync(installPath)) {
+        throw new Error(`Binary not found after download at ${installPath}`);
+      }
+
+      OrchestratorLogger.log(`[ElasticGitStorage] Successfully installed ${releaseTag} to ${installPath}`);
+
+      return installPath;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(
+        `[ElasticGitStorage] Failed to install: ${error.message}. Continuing without elastic-git-storage.`,
+      );
+
+      return '';
+    }
+  }
+
+  /**
+   * Ensure elastic-git-storage is available (find or install) and configure it.
+   *
+   * @param version - Version to install if not found ('latest' or a tag like 'v1.0.0')
+   * @param agentArgs - Additional arguments to pass to the agent
+   * @param storagePaths - Storage paths for the agent
+   * @param repoPath - Path to the git repository
+   * @returns Path to the configured executable, or empty string if setup failed
+   */
+  static async ensureAndConfigure(
+    version: string,
+    agentArgs: string,
+    storagePaths: string[],
+    repoPath: string,
+  ): Promise<string> {
+    OrchestratorLogger.log(`[ElasticGitStorage] Setting up elastic-git-storage (version: ${version || 'latest'})`);
+
+    // Try to find existing installation
+    let agentPath = await ElasticGitStorageService.findInstalled();
+
+    if (agentPath) {
+      OrchestratorLogger.log(`[ElasticGitStorage] Found existing installation at ${agentPath}`);
+    } else {
+      OrchestratorLogger.log(`[ElasticGitStorage] Not found on system, installing...`);
+      agentPath = await ElasticGitStorageService.install(version || 'latest');
+
+      if (!agentPath) {
+        return '';
+      }
+    }
+
+    // Delegate to LfsAgentService for git config setup
+    await LfsAgentService.configure(agentPath, agentArgs, storagePaths, repoPath);
+
+    return agentPath;
+  }
+}

src/model/orchestrator/services/lfs/lfs-agent-service.test.ts

@@ -0,0 +1,122 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { LfsAgentService } from './lfs-agent-service';
+
+// Mock dependencies
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('LfsAgentService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('configure', () => {
+    it('should call correct git config commands when agent exists', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await LfsAgentService.configure(
+        '/usr/local/bin/elastic-git-storage',
+        '--verbose',
+        ['/storage/path1', '/storage/path2'],
+        '/repo',
+      );
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        `git -C "/repo" config lfs.customtransfer.elastic-git-storage.path "/usr/local/bin/elastic-git-storage"`,
+      );
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        `git -C "/repo" config lfs.customtransfer.elastic-git-storage.args "--verbose"`,
+      );
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        `git -C "/repo" config lfs.standalonetransferagent elastic-git-storage`,
+      );
+    });
+
+    it('should set LFS_STORAGE_PATHS environment variable when storagePaths provided', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      await LfsAgentService.configure('/usr/local/bin/elastic-git-storage', '', ['/path/a', '/path/b'], '/repo');
+
+      expect(process.env.LFS_STORAGE_PATHS).toBe('/path/a;/path/b');
+    });
+
+    it('should log warning and return early when agent executable does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await LfsAgentService.configure('/nonexistent/agent', '', [], '/repo');
+
+      expect(OrchestratorSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('should derive agent name from executable filename', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+
+      await LfsAgentService.configure('/tools/my-custom-agent.exe', '', [], '/repo');
+
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(
+        `git -C "/repo" config lfs.customtransfer.my-custom-agent.path "/tools/my-custom-agent.exe"`,
+      );
+    });
+  });
+
+  describe('configure with empty storagePaths', () => {
+    it('should not set LFS_STORAGE_PATHS when storagePaths is empty', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+
+      const originalValue = process.env.LFS_STORAGE_PATHS;
+      delete process.env.LFS_STORAGE_PATHS;
+
+      await LfsAgentService.configure('/usr/local/bin/agent', '', [], '/repo');
+
+      expect(process.env.LFS_STORAGE_PATHS).toBeUndefined();
+
+      if (originalValue !== undefined) {
+        process.env.LFS_STORAGE_PATHS = originalValue;
+      }
+    });
+  });
+
+  describe('validate', () => {
+    it('should return true when agent executable exists', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      const result = await LfsAgentService.validate('/usr/local/bin/elastic-git-storage');
+      expect(result).toBe(true);
+    });
+
+    it('should return false when agent executable does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const result = await LfsAgentService.validate('/nonexistent/agent');
+      expect(result).toBe(false);
+    });
+
+    it('should log warning when agent does not exist', async () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const OrchestratorLogger = require('../core/orchestrator-logger').default;
+
+      await LfsAgentService.validate('/nonexistent/agent');
+
+      expect(OrchestratorLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Agent executable not found'));
+    });
+  });
+});

src/model/orchestrator/services/lfs/lfs-agent-service.ts

@@ -0,0 +1,59 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+export class LfsAgentService {
+  /**
+   * Configure a custom LFS transfer agent in a git repository.
+   * Sets up the git config entries and environment variables needed for the agent.
+   */
+  static async configure(
+    agentPath: string,
+    agentArgs: string,
+    storagePaths: string[],
+    repoPath: string,
+  ): Promise<void> {
+    // Validate the agent executable exists
+    if (!fs.existsSync(agentPath)) {
+      OrchestratorLogger.logWarning(
+        `[LfsAgent] Agent executable not found at ${agentPath}, continuing without custom LFS agent`,
+      );
+
+      return;
+    }
+
+    // Derive agent name from executable filename (without extension)
+    const agentName = path.basename(agentPath, path.extname(agentPath));
+
+    OrchestratorLogger.log(`[LfsAgent] Configuring custom LFS transfer agent: ${agentName}`);
+    OrchestratorLogger.log(`[LfsAgent]   Path: ${agentPath}`);
+    OrchestratorLogger.log(`[LfsAgent]   Args: ${agentArgs}`);
+
+    // Set git config entries for the custom transfer agent
+    await OrchestratorSystem.Run(`git -C "${repoPath}" config lfs.customtransfer.${agentName}.path "${agentPath}"`);
+    await OrchestratorSystem.Run(`git -C "${repoPath}" config lfs.customtransfer.${agentName}.args "${agentArgs}"`);
+    await OrchestratorSystem.Run(`git -C "${repoPath}" config lfs.standalonetransferagent ${agentName}`);
+
+    // Set storage paths environment variable if provided
+    if (storagePaths.length > 0) {
+      const storagePathsValue = storagePaths.join(';');
+      process.env.LFS_STORAGE_PATHS = storagePathsValue;
+      OrchestratorLogger.log(`[LfsAgent]   Storage paths: ${storagePathsValue}`);
+    }
+
+    OrchestratorLogger.log(`[LfsAgent] Custom LFS transfer agent configured successfully`);
+  }
+
+  /**
+   * Validate that the LFS transfer agent executable exists.
+   */
+  static async validate(agentPath: string): Promise<boolean> {
+    const exists = fs.existsSync(agentPath);
+    if (!exists) {
+      OrchestratorLogger.logWarning(`[LfsAgent] Agent executable not found: ${agentPath}`);
+    }
+
+    return exists;
+  }
+}

src/model/orchestrator/services/output/artifact-service.test.ts

@@ -0,0 +1,607 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OutputTypeRegistry, OutputTypeDefinition } from './output-type-registry';
+import { OutputService } from './output-service';
+import { OutputManifest } from './output-manifest';
+import { ArtifactUploadHandler, ArtifactUploadConfig } from './artifact-upload-handler';
+
+// Mock node:fs
+jest.mock('node:fs');
+const mockedFs = fs as jest.Mocked<typeof fs>;
+
+// Mock @actions/core (used by OrchestratorLogger)
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  setFailed: jest.fn(),
+  setSecret: jest.fn(),
+}));
+
+// Mock @actions/exec (used by upload handler for rclone)
+jest.mock('@actions/exec', () => ({
+  exec: jest.fn().mockResolvedValue(0),
+}));
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  OutputTypeRegistry.resetCustomTypes();
+});
+
+// ---------------------------------------------------------------------------
+// OutputTypeRegistry Tests
+// ---------------------------------------------------------------------------
+describe('OutputTypeRegistry', () => {
+  describe('built-in types', () => {
+    it('should have 8 built-in types', () => {
+      const allTypes = OutputTypeRegistry.getAllTypes();
+      const builtInTypes = allTypes.filter((t) => t.builtIn);
+      expect(builtInTypes).toHaveLength(8);
+    });
+
+    it.each(['build', 'test-results', 'server-build', 'data-export', 'images', 'logs', 'metrics', 'coverage'])(
+      'should include built-in type "%s"',
+      (typeName) => {
+        const typeDef = OutputTypeRegistry.getType(typeName);
+        expect(typeDef).toBeDefined();
+        expect(typeDef!.name).toBe(typeName);
+        expect(typeDef!.builtIn).toBe(true);
+      },
+    );
+
+    it('should return undefined for unknown types', () => {
+      const typeDef = OutputTypeRegistry.getType('nonexistent');
+      expect(typeDef).toBeUndefined();
+    });
+
+    it('should include default paths for all built-in types', () => {
+      const allTypes = OutputTypeRegistry.getAllTypes();
+      for (const typeDef of allTypes) {
+        expect(typeDef.defaultPath).toBeTruthy();
+        expect(typeof typeDef.defaultPath).toBe('string');
+      }
+    });
+
+    it('should include descriptions for all built-in types', () => {
+      const allTypes = OutputTypeRegistry.getAllTypes();
+      for (const typeDef of allTypes) {
+        expect(typeDef.description).toBeTruthy();
+        expect(typeof typeDef.description).toBe('string');
+      }
+    });
+  });
+
+  describe('custom type registration', () => {
+    it('should register a custom type', () => {
+      const customType: OutputTypeDefinition = {
+        name: 'custom-reports',
+        defaultPath: './Reports/',
+        description: 'Custom generated reports',
+        builtIn: false,
+      };
+
+      OutputTypeRegistry.registerType(customType);
+      const retrieved = OutputTypeRegistry.getType('custom-reports');
+      expect(retrieved).toBeDefined();
+      expect(retrieved!.name).toBe('custom-reports');
+      expect(retrieved!.builtIn).toBe(false);
+    });
+
+    it('should not override built-in types', () => {
+      const override: OutputTypeDefinition = {
+        name: 'build',
+        defaultPath: './Override/',
+        description: 'Should not override',
+        builtIn: false,
+      };
+
+      OutputTypeRegistry.registerType(override);
+      const buildType = OutputTypeRegistry.getType('build');
+      expect(buildType!.defaultPath).not.toBe('./Override/');
+      expect(buildType!.builtIn).toBe(true);
+    });
+
+    it('should include custom types in getAllTypes', () => {
+      OutputTypeRegistry.registerType({
+        name: 'custom-a',
+        defaultPath: './A/',
+        description: 'Custom A',
+        builtIn: false,
+      });
+
+      const allTypes = OutputTypeRegistry.getAllTypes();
+      expect(allTypes.length).toBe(9); // 8 built-in + 1 custom
+      expect(allTypes.some((t) => t.name === 'custom-a')).toBe(true);
+    });
+
+    it('should reset custom types', () => {
+      OutputTypeRegistry.registerType({
+        name: 'temp-type',
+        defaultPath: './Temp/',
+        description: 'Temporary type',
+        builtIn: false,
+      });
+
+      expect(OutputTypeRegistry.getType('temp-type')).toBeDefined();
+      OutputTypeRegistry.resetCustomTypes();
+      expect(OutputTypeRegistry.getType('temp-type')).toBeUndefined();
+    });
+
+    it('should force builtIn to false when registering custom types', () => {
+      OutputTypeRegistry.registerType({
+        name: 'sneaky',
+        defaultPath: './Sneaky/',
+        description: 'Tries to be built-in',
+        builtIn: true, // Intentionally setting to true
+      });
+
+      const retrieved = OutputTypeRegistry.getType('sneaky');
+      expect(retrieved).toBeDefined();
+      expect(retrieved!.builtIn).toBe(false);
+    });
+  });
+
+  describe('parseOutputTypes', () => {
+    it('should parse a comma-separated string of valid types', () => {
+      const types = OutputTypeRegistry.parseOutputTypes('build,logs,coverage');
+      expect(types).toHaveLength(3);
+      expect(types.map((t) => t.name)).toEqual(['build', 'logs', 'coverage']);
+    });
+
+    it('should skip unknown types', () => {
+      const types = OutputTypeRegistry.parseOutputTypes('build,unknown,logs');
+      expect(types).toHaveLength(2);
+      expect(types.map((t) => t.name)).toEqual(['build', 'logs']);
+    });
+
+    it('should handle empty string', () => {
+      const types = OutputTypeRegistry.parseOutputTypes('');
+      expect(types).toHaveLength(0);
+    });
+
+    it('should handle whitespace in type names', () => {
+      const types = OutputTypeRegistry.parseOutputTypes(' build , logs , coverage ');
+      expect(types).toHaveLength(3);
+    });
+
+    it('should include custom types when parsing', () => {
+      OutputTypeRegistry.registerType({
+        name: 'my-reports',
+        defaultPath: './Reports/',
+        description: 'Custom reports',
+        builtIn: false,
+      });
+
+      const types = OutputTypeRegistry.parseOutputTypes('build,my-reports');
+      expect(types).toHaveLength(2);
+      expect(types[1].name).toBe('my-reports');
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// OutputService Tests
+// ---------------------------------------------------------------------------
+describe('OutputService', () => {
+  const projectPath = '/project';
+  const buildGuid = 'test-guid-1234';
+
+  beforeEach(() => {
+    // Reset all fs mocks
+    mockedFs.existsSync.mockReset();
+    mockedFs.statSync.mockReset();
+    mockedFs.readdirSync.mockReset();
+    mockedFs.writeFileSync.mockReset();
+    mockedFs.mkdirSync.mockReset();
+  });
+
+  describe('collectOutputs', () => {
+    it('should return an empty manifest when no output types are declared', async () => {
+      const manifest = await OutputService.collectOutputs(projectPath, buildGuid, '');
+      expect(manifest.buildGuid).toBe(buildGuid);
+      expect(manifest.outputs).toHaveLength(0);
+      expect(manifest.timestamp).toBeTruthy();
+    });
+
+    it('should skip outputs where the path does not exist', async () => {
+      mockedFs.existsSync.mockReturnValue(false);
+
+      const manifest = await OutputService.collectOutputs(projectPath, buildGuid, 'build,logs');
+      expect(manifest.outputs).toHaveLength(0);
+    });
+
+    it('should collect directory outputs with file listings', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => true, size: 0 } as any);
+      mockedFs.readdirSync.mockImplementation((_dirPath: any, options?: any) => {
+        if (options?.withFileTypes) {
+          return [
+            { name: 'file1.txt', isDirectory: () => false },
+            { name: 'file2.txt', isDirectory: () => false },
+          ] as any;
+        }
+
+        return ['file1.txt', 'file2.txt'] as any;
+      });
+
+      const manifest = await OutputService.collectOutputs(projectPath, buildGuid, 'logs');
+      expect(manifest.outputs).toHaveLength(1);
+      expect(manifest.outputs[0].type).toBe('logs');
+      expect(manifest.outputs[0].files).toEqual(['file1.txt', 'file2.txt']);
+    });
+
+    it('should collect file output with correct size', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 4096 } as any);
+
+      const manifest = await OutputService.collectOutputs(projectPath, buildGuid, 'coverage');
+      expect(manifest.outputs).toHaveLength(1);
+      expect(manifest.outputs[0].size).toBe(4096);
+    });
+
+    it('should write manifest to disk when manifestPath is provided', async () => {
+      // existsSync returns false for output paths (no outputs found) but mkdirSync/writeFileSync should still be called
+      // The service only writes manifest when at least one output type is declared and types are resolved
+      // So we need to provide a valid output type and have its path exist
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 100 } as any);
+      mockedFs.mkdirSync.mockReturnValue(undefined);
+      mockedFs.writeFileSync.mockImplementation(() => {});
+
+      const manifestPath = '/output/manifest.json';
+      await OutputService.collectOutputs(projectPath, buildGuid, 'logs', manifestPath);
+
+      expect(mockedFs.mkdirSync).toHaveBeenCalledWith(path.dirname(manifestPath), { recursive: true });
+      expect(mockedFs.writeFileSync).toHaveBeenCalledWith(manifestPath, expect.any(String), 'utf8');
+    });
+
+    it('should generate valid JSON in the manifest file', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 200 } as any);
+      mockedFs.mkdirSync.mockReturnValue(undefined);
+      mockedFs.writeFileSync.mockImplementation(() => {});
+
+      const manifestPath = '/output/manifest.json';
+      await OutputService.collectOutputs(projectPath, buildGuid, 'coverage', manifestPath);
+
+      const writtenContent = (mockedFs.writeFileSync as jest.Mock).mock.calls[0][1];
+      const parsed = JSON.parse(writtenContent);
+      expect(parsed.buildGuid).toBe(buildGuid);
+      expect(Array.isArray(parsed.outputs)).toBe(true);
+      expect(parsed.outputs.length).toBeGreaterThan(0);
+    });
+
+    it('should set a valid ISO 8601 timestamp', async () => {
+      const manifest = await OutputService.collectOutputs(projectPath, buildGuid, '');
+      const parsed = new Date(manifest.timestamp);
+      expect(parsed.toISOString()).toBe(manifest.timestamp);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// ArtifactUploadHandler Tests
+// ---------------------------------------------------------------------------
+describe('ArtifactUploadHandler', () => {
+  const projectPath = '/project';
+
+  beforeEach(() => {
+    mockedFs.existsSync.mockReset();
+    mockedFs.statSync.mockReset();
+    mockedFs.readdirSync.mockReset();
+    mockedFs.mkdirSync.mockReset();
+    mockedFs.copyFileSync.mockReset();
+  });
+
+  describe('parseConfig', () => {
+    it('should parse valid config values', () => {
+      const config = ArtifactUploadHandler.parseConfig('github-artifacts', '/dest', 'gzip', '14');
+      expect(config.target).toBe('github-artifacts');
+      expect(config.destination).toBe('/dest');
+      expect(config.compression).toBe('gzip');
+      expect(config.retentionDays).toBe(14);
+    });
+
+    it('should default invalid target to github-artifacts', () => {
+      const config = ArtifactUploadHandler.parseConfig('invalid', undefined, 'none', '30');
+      expect(config.target).toBe('github-artifacts');
+    });
+
+    it('should default invalid compression to gzip', () => {
+      const config = ArtifactUploadHandler.parseConfig('local', '/dest', 'brotli', '30');
+      expect(config.compression).toBe('gzip');
+    });
+
+    it('should default invalid retention to 30 days', () => {
+      const config = ArtifactUploadHandler.parseConfig('local', '/dest', 'gzip', 'abc');
+      expect(config.retentionDays).toBe(30);
+    });
+
+    it('should default negative retention to 30 days', () => {
+      const config = ArtifactUploadHandler.parseConfig('local', '/dest', 'gzip', '-5');
+      expect(config.retentionDays).toBe(30);
+    });
+
+    it('should set destination to undefined when empty string', () => {
+      const config = ArtifactUploadHandler.parseConfig('storage', '', 'none', '7');
+      expect(config.destination).toBeUndefined();
+    });
+  });
+
+  describe('uploadArtifacts', () => {
+    it('should skip upload when target is none', async () => {
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/' }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'none',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(true);
+      expect(result.entries).toHaveLength(0);
+    });
+
+    it('should return success with no entries for empty manifest', async () => {
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'github-artifacts',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(true);
+      expect(result.entries).toHaveLength(0);
+      expect(result.totalBytes).toBe(0);
+    });
+
+    it('should fail entry when output path does not exist', async () => {
+      mockedFs.existsSync.mockReturnValue(false);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/Missing/' }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'local',
+        destination: '/output',
+        compression: 'none',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(false);
+      expect(result.entries).toHaveLength(1);
+      expect(result.entries[0].success).toBe(false);
+      expect(result.entries[0].error).toContain('does not exist');
+    });
+
+    it('should copy files for local upload target', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 1024 } as any);
+      mockedFs.mkdirSync.mockReturnValue(undefined);
+      mockedFs.copyFileSync.mockReturnValue(undefined);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'logs', path: './Logs/build.log', size: 1024 }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'local',
+        destination: '/output',
+        compression: 'none',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(true);
+      expect(result.entries).toHaveLength(1);
+      expect(result.entries[0].success).toBe(true);
+      expect(result.totalBytes).toBe(1024);
+    });
+
+    it('should fail local upload when no destination is provided', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 512 } as any);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'logs', path: './Logs/build.log', size: 512 }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'local',
+        compression: 'none',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(false);
+      expect(result.entries[0].success).toBe(false);
+      expect(result.entries[0].error).toContain('destination path');
+    });
+
+    it('should report correct duration', async () => {
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'none',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.durationMs).toBeGreaterThanOrEqual(0);
+    });
+  });
+
+  describe('collectFiles', () => {
+    it('should return single file for a file path', () => {
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false } as any);
+
+      const files = ArtifactUploadHandler.collectFiles('/path/to/file.txt');
+      expect(files).toEqual(['/path/to/file.txt']);
+    });
+
+    it('should return all files recursively for a directory', () => {
+      mockedFs.statSync.mockImplementation((p: any) => {
+        const pathStr = typeof p === 'string' ? p : p.toString();
+        if (pathStr.endsWith('.txt') || pathStr.endsWith('.log')) {
+          return { isDirectory: () => false } as any;
+        }
+
+        return { isDirectory: () => true } as any;
+      });
+
+      mockedFs.readdirSync.mockImplementation((dirPath: any, _options?: any) => {
+        const dirStr = typeof dirPath === 'string' ? dirPath : dirPath.toString();
+        if (dirStr === '/root') {
+          return [
+            { name: 'file1.txt', isDirectory: () => false },
+            { name: 'sub', isDirectory: () => true },
+          ] as any;
+        }
+        if (dirStr.endsWith('sub')) {
+          return [{ name: 'file2.log', isDirectory: () => false }] as any;
+        }
+
+        return [] as any;
+      });
+
+      const files = ArtifactUploadHandler.collectFiles('/root');
+      expect(files).toHaveLength(2);
+      expect(files).toContain(path.join('/root', 'file1.txt'));
+      expect(files).toContain(path.join('/root', 'sub', 'file2.log'));
+    });
+  });
+
+  describe('storage upload validation', () => {
+    it('should fail storage upload when no destination is provided', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 256 } as any);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/', size: 256 }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'storage',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(false);
+      expect(result.entries[0].error).toContain('destination URI');
+    });
+
+    it('should fail storage upload when destination URI has invalid format', async () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 256 } as any);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/', size: 256 }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'storage',
+        destination: '/just/a/local/path',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(false);
+      expect(result.entries[0].error).toContain('Invalid storage destination URI');
+    });
+
+    it('should fail storage upload when rclone is not installed', async () => {
+      // Mock child_process.execFileSync to throw (rclone not found)
+      const childProcess = require('node:child_process');
+      const originalExecFileSync = childProcess.execFileSync;
+      childProcess.execFileSync = jest.fn(() => {
+        throw new Error('ENOENT');
+      });
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 256 } as any);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/', size: 256 }],
+      };
+
+      const config: ArtifactUploadConfig = {
+        target: 'storage',
+        destination: 's3:my-bucket/artifacts',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      expect(result.success).toBe(false);
+      expect(result.entries[0].error).toContain('rclone is not installed');
+
+      // Restore
+      childProcess.execFileSync = originalExecFileSync;
+    });
+
+    it('should accept valid rclone storage URI formats', async () => {
+      // Mock child_process.execFileSync to succeed (rclone available)
+      const childProcess = require('node:child_process');
+      const originalExecFileSync = childProcess.execFileSync;
+      childProcess.execFileSync = jest.fn(() => 'rclone v1.65.0');
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.statSync.mockReturnValue({ isDirectory: () => false, size: 256 } as any);
+
+      const manifest: OutputManifest = {
+        buildGuid: 'test-guid',
+        timestamp: new Date().toISOString(),
+        outputs: [{ type: 'build', path: './Builds/', size: 256 }],
+      };
+
+      // s3:bucket format should pass URI validation and reach the exec call
+      const config: ArtifactUploadConfig = {
+        target: 'storage',
+        destination: 's3:my-bucket/artifacts',
+        compression: 'gzip',
+        retentionDays: 30,
+      };
+
+      const result = await ArtifactUploadHandler.uploadArtifacts(manifest, config, projectPath);
+      // Should succeed because exec is mocked to return 0
+      expect(result.entries[0].success).toBe(true);
+
+      // Restore
+      childProcess.execFileSync = originalExecFileSync;
+    });
+  });
+});

src/model/orchestrator/services/output/artifact-upload-handler.ts

@@ -0,0 +1,474 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { exec } from '@actions/exec';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { OutputManifest, OutputEntry } from './output-manifest';
+
+/**
+ * Configuration for artifact upload.
+ */
+export interface ArtifactUploadConfig {
+  /** Upload target: 'github-artifacts', 'storage', 'local', 'none' */
+  target: 'github-artifacts' | 'storage' | 'local' | 'none';
+
+  /** Destination path — storage URI for 'storage', local path for 'local' */
+  destination?: string;
+
+  /** Compression method */
+  compression: 'none' | 'gzip' | 'lz4';
+
+  /** Retention period in days (GitHub Artifacts only) */
+  retentionDays: number;
+}
+
+/**
+ * Result of an artifact upload operation.
+ */
+export interface UploadResult {
+  /** Whether the upload succeeded overall */
+  success: boolean;
+
+  /** Per-entry upload results */
+  entries: UploadEntryResult[];
+
+  /** Total bytes uploaded */
+  totalBytes: number;
+
+  /** Duration in milliseconds */
+  durationMs: number;
+}
+
+export interface UploadEntryResult {
+  /** The output type name */
+  type: string;
+
+  /** The output path */
+  path: string;
+
+  /** Whether this entry uploaded successfully */
+  success: boolean;
+
+  /** Bytes uploaded for this entry */
+  bytes: number;
+
+  /** Error message if upload failed */
+  error?: string;
+}
+
+/**
+ * GitHub Artifacts size limit per artifact (10 GB).
+ * Files larger than this must be split.
+ */
+const GITHUB_ARTIFACT_SIZE_LIMIT = 10 * 1024 * 1024 * 1024;
+
+/**
+ * Minimum valid storage URI pattern: "remote:path" or "remote:".
+ * rclone requires at least a remote name followed by a colon.
+ */
+const STORAGE_URI_PATTERN = /^[a-zA-Z][\w-]*:/;
+
+/**
+ * Check whether rclone is installed and available on PATH.
+ * Returns true if `rclone version` executes successfully.
+ */
+function isRcloneAvailable(): boolean {
+  try {
+    execFileSync('rclone', ['version'], { stdio: 'pipe', timeout: 5000 });
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validate that a storage destination URI has the correct rclone format.
+ * Valid format: "remoteName:path" (e.g., "s3:bucket/prefix", "gdrive:folder").
+ */
+function isValidStorageUri(uri: string): boolean {
+  return STORAGE_URI_PATTERN.test(uri);
+}
+
+/**
+ * Handles uploading build artifacts to various targets.
+ */
+export class ArtifactUploadHandler {
+  /**
+   * Upload artifacts described by a manifest to the configured target.
+   */
+  static async uploadArtifacts(
+    manifest: OutputManifest,
+    config: ArtifactUploadConfig,
+    projectPath: string,
+  ): Promise<UploadResult> {
+    const startTime = Date.now();
+    const result: UploadResult = {
+      success: true,
+      entries: [],
+      totalBytes: 0,
+      durationMs: 0,
+    };
+
+    if (config.target === 'none') {
+      OrchestratorLogger.log('[ArtifactUpload] Upload target is "none", skipping upload');
+      result.durationMs = Date.now() - startTime;
+
+      return result;
+    }
+
+    if (manifest.outputs.length === 0) {
+      OrchestratorLogger.log('[ArtifactUpload] No outputs in manifest, nothing to upload');
+      result.durationMs = Date.now() - startTime;
+
+      return result;
+    }
+
+    OrchestratorLogger.log(`[ArtifactUpload] Uploading ${manifest.outputs.length} output(s) to ${config.target}`);
+
+    for (const entry of manifest.outputs) {
+      const entryResult = await ArtifactUploadHandler.uploadEntry(entry, config, projectPath);
+      result.entries.push(entryResult);
+      result.totalBytes += entryResult.bytes;
+
+      if (!entryResult.success) {
+        result.success = false;
+      }
+    }
+
+    result.durationMs = Date.now() - startTime;
+
+    OrchestratorLogger.log(
+      `[ArtifactUpload] Upload complete: ${result.entries.filter((e) => e.success).length}/${
+        result.entries.length
+      } succeeded, ${result.totalBytes} bytes, ${result.durationMs}ms`,
+    );
+
+    return result;
+  }
+
+  /**
+   * Upload a single output entry.
+   */
+  private static async uploadEntry(
+    entry: OutputEntry,
+    config: ArtifactUploadConfig,
+    projectPath: string,
+  ): Promise<UploadEntryResult> {
+    const entryResult: UploadEntryResult = {
+      type: entry.type,
+      path: entry.path,
+      success: false,
+      bytes: entry.size || 0,
+    };
+
+    const resolvedPath = path.resolve(
+      projectPath,
+      entry.path.replace('{platform}', process.env.BUILD_TARGET || 'Unknown'),
+    );
+
+    if (!fs.existsSync(resolvedPath)) {
+      entryResult.error = `Output path does not exist: ${resolvedPath}`;
+      OrchestratorLogger.logWarning(`[ArtifactUpload] ${entryResult.error}`);
+
+      return entryResult;
+    }
+
+    try {
+      switch (config.target) {
+        case 'github-artifacts':
+          await ArtifactUploadHandler.uploadToGitHubArtifacts(entry, resolvedPath, config);
+          break;
+        case 'storage':
+          await ArtifactUploadHandler.uploadToStorage(entry, resolvedPath, config);
+          break;
+        case 'local':
+          await ArtifactUploadHandler.uploadToLocal(entry, resolvedPath, config);
+          break;
+      }
+      entryResult.success = true;
+      OrchestratorLogger.log(
+        `[ArtifactUpload] Uploaded '${entry.type}' (${entryResult.bytes} bytes) to ${config.target}`,
+      );
+    } catch (error: any) {
+      entryResult.error = error.message || String(error);
+      OrchestratorLogger.logWarning(`[ArtifactUpload] Failed to upload '${entry.type}': ${entryResult.error}`);
+    }
+
+    return entryResult;
+  }
+
+  /**
+   * Upload to GitHub Artifacts via @actions/artifact.
+   * Handles large file splitting if artifacts exceed the size limit.
+   */
+  private static async uploadToGitHubArtifacts(
+    entry: OutputEntry,
+    resolvedPath: string,
+    config: ArtifactUploadConfig,
+  ): Promise<void> {
+    // Dynamically require @actions/artifact — it may not be available in all environments.
+    // Using a variable to prevent TypeScript from resolving the module at compile time.
+    let artifact: any;
+    try {
+      const artifactModule = '@actions/artifact';
+      // eslint-disable-next-line @typescript-eslint/no-require-imports
+      artifact = require(artifactModule);
+    } catch {
+      throw new Error('@actions/artifact package is not available. Install it to use github-artifacts upload target.');
+    }
+
+    const artifactClient = artifact.DefaultArtifactClient
+      ? new artifact.DefaultArtifactClient()
+      : artifact.default
+      ? new artifact.default()
+      : artifact;
+
+    const files = ArtifactUploadHandler.collectFiles(resolvedPath);
+
+    if (files.length === 0) {
+      OrchestratorLogger.logWarning(`[ArtifactUpload] No files found at ${resolvedPath} for '${entry.type}'`);
+
+      return;
+    }
+
+    const totalSize = entry.size || 0;
+    const artifactName = `unity-output-${entry.type}`;
+
+    if (totalSize > GITHUB_ARTIFACT_SIZE_LIMIT) {
+      OrchestratorLogger.log(
+        `[ArtifactUpload] Output '${entry.type}' exceeds GitHub Artifacts size limit (${totalSize} > ${GITHUB_ARTIFACT_SIZE_LIMIT}), splitting into chunks`,
+      );
+      await ArtifactUploadHandler.uploadChunked(artifactClient, artifactName, files, resolvedPath, config);
+    } else {
+      const rootDirectory = fs.statSync(resolvedPath).isDirectory() ? resolvedPath : path.dirname(resolvedPath);
+
+      if (typeof artifactClient.uploadArtifact === 'function') {
+        await artifactClient.uploadArtifact(artifactName, files, rootDirectory, {
+          retentionDays: config.retentionDays,
+          compressionLevel: config.compression === 'none' ? 0 : 6,
+        });
+      } else {
+        throw new Error(
+          '@actions/artifact client does not have uploadArtifact method. Ensure the package version is compatible.',
+        );
+      }
+    }
+  }
+
+  /**
+   * Upload large artifacts in chunks to stay within GitHub size limits.
+   */
+  private static async uploadChunked(
+    artifactClient: any,
+    baseName: string,
+    files: string[],
+    rootDirectory: string,
+    config: ArtifactUploadConfig,
+  ): Promise<void> {
+    const chunkSize = GITHUB_ARTIFACT_SIZE_LIMIT;
+    let currentChunkFiles: string[] = [];
+    let currentChunkSize = 0;
+    let chunkIndex = 0;
+
+    for (const filePath of files) {
+      const fileSize = fs.statSync(filePath).size;
+
+      if (currentChunkSize + fileSize > chunkSize && currentChunkFiles.length > 0) {
+        await ArtifactUploadHandler.uploadSingleChunk(
+          artifactClient,
+          `${baseName}-part${chunkIndex}`,
+          currentChunkFiles,
+          rootDirectory,
+          config,
+        );
+        chunkIndex++;
+        currentChunkFiles = [];
+        currentChunkSize = 0;
+      }
+
+      currentChunkFiles.push(filePath);
+      currentChunkSize += fileSize;
+    }
+
+    if (currentChunkFiles.length > 0) {
+      await ArtifactUploadHandler.uploadSingleChunk(
+        artifactClient,
+        chunkIndex > 0 ? `${baseName}-part${chunkIndex}` : baseName,
+        currentChunkFiles,
+        rootDirectory,
+        config,
+      );
+    }
+  }
+
+  private static async uploadSingleChunk(
+    artifactClient: any,
+    name: string,
+    files: string[],
+    rootDirectory: string,
+    config: ArtifactUploadConfig,
+  ): Promise<void> {
+    OrchestratorLogger.log(`[ArtifactUpload] Uploading chunk '${name}' with ${files.length} file(s)`);
+
+    if (typeof artifactClient.uploadArtifact === 'function') {
+      await artifactClient.uploadArtifact(name, files, rootDirectory, {
+        retentionDays: config.retentionDays,
+        compressionLevel: config.compression === 'none' ? 0 : 6,
+      });
+    }
+  }
+
+  /**
+   * Upload to remote storage via rclone.
+   *
+   * Validates rclone availability and destination URI format before attempting
+   * the upload. If rclone is not installed, falls back to local copy when a
+   * local-compatible destination is provided, or skips with a clear error.
+   */
+  private static async uploadToStorage(
+    entry: OutputEntry,
+    resolvedPath: string,
+    config: ArtifactUploadConfig,
+  ): Promise<void> {
+    if (!config.destination) {
+      throw new Error('Storage upload requires a destination URI in artifactUploadPath');
+    }
+
+    // Validate storage URI format before attempting upload
+    if (!isValidStorageUri(config.destination)) {
+      throw new Error(
+        `Invalid storage destination URI: "${config.destination}". ` +
+          'Expected rclone remote format "remoteName:path" (e.g., "s3:my-bucket/artifacts", "gdrive:builds").',
+      );
+    }
+
+    // Check rclone availability before attempting upload
+    if (!isRcloneAvailable()) {
+      OrchestratorLogger.error(
+        'rclone is not installed or not in PATH. ' +
+          'Install rclone (https://rclone.org/install/) to use storage-based artifact upload. ' +
+          'Falling back to local copy.',
+      );
+
+      // Attempt local copy fallback using the destination as a hint
+      // Strip the remote prefix to get a local-ish path for fallback
+      OrchestratorLogger.logWarning(
+        `[ArtifactUpload] Storage upload skipped for '${entry.type}' — rclone not available`,
+      );
+      throw new Error(
+        'rclone is not installed or not in PATH. ' +
+          'Install rclone from https://rclone.org/install/ to use storage-based artifact upload.',
+      );
+    }
+
+    const destination = `${config.destination}/${entry.type}`;
+
+    OrchestratorLogger.log(`[ArtifactUpload] Uploading '${entry.type}' to storage: ${destination}`);
+
+    const args = ['copy', resolvedPath, destination, '--progress'];
+
+    if (config.compression !== 'none') {
+      // rclone doesn't have built-in compression flags for copy;
+      // compression is typically handled by the remote configuration.
+      // Log as informational.
+      OrchestratorLogger.log(
+        `[ArtifactUpload] Note: compression '${config.compression}' is configured at the remote level for rclone`,
+      );
+    }
+
+    await exec('rclone', args);
+  }
+
+  /**
+   * Upload to a local path (copy).
+   */
+  private static async uploadToLocal(
+    entry: OutputEntry,
+    resolvedPath: string,
+    config: ArtifactUploadConfig,
+  ): Promise<void> {
+    if (!config.destination) {
+      throw new Error('Local upload requires a destination path in artifactUploadPath');
+    }
+
+    const destination = path.join(config.destination, entry.type);
+    fs.mkdirSync(destination, { recursive: true });
+
+    OrchestratorLogger.log(`[ArtifactUpload] Copying '${entry.type}' to local path: ${destination}`);
+
+    ArtifactUploadHandler.copyRecursive(resolvedPath, destination);
+  }
+
+  /**
+   * Recursively copy files from source to destination.
+   */
+  private static copyRecursive(source: string, destination: string): void {
+    const stat = fs.statSync(source);
+
+    if (stat.isDirectory()) {
+      fs.mkdirSync(destination, { recursive: true });
+      const entries = fs.readdirSync(source);
+      for (const entry of entries) {
+        ArtifactUploadHandler.copyRecursive(path.join(source, entry), path.join(destination, entry));
+      }
+    } else {
+      fs.copyFileSync(source, destination);
+    }
+  }
+
+  /**
+   * Collect all files at a given path (recursively if directory).
+   */
+  static collectFiles(targetPath: string): string[] {
+    const stat = fs.statSync(targetPath);
+
+    if (!stat.isDirectory()) {
+      return [targetPath];
+    }
+
+    const files: string[] = [];
+    const entries = fs.readdirSync(targetPath, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const fullPath = path.join(targetPath, entry.name);
+      if (entry.isDirectory()) {
+        files.push(...ArtifactUploadHandler.collectFiles(fullPath));
+      } else {
+        files.push(fullPath);
+      }
+    }
+
+    return files;
+  }
+
+  /**
+   * Parse an ArtifactUploadConfig from action inputs.
+   */
+  static parseConfig(
+    target: string,
+    destination: string | undefined,
+    compression: string,
+    retentionDays: string,
+  ): ArtifactUploadConfig {
+    const validTargets = ['github-artifacts', 'storage', 'local', 'none'] as const;
+    const resolvedTarget = validTargets.includes(target as any)
+      ? (target as ArtifactUploadConfig['target'])
+      : 'github-artifacts';
+
+    const validCompressions = ['none', 'gzip', 'lz4'] as const;
+    const resolvedCompression = validCompressions.includes(compression as any)
+      ? (compression as ArtifactUploadConfig['compression'])
+      : 'gzip';
+
+    const parsedRetention = Number.parseInt(retentionDays, 10);
+    const resolvedRetention = Number.isNaN(parsedRetention) || parsedRetention <= 0 ? 30 : parsedRetention;
+
+    return {
+      target: resolvedTarget,
+      destination: destination || undefined,
+      compression: resolvedCompression,
+      retentionDays: resolvedRetention,
+    };
+  }
+}

src/model/orchestrator/services/output/index.ts

@@ -0,0 +1,3 @@
+export { OutputManifest, OutputEntry } from './output-manifest';
+export { OutputTypeRegistry, OutputTypeDefinition } from './output-type-registry';
+export { OutputService } from './output-service';

src/model/orchestrator/services/output/output-manifest.ts

@@ -0,0 +1,41 @@
+/**
+ * Structured build output manifest.
+ * Describes all artifacts produced by a build with type, path, size, hash, and metadata.
+ */
+
+export interface OutputEntry {
+  /** Output type identifier (e.g., 'build', 'test-results', 'images') */
+  type: string;
+
+  /** Relative path to the output */
+  path: string;
+
+  /** Output format (e.g., 'nunit3', 'junit', 'json') */
+  format?: string;
+
+  /** File size in bytes */
+  size?: number;
+
+  /** Content hash (e.g., 'sha256:abc...') */
+  hash?: string;
+
+  /** Individual files within the output path */
+  files?: string[];
+
+  /** Type-specific summary (e.g., test counts, build size) */
+  summary?: Record<string, unknown>;
+
+  /** Arbitrary metadata */
+  metadata?: Record<string, unknown>;
+}
+
+export interface OutputManifest {
+  /** Unique build identifier */
+  buildGuid: string;
+
+  /** ISO 8601 timestamp */
+  timestamp: string;
+
+  /** All outputs produced by this build */
+  outputs: OutputEntry[];
+}

src/model/orchestrator/services/output/output-service.ts

@@ -0,0 +1,118 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { OutputManifest, OutputEntry } from './output-manifest';
+import { OutputTypeRegistry } from './output-type-registry';
+
+/**
+ * Service for collecting, manifesting, and managing build outputs.
+ *
+ * After a build completes, this service scans declared output paths,
+ * generates a structured manifest, and prepares outputs for post-processing.
+ */
+export class OutputService {
+  /**
+   * Collect outputs from the workspace and generate a manifest.
+   *
+   * @param projectPath - Path to the Unity project root
+   * @param buildGuid - Unique build identifier
+   * @param outputTypesInput - Comma-separated output type names
+   * @param manifestPath - Where to write the manifest JSON (optional)
+   * @returns The generated output manifest
+   */
+  static async collectOutputs(
+    projectPath: string,
+    buildGuid: string,
+    outputTypesInput: string,
+    manifestPath?: string,
+  ): Promise<OutputManifest> {
+    const types = OutputTypeRegistry.parseOutputTypes(outputTypesInput);
+    const manifest: OutputManifest = {
+      buildGuid,
+      timestamp: new Date().toISOString(),
+      outputs: [],
+    };
+
+    if (types.length === 0) {
+      OrchestratorLogger.log('[Output] No output types declared, skipping collection');
+
+      return manifest;
+    }
+
+    OrchestratorLogger.log(
+      `[Output] Collecting ${types.length} output type(s): ${types.map((t) => t.name).join(', ')}`,
+    );
+
+    for (const typeDef of types) {
+      const outputPath = path.join(
+        projectPath,
+        typeDef.defaultPath.replace('{platform}', process.env.BUILD_TARGET || 'Unknown'),
+      );
+
+      if (!fs.existsSync(outputPath)) {
+        OrchestratorLogger.log(`[Output] No output found for '${typeDef.name}' at ${outputPath}`);
+        continue;
+      }
+
+      const entry: OutputEntry = {
+        type: typeDef.name,
+        path: typeDef.defaultPath,
+      };
+
+      // Collect file listing for directory outputs
+      try {
+        const stat = fs.statSync(outputPath);
+        if (stat.isDirectory()) {
+          entry.files = fs.readdirSync(outputPath);
+          entry.size = OutputService.getDirectorySize(outputPath);
+        } else {
+          entry.size = stat.size;
+        }
+      } catch {
+        OrchestratorLogger.logWarning(`[Output] Failed to stat output '${typeDef.name}' at ${outputPath}`);
+      }
+
+      manifest.outputs.push(entry);
+      OrchestratorLogger.log(
+        `[Output] Collected '${typeDef.name}': ${entry.files?.length || 1} file(s), ${entry.size || 0} bytes`,
+      );
+    }
+
+    // Write manifest to disk
+    if (manifestPath) {
+      try {
+        const manifestDir = path.dirname(manifestPath);
+        fs.mkdirSync(manifestDir, { recursive: true });
+        fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf8');
+        OrchestratorLogger.log(`[Output] Manifest written to ${manifestPath}`);
+      } catch (error: any) {
+        OrchestratorLogger.logWarning(`[Output] Failed to write manifest: ${error.message}`);
+      }
+    }
+
+    return manifest;
+  }
+
+  /**
+   * Calculate total size of a directory recursively.
+   */
+  private static getDirectorySize(dirPath: string): number {
+    let totalSize = 0;
+
+    try {
+      const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(dirPath, entry.name);
+        if (entry.isDirectory()) {
+          totalSize += OutputService.getDirectorySize(fullPath);
+        } else {
+          totalSize += fs.statSync(fullPath).size;
+        }
+      }
+    } catch {
+      // Ignore errors in size calculation
+    }
+
+    return totalSize;
+  }
+}

src/model/orchestrator/services/output/output-type-registry.ts

@@ -0,0 +1,136 @@
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+/**
+ * Registry of known output types with default paths and processing hints.
+ */
+
+export interface OutputTypeDefinition {
+  /** Type identifier */
+  name: string;
+
+  /** Default output path (relative to project root) */
+  defaultPath: string;
+
+  /** Human-readable description */
+  description: string;
+
+  /** Whether this type is built-in or user-registered */
+  builtIn: boolean;
+}
+
+export class OutputTypeRegistry {
+  private static readonly builtInTypes: Record<string, OutputTypeDefinition> = {
+    build: {
+      name: 'build',
+      defaultPath: './Builds/{platform}/',
+      description: 'Standard game build artifact',
+      builtIn: true,
+    },
+    'test-results': {
+      name: 'test-results',
+      defaultPath: './TestResults/',
+      description: 'NUnit/JUnit XML test results',
+      builtIn: true,
+    },
+    'server-build': {
+      name: 'server-build',
+      defaultPath: './Builds/{platform}-server/',
+      description: 'Dedicated server build artifact',
+      builtIn: true,
+    },
+    'data-export': {
+      name: 'data-export',
+      defaultPath: './Exports/',
+      description: 'Exported data files (CSV, JSON, binary)',
+      builtIn: true,
+    },
+    images: {
+      name: 'images',
+      defaultPath: './Captures/',
+      description: 'Screenshots, render captures, atlas previews',
+      builtIn: true,
+    },
+    logs: {
+      name: 'logs',
+      defaultPath: './Logs/',
+      description: 'Structured build and test logs',
+      builtIn: true,
+    },
+    metrics: {
+      name: 'metrics',
+      defaultPath: './Metrics/',
+      description: 'Build performance metrics and asset statistics',
+      builtIn: true,
+    },
+    coverage: {
+      name: 'coverage',
+      defaultPath: './Coverage/',
+      description: 'Code coverage reports',
+      builtIn: true,
+    },
+  };
+
+  private static customTypes: Record<string, OutputTypeDefinition> = {};
+
+  /**
+   * Get a type definition by name. Checks custom types first, then built-in.
+   */
+  static getType(name: string): OutputTypeDefinition | undefined {
+    return OutputTypeRegistry.customTypes[name] || OutputTypeRegistry.builtInTypes[name];
+  }
+
+  /**
+   * Get all registered types (built-in + custom).
+   */
+  static getAllTypes(): OutputTypeDefinition[] {
+    return [...Object.values(OutputTypeRegistry.builtInTypes), ...Object.values(OutputTypeRegistry.customTypes)];
+  }
+
+  /**
+   * Register a custom output type.
+   */
+  static registerType(definition: OutputTypeDefinition): void {
+    if (OutputTypeRegistry.builtInTypes[definition.name]) {
+      OrchestratorLogger.logWarning(`[OutputTypes] Cannot override built-in type '${definition.name}'`);
+
+      return;
+    }
+
+    OutputTypeRegistry.customTypes[definition.name] = { ...definition, builtIn: false };
+    OrchestratorLogger.log(`[OutputTypes] Registered custom type '${definition.name}'`);
+  }
+
+  /**
+   * Parse a comma-separated output types string into type definitions.
+   * Unknown types are logged as warnings and skipped.
+   */
+  static parseOutputTypes(outputTypesInput: string): OutputTypeDefinition[] {
+    if (!outputTypesInput) {
+      return [];
+    }
+
+    const names = outputTypesInput
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
+    const types: OutputTypeDefinition[] = [];
+
+    for (const name of names) {
+      const typeDef = OutputTypeRegistry.getType(name);
+      if (typeDef) {
+        types.push(typeDef);
+      } else {
+        OrchestratorLogger.logWarning(`[OutputTypes] Unknown output type '${name}', skipping`);
+      }
+    }
+
+    return types;
+  }
+
+  /**
+   * Reset custom types (for testing).
+   */
+  static resetCustomTypes(): void {
+    OutputTypeRegistry.customTypes = {};
+  }
+}

src/model/orchestrator/services/reliability/build-reliability-service.test.ts

@@ -0,0 +1,638 @@
+import { execSync, execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { BuildReliabilityService } from './build-reliability-service';
+
+// Mock dependencies
+jest.mock('node:child_process');
+jest.mock('node:fs');
+jest.mock('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+}));
+
+const mockExecSync = execSync as jest.MockedFunction<typeof execSync>;
+const mockExecFileSync = execFileSync as jest.MockedFunction<typeof execFileSync>;
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('BuildReliabilityService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  // =========================================================================
+  // checkGitIntegrity
+  // =========================================================================
+
+  describe('checkGitIntegrity', () => {
+    it('should return true when fsck succeeds with clean output', () => {
+      mockExecSync.mockReturnValue('');
+      const result = BuildReliabilityService.checkGitIntegrity('/repo');
+      expect(result).toBe(true);
+      expect(mockExecSync).toHaveBeenCalledWith(
+        'git -C "/repo" fsck --no-dangling',
+        expect.objectContaining({ encoding: 'utf8' }),
+      );
+    });
+
+    it('should return false when fsck output contains corruption indicators', () => {
+      mockExecSync.mockReturnValue('broken link from tree abc123');
+      const result = BuildReliabilityService.checkGitIntegrity('/repo');
+      expect(result).toBe(false);
+    });
+
+    it('should return false when fsck output contains missing objects', () => {
+      mockExecSync.mockReturnValue('missing blob abc123');
+      const result = BuildReliabilityService.checkGitIntegrity('/repo');
+      expect(result).toBe(false);
+    });
+
+    it('should return false when execSync throws (non-zero exit code)', () => {
+      mockExecSync.mockImplementation(() => {
+        const error: any = new Error('fsck failed');
+        error.stderr = Buffer.from('error: bad object HEAD');
+        throw error;
+      });
+      const result = BuildReliabilityService.checkGitIntegrity('/repo');
+      expect(result).toBe(false);
+    });
+
+    it('should use current directory when no repoPath provided', () => {
+      mockExecSync.mockReturnValue('');
+      BuildReliabilityService.checkGitIntegrity();
+      expect(mockExecSync).toHaveBeenCalledWith('git -C "." fsck --no-dangling', expect.anything());
+    });
+  });
+
+  // =========================================================================
+  // cleanStaleLockFiles
+  // =========================================================================
+
+  describe('cleanStaleLockFiles', () => {
+    it('should return 0 when .git directory does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
+      expect(result).toBe(0);
+    });
+
+    it('should remove lock files older than 10 minutes', () => {
+      const now = Date.now();
+      const oldTime = now - 15 * 60 * 1000; // 15 minutes ago
+
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.statSync.mockImplementation((filePath: any) => {
+        if (filePath === path.join('/repo', '.git')) {
+          return { isDirectory: () => true } as fs.Stats;
+        }
+        return { mtimeMs: oldTime } as fs.Stats;
+      });
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/repo', '.git')) {
+          return [
+            { name: 'index.lock', isDirectory: () => false },
+            { name: 'HEAD.lock', isDirectory: () => false },
+          ] as any;
+        }
+        return [];
+      });
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
+      expect(result).toBe(2);
+      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(2);
+    });
+
+    it('should NOT remove lock files younger than 10 minutes', () => {
+      const now = Date.now();
+      const recentTime = now - 2 * 60 * 1000; // 2 minutes ago
+
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.statSync.mockImplementation((filePath: any) => {
+        if (filePath === path.join('/repo', '.git')) {
+          return { isDirectory: () => true } as fs.Stats;
+        }
+        return { mtimeMs: recentTime } as fs.Stats;
+      });
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/repo', '.git')) {
+          return [{ name: 'index.lock', isDirectory: () => false }] as any;
+        }
+        return [];
+      });
+
+      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
+      expect(result).toBe(0);
+      expect(mockFs.unlinkSync).not.toHaveBeenCalled();
+    });
+
+    it('should recursively scan refs directory for lock files', () => {
+      const now = Date.now();
+      const oldTime = now - 15 * 60 * 1000;
+
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.statSync.mockImplementation((filePath: any) => {
+        if (filePath === path.join('/repo', '.git')) {
+          return { isDirectory: () => true } as fs.Stats;
+        }
+        return { mtimeMs: oldTime } as fs.Stats;
+      });
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        const gitDir = path.join('/repo', '.git');
+        if (dir === gitDir) {
+          return [{ name: 'refs', isDirectory: () => true }] as any;
+        }
+        if (dir === path.join(gitDir, 'refs')) {
+          return [{ name: 'heads', isDirectory: () => true }] as any;
+        }
+        if (dir === path.join(gitDir, 'refs', 'heads')) {
+          return [{ name: 'main.lock', isDirectory: () => false }] as any;
+        }
+        return [];
+      });
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.cleanStaleLockFiles('/repo');
+      expect(result).toBe(1);
+    });
+  });
+
+  // =========================================================================
+  // validateSubmoduleBackingStores
+  // =========================================================================
+
+  describe('validateSubmoduleBackingStores', () => {
+    it('should return empty array when .gitmodules does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
+      expect(result).toEqual([]);
+    });
+
+    it('should detect broken backing store for submodule', () => {
+      mockFs.existsSync.mockImplementation((p: any) => {
+        if (p === path.join('/repo', '.gitmodules')) return true;
+        if (p === path.join('/repo', 'lib/sub', '.git')) return true;
+        // Backing store does not exist
+        return false;
+      });
+      mockFs.readFileSync.mockImplementation((p: any) => {
+        if (p === path.join('/repo', '.gitmodules')) {
+          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
+        }
+        if (p === path.join('/repo', 'lib/sub', '.git')) {
+          return 'gitdir: ../../.git/modules/lib/sub';
+        }
+        return '';
+      });
+      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
+
+      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
+      expect(result).toContain('lib/sub');
+    });
+
+    it('should return empty array when all submodule backing stores are valid', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation((p: any) => {
+        if (p === path.join('/repo', '.gitmodules')) {
+          return '[submodule "sub"]\n\tpath = lib/sub\n\turl = https://example.com/sub.git';
+        }
+        if (p === path.join('/repo', 'lib/sub', '.git')) {
+          return 'gitdir: ../../.git/modules/lib/sub';
+        }
+        return '';
+      });
+      mockFs.statSync.mockReturnValue({ isFile: () => true } as fs.Stats);
+
+      const result = BuildReliabilityService.validateSubmoduleBackingStores('/repo');
+      expect(result).toEqual([]);
+    });
+  });
+
+  // =========================================================================
+  // recoverCorruptedRepo
+  // =========================================================================
+
+  describe('recoverCorruptedRepo', () => {
+    it('should orchestrate fsck cleanup and re-fetch, returning true on success', () => {
+      // cleanStaleLockFiles: no .git dir
+      mockFs.existsSync.mockReturnValue(false);
+      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
+
+      // fetch succeeds, then fsck succeeds
+      mockExecSync.mockReturnValue('');
+
+      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
+      expect(result).toBe(true);
+      // Should have called fetch
+      expect(mockExecSync).toHaveBeenCalledWith('git -C "/repo" fetch --all', expect.anything());
+    });
+
+    it('should return false when recovery fails to restore integrity', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
+
+      // fetch succeeds, but fsck fails
+      mockExecSync.mockImplementation((cmd: any) => {
+        if (typeof cmd === 'string' && cmd.includes('fetch')) return '';
+        if (typeof cmd === 'string' && cmd.includes('fsck')) {
+          return 'missing blob abc123';
+        }
+        return '';
+      });
+
+      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
+      expect(result).toBe(false);
+    });
+
+    it('should continue recovery even when fetch fails', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      mockFs.statSync.mockReturnValue({ isDirectory: () => false } as fs.Stats);
+
+      let callCount = 0;
+      mockExecSync.mockImplementation((cmd: any) => {
+        callCount++;
+        if (typeof cmd === 'string' && cmd.includes('fetch')) {
+          throw new Error('network error');
+        }
+        // fsck call
+        return '';
+      });
+
+      const result = BuildReliabilityService.recoverCorruptedRepo('/repo');
+      // Should still attempt fsck after failed fetch
+      expect(callCount).toBeGreaterThanOrEqual(2);
+    });
+  });
+
+  // =========================================================================
+  // cleanReservedFilenames
+  // =========================================================================
+
+  describe('cleanReservedFilenames', () => {
+    it('should return empty array when Assets directory does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const result = BuildReliabilityService.cleanReservedFilenames('/project');
+      expect(result).toEqual([]);
+    });
+
+    it('should remove files with reserved names (con, prn, aux, nul)', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/project', 'Assets')) {
+          return [
+            { name: 'con.txt', isDirectory: () => false },
+            { name: 'PRN.meta', isDirectory: () => false },
+            { name: 'aux.shader', isDirectory: () => false },
+            { name: 'nul.png', isDirectory: () => false },
+            { name: 'valid-file.cs', isDirectory: () => false },
+          ] as any;
+        }
+        return [];
+      });
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.cleanReservedFilenames('/project');
+      expect(result).toHaveLength(4);
+      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(4);
+    });
+
+    it('should remove directories with reserved names', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/project', 'Assets')) {
+          return [{ name: 'com1', isDirectory: () => true }] as any;
+        }
+        return [];
+      });
+      mockFs.rmSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.cleanReservedFilenames('/project');
+      expect(result).toHaveLength(1);
+      expect(mockFs.rmSync).toHaveBeenCalledWith(path.join('/project', 'Assets', 'com1'), {
+        recursive: true,
+        force: true,
+      });
+    });
+
+    it('should detect COM1 through COM9 and LPT1 through LPT9', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/project', 'Assets')) {
+          return [
+            { name: 'com1.txt', isDirectory: () => false },
+            { name: 'COM9.meta', isDirectory: () => false },
+            { name: 'lpt1.dat', isDirectory: () => false },
+            { name: 'LPT9.log', isDirectory: () => false },
+          ] as any;
+        }
+        return [];
+      });
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.cleanReservedFilenames('/project');
+      expect(result).toHaveLength(4);
+    });
+
+    it('should not remove files that merely contain reserved names as substrings', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockImplementation((dir: any) => {
+        if (dir === path.join('/project', 'Assets')) {
+          return [
+            { name: 'controller.cs', isDirectory: () => false },
+            { name: 'printer-utils.cs', isDirectory: () => false },
+            { name: 'auxiliary.shader', isDirectory: () => false },
+          ] as any;
+        }
+        return [];
+      });
+
+      const result = BuildReliabilityService.cleanReservedFilenames('/project');
+      expect(result).toHaveLength(0);
+    });
+  });
+
+  // =========================================================================
+  // getAvailableSpaceMB
+  // =========================================================================
+
+  describe('getAvailableSpaceMB', () => {
+    it('should return -1 when the check fails', () => {
+      mockExecFileSync.mockImplementation(() => {
+        throw new Error('Command failed');
+      });
+
+      const result = BuildReliabilityService.getAvailableSpaceMB('/some/path');
+      expect(result).toBe(-1);
+    });
+
+    it('should parse wmic output on Windows', () => {
+      const originalPlatform = process.platform;
+      Object.defineProperty(process, 'platform', { value: 'win32' });
+
+      // 10 GB in bytes
+      mockExecFileSync.mockReturnValue('\r\nFreeSpace=10737418240\r\n' as any);
+
+      const result = BuildReliabilityService.getAvailableSpaceMB('C:\\builds');
+      // 10737418240 / (1024 * 1024) = 10240 MB
+      expect(result).toBeCloseTo(10240, 0);
+
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    });
+
+    it('should parse df output on Unix', () => {
+      const originalPlatform = process.platform;
+      Object.defineProperty(process, 'platform', { value: 'linux' });
+
+      mockExecFileSync.mockReturnValue('  Avail\n  5120M\n' as any);
+
+      const result = BuildReliabilityService.getAvailableSpaceMB('/builds');
+      expect(result).toBe(5120);
+
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    });
+  });
+
+  // =========================================================================
+  // getDirectorySizeMB
+  // =========================================================================
+
+  describe('getDirectorySizeMB', () => {
+    it('should return file size for a single file', () => {
+      // 5 MB in bytes
+      mockFs.statSync.mockReturnValue({ isDirectory: () => false, size: 5 * 1024 * 1024 } as any);
+
+      const result = BuildReliabilityService.getDirectorySizeMB('/path/to/file.zip');
+      expect(result).toBeCloseTo(5, 0);
+    });
+
+    it('should return total size for a directory tree', () => {
+      const subDir = path.join('/build', 'sub');
+
+      mockFs.statSync.mockImplementation((p: any) => {
+        const pathStr = typeof p === 'string' ? p : p.toString();
+        if (pathStr === '/build' || pathStr === subDir) {
+          return { isDirectory: () => true, size: 0 } as any;
+        }
+
+        return { isDirectory: () => false, size: 1024 * 1024 } as any; // 1 MB each
+      });
+
+      mockFs.readdirSync.mockImplementation((dirPath: any, _options?: any) => {
+        const dirStr = typeof dirPath === 'string' ? dirPath : dirPath.toString();
+        if (dirStr === '/build') {
+          return [
+            { name: 'file1.bin', isDirectory: () => false },
+            { name: 'sub', isDirectory: () => true },
+          ] as any;
+        }
+        if (dirStr === subDir) {
+          return [{ name: 'file2.bin', isDirectory: () => false }] as any;
+        }
+
+        return [] as any;
+      });
+
+      const result = BuildReliabilityService.getDirectorySizeMB('/build');
+      expect(result).toBeCloseTo(2, 0); // 2 files * 1 MB each
+    });
+
+    it('should return -1 when calculation fails', () => {
+      mockFs.statSync.mockImplementation(() => {
+        throw new Error('Access denied');
+      });
+
+      const result = BuildReliabilityService.getDirectorySizeMB('/inaccessible');
+      expect(result).toBe(-1);
+    });
+  });
+
+  // =========================================================================
+  // archiveBuildOutput
+  // =========================================================================
+
+  describe('archiveBuildOutput', () => {
+    it('should skip archiving when source path does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
+      expect(mockExecSync).not.toHaveBeenCalled();
+    });
+
+    it('should create archive directory and tar.gz output', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.mkdirSync.mockReturnValue(undefined as any);
+      mockExecSync.mockReturnValue('');
+      // Make disk space check return unknown so we proceed
+      mockExecFileSync.mockImplementation(() => {
+        throw new Error('Command not found');
+      });
+      mockFs.statSync.mockImplementation(() => {
+        throw new Error('Not mocked');
+      });
+
+      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
+
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith('/archives', { recursive: true });
+      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
+    });
+
+    it('should skip archival when insufficient disk space', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.mkdirSync.mockReturnValue(undefined as any);
+
+      // Source is 1000 MB
+      mockFs.statSync.mockImplementation((p: any) => {
+        const pathStr = typeof p === 'string' ? p : p.toString();
+        if (pathStr.endsWith('big-file.bin')) {
+          return { isDirectory: () => false, size: 1000 * 1024 * 1024 } as any;
+        }
+        return { isDirectory: () => true, size: 0 } as any;
+      });
+      mockFs.readdirSync.mockImplementation(() => {
+        return [{ name: 'big-file.bin', isDirectory: () => false }] as any;
+      });
+
+      // Only 500 MB available
+      const originalPlatform = process.platform;
+      Object.defineProperty(process, 'platform', { value: 'linux' });
+      mockExecFileSync.mockReturnValue('  Avail\n  500M\n' as any);
+
+      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
+
+      // Should NOT have attempted the tar command
+      expect(mockExecSync).not.toHaveBeenCalledWith(expect.stringContaining('tar'), expect.anything());
+
+      Object.defineProperty(process, 'platform', { value: originalPlatform });
+    });
+
+    it('should clean up partial archive on tar failure', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.mkdirSync.mockReturnValue(undefined as any);
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      // Make disk space check return unknown so we proceed
+      mockExecFileSync.mockImplementation(() => {
+        throw new Error('Command not found');
+      });
+      mockFs.statSync.mockImplementation(() => {
+        throw new Error('Not mocked');
+      });
+
+      // tar command fails
+      mockExecSync.mockImplementation(() => {
+        const error: any = new Error('tar failed');
+        error.stderr = Buffer.from('No space left on device');
+        throw error;
+      });
+
+      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
+
+      // Should have attempted to clean up the partial archive
+      // (existsSync returns true for the partial file)
+      expect(mockFs.unlinkSync).toHaveBeenCalled();
+    });
+
+    it('should proceed with warning when disk space check fails', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.mkdirSync.mockReturnValue(undefined as any);
+      mockExecSync.mockReturnValue('');
+
+      // Disk space check fails
+      mockExecFileSync.mockImplementation(() => {
+        throw new Error('Command not found');
+      });
+      // Directory size check also fails
+      mockFs.statSync.mockImplementation(() => {
+        throw new Error('Not mocked');
+      });
+
+      BuildReliabilityService.archiveBuildOutput('/builds/output', '/archives');
+
+      // Should still proceed with tar
+      expect(mockExecSync).toHaveBeenCalledWith(expect.stringContaining('tar -czf'), expect.anything());
+    });
+  });
+
+  // =========================================================================
+  // enforceRetention
+  // =========================================================================
+
+  describe('enforceRetention', () => {
+    it('should return 0 when archive path does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const result = BuildReliabilityService.enforceRetention('/archive', 30);
+      expect(result).toBe(0);
+    });
+
+    it('should remove archives older than retention period', () => {
+      const now = Date.now();
+      const oldTime = now - 45 * 24 * 60 * 60 * 1000; // 45 days ago
+      const recentTime = now - 5 * 24 * 60 * 60 * 1000; // 5 days ago
+
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockReturnValue([
+        { name: 'build-old.tar.gz', isDirectory: () => false },
+        { name: 'build-recent.tar.gz', isDirectory: () => false },
+      ] as any);
+      mockFs.statSync.mockImplementation((p: any) => {
+        if ((p as string).includes('old')) {
+          return { mtimeMs: oldTime } as fs.Stats;
+        }
+        return { mtimeMs: recentTime } as fs.Stats;
+      });
+      mockFs.unlinkSync.mockReturnValue(undefined);
+
+      const result = BuildReliabilityService.enforceRetention('/archive', 30);
+      expect(result).toBe(1);
+      expect(mockFs.unlinkSync).toHaveBeenCalledTimes(1);
+    });
+
+    it('should keep all archives within retention period', () => {
+      const now = Date.now();
+      const recentTime = now - 5 * 24 * 60 * 60 * 1000;
+
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readdirSync.mockReturnValue([
+        { name: 'build-1.tar.gz', isDirectory: () => false },
+        { name: 'build-2.tar.gz', isDirectory: () => false },
+      ] as any);
+      mockFs.statSync.mockReturnValue({ mtimeMs: recentTime } as fs.Stats);
+
+      const result = BuildReliabilityService.enforceRetention('/archive', 30);
+      expect(result).toBe(0);
+    });
+  });
+
+  // =========================================================================
+  // configureGitEnvironment
+  // =========================================================================
+
+  describe('configureGitEnvironment', () => {
+    it('should set GIT_TERMINAL_PROMPT=0 in process.env', () => {
+      mockExecSync.mockReturnValue('');
+      BuildReliabilityService.configureGitEnvironment();
+      expect(process.env.GIT_TERMINAL_PROMPT).toBe('0');
+    });
+
+    it('should configure http.postBuffer via git config', () => {
+      mockExecSync.mockReturnValue('');
+      BuildReliabilityService.configureGitEnvironment();
+      expect(mockExecSync).toHaveBeenCalledWith('git config --global http.postBuffer 524288000', expect.anything());
+    });
+
+    it('should configure core.longpaths via git config', () => {
+      mockExecSync.mockReturnValue('');
+      BuildReliabilityService.configureGitEnvironment();
+      expect(mockExecSync).toHaveBeenCalledWith('git config --global core.longpaths true', expect.anything());
+    });
+
+    it('should warn but not throw when git config commands fail', () => {
+      const core = require('@actions/core');
+      mockExecSync.mockImplementation(() => {
+        throw new Error('git config failed');
+      });
+
+      // Should not throw
+      expect(() => BuildReliabilityService.configureGitEnvironment()).not.toThrow();
+      expect(core.warning).toHaveBeenCalled();
+    });
+  });
+});

src/model/orchestrator/services/reliability/build-reliability-service.ts

@@ -0,0 +1,527 @@
+import { execSync, execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import * as core from '@actions/core';
+
+/**
+ * Build reliability features for hardening CI pipelines.
+ * Provides git integrity checks, stale lock cleanup, submodule validation,
+ * reserved filename removal, build archival, and git environment configuration.
+ * All features are opt-in and fail gracefully (warnings only).
+ */
+export class BuildReliabilityService {
+  // Windows reserved device names that cause Unity asset importer infinite loops
+  private static readonly RESERVED_NAMES = new Set([
+    'con',
+    'prn',
+    'aux',
+    'nul',
+    'com1',
+    'com2',
+    'com3',
+    'com4',
+    'com5',
+    'com6',
+    'com7',
+    'com8',
+    'com9',
+    'lpt1',
+    'lpt2',
+    'lpt3',
+    'lpt4',
+    'lpt5',
+    'lpt6',
+    'lpt7',
+    'lpt8',
+    'lpt9',
+  ]);
+
+  // Lock files to look for in the .git directory
+  private static readonly LOCK_FILE_NAMES = new Set(['index.lock', 'shallow.lock', 'config.lock', 'HEAD.lock']);
+
+  // Maximum age in milliseconds before a lock file is considered stale (10 minutes)
+  private static readonly LOCK_FILE_MAX_AGE_MS = 10 * 60 * 1000;
+
+  /**
+   * Run git fsck to check repository integrity.
+   * Returns true if the repo is healthy, false if corruption detected.
+   */
+  static checkGitIntegrity(repoPath: string = '.'): boolean {
+    core.info(`[Reliability] Checking git integrity in ${repoPath}`);
+
+    try {
+      const output = execSync(`git -C "${repoPath}" fsck --no-dangling`, {
+        encoding: 'utf8',
+        timeout: 120_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+
+      // Parse output for corruption indicators
+      const corruptionPatterns = [
+        /broken link/i,
+        /missing (blob|tree|commit|tag)/i,
+        /dangling/i,
+        /corrupt/i,
+        /error in /i,
+      ];
+
+      for (const pattern of corruptionPatterns) {
+        if (pattern.test(output)) {
+          core.warning(`[Reliability] Git integrity check found issues: ${output.trim()}`);
+          return false;
+        }
+      }
+
+      core.info('[Reliability] Git integrity check passed');
+      return true;
+    } catch (error: any) {
+      // execSync throws on non-zero exit code
+      const stderr = error.stderr?.toString() ?? error.message;
+      core.warning(`[Reliability] Git integrity check failed: ${stderr}`);
+      return false;
+    }
+  }
+
+  /**
+   * Remove stale .lock files from the .git directory.
+   * Only removes lock files older than 10 minutes to avoid interfering with active operations.
+   * Returns the number of lock files removed.
+   */
+  static cleanStaleLockFiles(repoPath: string = '.'): number {
+    const gitDir = path.join(repoPath, '.git');
+    if (!fs.existsSync(gitDir) || !fs.statSync(gitDir).isDirectory()) {
+      return 0;
+    }
+
+    core.info(`[Reliability] Scanning for stale lock files in ${gitDir}`);
+    const now = Date.now();
+    let removed = 0;
+
+    const cleanDirectory = (directory: string): void => {
+      if (!fs.existsSync(directory)) return;
+
+      try {
+        const entries = fs.readdirSync(directory, { withFileTypes: true });
+        for (const entry of entries) {
+          const fullPath = path.join(directory, entry.name);
+          if (entry.isDirectory()) {
+            cleanDirectory(fullPath);
+          } else if (entry.name.endsWith('.lock')) {
+            // Check if it is a known lock file location OR under refs/
+            const relativePath = path.relative(gitDir, fullPath);
+            const isKnownLock = BuildReliabilityService.LOCK_FILE_NAMES.has(entry.name);
+            const isRefsLock = relativePath.startsWith('refs' + path.sep);
+
+            if (isKnownLock || isRefsLock) {
+              try {
+                const stat = fs.statSync(fullPath);
+                const ageMs = now - stat.mtimeMs;
+
+                if (ageMs > BuildReliabilityService.LOCK_FILE_MAX_AGE_MS) {
+                  fs.unlinkSync(fullPath);
+                  removed++;
+                  core.info(
+                    `[Reliability] Removed stale lock file (age: ${Math.round(ageMs / 1000)}s): ${relativePath}`,
+                  );
+                } else {
+                  core.info(
+                    `[Reliability] Lock file is recent (age: ${Math.round(ageMs / 1000)}s), skipping: ${relativePath}`,
+                  );
+                }
+              } catch {
+                core.warning(`[Reliability] Could not remove lock file: ${fullPath}`);
+              }
+            }
+          }
+        }
+      } catch {
+        // Directory not accessible
+      }
+    };
+
+    cleanDirectory(gitDir);
+
+    if (removed > 0) {
+      core.info(`[Reliability] Cleaned ${removed} stale lock file(s)`);
+    } else {
+      core.info('[Reliability] No stale lock files found');
+    }
+
+    return removed;
+  }
+
+  /**
+   * Validate that submodule .git files point to existing backing stores
+   * under .git/modules/. Returns list of submodule paths with broken backing stores.
+   */
+  static validateSubmoduleBackingStores(repoPath: string = '.'): string[] {
+    const broken: string[] = [];
+    const gitmodulesPath = path.join(repoPath, '.gitmodules');
+
+    if (!fs.existsSync(gitmodulesPath)) {
+      core.info('[Reliability] No .gitmodules found, skipping submodule validation');
+      return broken;
+    }
+
+    core.info(`[Reliability] Validating submodule backing stores in ${repoPath}`);
+
+    try {
+      const content = fs.readFileSync(gitmodulesPath, 'utf8');
+      const pathMatches = content.matchAll(/path\s*=\s*(.+)/g);
+
+      for (const match of pathMatches) {
+        const submodulePath = match[1].trim();
+        const gitFile = path.join(repoPath, submodulePath, '.git');
+
+        if (!fs.existsSync(gitFile)) {
+          // Submodule not initialized -- not necessarily broken
+          continue;
+        }
+
+        try {
+          const stat = fs.statSync(gitFile);
+          if (stat.isFile()) {
+            // .git is a file -- should contain "gitdir: <path>"
+            const gitFileContent = fs.readFileSync(gitFile, 'utf8').trim();
+            const gitdirMatch = gitFileContent.match(/^gitdir:\s*(.+)$/);
+
+            if (gitdirMatch) {
+              const backingStore = path.resolve(path.join(repoPath, submodulePath), gitdirMatch[1]);
+              if (!fs.existsSync(backingStore)) {
+                broken.push(submodulePath);
+                core.warning(`[Reliability] Submodule ${submodulePath} has broken backing store: ${backingStore}`);
+              } else {
+                core.info(`[Reliability] Submodule ${submodulePath} backing store OK`);
+              }
+            } else {
+              broken.push(submodulePath);
+              core.warning(`[Reliability] Submodule ${submodulePath} .git file has invalid format`);
+            }
+          }
+        } catch {
+          // Can't read .git file
+          core.warning(`[Reliability] Could not read .git file for submodule: ${submodulePath}`);
+        }
+      }
+    } catch (error: any) {
+      core.warning(`[Reliability] Could not read .gitmodules: ${error.message}`);
+    }
+
+    if (broken.length > 0) {
+      core.warning(`[Reliability] ${broken.length} submodule(s) have broken backing stores`);
+    } else {
+      core.info('[Reliability] All submodule backing stores are valid');
+    }
+
+    return broken;
+  }
+
+  /**
+   * Orchestrate recovery of a corrupted repository.
+   * Sequence: fsck -> clean locks -> re-fetch -> retry fsck.
+   * Returns true if recovery succeeded.
+   */
+  static recoverCorruptedRepo(repoPath: string = '.'): boolean {
+    core.warning(`[Reliability] Attempting automatic recovery for ${repoPath}`);
+
+    // Step 1: Clean stale lock files that may be preventing operations
+    const locksRemoved = BuildReliabilityService.cleanStaleLockFiles(repoPath);
+    if (locksRemoved > 0) {
+      core.info(`[Reliability] Recovery: cleaned ${locksRemoved} lock file(s)`);
+    }
+
+    // Step 2: Re-fetch to restore missing objects
+    try {
+      core.info('[Reliability] Recovery: re-fetching from remote');
+      execSync(`git -C "${repoPath}" fetch --all`, {
+        encoding: 'utf8',
+        timeout: 300_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      core.info('[Reliability] Recovery: fetch completed');
+    } catch (error: any) {
+      core.warning(`[Reliability] Recovery: fetch failed: ${error.stderr?.toString() ?? error.message}`);
+    }
+
+    // Step 3: Retry fsck
+    const healthy = BuildReliabilityService.checkGitIntegrity(repoPath);
+    if (healthy) {
+      core.info('[Reliability] Recovery succeeded -- repository is healthy');
+    } else {
+      core.warning('[Reliability] Recovery failed -- repository still has integrity issues');
+    }
+
+    return healthy;
+  }
+
+  /**
+   * Scan a directory tree for files/directories with Windows reserved names.
+   * These names (con, prn, aux, nul, com1-9, lpt1-9) with any extension
+   * cause Unity asset importer infinite loops on Windows.
+   * Returns list of paths that were removed.
+   */
+  static cleanReservedFilenames(projectPath: string): string[] {
+    const assetsPath = path.join(projectPath, 'Assets');
+    if (!fs.existsSync(assetsPath)) {
+      core.info(`[Reliability] No Assets directory found at ${assetsPath}, skipping reserved filename scan`);
+      return [];
+    }
+
+    core.info(`[Reliability] Scanning for reserved filenames in ${assetsPath}`);
+    const cleaned: string[] = [];
+
+    const scanDirectory = (directory: string): void => {
+      try {
+        const entries = fs.readdirSync(directory, { withFileTypes: true });
+        for (const entry of entries) {
+          const nameWithoutExtension = entry.name.split('.')[0].toLowerCase();
+          const fullPath = path.join(directory, entry.name);
+
+          if (BuildReliabilityService.RESERVED_NAMES.has(nameWithoutExtension)) {
+            try {
+              if (entry.isDirectory()) {
+                fs.rmSync(fullPath, { recursive: true, force: true });
+              } else {
+                fs.unlinkSync(fullPath);
+              }
+              cleaned.push(fullPath);
+              core.warning(`[Reliability] Removed reserved filename: ${fullPath}`);
+            } catch {
+              core.warning(`[Reliability] Could not remove reserved filename: ${fullPath}`);
+            }
+          } else if (entry.isDirectory()) {
+            scanDirectory(fullPath);
+          }
+        }
+      } catch {
+        // Directory not accessible
+      }
+    };
+
+    scanDirectory(assetsPath);
+
+    if (cleaned.length > 0) {
+      core.warning(`[Reliability] Cleaned ${cleaned.length} reserved filename(s)`);
+    } else {
+      core.info('[Reliability] No reserved filenames found');
+    }
+
+    return cleaned;
+  }
+
+  /**
+   * Get available disk space in megabytes for a given directory.
+   * Returns -1 if the check fails (unknown space).
+   *
+   * Cross-platform: uses wmic on Windows, df on Unix.
+   */
+  static getAvailableSpaceMB(directoryPath: string): number {
+    try {
+      if (process.platform === 'win32') {
+        const drive = path.parse(directoryPath).root;
+        const driveLetter = drive.replace(/[:\\\/]/g, '');
+        const output = execFileSync(
+          'wmic',
+          ['logicaldisk', 'where', `DeviceID='${driveLetter}:'`, 'get', 'FreeSpace', '/value'],
+          { encoding: 'utf8', timeout: 10_000 },
+        );
+        const match = output.match(/FreeSpace=(\d+)/);
+
+        return match ? Number.parseInt(match[1], 10) / (1024 * 1024) : -1;
+      } else {
+        const output = execFileSync('df', ['-BM', '--output=avail', directoryPath], {
+          encoding: 'utf8',
+          timeout: 10_000,
+        });
+        const lines = output.trim().split('\n');
+
+        return Number.parseInt(lines[lines.length - 1], 10);
+      }
+    } catch {
+      return -1; // Unknown, caller should proceed with warning
+    }
+  }
+
+  /**
+   * Calculate the total size of a directory in megabytes.
+   * Returns -1 if the calculation fails.
+   */
+  static getDirectorySizeMB(directoryPath: string): number {
+    try {
+      const stat = fs.statSync(directoryPath);
+      if (!stat.isDirectory()) {
+        return stat.size / (1024 * 1024);
+      }
+
+      let totalBytes = 0;
+      const walkDirectory = (dir: string): void => {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          const fullPath = path.join(dir, entry.name);
+          if (entry.isDirectory()) {
+            walkDirectory(fullPath);
+          } else {
+            try {
+              totalBytes += fs.statSync(fullPath).size;
+            } catch {
+              // Skip inaccessible files
+            }
+          }
+        }
+      };
+
+      walkDirectory(directoryPath);
+
+      return totalBytes / (1024 * 1024);
+    } catch {
+      return -1;
+    }
+  }
+
+  /**
+   * Create a tar.gz archive of build output.
+   *
+   * Validates disk space before archiving. Skips archival with a warning
+   * if insufficient space is detected, preventing partial writes on full disks.
+   */
+  static archiveBuildOutput(sourcePath: string, archivePath: string): void {
+    if (!fs.existsSync(sourcePath)) {
+      core.info(`[Reliability] No build output to archive at ${sourcePath}`);
+      return;
+    }
+
+    fs.mkdirSync(archivePath, { recursive: true });
+
+    // Check available disk space before archiving
+    const sourceSizeMB = BuildReliabilityService.getDirectorySizeMB(sourcePath);
+    const availableSpaceMB = BuildReliabilityService.getAvailableSpaceMB(archivePath);
+
+    if (sourceSizeMB >= 0 && availableSpaceMB >= 0) {
+      const neededMB = Math.ceil(sourceSizeMB * 1.1); // 10% safety margin
+      if (availableSpaceMB < neededMB) {
+        core.warning(
+          `[Reliability] Insufficient disk space for archive. ` +
+            `Need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB. Skipping archive.`,
+        );
+        return;
+      }
+      core.info(
+        `[Reliability] Disk space check passed: need ~${neededMB}MB, available: ${Math.floor(availableSpaceMB)}MB`,
+      );
+    } else if (availableSpaceMB < 0) {
+      core.warning('[Reliability] Could not determine available disk space. Proceeding with archive cautiously.');
+    }
+
+    const timestamp = new Date().toISOString().replace(/[.:]/g, '-');
+    const archiveFile = path.join(archivePath, `build-${timestamp}.tar.gz`);
+
+    try {
+      execSync(`tar -czf "${archiveFile}" -C "${path.dirname(sourcePath)}" "${path.basename(sourcePath)}"`, {
+        encoding: 'utf8',
+        timeout: 600_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      core.info(`[Reliability] Build output archived to ${archiveFile}`);
+    } catch (error: any) {
+      core.warning(`[Reliability] Failed to archive build output: ${error.stderr?.toString() ?? error.message}`);
+
+      // Clean up partial archive if it exists to avoid leaving corrupted files
+      try {
+        if (fs.existsSync(archiveFile)) {
+          fs.unlinkSync(archiveFile);
+          core.info(`[Reliability] Cleaned up partial archive: ${archiveFile}`);
+        }
+      } catch {
+        // Best-effort cleanup
+      }
+    }
+  }
+
+  /**
+   * Enforce retention policy -- delete archives older than the retention period.
+   * Returns the number of old archives removed.
+   */
+  static enforceRetention(archivePath: string, retentionDays: number): number {
+    if (!fs.existsSync(archivePath)) {
+      return 0;
+    }
+
+    const now = Date.now();
+    const retentionMs = retentionDays * 24 * 60 * 60 * 1000;
+    let removed = 0;
+
+    try {
+      const entries = fs.readdirSync(archivePath, { withFileTypes: true });
+      for (const entry of entries) {
+        const fullPath = path.join(archivePath, entry.name);
+        try {
+          const stat = fs.statSync(fullPath);
+          const ageMs = now - stat.mtimeMs;
+
+          if (ageMs > retentionMs) {
+            if (entry.isDirectory()) {
+              fs.rmSync(fullPath, { recursive: true, force: true });
+            } else {
+              fs.unlinkSync(fullPath);
+            }
+            removed++;
+            core.info(
+              `[Reliability] Removed old archive: ${entry.name} (age: ${Math.round(
+                ageMs / (24 * 60 * 60 * 1000),
+              )} days)`,
+            );
+          }
+        } catch {
+          core.warning(`[Reliability] Could not process archive entry: ${fullPath}`);
+        }
+      }
+    } catch {
+      core.warning(`[Reliability] Could not read archive directory: ${archivePath}`);
+      return 0;
+    }
+
+    if (removed > 0) {
+      core.info(
+        `[Reliability] Retention enforced: removed ${removed} old archive(s), retention: ${retentionDays} days`,
+      );
+    }
+
+    return removed;
+  }
+
+  /**
+   * Configure git environment variables for CI reliability.
+   * Sets GIT_TERMINAL_PROMPT=0, increases http.postBuffer, enables core.longpaths.
+   */
+  static configureGitEnvironment(): void {
+    core.info('[Reliability] Configuring git environment for CI');
+
+    // Prevent git from prompting for credentials (hangs in CI)
+    process.env.GIT_TERMINAL_PROMPT = '0';
+    core.info('[Reliability] Set GIT_TERMINAL_PROMPT=0');
+
+    try {
+      // Increase http.postBuffer to 500MB for large pushes
+      execSync('git config --global http.postBuffer 524288000', {
+        encoding: 'utf8',
+        timeout: 10_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      core.info('[Reliability] Set http.postBuffer=524288000 (500MB)');
+    } catch (error: any) {
+      core.warning(`[Reliability] Could not set http.postBuffer: ${error.message}`);
+    }
+
+    try {
+      // Enable long paths on Windows
+      execSync('git config --global core.longpaths true', {
+        encoding: 'utf8',
+        timeout: 10_000,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+      core.info('[Reliability] Set core.longpaths=true');
+    } catch (error: any) {
+      core.warning(`[Reliability] Could not set core.longpaths: ${error.message}`);
+    }
+  }
+}

src/model/orchestrator/services/reliability/index.ts

@@ -0,0 +1 @@
+export { BuildReliabilityService } from './build-reliability-service';

src/model/orchestrator/services/secrets/secret-source-service.test.ts

@@ -0,0 +1,446 @@
+import fs from 'node:fs';
+import * as core from '@actions/core';
+import { SecretSourceService, validateSecretKey } from './secret-source-service';
+
+jest.mock('node:fs');
+jest.mock('@actions/core', () => ({
+  setSecret: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn(),
+  error: jest.fn(),
+}));
+jest.mock('../core/orchestrator-system', () => ({
+  OrchestratorSystem: {
+    Run: jest.fn().mockResolvedValue(''),
+  },
+}));
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+describe('SecretSourceService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('validateSecretKey', () => {
+    it('should accept alphanumeric keys', () => {
+      expect(validateSecretKey('MY_SECRET_KEY')).toBe('MY_SECRET_KEY');
+    });
+
+    it('should accept keys with hyphens', () => {
+      expect(validateSecretKey('my-secret-key')).toBe('my-secret-key');
+    });
+
+    it('should accept keys with dots', () => {
+      expect(validateSecretKey('my.secret.key')).toBe('my.secret.key');
+    });
+
+    it('should accept keys with forward slashes', () => {
+      expect(validateSecretKey('path/to/secret')).toBe('path/to/secret');
+    });
+
+    it('should accept keys with mixed valid characters', () => {
+      expect(validateSecretKey('my-app/prod_db.password')).toBe('my-app/prod_db.password');
+    });
+
+    it('should reject keys with semicolons (shell injection)', () => {
+      expect(() => validateSecretKey('; rm -rf /')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with backticks (command substitution)', () => {
+      expect(() => validateSecretKey('`whoami`')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with dollar signs (variable expansion)', () => {
+      expect(() => validateSecretKey('$HOME')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with pipe characters', () => {
+      expect(() => validateSecretKey('key | cat /etc/passwd')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with ampersands', () => {
+      expect(() => validateSecretKey('key && echo pwned')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with newlines', () => {
+      expect(() => validateSecretKey('key\nmalicious')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with quotes', () => {
+      expect(() => validateSecretKey('"key"')).toThrow('Invalid secret key name');
+      expect(() => validateSecretKey("'key'")).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with parentheses (subshell)', () => {
+      expect(() => validateSecretKey('$(whoami)')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject empty keys', () => {
+      expect(() => validateSecretKey('')).toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with spaces', () => {
+      expect(() => validateSecretKey('key with spaces')).toThrow('Invalid secret key name');
+    });
+  });
+
+  describe('isPremadeSource', () => {
+    it('should return true for aws-secrets-manager', () => {
+      expect(SecretSourceService.isPremadeSource('aws-secrets-manager')).toBe(true);
+    });
+
+    it('should return true for aws-secret-manager (legacy alias)', () => {
+      expect(SecretSourceService.isPremadeSource('aws-secret-manager')).toBe(true);
+    });
+
+    it('should return true for aws-parameter-store', () => {
+      expect(SecretSourceService.isPremadeSource('aws-parameter-store')).toBe(true);
+    });
+
+    it('should return true for gcp-secret-manager', () => {
+      expect(SecretSourceService.isPremadeSource('gcp-secret-manager')).toBe(true);
+    });
+
+    it('should return true for azure-key-vault', () => {
+      expect(SecretSourceService.isPremadeSource('azure-key-vault')).toBe(true);
+    });
+
+    it('should return true for hashicorp-vault', () => {
+      expect(SecretSourceService.isPremadeSource('hashicorp-vault')).toBe(true);
+    });
+
+    it('should return true for hashicorp-vault-kv1', () => {
+      expect(SecretSourceService.isPremadeSource('hashicorp-vault-kv1')).toBe(true);
+    });
+
+    it('should return true for vault (short alias)', () => {
+      expect(SecretSourceService.isPremadeSource('vault')).toBe(true);
+    });
+
+    it('should return false for unknown source', () => {
+      expect(SecretSourceService.isPremadeSource('unknown-source')).toBe(false);
+    });
+  });
+
+  describe('getAvailableSources', () => {
+    it('should return all premade source names', () => {
+      const sources = SecretSourceService.getAvailableSources();
+      expect(sources).toContain('aws-secrets-manager');
+      expect(sources).toContain('aws-parameter-store');
+      expect(sources).toContain('gcp-secret-manager');
+      expect(sources).toContain('azure-key-vault');
+      expect(sources).toContain('hashicorp-vault');
+      expect(sources).toContain('hashicorp-vault-kv1');
+      expect(sources).toContain('vault');
+      expect(sources.length).toBeGreaterThanOrEqual(8);
+    });
+  });
+
+  describe('resolveSource', () => {
+    it('should resolve premade source by name', () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('aws-secrets-manager');
+      expect(source!.command).toContain('secretsmanager');
+    });
+
+    it('should resolve custom command with {0} placeholder', () => {
+      const source = SecretSourceService.resolveSource('vault kv get -field=value secret/{0}');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('custom-command');
+      expect(source!.command).toContain('{0}');
+    });
+
+    it('should resolve command with spaces as custom command', () => {
+      const source = SecretSourceService.resolveSource('my-tool get-secret');
+      expect(source).toBeDefined();
+      expect(source!.name).toBe('custom-command');
+    });
+
+    it('should return undefined for unknown single-word source', () => {
+      const source = SecretSourceService.resolveSource('unknown');
+      expect(source).toBeUndefined();
+    });
+  });
+
+  describe('fetchSecret', () => {
+    it('should run the command with {0} replaced by key', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('my-secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(result).toBe('my-secret-value');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledWith(expect.stringContaining('MY_SECRET'), false, true);
+    });
+
+    it('should parse JSON output when parseOutput is json-field', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'extracted-secret' }));
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('extracted-secret');
+    });
+
+    it('should fall back to raw output on invalid JSON with json-field mode', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('not-json');
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('not-json');
+    });
+
+    it('should return empty string on command failure', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockRejectedValue(new Error('command not found'));
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(result).toBe('');
+    });
+
+    it('should reject keys with shell injection characters', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '; rm -rf /')).rejects.toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with command substitution', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '$(whoami)')).rejects.toThrow('Invalid secret key name');
+    });
+
+    it('should reject keys with backtick command substitution', async () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+
+      await expect(SecretSourceService.fetchSecret(source, '`cat /etc/passwd`')).rejects.toThrow(
+        'Invalid secret key name',
+      );
+    });
+
+    it('should accept keys with valid path-like patterns', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      const result = await SecretSourceService.fetchSecret(source, 'prod/database/password');
+
+      expect(result).toBe('secret-value');
+    });
+
+    it('should mask fetched secret values with core.setSecret', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('super-secret-value');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(core.setSecret).toHaveBeenCalledWith('super-secret-value');
+    });
+
+    it('should not mask empty secret values', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue('');
+
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      await SecretSourceService.fetchSecret(source, 'MY_SECRET');
+
+      expect(core.setSecret).not.toHaveBeenCalled();
+    });
+
+    it('should mask JSON-extracted secret values', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValue(JSON.stringify({ value: 'json-secret' }));
+
+      const source = {
+        name: 'test-source',
+        command: 'fetch {0}',
+        parseOutput: 'json-field' as const,
+        jsonField: 'value',
+      };
+      await SecretSourceService.fetchSecret(source, 'KEY');
+
+      expect(core.setSecret).toHaveBeenCalledWith('json-secret');
+    });
+  });
+
+  describe('fetchFromEnv', () => {
+    it('should return env var value when set', () => {
+      process.env.TEST_SECRET_KEY = 'env-value';
+      const result = SecretSourceService.fetchFromEnv('TEST_SECRET_KEY');
+      expect(result).toBe('env-value');
+      delete process.env.TEST_SECRET_KEY;
+    });
+
+    it('should return empty string when env var is not set', () => {
+      const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_12345');
+      expect(result).toBe('');
+    });
+
+    it('should mask env var values with core.setSecret', () => {
+      process.env.TEST_MASK_KEY = 'masked-env-value';
+      SecretSourceService.fetchFromEnv('TEST_MASK_KEY');
+      expect(core.setSecret).toHaveBeenCalledWith('masked-env-value');
+      delete process.env.TEST_MASK_KEY;
+    });
+
+    it('should not mask empty env var values', () => {
+      const result = SecretSourceService.fetchFromEnv('NONEXISTENT_KEY_99999');
+      expect(result).toBe('');
+      expect(core.setSecret).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('fetchAll', () => {
+    it('should fetch all keys from env source', async () => {
+      process.env.KEY_A = 'val-a';
+      process.env.KEY_B = 'val-b';
+
+      const results = await SecretSourceService.fetchAll('env', ['KEY_A', 'KEY_B']);
+
+      expect(results.KEY_A).toBe('val-a');
+      expect(results.KEY_B).toBe('val-b');
+
+      delete process.env.KEY_A;
+      delete process.env.KEY_B;
+    });
+
+    it('should fetch all keys from premade source', async () => {
+      const { OrchestratorSystem } = require('../core/orchestrator-system');
+      OrchestratorSystem.Run.mockResolvedValueOnce('secret-1').mockResolvedValueOnce('secret-2');
+
+      const results = await SecretSourceService.fetchAll('aws-parameter-store', ['param1', 'param2']);
+
+      expect(results.param1).toBe('secret-1');
+      expect(results.param2).toBe('secret-2');
+      expect(OrchestratorSystem.Run).toHaveBeenCalledTimes(2);
+    });
+
+    it('should return empty results for unknown source', async () => {
+      const results = await SecretSourceService.fetchAll('unknown', ['key1']);
+      expect(results).toEqual({});
+    });
+  });
+
+  describe('loadFromYaml', () => {
+    it('should return empty array when file does not exist', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(false);
+      const result = SecretSourceService.loadFromYaml('/nonexistent.yml');
+      expect(result).toEqual([]);
+    });
+
+    it('should parse valid YAML source definitions', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(`
+sources:
+  - name: my-vault
+    command: 'vault kv get -field=value secret/{0}'
+  - name: my-api
+    command: 'curl -s https://api.example.com/{0}'
+    parseOutput: json-field
+    jsonField: secret_value
+`);
+
+      const result = SecretSourceService.loadFromYaml('/sources.yml');
+
+      expect(result).toHaveLength(2);
+      expect(result[0].name).toBe('my-vault');
+      expect(result[0].command).toBe('vault kv get -field=value secret/{0}');
+      expect(result[1].name).toBe('my-api');
+      expect(result[1].parseOutput).toBe('json-field');
+      expect(result[1].jsonField).toBe('secret_value');
+    });
+
+    it('should handle YAML with single source', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockReturnValue(`
+sources:
+  - name: simple
+    command: echo {0}
+`);
+
+      const result = SecretSourceService.loadFromYaml('/simple.yml');
+      expect(result).toHaveLength(1);
+      expect(result[0].name).toBe('simple');
+    });
+
+    it('should return empty array on parse error', () => {
+      (mockFs.existsSync as jest.Mock).mockReturnValue(true);
+      (mockFs.readFileSync as jest.Mock).mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      const result = SecretSourceService.loadFromYaml('/error.yml');
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe('premade source commands', () => {
+    it('aws-secrets-manager uses --query SecretString', () => {
+      const source = SecretSourceService.resolveSource('aws-secrets-manager')!;
+      expect(source.command).toContain('--query SecretString');
+      expect(source.command).toContain('--output text');
+    });
+
+    it('aws-parameter-store uses --with-decryption', () => {
+      const source = SecretSourceService.resolveSource('aws-parameter-store')!;
+      expect(source.command).toContain('--with-decryption');
+      expect(source.command).toContain('--query Parameter.Value');
+    });
+
+    it('gcp-secret-manager uses latest version', () => {
+      const source = SecretSourceService.resolveSource('gcp-secret-manager')!;
+      expect(source.command).toContain('latest');
+    });
+
+    it('azure-key-vault uses AZURE_VAULT_NAME env var', () => {
+      const source = SecretSourceService.resolveSource('azure-key-vault')!;
+      expect(source.command).toContain('$AZURE_VAULT_NAME');
+    });
+
+    it('hashicorp-vault uses vault kv get with VAULT_MOUNT', () => {
+      const source = SecretSourceService.resolveSource('hashicorp-vault')!;
+      expect(source.command).toContain('vault kv get');
+      expect(source.command).toContain('VAULT_MOUNT');
+      expect(source.command).toContain('-field=value');
+    });
+
+    it('hashicorp-vault-kv1 uses vault read for KV v1', () => {
+      const source = SecretSourceService.resolveSource('hashicorp-vault-kv1')!;
+      expect(source.command).toContain('vault read');
+      expect(source.command).toContain('-field=value');
+    });
+
+    it('vault alias resolves to same command as hashicorp-vault', () => {
+      const vault = SecretSourceService.resolveSource('vault')!;
+      const hashicorpVault = SecretSourceService.resolveSource('hashicorp-vault')!;
+      expect(vault.command).toBe(hashicorpVault.command);
+    });
+  });
+});

src/model/orchestrator/services/secrets/secret-source-service.ts

@@ -0,0 +1,337 @@
+import fs from 'node:fs';
+import * as core from '@actions/core';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+
+/**
+ * A secret source definition: how to fetch a secret value by key.
+ */
+export interface SecretSourceDefinition {
+  name: string;
+  command: string;
+  parseOutput?: 'raw' | 'json-field';
+  jsonField?: string;
+}
+
+/**
+ * Validate that a secret key name contains only safe characters.
+ * Prevents shell injection when keys are interpolated into commands.
+ *
+ * Allowed characters: alphanumeric, hyphens, underscores, dots, forward slashes.
+ *
+ * @param key - The secret key name to validate
+ * @returns The validated key (unchanged)
+ * @throws Error if the key contains disallowed characters
+ */
+export function validateSecretKey(key: string): string {
+  if (!/^[a-zA-Z0-9\-_./]+$/.test(key)) {
+    throw new Error(
+      `Invalid secret key name: "${key}". Keys may only contain alphanumeric characters, hyphens, underscores, dots, and forward slashes.`,
+    );
+  }
+
+  return key;
+}
+
+/**
+ * Mask a secret value so it does not appear in GitHub Actions logs.
+ * Empty or whitespace-only values are skipped (core.setSecret would be a no-op).
+ */
+function maskSecretValue(value: string): void {
+  if (value.trim().length > 0) {
+    core.setSecret(value);
+  }
+}
+
+/**
+ * Premade secret sources and custom YAML-based secret source definitions.
+ *
+ * Premade sources are string shortcuts that expand to shell commands:
+ *   - `aws-secrets-manager` -- AWS Secrets Manager
+ *   - `aws-parameter-store` -- AWS Systems Manager Parameter Store
+ *   - `gcp-secret-manager` -- Google Cloud Secret Manager
+ *   - `azure-key-vault` -- Azure Key Vault (requires AZURE_VAULT_NAME env var)
+ *   - `hashicorp-vault` -- HashiCorp Vault KV v2 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `hashicorp-vault-kv1` -- HashiCorp Vault KV v1 (requires VAULT_ADDR, optionally VAULT_MOUNT)
+ *   - `env` -- Read from environment variables (no shell command needed)
+ *
+ * Custom YAML format:
+ *   sources:
+ *     - name: my-vault
+ *       command: 'vault kv get -field=value secret/{0}'
+ *     - name: my-api
+ *       command: 'curl -s https://secrets.example.com/api/{0}'
+ *       parseOutput: json-field
+ *       jsonField: value
+ */
+export class SecretSourceService {
+  private static readonly premadeSources: Record<string, SecretSourceDefinition> = {
+    'aws-secrets-manager': {
+      name: 'aws-secrets-manager',
+      command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+      parseOutput: 'raw',
+    },
+    'aws-secret-manager': {
+      // Alias for backward compatibility (original name in inputPullCommand)
+      name: 'aws-secret-manager',
+      command: 'aws secretsmanager get-secret-value --secret-id {0} --query SecretString --output text',
+      parseOutput: 'raw',
+    },
+    'aws-parameter-store': {
+      name: 'aws-parameter-store',
+      command: 'aws ssm get-parameter --name {0} --with-decryption --query Parameter.Value --output text',
+      parseOutput: 'raw',
+    },
+    'gcp-secret-manager': {
+      name: 'gcp-secret-manager',
+      command: 'gcloud secrets versions access latest --secret="{0}"',
+      parseOutput: 'raw',
+    },
+    'azure-key-vault': {
+      name: 'azure-key-vault',
+      command: 'az keyvault secret show --vault-name "$AZURE_VAULT_NAME" --name {0} --query value --output tsv',
+      parseOutput: 'raw',
+    },
+    'hashicorp-vault': {
+      // HashiCorp Vault KV v2 (default). Requires VAULT_ADDR env var.
+      // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+      // Authentication is handled by VAULT_TOKEN or other Vault auth env vars.
+      name: 'hashicorp-vault',
+      command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+    'hashicorp-vault-kv1': {
+      // HashiCorp Vault KV v1. Requires VAULT_ADDR env var.
+      // Optionally set VAULT_MOUNT to override the mount path (default: 'secret').
+      name: 'hashicorp-vault-kv1',
+      command: 'vault read -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+    vault: {
+      // Short alias for hashicorp-vault (KV v2)
+      name: 'vault',
+      command: 'vault kv get -mount="${VAULT_MOUNT:-secret}" -field=value {0}',
+      parseOutput: 'raw',
+    },
+  };
+
+  /**
+   * Check if a source name is a known premade source.
+   */
+  static isPremadeSource(sourceName: string): boolean {
+    return sourceName in SecretSourceService.premadeSources;
+  }
+
+  /**
+   * Get the list of available premade source names.
+   */
+  static getAvailableSources(): string[] {
+    return Object.keys(SecretSourceService.premadeSources);
+  }
+
+  /**
+   * Resolve a source name to a SecretSourceDefinition.
+   *
+   * - If the name matches a premade source, returns that definition.
+   * - If it looks like a shell command (contains spaces or {0}), wraps it as a custom command.
+   * - Otherwise, returns undefined.
+   */
+  static resolveSource(sourceName: string): SecretSourceDefinition | undefined {
+    // Check premade sources
+    if (SecretSourceService.isPremadeSource(sourceName)) {
+      return SecretSourceService.premadeSources[sourceName];
+    }
+
+    // If it contains a placeholder or spaces, treat it as a raw command
+    if (sourceName.includes('{0}') || sourceName.includes(' ')) {
+      return {
+        name: 'custom-command',
+        command: sourceName,
+        parseOutput: 'raw',
+      };
+    }
+
+    return undefined;
+  }
+
+  /**
+   * Load custom secret source definitions from a YAML file.
+   *
+   * Expected format:
+   *   sources:
+   *     - name: my-source
+   *       command: 'my-tool get-secret {0}'
+   *     - name: my-api
+   *       command: 'curl -s https://api.example.com/secrets/{0}'
+   *       parseOutput: json-field
+   *       jsonField: value
+   */
+  static loadFromYaml(filePath: string): SecretSourceDefinition[] {
+    if (!fs.existsSync(filePath)) {
+      OrchestratorLogger.logWarning(`Secret source YAML not found: ${filePath}`);
+
+      return [];
+    }
+
+    try {
+      const content = fs.readFileSync(filePath, 'utf8');
+      const parsed = SecretSourceService.parseSimpleYaml(content);
+
+      return parsed;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`Failed to parse secret source YAML: ${error.message}`);
+
+      return [];
+    }
+  }
+
+  /**
+   * Fetch a secret value using the given source definition.
+   *
+   * Validates the key against an allowlist pattern before interpolating it
+   * into the command string to prevent shell injection. The fetched secret
+   * value is masked via core.setSecret() so it does not leak in logs.
+   *
+   * @param source - The secret source definition to use
+   * @param key - The secret key to fetch
+   * @returns The secret value, or empty string on failure
+   */
+  static async fetchSecret(source: SecretSourceDefinition, key: string): Promise<string> {
+    // Validate the key to prevent shell injection
+    validateSecretKey(key);
+
+    const command = source.command.replace(/\{0\}/g, key);
+
+    try {
+      const output = await OrchestratorSystem.Run(command, false, true);
+
+      let value: string;
+
+      if (source.parseOutput === 'json-field' && source.jsonField) {
+        try {
+          const parsed = JSON.parse(output);
+          value = parsed[source.jsonField] || '';
+        } catch {
+          OrchestratorLogger.logWarning(`Failed to parse JSON output from ${source.name} for key ${key}`);
+          value = output.trim();
+        }
+      } else {
+        value = output.trim();
+      }
+
+      // Mask the secret value so it does not appear in GitHub Actions logs
+      maskSecretValue(value);
+
+      return value;
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`Failed to fetch secret '${key}' from ${source.name}: ${error.message}`);
+
+      return '';
+    }
+  }
+
+  /**
+   * Fetch a secret from an environment variable. No shell command needed.
+   * The value is masked via core.setSecret() so it does not leak in logs.
+   */
+  static fetchFromEnv(key: string): string {
+    const value = process.env[key] || '';
+    maskSecretValue(value);
+
+    return value;
+  }
+
+  /**
+   * Resolve a source name and fetch all secrets from it.
+   *
+   * @param sourceName - Premade source name, shell command, or 'env'
+   * @param keys - List of secret keys to fetch
+   * @returns Map of key -> value
+   */
+  static async fetchAll(sourceName: string, keys: string[]): Promise<Record<string, string>> {
+    const results: Record<string, string> = {};
+
+    if (sourceName === 'env') {
+      for (const key of keys) {
+        results[key] = SecretSourceService.fetchFromEnv(key);
+      }
+
+      return results;
+    }
+
+    const source = SecretSourceService.resolveSource(sourceName);
+    if (!source) {
+      OrchestratorLogger.logWarning(
+        `Unknown secret source '${sourceName}'. Available sources: ${SecretSourceService.getAvailableSources().join(
+          ', ',
+        )}`,
+      );
+
+      return results;
+    }
+
+    OrchestratorLogger.log(`Fetching ${keys.length} secret(s) from ${source.name}`);
+
+    for (const key of keys) {
+      results[key] = await SecretSourceService.fetchSecret(source, key);
+    }
+
+    return results;
+  }
+
+  /**
+   * Simple YAML parser for secret source definitions.
+   * Handles the specific structure we expect without requiring a YAML library.
+   */
+  private static parseSimpleYaml(content: string): SecretSourceDefinition[] {
+    const definitions: SecretSourceDefinition[] = [];
+    const lines = content.split('\n');
+    let current: Partial<SecretSourceDefinition> | null = null;
+
+    for (const rawLine of lines) {
+      const line = rawLine.replace(/\r$/, '');
+      const trimmed = line.trim();
+
+      if (trimmed === '' || trimmed.startsWith('#')) continue;
+
+      if (trimmed === '- name:' || trimmed.startsWith('- name:')) {
+        if (current?.name && current?.command) {
+          definitions.push(current as SecretSourceDefinition);
+        }
+
+        current = {
+          name: trimmed
+            .replace('- name:', '')
+            .trim()
+            .replace(/^['"]|['"]$/g, ''),
+          parseOutput: 'raw',
+        };
+        continue;
+      }
+
+      if (current && trimmed.startsWith('command:')) {
+        current.command = trimmed
+          .replace('command:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+      } else if (current && trimmed.startsWith('parseOutput:')) {
+        const value = trimmed
+          .replace('parseOutput:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+        current.parseOutput = value as 'raw' | 'json-field';
+      } else if (current && trimmed.startsWith('jsonField:')) {
+        current.jsonField = trimmed
+          .replace('jsonField:', '')
+          .trim()
+          .replace(/^['"]|['"]$/g, '');
+      }
+    }
+
+    if (current?.name && current?.command) {
+      definitions.push(current as SecretSourceDefinition);
+    }
+
+    return definitions;
+  }
+}

src/model/orchestrator/services/submodule/submodule-profile-service.test.ts

@@ -0,0 +1,385 @@
+import fs from 'node:fs';
+import { SubmoduleProfileService } from './submodule-profile-service';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system');
+jest.mock('../core/orchestrator-logger', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    logWarning: jest.fn(),
+    error: jest.fn(),
+  },
+}));
+
+const mockedFs = fs as jest.Mocked<typeof fs>;
+const mockedSystem = OrchestratorSystem as jest.Mocked<typeof OrchestratorSystem>;
+
+describe('SubmoduleProfileService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('parseProfile', () => {
+    it('reads and parses a valid YAML profile', () => {
+      const profileYaml = `
+primary_submodule: Assets/_Game/Submodules/TurnOfWarEndlessCrusade
+product_name: Endless Crusade
+submodules:
+  - name: TurnOfWar
+    branch: main
+  - name: TurnOfWarEndlessCrusade
+    branch: main
+  - name: AreaOfOperations
+    branch: empty
+`;
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockReturnValue(profileYaml);
+
+      const profile = SubmoduleProfileService.parseProfile('/path/to/profile.yml');
+
+      expect(profile.primary_submodule).toBe('Assets/_Game/Submodules/TurnOfWarEndlessCrusade');
+      expect(profile.product_name).toBe('Endless Crusade');
+      expect(profile.submodules).toHaveLength(3);
+      expect(profile.submodules[0]).toEqual({ name: 'TurnOfWar', branch: 'main' });
+      expect(profile.submodules[1]).toEqual({ name: 'TurnOfWarEndlessCrusade', branch: 'main' });
+      expect(profile.submodules[2]).toEqual({ name: 'AreaOfOperations', branch: 'empty' });
+    });
+
+    it('throws if profile file does not exist', () => {
+      mockedFs.existsSync.mockReturnValue(false);
+
+      expect(() => SubmoduleProfileService.parseProfile('/missing/profile.yml')).toThrow('Submodule profile not found');
+    });
+
+    it('throws if YAML is missing submodules array', () => {
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockReturnValue('product_name: Test\n');
+
+      expect(() => SubmoduleProfileService.parseProfile('/path/to/bad.yml')).toThrow("expected 'submodules' array");
+    });
+  });
+
+  describe('mergeVariant', () => {
+    it('correctly overlays variant entries on base profile', () => {
+      const baseYaml = `
+submodules:
+  - name: ModuleA
+    branch: main
+  - name: ModuleB
+    branch: main
+`;
+      const variantYaml = `
+product_name: Server Build
+submodules:
+  - name: ModuleB
+    branch: empty
+  - name: ModuleC
+    branch: develop
+`;
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockImplementation((filePath: any) => {
+        if (filePath === '/base.yml') return baseYaml;
+        if (filePath === '/variant.yml') return variantYaml;
+
+        return '';
+      });
+
+      const base = SubmoduleProfileService.parseProfile('/base.yml');
+      const merged = SubmoduleProfileService.mergeVariant(base, '/variant.yml');
+
+      expect(merged.product_name).toBe('Server Build');
+      expect(merged.submodules).toHaveLength(3);
+
+      const moduleA = merged.submodules.find((s) => s.name === 'ModuleA');
+      const moduleB = merged.submodules.find((s) => s.name === 'ModuleB');
+      const moduleC = merged.submodules.find((s) => s.name === 'ModuleC');
+
+      expect(moduleA?.branch).toBe('main');
+      expect(moduleB?.branch).toBe('empty');
+      expect(moduleC?.branch).toBe('develop');
+    });
+  });
+
+  describe('matchSubmodule', () => {
+    it('matches exact submodule name', () => {
+      expect(SubmoduleProfileService.matchSubmodule('TurnOfWar', 'TurnOfWar')).toBe(true);
+    });
+
+    it('matches exact leaf folder name against full path', () => {
+      expect(SubmoduleProfileService.matchSubmodule('Assets/_Game/Submodules/TurnOfWar', 'TurnOfWar')).toBe(true);
+    });
+
+    it('does not match unrelated names', () => {
+      expect(SubmoduleProfileService.matchSubmodule('TurnOfWar', 'AreaOfOperations')).toBe(false);
+    });
+
+    it('matches trailing wildcard against full path', () => {
+      expect(SubmoduleProfileService.matchSubmodule('Assets/_Engine/Submodules/PluginsFoo', 'Plugins*')).toBe(true);
+    });
+
+    it('matches trailing wildcard against full path prefix', () => {
+      expect(
+        SubmoduleProfileService.matchSubmodule(
+          'Assets/_Engine/Submodules/PluginsFoo',
+          'Assets/_Engine/Submodules/Plugins*',
+        ),
+      ).toBe(true);
+    });
+
+    it('does not match wildcard that does not align', () => {
+      expect(SubmoduleProfileService.matchSubmodule('Assets/_Engine/Submodules/SensorToolkit', 'Plugins*')).toBe(false);
+    });
+  });
+
+  describe('parseGitmodules', () => {
+    it('parses a typical .gitmodules file', () => {
+      const gitmodulesContent = `[submodule "Assets/_Game/Submodules/TurnOfWar"]
+\tpath = Assets/_Game/Submodules/TurnOfWar
+\turl = https://github.com/org/TurnOfWar.git
+[submodule "Assets/_Game/Submodules/EndlessCrusade"]
+\tpath = Assets/_Game/Submodules/EndlessCrusade
+\turl = https://github.com/org/EndlessCrusade.git
+[submodule "Assets/_Engine/Submodules/SensorToolkit"]
+\tpath = Assets/_Engine/Submodules/SensorToolkit
+\turl = https://github.com/org/SensorToolkit.git
+`;
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockReturnValue(gitmodulesContent);
+
+      const result = SubmoduleProfileService.parseGitmodules('/repo');
+
+      expect(result.size).toBe(3);
+      expect(result.get('Assets/_Game/Submodules/TurnOfWar')).toBe('Assets/_Game/Submodules/TurnOfWar');
+      expect(result.get('Assets/_Game/Submodules/EndlessCrusade')).toBe('Assets/_Game/Submodules/EndlessCrusade');
+      expect(result.get('Assets/_Engine/Submodules/SensorToolkit')).toBe('Assets/_Engine/Submodules/SensorToolkit');
+    });
+
+    it('returns empty map when .gitmodules does not exist', () => {
+      mockedFs.existsSync.mockReturnValue(false);
+
+      const result = SubmoduleProfileService.parseGitmodules('/repo');
+
+      expect(result.size).toBe(0);
+    });
+  });
+
+  describe('createInitPlan', () => {
+    it('generates correct init and skip actions', async () => {
+      const profileYaml = `
+submodules:
+  - name: TurnOfWar
+    branch: main
+  - name: EndlessCrusade
+    branch: main
+  - name: SensorToolkit
+    branch: empty
+`;
+
+      const gitmodulesContent = `[submodule "Assets/_Game/Submodules/TurnOfWar"]
+\tpath = Assets/_Game/Submodules/TurnOfWar
+\turl = https://github.com/org/TurnOfWar.git
+[submodule "Assets/_Game/Submodules/EndlessCrusade"]
+\tpath = Assets/_Game/Submodules/EndlessCrusade
+\turl = https://github.com/org/EndlessCrusade.git
+[submodule "Assets/_Engine/Submodules/SensorToolkit"]
+\tpath = Assets/_Engine/Submodules/SensorToolkit
+\turl = https://github.com/org/SensorToolkit.git
+[submodule "Assets/_Game/Submodules/Unmatched"]
+\tpath = Assets/_Game/Submodules/Unmatched
+\turl = https://github.com/org/Unmatched.git
+`;
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockImplementation((filePath: any) => {
+        if (String(filePath).endsWith('profile.yml')) return profileYaml;
+        if (String(filePath).endsWith('.gitmodules')) return gitmodulesContent;
+
+        return '';
+      });
+
+      const plan = await SubmoduleProfileService.createInitPlan('/path/to/profile.yml', '', '/repo');
+
+      expect(plan).toHaveLength(4);
+
+      const turnOfWar = plan.find((a) => a.name === 'Assets/_Game/Submodules/TurnOfWar');
+      expect(turnOfWar?.action).toBe('init');
+      expect(turnOfWar?.branch).toBe('main');
+
+      const endlessCrusade = plan.find((a) => a.name === 'Assets/_Game/Submodules/EndlessCrusade');
+      expect(endlessCrusade?.action).toBe('init');
+      expect(endlessCrusade?.branch).toBe('main');
+
+      const sensorToolkit = plan.find((a) => a.name === 'Assets/_Engine/Submodules/SensorToolkit');
+      expect(sensorToolkit?.action).toBe('skip');
+      expect(sensorToolkit?.branch).toBe('empty');
+
+      const unmatched = plan.find((a) => a.name === 'Assets/_Game/Submodules/Unmatched');
+      expect(unmatched?.action).toBe('skip');
+      expect(unmatched?.branch).toBe('empty');
+    });
+
+    it('applies variant overlay when variantPath is provided', async () => {
+      const profileYaml = `
+submodules:
+  - name: TurnOfWar
+    branch: main
+  - name: EndlessCrusade
+    branch: main
+`;
+
+      const variantYaml = `
+submodules:
+  - name: EndlessCrusade
+    branch: empty
+`;
+
+      const gitmodulesContent = `[submodule "Assets/_Game/Submodules/TurnOfWar"]
+\tpath = Assets/_Game/Submodules/TurnOfWar
+\turl = https://github.com/org/TurnOfWar.git
+[submodule "Assets/_Game/Submodules/EndlessCrusade"]
+\tpath = Assets/_Game/Submodules/EndlessCrusade
+\turl = https://github.com/org/EndlessCrusade.git
+`;
+
+      mockedFs.existsSync.mockReturnValue(true);
+      mockedFs.readFileSync.mockImplementation((filePath: any) => {
+        const p = String(filePath);
+        if (p.endsWith('profile.yml')) return profileYaml;
+        if (p.endsWith('variant.yml')) return variantYaml;
+        if (p.endsWith('.gitmodules')) return gitmodulesContent;
+
+        return '';
+      });
+
+      const plan = await SubmoduleProfileService.createInitPlan(
+        '/path/to/profile.yml',
+        '/path/to/variant.yml',
+        '/repo',
+      );
+
+      expect(plan).toHaveLength(2);
+
+      const turnOfWar = plan.find((a) => a.name === 'Assets/_Game/Submodules/TurnOfWar');
+      expect(turnOfWar?.action).toBe('init');
+
+      const endlessCrusade = plan.find((a) => a.name === 'Assets/_Game/Submodules/EndlessCrusade');
+      expect(endlessCrusade?.action).toBe('skip');
+    });
+  });
+
+  describe('execute', () => {
+    it('runs init commands for init actions and deinit for skip actions', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      const plan = [
+        { name: 'ModuleA', path: 'Assets/ModuleA', branch: 'main', action: 'init' as const },
+        { name: 'ModuleB', path: 'Assets/ModuleB', branch: 'develop', action: 'init' as const },
+        { name: 'ModuleC', path: 'Assets/ModuleC', branch: 'empty', action: 'skip' as const },
+      ];
+
+      await SubmoduleProfileService.execute(plan, '/repo');
+
+      // ModuleA: init only (branch is main, no checkout needed)
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule update --init Assets/ModuleA');
+
+      // ModuleB: init + checkout develop
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule update --init Assets/ModuleB');
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git -C Assets/ModuleB checkout develop');
+
+      // ModuleC: deinit
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule deinit -f Assets/ModuleC 2>/dev/null || true');
+    });
+
+    it('configures auth when token is provided', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      await SubmoduleProfileService.execute([], '/repo', 'my-secret-token');
+
+      expect(mockedSystem.Run).toHaveBeenCalledWith(
+        'git config url."https://my-secret-token@github.com/".insteadOf "https://github.com/"',
+      );
+    });
+
+    it('does not configure auth when no token is provided', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      await SubmoduleProfileService.execute([], '/repo');
+
+      expect(mockedSystem.Run).not.toHaveBeenCalledWith(expect.stringContaining('git config url'));
+    });
+  });
+
+  describe('execute — command construction safety', () => {
+    it('constructs expected git commands for a standard path', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      const plan = [
+        {
+          name: 'Assets/_Game/Submodules/TurnOfWar',
+          path: 'Assets/_Game/Submodules/TurnOfWar',
+          branch: 'main',
+          action: 'init' as const,
+        },
+      ];
+
+      await SubmoduleProfileService.execute(plan, '/repo');
+
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule update --init Assets/_Game/Submodules/TurnOfWar');
+    });
+
+    it('passes path directly into git commands (paths with spaces are not quoted)', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      // This test documents current behavior: paths are passed as-is.
+      // If a path contained shell metacharacters, they would be passed through.
+      // This is acceptable because submodule paths come from .gitmodules (trusted source),
+      // not from user input. Still, this test documents the behavior for awareness.
+      const plan = [
+        { name: 'Module With Spaces', path: 'Assets/Module With Spaces', branch: 'main', action: 'init' as const },
+      ];
+
+      await SubmoduleProfileService.execute(plan, '/repo');
+
+      // The current implementation passes the path directly — no shell quoting
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule update --init Assets/Module With Spaces');
+    });
+
+    it('passes branch name directly into git checkout command', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      // Document that branch names are passed as-is into shell commands.
+      // Branch names come from the trusted profile YAML, not user input.
+      const plan = [{ name: 'ModuleX', path: 'Assets/ModuleX', branch: 'feature/my-branch', action: 'init' as const }];
+
+      await SubmoduleProfileService.execute(plan, '/repo');
+
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git -C Assets/ModuleX checkout feature/my-branch');
+    });
+
+    it('constructs deinit command with error suppression for skip actions', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      const plan = [{ name: 'Unused', path: 'Assets/Unused', branch: 'empty', action: 'skip' as const }];
+
+      await SubmoduleProfileService.execute(plan, '/repo');
+
+      expect(mockedSystem.Run).toHaveBeenCalledWith('git submodule deinit -f Assets/Unused 2>/dev/null || true');
+    });
+
+    it('injects token into git config URL insteadOf pattern', async () => {
+      mockedSystem.Run.mockResolvedValue('');
+
+      // The token is embedded directly into the URL pattern.
+      // This is the standard Git credential approach for CI.
+      await SubmoduleProfileService.execute([], '/repo', 'ghp_abc123xyz');
+
+      const configCall = mockedSystem.Run.mock.calls.find((call: any[]) => String(call[0]).includes('git config url'));
+      expect(configCall).toBeDefined();
+      expect(configCall![0]).toBe('git config url."https://ghp_abc123xyz@github.com/".insteadOf "https://github.com/"');
+    });
+  });
+});

src/model/orchestrator/services/submodule/submodule-profile-service.ts

@@ -0,0 +1,226 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import YAML from 'yaml';
+import { SubmoduleProfile, SubmoduleEntry, SubmoduleInitAction, SubmoduleInitPlan } from './submodule-profile-types';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+export class SubmoduleProfileService {
+  /**
+   * Parse a submodule profile YAML file and return the typed profile.
+   */
+  static parseProfile(profilePath: string): SubmoduleProfile {
+    if (!fs.existsSync(profilePath)) {
+      throw new Error(`Submodule profile not found: ${profilePath}`);
+    }
+
+    const raw = fs.readFileSync(profilePath, 'utf8');
+    let parsed: any;
+    try {
+      parsed = YAML.parse(raw);
+    } catch (error: any) {
+      throw new Error(`Failed to parse submodule profile YAML at ${profilePath}: ${error.message}`);
+    }
+
+    if (!parsed || !Array.isArray(parsed.submodules)) {
+      throw new Error(`Invalid submodule profile: expected 'submodules' array in ${profilePath}`);
+    }
+
+    return {
+      primary_submodule: parsed.primary_submodule,
+      product_name: parsed.product_name,
+      submodules: parsed.submodules.map((entry: any) => ({
+        name: String(entry.name),
+        branch: String(entry.branch),
+      })),
+    };
+  }
+
+  /**
+   * Merge a variant profile on top of a base profile.
+   * Variant submodule entries override base entries matched by name.
+   * New variant entries are appended.
+   * Scalar fields (primary_submodule, product_name) are replaced by variant values.
+   */
+  static mergeVariant(base: SubmoduleProfile, variantPath: string): SubmoduleProfile {
+    if (!fs.existsSync(variantPath)) {
+      throw new Error(`Submodule variant not found: ${variantPath}`);
+    }
+
+    const variant = SubmoduleProfileService.parseProfile(variantPath);
+
+    // Start with a copy of base submodules
+    const mergedEntries = new Map<string, SubmoduleEntry>();
+    for (const entry of base.submodules) {
+      mergedEntries.set(entry.name, { ...entry });
+    }
+
+    // Overlay variant entries
+    for (const entry of variant.submodules) {
+      mergedEntries.set(entry.name, { ...entry });
+    }
+
+    return {
+      primary_submodule: variant.primary_submodule ?? base.primary_submodule,
+      product_name: variant.product_name ?? base.product_name,
+      submodules: [...mergedEntries.values()],
+    };
+  }
+
+  /**
+   * Parse the .gitmodules file from a repository and return a map of submodule name -> path.
+   */
+  static parseGitmodules(repoPath: string): Map<string, string> {
+    const gitmodulesPath = path.join(repoPath, '.gitmodules');
+    const result = new Map<string, string>();
+
+    if (!fs.existsSync(gitmodulesPath)) {
+      return result;
+    }
+
+    const content = fs.readFileSync(gitmodulesPath, 'utf8');
+    const lines = content.split('\n');
+
+    let currentName: string | undefined;
+
+    for (const line of lines) {
+      const trimmed = line.trim();
+
+      // Match [submodule "name"]
+      const submoduleMatch = trimmed.match(/^\[submodule\s+"(.+)"\]$/);
+      if (submoduleMatch) {
+        currentName = submoduleMatch[1];
+        continue;
+      }
+
+      // Match path = value
+      const pathMatch = trimmed.match(/^path\s*=\s*(.+)$/);
+      if (pathMatch && currentName) {
+        result.set(currentName, pathMatch[1].trim());
+      }
+    }
+
+    return result;
+  }
+
+  /**
+   * Match a submodule name/path against a profile pattern.
+   * Supports exact match and glob-like patterns (only `*` wildcard at end).
+   * Matches against both the full submodule path and the leaf folder name.
+   */
+  static matchSubmodule(submoduleName: string, pattern: string): boolean {
+    // Check for trailing wildcard
+    if (pattern.endsWith('*')) {
+      const prefix = pattern.slice(0, -1);
+
+      // Match against full path
+      if (submoduleName.startsWith(prefix)) {
+        return true;
+      }
+
+      // Match against leaf folder name
+      const leaf = submoduleName.split('/').pop() || '';
+      if (leaf.startsWith(prefix)) {
+        return true;
+      }
+
+      return false;
+    }
+
+    // Exact match against full path
+    if (submoduleName === pattern) {
+      return true;
+    }
+
+    // Exact match against leaf folder name
+    const leaf = submoduleName.split('/').pop() || '';
+    if (leaf === pattern) {
+      return true;
+    }
+
+    return false;
+  }
+
+  /**
+   * Create an initialization plan by matching .gitmodules entries against profile rules.
+   * Unmatched submodules default to 'skip'.
+   */
+  static async createInitPlan(profilePath: string, variantPath: string, repoPath: string): Promise<SubmoduleInitPlan> {
+    let profile = SubmoduleProfileService.parseProfile(profilePath);
+
+    if (variantPath) {
+      profile = SubmoduleProfileService.mergeVariant(profile, variantPath);
+    }
+
+    const gitmodules = SubmoduleProfileService.parseGitmodules(repoPath);
+    const plan: SubmoduleInitPlan = [];
+
+    for (const [name, submodulePath] of gitmodules) {
+      let matchedEntry: SubmoduleEntry | undefined;
+
+      for (const entry of profile.submodules) {
+        if (
+          SubmoduleProfileService.matchSubmodule(name, entry.name) ||
+          SubmoduleProfileService.matchSubmodule(submodulePath, entry.name)
+        ) {
+          matchedEntry = entry;
+          break;
+        }
+      }
+
+      if (matchedEntry) {
+        const action: SubmoduleInitAction = {
+          name,
+          path: submodulePath,
+          branch: matchedEntry.branch,
+          action: matchedEntry.branch === 'empty' ? 'skip' : 'init',
+        };
+        plan.push(action);
+      } else {
+        // Unmatched submodules default to skip
+        plan.push({
+          name,
+          path: submodulePath,
+          branch: 'empty',
+          action: 'skip',
+        });
+      }
+    }
+
+    return plan;
+  }
+
+  /**
+   * Execute a submodule initialization plan.
+   * Configures auth if token is provided, then inits or deinits each submodule.
+   */
+  static async execute(plan: SubmoduleInitPlan, repoPath: string, token?: string): Promise<void> {
+    if (token) {
+      OrchestratorLogger.log('Configuring git authentication for submodule initialization...');
+      await OrchestratorSystem.Run(`git config url."https://${token}@github.com/".insteadOf "https://github.com/"`);
+    }
+
+    for (const action of plan) {
+      const fullPath = path.posix.join(repoPath, action.path).replace(/\\/g, '/');
+
+      if (action.action === 'init') {
+        OrchestratorLogger.log(`Initializing submodule: ${action.name} (branch: ${action.branch})`);
+        await OrchestratorSystem.Run(`git submodule update --init ${action.path}`);
+
+        if (action.branch !== 'main') {
+          OrchestratorLogger.log(`Checking out branch '${action.branch}' for submodule: ${action.name}`);
+          await OrchestratorSystem.Run(`git -C ${action.path} checkout ${action.branch}`);
+        }
+      } else {
+        OrchestratorLogger.log(`Skipping submodule: ${action.name}`);
+        await OrchestratorSystem.Run(`git submodule deinit -f ${action.path} 2>/dev/null || true`);
+      }
+    }
+
+    OrchestratorLogger.log(
+      `Submodule initialization complete: ${plan.filter((a) => a.action === 'init').length} initialized, ${
+        plan.filter((a) => a.action === 'skip').length
+      } skipped`,
+    );
+  }
+}

src/model/orchestrator/services/submodule/submodule-profile-types.ts

@@ -0,0 +1,19 @@
+export interface SubmoduleEntry {
+  name: string;
+  branch: string;
+}
+
+export interface SubmoduleProfile {
+  primary_submodule?: string;
+  product_name?: string;
+  submodules: SubmoduleEntry[];
+}
+
+export interface SubmoduleInitAction {
+  name: string;
+  path: string;
+  branch: string;
+  action: 'init' | 'skip';
+}
+
+export type SubmoduleInitPlan = SubmoduleInitAction[];

src/model/orchestrator/services/sync/incremental-sync-service.ts

@@ -0,0 +1,315 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState, SyncStrategy } from './sync-state';
+import { SyncStateManager } from './sync-state-manager';
+
+/**
+ * Service for incremental workspace synchronization.
+ *
+ * Supports multiple sync strategies:
+ * - full: Traditional clone + cache restore (default)
+ * - git-delta: Fetch and apply only changed files since last sync
+ * - direct-input: Apply file changes passed as job input (no git push required)
+ * - storage-pull: Fetch changed files from rclone-backed generic storage
+ */
+export class IncrementalSyncService {
+  /**
+   * Load sync state from the workspace.
+   */
+  static loadSyncState(workspacePath: string, statePath?: string): SyncState | undefined {
+    return SyncStateManager.loadState(workspacePath, statePath);
+  }
+
+  /**
+   * Save sync state to the workspace.
+   */
+  static saveSyncState(workspacePath: string, state: SyncState, statePath?: string): void {
+    SyncStateManager.saveState(workspacePath, state, statePath);
+  }
+
+  /**
+   * Determine the appropriate sync strategy based on workspace state and configuration.
+   */
+  static resolveStrategy(requestedStrategy: SyncStrategy, workspacePath: string, statePath?: string): SyncStrategy {
+    if (requestedStrategy === 'full') {
+      return 'full';
+    }
+
+    // git-delta requires an existing sync state
+    if (requestedStrategy === 'git-delta') {
+      const state = SyncStateManager.loadState(workspacePath, statePath);
+      if (!state) {
+        OrchestratorLogger.log('[Sync] No sync state found, falling back to full sync');
+
+        return 'full';
+      }
+
+      return 'git-delta';
+    }
+
+    return requestedStrategy;
+  }
+
+  /**
+   * Execute a git-delta sync: fetch latest and apply only changed files.
+   *
+   * @param workspacePath - Path to the git workspace
+   * @param targetReference - Git ref to sync to (commit SHA, branch, tag)
+   * @param statePath - Optional custom path for sync state file
+   * @returns Number of files changed
+   */
+  static async syncGitDelta(workspacePath: string, targetReference: string, statePath?: string): Promise<number> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state) {
+      throw new Error('Cannot git-delta sync without existing sync state');
+    }
+
+    OrchestratorLogger.log(`[Sync] Git delta: ${state.lastSyncCommit.slice(0, 8)} -> ${targetReference.slice(0, 8)}`);
+
+    // Fetch latest
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" fetch origin`, true);
+
+    // Get list of changed files
+    const diffOutput = await OrchestratorSystem.Run(
+      `git -C "${workspacePath}" diff --name-only ${state.lastSyncCommit}..${targetReference}`,
+      true,
+    );
+
+    const changedFiles = diffOutput.split('\n').filter(Boolean);
+    OrchestratorLogger.log(`[Sync] ${changedFiles.length} file(s) changed`);
+
+    if (changedFiles.length > 0) {
+      // Checkout target ref
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout ${targetReference}`, true);
+    }
+
+    // Update sync state
+    const newState: SyncState = {
+      lastSyncCommit: targetReference,
+      lastSyncTimestamp: new Date().toISOString(),
+      workspaceHash: SyncStateManager.calculateWorkspaceHash(workspacePath),
+      pendingOverlays: state.pendingOverlays,
+    };
+    SyncStateManager.saveState(workspacePath, newState, statePath);
+
+    return changedFiles.length;
+  }
+
+  /**
+   * Apply a direct input overlay from a local archive or storage URI.
+   *
+   * For storage URIs (storage://remote:bucket/path), the archive is fetched via rclone.
+   * For local paths, the archive is extracted directly.
+   *
+   * @param workspacePath - Path to the workspace
+   * @param inputReference - Local path or storage:// URI to the input archive
+   * @param rcloneRemote - rclone remote name for storage:// URIs (optional, uses URI-embedded remote)
+   * @param statePath - Optional custom path for sync state file
+   * @returns List of overlay paths applied
+   */
+  static async applyDirectInput(
+    workspacePath: string,
+    inputReference: string,
+    rcloneRemote?: string,
+    statePath?: string,
+  ): Promise<string[]> {
+    let localArchive = inputReference;
+
+    // If storage URI, fetch via rclone first
+    if (inputReference.startsWith('storage://')) {
+      const parsed = IncrementalSyncService.parseStorageUri(inputReference);
+      const remote = rcloneRemote || parsed.remote;
+      const remotePath = parsed.path;
+
+      localArchive = path.join(workspacePath, '.game-ci-input-overlay.tar');
+      OrchestratorLogger.log(`[Sync] Fetching input from storage: ${inputReference}`);
+
+      await IncrementalSyncService.executeRcloneCopy(remote, remotePath, path.dirname(localArchive));
+    }
+
+    if (!fs.existsSync(localArchive)) {
+      throw new Error(`Input archive not found: ${localArchive}`);
+    }
+
+    OrchestratorLogger.log(`[Sync] Applying direct input overlay from ${localArchive}`);
+
+    // Extract overlay
+    await OrchestratorSystem.Run(`tar -xf "${localArchive}" -C "${workspacePath}"`, true);
+
+    // Track overlay in sync state
+    const state = SyncStateManager.loadState(workspacePath, statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(localArchive);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    return [localArchive];
+  }
+
+  /**
+   * Execute a storage-pull sync: pull changed files from an rclone remote.
+   *
+   * This strategy fetches content from a remote storage backend (S3, GCS, Azure, etc.)
+   * and overlays it onto the workspace. Supports two modes:
+   * - overlay: extract on top of existing workspace (default)
+   * - clean: fresh git checkout, then apply overlay
+   *
+   * @param workspacePath - Path to the workspace
+   * @param storageUri - storage://remote:bucket/path URI pointing to remote content
+   * @param options - Configuration for the storage-pull operation
+   * @returns List of files pulled from storage
+   */
+  static async syncStoragePull(
+    workspacePath: string,
+    storageUri: string,
+    options: {
+      rcloneRemote?: string;
+      cleanMode?: boolean;
+      syncRevertAfter?: boolean;
+      statePath?: string;
+    } = {},
+  ): Promise<string[]> {
+    if (!storageUri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${storageUri}. Must start with storage://`);
+    }
+
+    // Verify rclone is available
+    try {
+      await OrchestratorSystem.Run('rclone version', true, true);
+    } catch {
+      throw new Error('rclone binary not found. Install rclone to use storage-pull sync strategy.');
+    }
+
+    const parsed = IncrementalSyncService.parseStorageUri(storageUri);
+    const remote = options.rcloneRemote || parsed.remote;
+    const remotePath = parsed.path;
+
+    OrchestratorLogger.log(`[Sync] Storage pull: ${remote}:${remotePath} -> ${workspacePath}`);
+
+    // Clean mode: reset workspace to clean git state before applying overlay
+    if (options.cleanMode) {
+      OrchestratorLogger.log('[Sync] Clean mode: resetting workspace to HEAD');
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+      await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+    }
+
+    // Pull from remote storage directly into workspace
+    const rcloneSource = `${remote}:${remotePath}`;
+    await OrchestratorSystem.Run(`rclone copy "${rcloneSource}" "${workspacePath}" --transfers 8 --checkers 16`, true);
+
+    // List what was pulled for tracking
+    let pulledFiles: string[] = [];
+    try {
+      const lsOutput = await OrchestratorSystem.Run(`rclone ls "${rcloneSource}"`, true, true);
+      pulledFiles = lsOutput
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => {
+          // rclone ls outputs: "  <size> <path>"
+          const trimmed = line.trim();
+          const spaceIndex = trimmed.indexOf(' ');
+
+          return spaceIndex >= 0 ? trimmed.slice(spaceIndex + 1).trim() : trimmed;
+        })
+        .filter(Boolean);
+    } catch {
+      OrchestratorLogger.logWarning('[Sync] Could not list pulled files from remote');
+    }
+
+    OrchestratorLogger.log(`[Sync] Pulled ${pulledFiles.length} file(s) from storage`);
+
+    // Update sync state with overlay tracking
+    const state = SyncStateManager.loadState(workspacePath, options.statePath) || {
+      lastSyncCommit: '',
+      lastSyncTimestamp: new Date().toISOString(),
+      pendingOverlays: [],
+    };
+
+    state.pendingOverlays.push(storageUri);
+    state.lastSyncTimestamp = new Date().toISOString();
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, options.statePath);
+
+    return pulledFiles;
+  }
+
+  /**
+   * Parse a storage:// URI into remote and path components.
+   *
+   * Supported formats:
+   * - storage://remote:bucket/path  (explicit remote with colon separator)
+   * - storage://remote/path         (remote name is first path segment)
+   *
+   * @param uri - The storage:// URI to parse
+   * @returns Object with remote name and path
+   */
+  static parseStorageUri(uri: string): { remote: string; path: string } {
+    if (!uri.startsWith('storage://')) {
+      throw new Error(`Invalid storage URI: ${uri}. Must start with storage://`);
+    }
+
+    const stripped = uri.replace('storage://', '');
+
+    // Check for explicit remote:path format (e.g., "myremote:bucket/path")
+    const colonIndex = stripped.indexOf(':');
+    if (colonIndex > 0) {
+      return {
+        remote: stripped.slice(0, colonIndex),
+        path: stripped.slice(colonIndex + 1),
+      };
+    }
+
+    // Fallback: first segment is remote name (e.g., "myremote/bucket/path")
+    const slashIndex = stripped.indexOf('/');
+    if (slashIndex > 0) {
+      return {
+        remote: stripped.slice(0, slashIndex),
+        path: stripped.slice(slashIndex + 1),
+      };
+    }
+
+    // Just a remote name with no path
+    return {
+      remote: stripped,
+      path: '',
+    };
+  }
+
+  /**
+   * Execute rclone copy with standard flags.
+   */
+  private static async executeRcloneCopy(remote: string, remotePath: string, destinationPath: string): Promise<void> {
+    await OrchestratorSystem.Run(
+      `rclone copy "${remote}:${remotePath}" "${destinationPath}" --transfers 8 --checkers 16`,
+      true,
+    );
+  }
+
+  /**
+   * Revert pending overlays by restoring git state.
+   */
+  static async revertOverlays(workspacePath: string, statePath?: string): Promise<void> {
+    const state = SyncStateManager.loadState(workspacePath, statePath);
+    if (!state || state.pendingOverlays.length === 0) {
+      return;
+    }
+
+    OrchestratorLogger.log(`[Sync] Reverting ${state.pendingOverlays.length} overlay(s)`);
+
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" checkout -- .`, true);
+
+    // Clean untracked files from overlays
+    await OrchestratorSystem.Run(`git -C "${workspacePath}" clean -fd`, true);
+
+    state.pendingOverlays = [];
+    state.workspaceHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+    SyncStateManager.saveState(workspacePath, state, statePath);
+
+    OrchestratorLogger.log('[Sync] Overlays reverted');
+  }
+}

src/model/orchestrator/services/sync/incremental-sync.test.ts

@@ -0,0 +1,544 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { IncrementalSyncService } from './incremental-sync-service';
+import { SyncStateManager } from './sync-state-manager';
+import { SyncState } from './sync-state';
+import { OrchestratorSystem } from '../core/orchestrator-system';
+import OrchestratorLogger from '../core/orchestrator-logger';
+
+// Mock dependencies
+jest.mock('node:fs');
+jest.mock('../core/orchestrator-system');
+jest.mock('../core/orchestrator-logger');
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+const mockSystem = OrchestratorSystem as jest.Mocked<typeof OrchestratorSystem>;
+const mockLogger = OrchestratorLogger as jest.Mocked<typeof OrchestratorLogger>;
+
+afterEach(() => {
+  jest.clearAllMocks();
+  jest.restoreAllMocks();
+});
+
+describe('IncrementalSyncService', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('parseStorageUri', () => {
+    it('parses storage://remote:bucket/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket/some/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/some/path' });
+    });
+
+    it('parses storage://remote/path format', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote/mybucket/path');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket/path' });
+    });
+
+    it('parses storage://remote:bucket with no sub-path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote:mybucket');
+      expect(result).toEqual({ remote: 'myremote', path: 'mybucket' });
+    });
+
+    it('handles remote-only URI without path', () => {
+      const result = IncrementalSyncService.parseStorageUri('storage://myremote');
+      expect(result).toEqual({ remote: 'myremote', path: '' });
+    });
+
+    it('throws on invalid URI without storage:// prefix', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('http://example.com')).toThrow('Invalid storage URI');
+    });
+
+    it('throws on empty URI', () => {
+      expect(() => IncrementalSyncService.parseStorageUri('')).toThrow('Invalid storage URI');
+    });
+  });
+
+  describe('resolveStrategy', () => {
+    it('returns full when full is requested', () => {
+      const result = IncrementalSyncService.resolveStrategy('full', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns git-delta when sync state exists', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('git-delta');
+    });
+
+    it('falls back to full when git-delta requested but no sync state', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = IncrementalSyncService.resolveStrategy('git-delta', workspacePath);
+      expect(result).toBe('full');
+    });
+
+    it('returns direct-input as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('direct-input', workspacePath);
+      expect(result).toBe('direct-input');
+    });
+
+    it('returns storage-pull as-is', () => {
+      const result = IncrementalSyncService.resolveStrategy('storage-pull', workspacePath);
+      expect(result).toBe('storage-pull');
+    });
+  });
+
+  describe('syncGitDelta', () => {
+    const targetReference = 'def456789';
+
+    beforeEach(() => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123456',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+    });
+
+    it('fetches and checks out changed files', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\nfile2.cs\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(2);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" fetch origin'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('diff --name-only abc123456..def456789'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('checkout def456789'), true);
+    });
+
+    it('skips checkout when no files changed', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce(''); // git diff (empty)
+
+      const result = await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(result).toBe(0);
+
+      // Should only have fetch + diff calls, no checkout
+      expect(mockSystem.Run).toHaveBeenCalledTimes(2);
+    });
+
+    it('throws when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.syncGitDelta(workspacePath, targetReference)).rejects.toThrow(
+        'Cannot git-delta sync without existing sync state',
+      );
+    });
+
+    it('saves updated sync state after delta sync', async () => {
+      mockSystem.Run.mockResolvedValueOnce(''); // git fetch
+      mockSystem.Run.mockResolvedValueOnce('file1.txt\n'); // git diff
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout
+
+      await IncrementalSyncService.syncGitDelta(workspacePath, targetReference);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.lastSyncCommit).toBe(targetReference);
+    });
+  });
+
+  describe('applyDirectInput', () => {
+    it('extracts a local archive to workspace', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        // State file path does not exist
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce(''); // tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(result).toEqual([archivePath]);
+      expect(mockSystem.Run).toHaveBeenCalledWith(expect.stringContaining('tar -xf "/tmp/overlay.tar"'), true);
+    });
+
+    it('fetches archive from storage URI via rclone then extracts', async () => {
+      const storageUri = 'storage://s3remote:builds/overlay.tar';
+
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        const pathString = p.toString();
+        if (pathString.includes('.game-ci-input-overlay.tar')) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValue(''); // rclone copy + tar extract
+
+      const result = await IncrementalSyncService.applyDirectInput(workspacePath, storageUri);
+
+      expect(result.length).toBe(1);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3remote:builds/overlay.tar"'),
+        true,
+      );
+    });
+
+    it('throws when local archive does not exist', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await expect(IncrementalSyncService.applyDirectInput(workspacePath, '/missing/archive.tar')).rejects.toThrow(
+        'Input archive not found',
+      );
+    });
+
+    it('tracks overlay in sync state', async () => {
+      const archivePath = '/tmp/overlay.tar';
+      mockFs.existsSync.mockImplementation((p: fs.PathLike) => {
+        if (p === archivePath) return true;
+
+        return false;
+      });
+      mockSystem.Run.mockResolvedValueOnce('');
+
+      await IncrementalSyncService.applyDirectInput(workspacePath, archivePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(archivePath);
+    });
+  });
+
+  describe('syncStoragePull', () => {
+    const storageUri = 'storage://s3:game-builds/latest';
+
+    beforeEach(() => {
+      mockFs.existsSync.mockReturnValue(false); // no existing state
+    });
+
+    it('pulls files from rclone remote into workspace', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version check
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  1234 file1.txt\n  5678 dir/file2.cs\n'); // rclone ls
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual(['file1.txt', 'dir/file2.cs']);
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "s3:game-builds/latest" "/workspace/project"'),
+        true,
+      );
+    });
+
+    it('uses custom rclone remote when provided', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, {
+        rcloneRemote: 'custom-remote',
+      });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('rclone copy "custom-remote:game-builds/latest"'),
+        true,
+      );
+    });
+
+    it('resets workspace in clean mode before pull', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // git checkout -- .
+      mockSystem.Run.mockResolvedValueOnce(''); // git clean -fd
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri, { cleanMode: true });
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('throws on invalid storage URI', async () => {
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, 'http://example.com')).rejects.toThrow(
+        'Invalid storage URI',
+      );
+    });
+
+    it('throws when rclone binary is not available', async () => {
+      mockSystem.Run.mockRejectedValueOnce(new Error('command not found: rclone'));
+
+      await expect(IncrementalSyncService.syncStoragePull(workspacePath, storageUri)).rejects.toThrow(
+        'rclone binary not found',
+      );
+    });
+
+    it('saves sync state with overlay tracking', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockResolvedValueOnce('  100 a.txt\n'); // rclone ls
+
+      await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toContain(storageUri);
+    });
+
+    it('handles rclone ls failure gracefully', async () => {
+      mockSystem.Run.mockResolvedValueOnce('rclone v1.60.0'); // version
+      mockSystem.Run.mockResolvedValueOnce(''); // rclone copy
+      mockSystem.Run.mockRejectedValueOnce(new Error('ls failed')); // rclone ls fails
+
+      const result = await IncrementalSyncService.syncStoragePull(workspacePath, storageUri);
+
+      expect(result).toEqual([]);
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Could not list pulled files'));
+    });
+  });
+
+  describe('revertOverlays', () => {
+    it('reverts git state and cleans untracked files', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar', 'storage://s3:builds/content'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" checkout -- .'),
+        true,
+      );
+      expect(mockSystem.Run).toHaveBeenCalledWith(
+        expect.stringContaining('git -C "/workspace/project" clean -fd'),
+        true,
+      );
+    });
+
+    it('clears pending overlays in saved state', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: ['/tmp/overlay.tar'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+      mockSystem.Run.mockResolvedValue('');
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalled();
+      const writeCall = mockFs.writeFileSync.mock.calls[0];
+      const savedState = JSON.parse(writeCall[1] as string) as SyncState;
+      expect(savedState.pendingOverlays).toEqual([]);
+    });
+
+    it('does nothing when no overlays are pending', async () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: new Date().toISOString(),
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+
+    it('does nothing when no sync state exists', async () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      await IncrementalSyncService.revertOverlays(workspacePath);
+
+      expect(mockSystem.Run).not.toHaveBeenCalled();
+    });
+  });
+});
+
+describe('SyncStateManager', () => {
+  const workspacePath = '/workspace/project';
+
+  describe('loadState', () => {
+    it('returns parsed state from default path', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toEqual(state);
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, '.game-ci/sync-state.json'), 'utf8');
+    });
+
+    it('uses custom state path when provided', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(JSON.stringify(state));
+
+      SyncStateManager.loadState(workspacePath, 'custom/state.json');
+
+      expect(mockFs.readFileSync).toHaveBeenCalledWith(path.join(workspacePath, 'custom/state.json'), 'utf8');
+    });
+
+    it('returns undefined when state file does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+    });
+
+    it('returns undefined and logs warning on malformed JSON', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('not-valid-json{{{');
+
+      const result = SyncStateManager.loadState(workspacePath);
+
+      expect(result).toBeUndefined();
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to load sync state'));
+    });
+  });
+
+  describe('saveState', () => {
+    it('writes state to default path with pretty JSON', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: ['overlay1'],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.writeFileSync).toHaveBeenCalledWith(
+        path.join(workspacePath, '.game-ci/sync-state.json'),
+        JSON.stringify(state, undefined, 2),
+        'utf8',
+      );
+    });
+
+    it('creates parent directories if they do not exist', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(false);
+
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith(expect.stringContaining('.game-ci'), { recursive: true });
+    });
+
+    it('logs warning on write failure instead of throwing', () => {
+      const state: SyncState = {
+        lastSyncCommit: 'abc123',
+        lastSyncTimestamp: '2026-01-01T00:00:00.000Z',
+        pendingOverlays: [],
+      };
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.writeFileSync.mockImplementation(() => {
+        throw new Error('Permission denied');
+      });
+
+      // Should not throw
+      SyncStateManager.saveState(workspacePath, state);
+
+      expect(mockLogger.logWarning).toHaveBeenCalledWith(expect.stringContaining('Failed to save sync state'));
+    });
+  });
+
+  describe('calculateWorkspaceHash', () => {
+    it('produces a deterministic SHA-256 hash from workspace files', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation((filePath: fs.PathOrFileDescriptor) => {
+        const p = filePath.toString();
+        if (p.includes('ProjectVersion.txt')) return 'm_EditorVersion: 2022.3.10f1';
+        if (p.includes('manifest.json')) return '{"dependencies":{}}';
+        if (p.includes('packages-lock.json')) return '{"dependencies":{}}';
+        if (p.includes('csc.rsp')) return '-nullable+';
+
+        return '';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).toBe(hash2);
+      expect(hash1).toHaveLength(64); // SHA-256 hex digest
+    });
+
+    it('produces different hashes for different workspace content', () => {
+      let callCount = 0;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockImplementation(() => {
+        callCount++;
+
+        return callCount <= 4 ? 'content-v1' : 'content-v2';
+      });
+
+      const hash1 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+      const hash2 = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash1).not.toBe(hash2);
+    });
+
+    it('includes missing file markers in hash for absent files', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const hash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      expect(hash).toHaveLength(64);
+    });
+  });
+
+  describe('hasDrifted', () => {
+    it('returns false when workspace hash matches', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      const savedHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, savedHash);
+
+      expect(result).toBe(false);
+    });
+
+    it('returns true when workspace hash differs', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      const result = SyncStateManager.hasDrifted(workspacePath, 'some-old-hash-that-will-not-match');
+
+      expect(result).toBe(true);
+    });
+  });
+});

src/model/orchestrator/services/sync/index.ts

@@ -0,0 +1,3 @@
+export { SyncState, SyncStrategy } from './sync-state';
+export { IncrementalSyncService } from './incremental-sync-service';
+export { SyncStateManager } from './sync-state-manager';

src/model/orchestrator/services/sync/sync-state-manager.ts

@@ -0,0 +1,125 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import OrchestratorLogger from '../core/orchestrator-logger';
+import { SyncState } from './sync-state';
+
+/**
+ * Manages persistent sync state for incremental workspace updates.
+ *
+ * The sync state tracks what has been synced to a workspace, enabling
+ * delta-based updates instead of full clones. State is stored as a JSON
+ * file in the workspace (default: .game-ci/sync-state.json).
+ */
+export class SyncStateManager {
+  static readonly DEFAULT_STATE_PATH = '.game-ci/sync-state.json';
+
+  /**
+   * Key workspace files whose content is hashed for drift detection.
+   * Changes to any of these files indicate the workspace may have been
+   * modified outside of the sync system.
+   */
+  private static readonly WORKSPACE_HASH_FILES = [
+    'ProjectSettings/ProjectVersion.txt',
+    'Packages/manifest.json',
+    'Packages/packages-lock.json',
+    'Assets/csc.rsp',
+  ];
+
+  /**
+   * Load sync state from the workspace.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   * @returns The loaded sync state, or undefined if no state exists or parsing fails
+   */
+  static loadState(workspacePath: string, statePath?: string): SyncState | undefined {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    if (!fs.existsSync(resolvedPath)) {
+      return;
+    }
+
+    try {
+      const content = fs.readFileSync(resolvedPath, 'utf8');
+
+      return JSON.parse(content) as SyncState;
+    } catch {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to load sync state from ${resolvedPath}`);
+
+      return;
+    }
+  }
+
+  /**
+   * Save sync state to the workspace.
+   *
+   * Creates parent directories if they do not exist.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param state - The sync state to persist
+   * @param statePath - Relative path to the state file (default: .game-ci/sync-state.json)
+   */
+  static saveState(workspacePath: string, state: SyncState, statePath?: string): void {
+    const resolvedPath = path.join(workspacePath, statePath || SyncStateManager.DEFAULT_STATE_PATH);
+
+    try {
+      const directory = path.dirname(resolvedPath);
+      if (!fs.existsSync(directory)) {
+        fs.mkdirSync(directory, { recursive: true });
+      }
+
+      fs.writeFileSync(resolvedPath, JSON.stringify(state, undefined, 2), 'utf8');
+      OrchestratorLogger.log(
+        `[SyncState] State saved: commit=${state.lastSyncCommit}, overlays=${state.pendingOverlays.length}`,
+      );
+    } catch (error: any) {
+      OrchestratorLogger.logWarning(`[SyncState] Failed to save sync state: ${error.message}`);
+    }
+  }
+
+  /**
+   * Calculate a SHA-256 hash of key workspace files for drift detection.
+   *
+   * Hashes the content of known workspace files (ProjectVersion.txt,
+   * manifest.json, etc.) to produce a fingerprint. If the hash changes
+   * between syncs, the workspace may have been modified externally.
+   *
+   * Files that do not exist are skipped (their absence is part of the hash).
+   *
+   * @param workspacePath - Root path of the workspace
+   * @returns Hex-encoded SHA-256 hash string
+   */
+  static calculateWorkspaceHash(workspacePath: string): string {
+    const hash = crypto.createHash('sha256');
+
+    for (const relativePath of SyncStateManager.WORKSPACE_HASH_FILES) {
+      const filePath = path.join(workspacePath, relativePath);
+      try {
+        if (fs.existsSync(filePath)) {
+          const content = fs.readFileSync(filePath, 'utf8');
+          hash.update(`${relativePath}:${content}`);
+        } else {
+          hash.update(`${relativePath}:__missing__`);
+        }
+      } catch {
+        hash.update(`${relativePath}:__error__`);
+      }
+    }
+
+    return hash.digest('hex');
+  }
+
+  /**
+   * Check if the workspace has drifted from a previously saved hash.
+   *
+   * @param workspacePath - Root path of the workspace
+   * @param savedHash - The previously saved workspace hash to compare against
+   * @returns true if the current workspace hash differs from the saved hash
+   */
+  static hasDrifted(workspacePath: string, savedHash: string): boolean {
+    const currentHash = SyncStateManager.calculateWorkspaceHash(workspacePath);
+
+    return currentHash !== savedHash;
+  }
+}

src/model/orchestrator/services/sync/sync-state.ts

@@ -0,0 +1,19 @@
+/**
+ * Persistent sync state for incremental workspace updates.
+ * Stored on the runner to track what has already been synced.
+ */
+export interface SyncState {
+  /** Last successfully synced git commit SHA */
+  lastSyncCommit: string;
+
+  /** ISO 8601 timestamp of last sync */
+  lastSyncTimestamp: string;
+
+  /** SHA-256 hash of workspace state (optional) */
+  workspaceHash?: string;
+
+  /** List of overlay paths that haven't been reverted */
+  pendingOverlays: string[];
+}
+
+export type SyncStrategy = 'full' | 'git-delta' | 'direct-input' | 'storage-pull';

src/model/orchestrator/services/test-workflow/index.ts

@@ -0,0 +1,12 @@
+export { TestSuiteParser } from './test-suite-parser';
+export { TaxonomyFilterService } from './taxonomy-filter-service';
+export { TestResultReporter } from './test-result-reporter';
+export { TestWorkflowService } from './test-workflow-service';
+export {
+  TestSuiteDefinition,
+  TestRunDefinition,
+  TaxonomyDimension,
+  TaxonomyDefinition,
+  TestResult,
+  TestFailure,
+} from './test-workflow-types';

src/model/orchestrator/services/test-workflow/taxonomy-filter-service.ts

@@ -0,0 +1,198 @@
+import fs from 'node:fs';
+import YAML from 'yaml';
+import { TaxonomyDimension, TaxonomyDefinition } from './test-workflow-types';
+
+/**
+ * Manages test taxonomy dimensions and builds filter arguments for
+ * the Unity test runner CLI. Supports comma-separated value lists,
+ * regex patterns (/pattern/), and hierarchical dot-notation matching.
+ */
+export class TaxonomyFilterService {
+  /**
+   * Built-in taxonomy dimensions that are always available.
+   * Projects may extend these via a custom taxonomy file.
+   */
+  private static readonly BUILT_IN_DIMENSIONS: TaxonomyDimension[] = [
+    { name: 'Scope', values: ['Unit', 'Integration', 'System', 'End To End'] },
+    { name: 'Maturity', values: ['Trusted', 'Adolescent', 'Experimental'] },
+    { name: 'FeedbackSpeed', values: ['Fast', 'Moderate', 'Slow'] },
+    { name: 'Execution', values: ['Synchronous', 'Asynchronous', 'Coroutine'] },
+    { name: 'Rigor', values: ['Strict', 'Normal', 'Relaxed'] },
+    { name: 'Determinism', values: ['Deterministic', 'NonDeterministic'] },
+    { name: 'IsolationLevel', values: ['Full', 'Partial', 'None'] },
+  ];
+
+  /**
+   * Load taxonomy dimensions: built-in dimensions plus any custom dimensions
+   * from an optional taxonomy file.
+   */
+  static loadTaxonomy(filePath?: string): TaxonomyDimension[] {
+    const dimensions = [...TaxonomyFilterService.BUILT_IN_DIMENSIONS];
+
+    if (filePath && fs.existsSync(filePath)) {
+      const content = fs.readFileSync(filePath, 'utf8');
+      const parsed = YAML.parse(content) as TaxonomyDefinition;
+
+      if (parsed?.extensible_groups && Array.isArray(parsed.extensible_groups)) {
+        for (const group of parsed.extensible_groups) {
+          if (group.name && Array.isArray(group.values)) {
+            // If a custom dimension has the same name as a built-in, merge values
+            const existing = dimensions.find((d) => d.name === group.name);
+            if (existing) {
+              const existingValues = new Set(existing.values);
+              for (const value of group.values) {
+                if (!existingValues.has(value)) {
+                  existing.values.push(value);
+                }
+              }
+            } else {
+              dimensions.push({ name: group.name, values: [...group.values] });
+            }
+          }
+        }
+      }
+    }
+
+    return dimensions;
+  }
+
+  /**
+   * Convert a filter map to Unity test runner CLI args (--testFilter).
+   *
+   * Each filter dimension becomes a category expression. Multiple values in one
+   * dimension are OR'd; multiple dimensions are AND'd. The result is a single
+   * --testFilter string suitable for passing to Unity's test runner CLI.
+   *
+   * Regex patterns (values wrapped in /.../) are converted to category regex
+   * expressions supported by the Unity test runner.
+   */
+  static buildFilterArgs(filters: Record<string, string>): string {
+    if (!filters || Object.keys(filters).length === 0) {
+      return '';
+    }
+
+    const categoryExpressions: string[] = [];
+
+    for (const [dimension, valueSpec] of Object.entries(filters)) {
+      const expression = TaxonomyFilterService.buildDimensionExpression(dimension, valueSpec);
+      if (expression) {
+        categoryExpressions.push(expression);
+      }
+    }
+
+    if (categoryExpressions.length === 0) {
+      return '';
+    }
+
+    // Unity test runner uses --testFilter with category expressions
+    // Multiple dimensions are AND'd by joining with ';'
+    const filterString = categoryExpressions.join(';');
+    return `--testFilter "${filterString}"`;
+  }
+
+  /**
+   * Build a filter expression for a single taxonomy dimension.
+   */
+  private static buildDimensionExpression(dimension: string, valueSpec: string): string {
+    if (!valueSpec || valueSpec.trim() === '') {
+      return '';
+    }
+
+    const trimmed = valueSpec.trim();
+
+    // Check if the value is a regex pattern: /pattern/
+    if (trimmed.startsWith('/') && trimmed.endsWith('/') && trimmed.length > 2) {
+      const pattern = trimmed.slice(1, -1);
+      return `${dimension}=~${pattern}`;
+    }
+
+    // Comma-separated values: OR'd together
+    const values = trimmed
+      .split(',')
+      .map((v) => v.trim())
+      .filter((v) => v.length > 0);
+
+    if (values.length === 0) {
+      return '';
+    }
+
+    if (values.length === 1) {
+      return `${dimension}=${values[0]}`;
+    }
+
+    // Multiple values: use pipe-separated OR syntax
+    return `${dimension}=${values.join('|')}`;
+  }
+
+  /**
+   * Check if a test's taxonomy metadata matches the given filter criteria.
+   *
+   * A test matches if ALL filter dimensions match (AND across dimensions).
+   * Within a single dimension, the test must match ANY of the specified values (OR).
+   * Regex patterns are matched as regular expressions.
+   * Hierarchical dot-notation supports prefix matching (e.g., filter "Combat.Melee"
+   * matches test category "Combat.Melee.Sword").
+   */
+  static matchesFilter(testCategories: Record<string, string>, filters: Record<string, string>): boolean {
+    for (const [dimension, valueSpec] of Object.entries(filters)) {
+      const testValue = testCategories[dimension];
+
+      // If the test has no value for this dimension, it does not match
+      if (testValue === undefined || testValue === null) {
+        return false;
+      }
+
+      if (!TaxonomyFilterService.matchesDimensionFilter(testValue, valueSpec)) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  /**
+   * Check if a single test category value matches a dimension filter spec.
+   */
+  private static matchesDimensionFilter(testValue: string, valueSpec: string): boolean {
+    const trimmed = valueSpec.trim();
+
+    // Regex pattern
+    if (trimmed.startsWith('/') && trimmed.endsWith('/') && trimmed.length > 2) {
+      const pattern = trimmed.slice(1, -1);
+      try {
+        const regex = new RegExp(pattern);
+        return regex.test(testValue);
+      } catch {
+        // Invalid regex, treat as literal
+        return testValue === trimmed;
+      }
+    }
+
+    // Comma-separated values
+    const values = trimmed
+      .split(',')
+      .map((v) => v.trim())
+      .filter((v) => v.length > 0);
+
+    return values.some((filterValue) => {
+      // Exact match
+      if (testValue === filterValue) {
+        return true;
+      }
+
+      // Hierarchical dot-notation prefix match
+      // Filter "Combat.Melee" matches test "Combat.Melee" and "Combat.Melee.Sword"
+      if (filterValue.includes('.') || testValue.includes('.')) {
+        if (testValue.startsWith(filterValue + '.') || testValue === filterValue) {
+          return true;
+        }
+        // Also allow the test to be a prefix of the filter for upward matching
+        if (filterValue.startsWith(testValue + '.')) {
+          return true;
+        }
+      }
+
+      return false;
+    });
+  }
+}

src/model/orchestrator/services/test-workflow/test-result-reporter.ts

@@ -0,0 +1,316 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { TestResult, TestFailure } from './test-workflow-types';
+
+/**
+ * Parses test result files (JUnit XML, Unity JSON) and generates structured
+ * summary reports. Supports writing results in multiple formats for CI
+ * integration (GitHub Checks, artifact upload).
+ */
+export class TestResultReporter {
+  /**
+   * Parse a JUnit XML test result file into a TestResult.
+   * JUnit XML is the standard format produced by Unity's test runner.
+   */
+  static parseJUnitResults(xmlPath: string): TestResult {
+    if (!fs.existsSync(xmlPath)) {
+      throw new Error(`JUnit result file not found: ${xmlPath}`);
+    }
+
+    const content = fs.readFileSync(xmlPath, 'utf8');
+    return TestResultReporter.parseJUnitXml(content);
+  }
+
+  /**
+   * Parse JUnit XML content string into a TestResult.
+   */
+  static parseJUnitXml(xmlContent: string): TestResult {
+    // Extract the testsuite opening tag
+    const suiteTagMatch = xmlContent.match(/<testsuite\s[^>]*>/);
+
+    let runName = 'unknown';
+    let totalTests = 0;
+    let failureCount = 0;
+    let skippedCount = 0;
+    let duration = 0;
+
+    if (suiteTagMatch) {
+      const tag = suiteTagMatch[0];
+
+      // Extract individual attributes -- order-independent
+      const nameMatch = tag.match(/\sname="([^"]*)"/);
+      const testsMatch = tag.match(/\stests="(\d+)"/);
+      const failuresMatch = tag.match(/\sfailures="(\d+)"/);
+      const skippedMatch = tag.match(/\sskipped="(\d+)"/);
+      const timeMatch = tag.match(/\stime="([^"]*)"/);
+
+      runName = nameMatch ? nameMatch[1] : 'unknown';
+      totalTests = testsMatch ? Number.parseInt(testsMatch[1], 10) : 0;
+      failureCount = failuresMatch ? Number.parseInt(failuresMatch[1], 10) : 0;
+      skippedCount = skippedMatch ? Number.parseInt(skippedMatch[1], 10) : 0;
+      duration = timeMatch ? Number.parseFloat(timeMatch[1]) : 0;
+    }
+
+    // Extract individual test failures by splitting into testcase blocks
+    const failures: TestFailure[] = [];
+    const testcasePattern = /<testcase\s[^>]*>[\s\S]*?<\/testcase>/g;
+
+    let tcMatch;
+    while ((tcMatch = testcasePattern.exec(xmlContent)) !== null) {
+      const block = tcMatch[0];
+
+      // Only process testcases that contain a <failure> element
+      if (!block.includes('<failure')) {
+        continue;
+      }
+
+      // Extract testcase attributes (order-independent)
+      const tcTag = block.match(/<testcase\s[^>]*>/);
+      if (!tcTag) continue;
+
+      const cnMatch = tcTag[0].match(/\sclassname="([^"]*)"/);
+      const tnMatch = tcTag[0].match(/\sname="([^"]*)"/);
+
+      const className = cnMatch ? cnMatch[1] : 'unknown';
+      const testName = tnMatch ? tnMatch[1] : 'unknown';
+
+      // Extract failure message
+      const failTag = block.match(/<failure\s[^>]*>/);
+      const msgMatch = failTag ? failTag[0].match(/\smessage="([^"]*)"/) : null;
+      const message = msgMatch ? msgMatch[1] : 'Test failed';
+
+      // Extract stack trace from CDATA or text content
+      const cdataMatch = block.match(/<failure[^>]*>[\s\S]*?<!\[CDATA\[([\s\S]*?)\]\]>/);
+      const textMatch = !cdataMatch ? block.match(/<failure[^>]*>([^<]*)<\/failure>/) : null;
+      const stackTrace = cdataMatch ? cdataMatch[1].trim() : textMatch ? textMatch[1].trim() : undefined;
+
+      failures.push({ testName, className, message, stackTrace: stackTrace || undefined });
+    }
+
+    const passed = totalTests - failureCount - skippedCount;
+
+    return {
+      runName,
+      passed: Math.max(0, passed),
+      failed: failureCount,
+      skipped: skippedCount,
+      duration,
+      failures,
+    };
+  }
+
+  /**
+   * Parse a Unity JSON test result file into a TestResult.
+   */
+  static parseJsonResults(jsonPath: string): TestResult {
+    if (!fs.existsSync(jsonPath)) {
+      throw new Error(`JSON result file not found: ${jsonPath}`);
+    }
+
+    const content = fs.readFileSync(jsonPath, 'utf8');
+    const data = JSON.parse(content);
+
+    return TestResultReporter.parseJsonData(data);
+  }
+
+  /**
+   * Parse Unity JSON test result data into a TestResult.
+   */
+  static parseJsonData(data: any): TestResult {
+    const runName = data.name ?? data.suiteName ?? 'unknown';
+    const passed = data.passed ?? data.passCount ?? 0;
+    const failed = data.failed ?? data.failCount ?? 0;
+    const skipped = data.skipped ?? data.skipCount ?? data.inconclusive ?? 0;
+    const duration = data.duration ?? data.time ?? 0;
+
+    const failures: TestFailure[] = [];
+
+    // Unity test results may have a 'testResults' or 'results' array
+    const results = data.testResults ?? data.results ?? data.children ?? [];
+
+    if (Array.isArray(results)) {
+      for (const result of results) {
+        TestResultReporter.extractFailures(result, failures);
+      }
+    }
+
+    return {
+      runName,
+      passed,
+      failed,
+      skipped,
+      duration,
+      failures,
+    };
+  }
+
+  /**
+   * Recursively extract failures from nested Unity test result JSON.
+   */
+  private static extractFailures(node: any, failures: TestFailure[]): void {
+    if (!node) return;
+
+    const status = (node.result ?? node.status ?? '').toLowerCase();
+    if (status === 'failed' || status === 'failure') {
+      failures.push({
+        testName: node.name ?? node.testName ?? 'unknown',
+        className: node.className ?? node.fullName ?? node.name ?? 'unknown',
+        message: node.message ?? node.output ?? 'Test failed',
+        stackTrace: node.stackTrace ?? node.trace ?? undefined,
+      });
+    }
+
+    // Recurse into children (Unity nests test fixtures inside suites)
+    const children = node.children ?? node.testResults ?? node.results ?? [];
+    if (Array.isArray(children)) {
+      for (const child of children) {
+        TestResultReporter.extractFailures(child, failures);
+      }
+    }
+  }
+
+  /**
+   * Generate a markdown summary table from an array of test results.
+   */
+  static generateSummary(results: TestResult[]): string {
+    if (results.length === 0) {
+      return 'No test results available.';
+    }
+
+    const lines: string[] = [];
+    lines.push('## Test Results Summary');
+    lines.push('');
+    lines.push('| Run | Passed | Failed | Skipped | Duration |');
+    lines.push('|-----|--------|--------|---------|----------|');
+
+    let totalPassed = 0;
+    let totalFailed = 0;
+    let totalSkipped = 0;
+    let totalDuration = 0;
+
+    for (const result of results) {
+      const status = result.failed > 0 ? 'X' : 'OK';
+      const durationStr = TestResultReporter.formatDuration(result.duration);
+      lines.push(
+        `| ${status} ${result.runName} | ${result.passed} | ${result.failed} | ${result.skipped} | ${durationStr} |`,
+      );
+      totalPassed += result.passed;
+      totalFailed += result.failed;
+      totalSkipped += result.skipped;
+      totalDuration += result.duration;
+    }
+
+    lines.push(
+      `| **Total** | **${totalPassed}** | **${totalFailed}** | **${totalSkipped}** | **${TestResultReporter.formatDuration(
+        totalDuration,
+      )}** |`,
+    );
+    lines.push('');
+
+    // Append failure details if any
+    const allFailures = results.flatMap((r) => r.failures.map((f) => ({ ...f, run: r.runName })));
+    if (allFailures.length > 0) {
+      lines.push('### Failures');
+      lines.push('');
+      for (const failure of allFailures) {
+        lines.push(`**${failure.run}** - \`${failure.className}.${failure.testName}\``);
+        lines.push(`> ${failure.message}`);
+        if (failure.stackTrace) {
+          lines.push('```');
+          lines.push(failure.stackTrace.slice(0, 500));
+          lines.push('```');
+        }
+        lines.push('');
+      }
+    }
+
+    return lines.join('\n');
+  }
+
+  /**
+   * Write test results to the output path in the specified format(s).
+   */
+  static writeResults(results: TestResult[], outputPath: string, format: 'junit' | 'json' | 'both'): void {
+    if (!fs.existsSync(outputPath)) {
+      fs.mkdirSync(outputPath, { recursive: true });
+    }
+
+    if (format === 'json' || format === 'both') {
+      const jsonPath = path.join(outputPath, 'test-results.json');
+      fs.writeFileSync(jsonPath, JSON.stringify(results, null, 2), 'utf8');
+    }
+
+    if (format === 'junit' || format === 'both') {
+      const junitPath = path.join(outputPath, 'test-results.xml');
+      const xml = TestResultReporter.toJUnitXml(results);
+      fs.writeFileSync(junitPath, xml, 'utf8');
+    }
+
+    // Always write markdown summary
+    const summaryPath = path.join(outputPath, 'test-summary.md');
+    const summary = TestResultReporter.generateSummary(results);
+    fs.writeFileSync(summaryPath, summary, 'utf8');
+  }
+
+  /**
+   * Convert TestResult array to JUnit XML format.
+   */
+  private static toJUnitXml(results: TestResult[]): string {
+    const lines: string[] = [];
+    lines.push('<?xml version="1.0" encoding="UTF-8"?>');
+    lines.push('<testsuites>');
+
+    for (const result of results) {
+      const total = result.passed + result.failed + result.skipped;
+      lines.push(
+        `  <testsuite name="${TestResultReporter.escapeXml(result.runName)}" tests="${total}" failures="${
+          result.failed
+        }" skipped="${result.skipped}" time="${result.duration.toFixed(3)}">`,
+      );
+
+      // Write failure test cases
+      for (const failure of result.failures) {
+        lines.push(
+          `    <testcase classname="${TestResultReporter.escapeXml(
+            failure.className,
+          )}" name="${TestResultReporter.escapeXml(failure.testName)}">`,
+        );
+        lines.push(`      <failure message="${TestResultReporter.escapeXml(failure.message)}">`);
+        if (failure.stackTrace) {
+          lines.push(`        <![CDATA[${failure.stackTrace}]]>`);
+        }
+        lines.push('      </failure>');
+        lines.push('    </testcase>');
+      }
+
+      lines.push('  </testsuite>');
+    }
+
+    lines.push('</testsuites>');
+    return lines.join('\n');
+  }
+
+  /**
+   * Escape special XML characters.
+   */
+  private static escapeXml(str: string): string {
+    return str
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&apos;');
+  }
+
+  /**
+   * Format a duration in seconds to a human-readable string.
+   */
+  private static formatDuration(seconds: number): string {
+    if (seconds < 60) {
+      return `${seconds.toFixed(1)}s`;
+    }
+    const minutes = Math.floor(seconds / 60);
+    const remainingSeconds = seconds % 60;
+    return `${minutes}m ${remainingSeconds.toFixed(0)}s`;
+  }
+}

src/model/orchestrator/services/test-workflow/test-suite-parser.ts

@@ -0,0 +1,263 @@
+import fs from 'node:fs';
+import YAML from 'yaml';
+import { TestSuiteDefinition, TestRunDefinition } from './test-workflow-types';
+
+/**
+ * Parses and validates YAML-based test suite definition files.
+ * Handles dependency resolution (topological sort) for ordered test run execution.
+ */
+export class TestSuiteParser {
+  /**
+   * Read and parse a YAML test suite definition file.
+   * Validates the structure and returns a typed TestSuiteDefinition.
+   */
+  static parseSuiteFile(filePath: string): TestSuiteDefinition {
+    if (!fs.existsSync(filePath)) {
+      throw new Error(`Test suite file not found: ${filePath}`);
+    }
+
+    const content = fs.readFileSync(filePath, 'utf8');
+    const parsed = YAML.parse(content);
+
+    if (!parsed || typeof parsed !== 'object') {
+      throw new Error(`Invalid YAML in test suite file: ${filePath}`);
+    }
+
+    if (!parsed.name || typeof parsed.name !== 'string') {
+      throw new Error(`Test suite must have a 'name' field (string): ${filePath}`);
+    }
+
+    if (!Array.isArray(parsed.runs) || parsed.runs.length === 0) {
+      throw new Error(`Test suite must have a non-empty 'runs' array: ${filePath}`);
+    }
+
+    const suite: TestSuiteDefinition = {
+      name: parsed.name,
+      description: parsed.description,
+      runs: parsed.runs.map((run: any) => TestSuiteParser.parseRun(run)),
+    };
+
+    const errors = TestSuiteParser.validateSuite(suite);
+    if (errors.length > 0) {
+      throw new Error(`Test suite validation failed:\n  ${errors.join('\n  ')}`);
+    }
+
+    return suite;
+  }
+
+  /**
+   * Parse a single run definition from raw YAML data.
+   */
+  private static parseRun(raw: any): TestRunDefinition {
+    if (!raw || typeof raw !== 'object') {
+      throw new Error(`Each run must be an object`);
+    }
+
+    if (!raw.name || typeof raw.name !== 'string') {
+      throw new Error(`Each run must have a 'name' field (string)`);
+    }
+
+    const run: TestRunDefinition = {
+      name: raw.name,
+    };
+
+    if (raw.needs !== undefined) {
+      if (!Array.isArray(raw.needs)) {
+        throw new Error(`Run '${raw.name}': 'needs' must be an array of strings`);
+      }
+      run.needs = raw.needs;
+    }
+
+    if (raw.editMode !== undefined) {
+      run.editMode = Boolean(raw.editMode);
+    }
+
+    if (raw.playMode !== undefined) {
+      run.playMode = Boolean(raw.playMode);
+    }
+
+    if (raw.builtClient !== undefined) {
+      run.builtClient = Boolean(raw.builtClient);
+    }
+
+    if (raw.builtClientPath !== undefined) {
+      run.builtClientPath = String(raw.builtClientPath);
+    }
+
+    if (raw.filters !== undefined) {
+      if (typeof raw.filters !== 'object' || Array.isArray(raw.filters)) {
+        throw new Error(`Run '${raw.name}': 'filters' must be a key-value object`);
+      }
+      run.filters = {};
+      for (const [key, value] of Object.entries(raw.filters)) {
+        run.filters[key] = String(value);
+      }
+    }
+
+    if (raw.timeout !== undefined) {
+      const timeout = Number(raw.timeout);
+      if (Number.isNaN(timeout) || timeout <= 0) {
+        throw new Error(`Run '${raw.name}': 'timeout' must be a positive number`);
+      }
+      run.timeout = timeout;
+    }
+
+    return run;
+  }
+
+  /**
+   * Resolve run execution order via topological sort based on 'needs' dependencies.
+   * Returns an array of parallel groups -- each group contains runs that can execute concurrently.
+   * Runs within the same group have no inter-dependencies.
+   */
+  static resolveRunOrder(suite: TestSuiteDefinition): TestRunDefinition[][] {
+    const runMap = new Map<string, TestRunDefinition>();
+    for (const run of suite.runs) {
+      runMap.set(run.name, run);
+    }
+
+    // Build adjacency: inDegree counts and dependents map
+    const inDegree = new Map<string, number>();
+    const dependents = new Map<string, string[]>();
+
+    for (const run of suite.runs) {
+      if (!inDegree.has(run.name)) {
+        inDegree.set(run.name, 0);
+      }
+      if (!dependents.has(run.name)) {
+        dependents.set(run.name, []);
+      }
+
+      if (run.needs) {
+        for (const dep of run.needs) {
+          inDegree.set(run.name, (inDegree.get(run.name) ?? 0) + 1);
+          if (!dependents.has(dep)) {
+            dependents.set(dep, []);
+          }
+          dependents.get(dep)!.push(run.name);
+        }
+      }
+    }
+
+    // Kahn's algorithm producing parallel layers
+    const groups: TestRunDefinition[][] = [];
+    let ready = suite.runs.filter((r) => (inDegree.get(r.name) ?? 0) === 0);
+    let processed = 0;
+
+    while (ready.length > 0) {
+      groups.push(ready);
+      processed += ready.length;
+
+      const nextReady: TestRunDefinition[] = [];
+      for (const run of ready) {
+        for (const dep of dependents.get(run.name) ?? []) {
+          const newDegree = (inDegree.get(dep) ?? 1) - 1;
+          inDegree.set(dep, newDegree);
+          if (newDegree === 0) {
+            nextReady.push(runMap.get(dep)!);
+          }
+        }
+      }
+      ready = nextReady;
+    }
+
+    if (processed !== suite.runs.length) {
+      throw new Error(`Circular dependency detected in test suite '${suite.name}'`);
+    }
+
+    return groups;
+  }
+
+  /**
+   * Validate a parsed test suite definition.
+   * Returns an array of validation error messages (empty = valid).
+   */
+  static validateSuite(suite: TestSuiteDefinition): string[] {
+    const errors: string[] = [];
+    const runNames = new Set<string>();
+
+    // Check for duplicate run names
+    for (const run of suite.runs) {
+      if (runNames.has(run.name)) {
+        errors.push(`Duplicate run name: '${run.name}'`);
+      }
+      runNames.add(run.name);
+    }
+
+    // Check that all 'needs' references exist
+    for (const run of suite.runs) {
+      if (run.needs) {
+        for (const dep of run.needs) {
+          if (!runNames.has(dep)) {
+            errors.push(`Run '${run.name}' depends on unknown run '${dep}'`);
+          }
+        }
+
+        // Self-dependency
+        if (run.needs.includes(run.name)) {
+          errors.push(`Run '${run.name}' depends on itself`);
+        }
+      }
+    }
+
+    // Check that at least one test mode is specified per run
+    for (const run of suite.runs) {
+      if (!run.editMode && !run.playMode && !run.builtClient) {
+        errors.push(`Run '${run.name}' must specify at least one of: editMode, playMode, builtClient`);
+      }
+    }
+
+    // Detect circular dependencies via DFS
+    const circularError = TestSuiteParser.detectCircularDependencies(suite);
+    if (circularError) {
+      errors.push(circularError);
+    }
+
+    return errors;
+  }
+
+  /**
+   * Detect circular dependencies using DFS cycle detection.
+   */
+  private static detectCircularDependencies(suite: TestSuiteDefinition): string | null {
+    const adjacency = new Map<string, string[]>();
+    for (const run of suite.runs) {
+      adjacency.set(run.name, run.needs ?? []);
+    }
+
+    const visited = new Set<string>();
+    const visiting = new Set<string>();
+
+    const dfs = (node: string, path: string[]): string | null => {
+      if (visiting.has(node)) {
+        const cycleStart = path.indexOf(node);
+        const cycle = path.slice(cycleStart).concat(node);
+        return `Circular dependency: ${cycle.join(' -> ')}`;
+      }
+      if (visited.has(node)) {
+        return null;
+      }
+
+      visiting.add(node);
+      path.push(node);
+
+      for (const dep of adjacency.get(node) ?? []) {
+        if (adjacency.has(dep)) {
+          const result = dfs(dep, [...path]);
+          if (result) return result;
+        }
+      }
+
+      visiting.delete(node);
+      visited.add(node);
+      return null;
+    };
+
+    for (const run of suite.runs) {
+      const result = dfs(run.name, []);
+      if (result) return result;
+    }
+
+    return null;
+  }
+}

src/model/orchestrator/services/test-workflow/test-workflow-service.ts

@@ -0,0 +1,246 @@
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import path from 'node:path';
+import * as core from '@actions/core';
+import BuildParameters from '../../../build-parameters';
+import { TestSuiteParser } from './test-suite-parser';
+import { TaxonomyFilterService } from './taxonomy-filter-service';
+import { TestResultReporter } from './test-result-reporter';
+import { TestRunDefinition, TestResult } from './test-workflow-types';
+
+const execAsync = promisify(exec);
+
+/**
+ * Main entry point for the test workflow engine.
+ * Orchestrates parsing of YAML suite definitions, resolving run order,
+ * executing test runs via Unity CLI, and collecting structured results.
+ */
+export class TestWorkflowService {
+  /**
+   * Execute a full test suite from a YAML definition file.
+   * Parses the suite, resolves dependency order, executes each parallel
+   * group sequentially (runs within a group execute concurrently), and
+   * collects all results.
+   */
+  static async executeTestSuite(suitePath: string, parameters: BuildParameters): Promise<TestResult[]> {
+    core.info(`[TestWorkflow] Loading test suite from: ${suitePath}`);
+
+    const suite = TestSuiteParser.parseSuiteFile(suitePath);
+    core.info(`[TestWorkflow] Suite '${suite.name}' loaded with ${suite.runs.length} run(s)`);
+
+    if (suite.description) {
+      core.info(`[TestWorkflow] Description: ${suite.description}`);
+    }
+
+    const groups = TestSuiteParser.resolveRunOrder(suite);
+    core.info(`[TestWorkflow] Resolved into ${groups.length} execution group(s)`);
+
+    const allResults: TestResult[] = [];
+    let groupIndex = 0;
+
+    for (const group of groups) {
+      groupIndex++;
+      const runNames = group.map((r) => r.name).join(', ');
+      core.info(`[TestWorkflow] Executing group ${groupIndex}/${groups.length}: [${runNames}]`);
+
+      // Execute runs within a group concurrently
+      const groupResults = await Promise.all(group.map((run) => TestWorkflowService.executeTestRun(run, parameters)));
+
+      allResults.push(...groupResults);
+
+      // Check for failures -- if any run in this group failed, log a warning
+      // but continue to the next group (fail-forward for maximum feedback)
+      const failedRuns = groupResults.filter((r) => r.failed > 0);
+      if (failedRuns.length > 0) {
+        const failedNames = failedRuns.map((r) => r.runName).join(', ');
+        core.warning(`[TestWorkflow] Failures detected in group ${groupIndex}: [${failedNames}]`);
+      }
+    }
+
+    // Generate and output summary
+    const summary = TestResultReporter.generateSummary(allResults);
+    core.info(summary);
+
+    // Write results if output path is configured
+    const resultPath = parameters.testResultPath;
+    const resultFormat = parameters.testResultFormat;
+    if (resultPath) {
+      TestResultReporter.writeResults(allResults, resultPath, resultFormat as 'junit' | 'json' | 'both');
+      core.info(`[TestWorkflow] Results written to: ${resultPath}`);
+    }
+
+    return allResults;
+  }
+
+  /**
+   * Execute a single test run definition.
+   * Builds the Unity CLI arguments based on the run configuration (edit mode,
+   * play mode, built client) and taxonomy filters, executes the command
+   * asynchronously, and parses the result output.
+   *
+   * Uses promisified exec instead of execSync so that Promise.all can
+   * actually run multiple test groups in parallel without blocking the
+   * Node.js event loop.
+   */
+  static async executeTestRun(run: TestRunDefinition, parameters: BuildParameters): Promise<TestResult> {
+    core.info(`[TestWorkflow] Starting run: '${run.name}'`);
+
+    const unityArguments = TestWorkflowService.buildUnityArgs(run, parameters);
+    const timeoutMs = (run.timeout ?? 600) * 1000;
+
+    core.info(`[TestWorkflow] Unity args: ${unityArguments}`);
+
+    const startTime = Date.now();
+
+    try {
+      const resultDirectory = path.join(parameters.testResultPath ?? './test-results', run.name);
+      const resultFile = path.join(resultDirectory, 'results.xml');
+
+      // Build the full Unity command
+      const unityPath = TestWorkflowService.resolveUnityPath(parameters);
+      const command = `"${unityPath}" ${unityArguments} -testResults "${resultFile}"`;
+
+      core.info(`[TestWorkflow] Executing: ${command}`);
+
+      await execAsync(command, {
+        timeout: timeoutMs,
+        maxBuffer: 50 * 1024 * 1024, // 50 MB to handle large Unity output
+        cwd: parameters.projectPath || process.cwd(),
+      });
+
+      const duration = (Date.now() - startTime) / 1000;
+
+      // Parse the result file
+      try {
+        const result = TestResultReporter.parseJUnitResults(resultFile);
+        result.runName = run.name;
+        result.duration = duration;
+
+        return result;
+      } catch {
+        // Result file may not exist if Unity exited early
+        core.warning(`[TestWorkflow] Could not parse results for run '${run.name}' -- result file may be missing`);
+
+        return {
+          runName: run.name,
+          passed: 0,
+          failed: 0,
+          skipped: 0,
+          duration,
+          failures: [],
+        };
+      }
+    } catch (error: any) {
+      const duration = (Date.now() - startTime) / 1000;
+
+      // The promisified exec sets error.killed when the process is terminated
+      // due to timeout, and error.signal will be 'SIGTERM'
+      const isTimeout = error.killed === true || error.signal === 'SIGTERM';
+
+      if (isTimeout) {
+        core.error(`[TestWorkflow] Run '${run.name}' timed out after ${run.timeout ?? 600}s`);
+      } else {
+        core.error(`[TestWorkflow] Run '${run.name}' failed: ${error.message}`);
+      }
+
+      // Try to parse partial results even on failure
+      const resultDirectory = path.join(parameters.testResultPath ?? './test-results', run.name);
+      const resultFile = path.join(resultDirectory, 'results.xml');
+
+      try {
+        const result = TestResultReporter.parseJUnitResults(resultFile);
+        result.runName = run.name;
+        result.duration = duration;
+
+        return result;
+      } catch {
+        return {
+          runName: run.name,
+          passed: 0,
+          failed: 1,
+          skipped: 0,
+          duration,
+          failures: [
+            {
+              testName: isTimeout ? 'Timeout' : 'ExecutionError',
+              className: run.name,
+              message: isTimeout
+                ? `Test run timed out after ${run.timeout ?? 600}s`
+                : error.message ?? 'Unknown execution error',
+              stackTrace: error.stderr ?? undefined,
+            },
+          ],
+        };
+      }
+    }
+  }
+
+  /**
+   * Build Unity CLI arguments for a test run based on its configuration.
+   */
+  static buildUnityArgs(run: TestRunDefinition, parameters: BuildParameters): string {
+    const unityArguments: string[] = ['-batchmode', '-nographics'];
+
+    // Project path
+    if (parameters.projectPath) {
+      unityArguments.push(`-projectPath "${parameters.projectPath}"`);
+    }
+
+    // Test mode
+    if (run.builtClient && run.builtClientPath) {
+      // Built client testing: run tests against a built player
+      unityArguments.push(
+        '-runTests',
+        `-testPlatform StandalonePlayer`,
+        `-assemblyNames Assembly-CSharp-Tests`,
+        `-builtPlayerPath "${run.builtClientPath}"`,
+      );
+    } else if (run.editMode && run.playMode) {
+      // Both modes: run EditMode first, then PlayMode will require a separate invocation
+      // For combined mode, use EditMode (the service handles sequencing)
+      unityArguments.push('-runTests', '-testPlatform EditMode');
+    } else if (run.playMode) {
+      unityArguments.push('-runTests', '-testPlatform PlayMode');
+    } else if (run.editMode) {
+      unityArguments.push('-runTests', '-testPlatform EditMode');
+    }
+
+    // Apply taxonomy filters
+    if (run.filters && Object.keys(run.filters).length > 0) {
+      const filterArguments = TaxonomyFilterService.buildFilterArgs(run.filters);
+      if (filterArguments) {
+        unityArguments.push(filterArguments);
+      }
+    }
+
+    // Target platform
+    if (parameters.targetPlatform) {
+      unityArguments.push(`-buildTarget ${parameters.targetPlatform}`);
+    }
+
+    return unityArguments.join(' ');
+  }
+
+  /**
+   * Resolve the path to the Unity editor executable.
+   */
+  private static resolveUnityPath(parameters: BuildParameters): string {
+    // In CI, Unity path is typically set via environment or the docker container
+    const environmentUnityPath = process.env.UNITY_PATH ?? process.env.UNITY_EDITOR;
+    if (environmentUnityPath) {
+      return environmentUnityPath;
+    }
+
+    // Default paths by platform
+    if (process.platform === 'win32') {
+      return `C:/Program Files/Unity/Hub/Editor/${parameters.editorVersion}/Editor/Unity.exe`;
+    }
+
+    if (process.platform === 'darwin') {
+      return `/Applications/Unity/Hub/Editor/${parameters.editorVersion}/Unity.app/Contents/MacOS/Unity`;
+    }
+
+    // Linux default (Docker container path)
+    return '/opt/unity/Editor/Unity';
+  }
+}

src/model/orchestrator/services/test-workflow/test-workflow-types.ts

@@ -0,0 +1,41 @@
+export interface TestSuiteDefinition {
+  name: string;
+  description?: string;
+  runs: TestRunDefinition[];
+}
+
+export interface TestRunDefinition {
+  name: string;
+  needs?: string[];
+  editMode?: boolean;
+  playMode?: boolean;
+  builtClient?: boolean;
+  builtClientPath?: string;
+  filters?: Record<string, string>; // dimension -> comma-separated values or /regex/
+  timeout?: number;
+}
+
+export interface TaxonomyDimension {
+  name: string;
+  values: string[];
+}
+
+export interface TaxonomyDefinition {
+  extensible_groups: TaxonomyDimension[];
+}
+
+export interface TestResult {
+  runName: string;
+  passed: number;
+  failed: number;
+  skipped: number;
+  duration: number;
+  failures: TestFailure[];
+}
+
+export interface TestFailure {
+  testName: string;
+  className: string;
+  message: string;
+  stackTrace?: string;
+}

src/model/orchestrator/services/test-workflow/test-workflow.test.ts

@@ -0,0 +1,562 @@
+import fs from 'node:fs';
+import { TestSuiteParser } from './test-suite-parser';
+import { TaxonomyFilterService } from './taxonomy-filter-service';
+import { TestResultReporter } from './test-result-reporter';
+import { TestWorkflowService } from './test-workflow-service';
+import { TestSuiteDefinition, TestResult, TestRunDefinition } from './test-workflow-types';
+
+jest.mock('node:fs');
+jest.mock('@actions/core');
+
+const mockFs = fs as jest.Mocked<typeof fs>;
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+// ============================================================================
+// Test Suite Parser
+// ============================================================================
+
+describe('TestSuiteParser', () => {
+  describe('parseSuiteFile', () => {
+    it('should parse a valid YAML suite file', () => {
+      const yaml = `
+name: pull-request
+description: Fast feedback for pull requests
+runs:
+  - name: fast
+    editMode: true
+    filters:
+      Maturity: Trusted
+      FeedbackSpeed: Fast,Moderate
+    timeout: 300
+  - name: basic
+    needs: [fast]
+    editMode: true
+    playMode: true
+    filters:
+      Maturity: Trusted,Adolescent
+    timeout: 600
+`;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(yaml);
+
+      const suite = TestSuiteParser.parseSuiteFile('/path/to/suite.yml');
+
+      expect(suite.name).toBe('pull-request');
+      expect(suite.description).toBe('Fast feedback for pull requests');
+      expect(suite.runs).toHaveLength(2);
+      expect(suite.runs[0].name).toBe('fast');
+      expect(suite.runs[0].editMode).toBe(true);
+      expect(suite.runs[0].filters?.Maturity).toBe('Trusted');
+      expect(suite.runs[0].timeout).toBe(300);
+      expect(suite.runs[1].needs).toEqual(['fast']);
+    });
+
+    it('should throw when file does not exist', () => {
+      mockFs.existsSync.mockReturnValue(false);
+
+      expect(() => TestSuiteParser.parseSuiteFile('/missing.yml')).toThrow('not found');
+    });
+
+    it('should throw on invalid YAML', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('not: valid: yaml: [');
+
+      expect(() => TestSuiteParser.parseSuiteFile('/bad.yml')).toThrow();
+    });
+
+    it('should throw when suite has no name', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('runs:\n  - name: test\n    editMode: true');
+
+      expect(() => TestSuiteParser.parseSuiteFile('/no-name.yml')).toThrow("'name'");
+    });
+
+    it('should throw when suite has no runs', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue('name: test');
+
+      expect(() => TestSuiteParser.parseSuiteFile('/no-runs.yml')).toThrow("'runs'");
+    });
+
+    it('should throw on invalid needs reference', () => {
+      const yaml = `
+name: bad-deps
+runs:
+  - name: first
+    editMode: true
+    needs: [nonexistent]
+`;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(yaml);
+
+      expect(() => TestSuiteParser.parseSuiteFile('/bad-deps.yml')).toThrow("unknown run 'nonexistent'");
+    });
+  });
+
+  describe('resolveRunOrder', () => {
+    it('should return single group when no dependencies exist', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'test',
+        runs: [
+          { name: 'a', editMode: true },
+          { name: 'b', playMode: true },
+        ],
+      };
+
+      const groups = TestSuiteParser.resolveRunOrder(suite);
+      expect(groups).toHaveLength(1);
+      expect(groups[0]).toHaveLength(2);
+    });
+
+    it('should resolve linear dependencies into sequential groups', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'test',
+        runs: [
+          { name: 'a', editMode: true },
+          { name: 'b', needs: ['a'], playMode: true },
+          { name: 'c', needs: ['b'], editMode: true },
+        ],
+      };
+
+      const groups = TestSuiteParser.resolveRunOrder(suite);
+      expect(groups).toHaveLength(3);
+      expect(groups[0][0].name).toBe('a');
+      expect(groups[1][0].name).toBe('b');
+      expect(groups[2][0].name).toBe('c');
+    });
+
+    it('should place independent runs in the same group', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'test',
+        runs: [
+          { name: 'root', editMode: true },
+          { name: 'branch-a', needs: ['root'], playMode: true },
+          { name: 'branch-b', needs: ['root'], editMode: true },
+        ],
+      };
+
+      const groups = TestSuiteParser.resolveRunOrder(suite);
+      expect(groups).toHaveLength(2);
+      expect(groups[0]).toHaveLength(1);
+      expect(groups[1]).toHaveLength(2);
+    });
+
+    it('should detect circular dependencies', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'circular',
+        runs: [
+          { name: 'a', needs: ['b'], editMode: true },
+          { name: 'b', needs: ['a'], playMode: true },
+        ],
+      };
+
+      expect(() => TestSuiteParser.resolveRunOrder(suite)).toThrow('Circular dependency');
+    });
+
+    it('should detect three-way circular dependencies', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'circular3',
+        runs: [
+          { name: 'a', needs: ['c'], editMode: true },
+          { name: 'b', needs: ['a'], playMode: true },
+          { name: 'c', needs: ['b'], editMode: true },
+        ],
+      };
+
+      expect(() => TestSuiteParser.resolveRunOrder(suite)).toThrow('Circular dependency');
+    });
+  });
+
+  describe('validateSuite', () => {
+    it('should return no errors for a valid suite', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'valid',
+        runs: [
+          { name: 'a', editMode: true },
+          { name: 'b', needs: ['a'], playMode: true },
+        ],
+      };
+
+      const errors = TestSuiteParser.validateSuite(suite);
+      expect(errors).toHaveLength(0);
+    });
+
+    it('should detect duplicate run names', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'dupes',
+        runs: [
+          { name: 'a', editMode: true },
+          { name: 'a', playMode: true },
+        ],
+      };
+
+      const errors = TestSuiteParser.validateSuite(suite);
+      expect(errors.some((e) => e.includes('Duplicate'))).toBe(true);
+    });
+
+    it('should detect missing test mode', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'no-mode',
+        runs: [{ name: 'empty' }],
+      };
+
+      const errors = TestSuiteParser.validateSuite(suite);
+      expect(errors.some((e) => e.includes('editMode'))).toBe(true);
+    });
+
+    it('should detect self-dependency', () => {
+      const suite: TestSuiteDefinition = {
+        name: 'self-dep',
+        runs: [{ name: 'a', needs: ['a'], editMode: true }],
+      };
+
+      const errors = TestSuiteParser.validateSuite(suite);
+      expect(errors.some((e) => e.includes('depends on itself'))).toBe(true);
+    });
+  });
+});
+
+// ============================================================================
+// Taxonomy Filter Service
+// ============================================================================
+
+describe('TaxonomyFilterService', () => {
+  describe('loadTaxonomy', () => {
+    it('should return built-in dimensions when no file provided', () => {
+      const dimensions = TaxonomyFilterService.loadTaxonomy();
+
+      expect(dimensions.length).toBeGreaterThanOrEqual(7);
+      expect(dimensions.find((d) => d.name === 'Scope')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'Maturity')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'FeedbackSpeed')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'Execution')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'Rigor')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'Determinism')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'IsolationLevel')).toBeDefined();
+    });
+
+    it('should merge custom dimensions from file', () => {
+      const yaml = `
+extensible_groups:
+  - name: SubjectLevel
+    values: [Class, Feature, System, Product]
+  - name: DataScenario
+    values: [HappyPath, EdgeCase]
+`;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(yaml);
+
+      const dimensions = TaxonomyFilterService.loadTaxonomy('/taxonomy.yml');
+
+      expect(dimensions.find((d) => d.name === 'SubjectLevel')).toBeDefined();
+      expect(dimensions.find((d) => d.name === 'DataScenario')).toBeDefined();
+      // Built-ins should still exist
+      expect(dimensions.find((d) => d.name === 'Scope')).toBeDefined();
+    });
+
+    it('should merge values for existing dimensions', () => {
+      const yaml = `
+extensible_groups:
+  - name: Scope
+    values: [Unit, Integration, Acceptance]
+`;
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.readFileSync.mockReturnValue(yaml);
+
+      const dimensions = TaxonomyFilterService.loadTaxonomy('/taxonomy.yml');
+      const scope = dimensions.find((d) => d.name === 'Scope');
+
+      expect(scope).toBeDefined();
+      // Should contain built-in + custom values without duplicates
+      expect(scope!.values).toContain('Unit');
+      expect(scope!.values).toContain('Integration');
+      expect(scope!.values).toContain('Acceptance');
+      expect(scope!.values).toContain('System');
+    });
+  });
+
+  describe('buildFilterArgs', () => {
+    it('should return empty string for empty filters', () => {
+      expect(TaxonomyFilterService.buildFilterArgs({})).toBe('');
+    });
+
+    it('should build single-value filter', () => {
+      const result = TaxonomyFilterService.buildFilterArgs({ Maturity: 'Trusted' });
+      expect(result).toBe('--testFilter "Maturity=Trusted"');
+    });
+
+    it('should build multi-value filter with pipe separator', () => {
+      const result = TaxonomyFilterService.buildFilterArgs({ Scope: 'Unit,Integration' });
+      expect(result).toBe('--testFilter "Scope=Unit|Integration"');
+    });
+
+    it('should build regex filter', () => {
+      const result = TaxonomyFilterService.buildFilterArgs({ Maturity: '/Trusted|Adolescent/' });
+      expect(result).toBe('--testFilter "Maturity=~Trusted|Adolescent"');
+    });
+
+    it('should AND multiple dimensions with semicolon', () => {
+      const result = TaxonomyFilterService.buildFilterArgs({
+        Maturity: 'Trusted',
+        Scope: 'Unit',
+      });
+      expect(result).toContain(';');
+      expect(result).toContain('Maturity=Trusted');
+      expect(result).toContain('Scope=Unit');
+    });
+  });
+
+  describe('matchesFilter', () => {
+    it('should match exact value', () => {
+      const match = TaxonomyFilterService.matchesFilter({ Scope: 'Unit', Maturity: 'Trusted' }, { Scope: 'Unit' });
+      expect(match).toBe(true);
+    });
+
+    it('should match comma-separated values', () => {
+      const match = TaxonomyFilterService.matchesFilter({ Scope: 'Integration' }, { Scope: 'Unit,Integration' });
+      expect(match).toBe(true);
+    });
+
+    it('should not match when value is not in list', () => {
+      const match = TaxonomyFilterService.matchesFilter({ Scope: 'End To End' }, { Scope: 'Unit,Integration' });
+      expect(match).toBe(false);
+    });
+
+    it('should require all dimensions to match (AND)', () => {
+      const match = TaxonomyFilterService.matchesFilter(
+        { Scope: 'Unit', Maturity: 'Experimental' },
+        { Scope: 'Unit', Maturity: 'Trusted' },
+      );
+      expect(match).toBe(false);
+    });
+
+    it('should match regex patterns', () => {
+      const match = TaxonomyFilterService.matchesFilter({ Maturity: 'Trusted' }, { Maturity: '/Trusted|Adolescent/' });
+      expect(match).toBe(true);
+    });
+
+    it('should not match when regex does not match', () => {
+      const match = TaxonomyFilterService.matchesFilter(
+        { Maturity: 'Experimental' },
+        { Maturity: '/Trusted|Adolescent/' },
+      );
+      expect(match).toBe(false);
+    });
+
+    it('should return false when test lacks a required dimension', () => {
+      const match = TaxonomyFilterService.matchesFilter({}, { Scope: 'Unit' });
+      expect(match).toBe(false);
+    });
+
+    it('should handle hierarchical dot-notation matching', () => {
+      const match = TaxonomyFilterService.matchesFilter({ Domain: 'Combat.Melee.Sword' }, { Domain: 'Combat.Melee' });
+      expect(match).toBe(true);
+    });
+  });
+});
+
+// ============================================================================
+// Test Result Reporter
+// ============================================================================
+
+describe('TestResultReporter', () => {
+  describe('parseJUnitXml', () => {
+    it('should parse a valid JUnit XML string', () => {
+      const xml = `<?xml version="1.0" encoding="UTF-8"?>
+<testsuite name="EditMode" tests="10" failures="2" skipped="1" time="5.432">
+  <testcase classname="MyTests" name="TestA">
+  </testcase>
+  <testcase classname="MyTests" name="TestB">
+    <failure message="Expected true">
+      <![CDATA[at MyTests.TestB() in TestFile.cs:42]]>
+    </failure>
+  </testcase>
+</testsuite>`;
+
+      const result = TestResultReporter.parseJUnitXml(xml);
+
+      expect(result.runName).toBe('EditMode');
+      expect(result.passed).toBe(7);
+      expect(result.failed).toBe(2);
+      expect(result.skipped).toBe(1);
+      expect(result.duration).toBeCloseTo(5.432);
+      expect(result.failures).toHaveLength(1);
+      expect(result.failures[0].testName).toBe('TestB');
+      expect(result.failures[0].className).toBe('MyTests');
+      expect(result.failures[0].message).toBe('Expected true');
+      expect(result.failures[0].stackTrace).toContain('TestFile.cs:42');
+    });
+
+    it('should handle empty test suite', () => {
+      const xml = `<testsuite name="Empty" tests="0" failures="0" time="0.0"></testsuite>`;
+
+      const result = TestResultReporter.parseJUnitXml(xml);
+      expect(result.passed).toBe(0);
+      expect(result.failed).toBe(0);
+      expect(result.failures).toHaveLength(0);
+    });
+  });
+
+  describe('parseJsonData', () => {
+    it('should parse Unity JSON test result data', () => {
+      const data = {
+        name: 'PlayMode',
+        passed: 15,
+        failed: 2,
+        skipped: 3,
+        duration: 12.5,
+        testResults: [{ name: 'FailingTest', className: 'MyClass', result: 'Failed', message: 'Assert failed' }],
+      };
+
+      const result = TestResultReporter.parseJsonData(data);
+      expect(result.runName).toBe('PlayMode');
+      expect(result.passed).toBe(15);
+      expect(result.failed).toBe(2);
+      expect(result.skipped).toBe(3);
+      expect(result.failures).toHaveLength(1);
+      expect(result.failures[0].testName).toBe('FailingTest');
+    });
+  });
+
+  describe('generateSummary', () => {
+    it('should generate a markdown summary table', () => {
+      const results: TestResult[] = [
+        {
+          runName: 'fast',
+          passed: 10,
+          failed: 0,
+          skipped: 2,
+          duration: 5.0,
+          failures: [],
+        },
+        {
+          runName: 'basic',
+          passed: 20,
+          failed: 1,
+          skipped: 0,
+          duration: 30.0,
+          failures: [{ testName: 'TestX', className: 'ClassX', message: 'Expected 1 but got 2' }],
+        },
+      ];
+
+      const summary = TestResultReporter.generateSummary(results);
+
+      expect(summary).toContain('Test Results Summary');
+      expect(summary).toContain('fast');
+      expect(summary).toContain('basic');
+      expect(summary).toContain('Total');
+      expect(summary).toContain('Failures');
+      expect(summary).toContain('TestX');
+    });
+
+    it('should return message when no results available', () => {
+      const summary = TestResultReporter.generateSummary([]);
+      expect(summary).toContain('No test results');
+    });
+  });
+
+  describe('writeResults', () => {
+    it('should create output directory and write files for json format', () => {
+      mockFs.existsSync.mockReturnValue(false);
+      mockFs.mkdirSync.mockReturnValue(undefined as any);
+      mockFs.writeFileSync.mockReturnValue(undefined);
+
+      const results: TestResult[] = [
+        { runName: 'test', passed: 5, failed: 0, skipped: 0, duration: 1.0, failures: [] },
+      ];
+
+      TestResultReporter.writeResults(results, '/output', 'json');
+
+      expect(mockFs.mkdirSync).toHaveBeenCalledWith('/output', { recursive: true });
+      // Should write JSON + summary
+      expect(mockFs.writeFileSync).toHaveBeenCalledTimes(2);
+    });
+
+    it('should write both formats when specified', () => {
+      mockFs.existsSync.mockReturnValue(true);
+      mockFs.writeFileSync.mockReturnValue(undefined);
+
+      const results: TestResult[] = [
+        { runName: 'test', passed: 5, failed: 0, skipped: 0, duration: 1.0, failures: [] },
+      ];
+
+      TestResultReporter.writeResults(results, '/output', 'both');
+
+      // Should write JSON + JUnit XML + summary = 3 calls
+      expect(mockFs.writeFileSync).toHaveBeenCalledTimes(3);
+    });
+  });
+});
+
+// ============================================================================
+// Test Workflow Service - buildUnityArgs
+// ============================================================================
+
+describe('TestWorkflowService', () => {
+  describe('buildUnityArgs', () => {
+    const baseParams = {
+      projectPath: '/project',
+      targetPlatform: 'StandaloneLinux64',
+      testResultPath: './test-results',
+      testResultFormat: 'junit',
+    } as any;
+
+    it('should build EditMode args', () => {
+      const run: TestRunDefinition = { name: 'edit', editMode: true };
+
+      const args = TestWorkflowService.buildUnityArgs(run, baseParams);
+
+      expect(args).toContain('-batchmode');
+      expect(args).toContain('-nographics');
+      expect(args).toContain('-runTests');
+      expect(args).toContain('-testPlatform EditMode');
+      expect(args).toContain('-projectPath');
+    });
+
+    it('should build PlayMode args', () => {
+      const run: TestRunDefinition = { name: 'play', playMode: true };
+
+      const args = TestWorkflowService.buildUnityArgs(run, baseParams);
+
+      expect(args).toContain('-testPlatform PlayMode');
+    });
+
+    it('should build built-client args', () => {
+      const run: TestRunDefinition = {
+        name: 'client',
+        builtClient: true,
+        builtClientPath: './Builds/Linux',
+      };
+
+      const args = TestWorkflowService.buildUnityArgs(run, baseParams);
+
+      expect(args).toContain('-testPlatform StandalonePlayer');
+      expect(args).toContain('-builtPlayerPath');
+      expect(args).toContain('./Builds/Linux');
+    });
+
+    it('should include taxonomy filter args', () => {
+      const run: TestRunDefinition = {
+        name: 'filtered',
+        editMode: true,
+        filters: { Maturity: 'Trusted', Scope: 'Unit,Integration' },
+      };
+
+      const args = TestWorkflowService.buildUnityArgs(run, baseParams);
+
+      expect(args).toContain('--testFilter');
+      expect(args).toContain('Maturity=Trusted');
+    });
+
+    it('should include build target', () => {
+      const run: TestRunDefinition = { name: 'test', editMode: true };
+
+      const args = TestWorkflowService.buildUnityArgs(run, baseParams);
+
+      expect(args).toContain('-buildTarget StandaloneLinux64');
+    });
+  });
+});

src/model/orchestrator/services/test/README.md

@@ -0,0 +1,5 @@
+# Test Workflow Engine
+
+Service for YAML-based test suite definitions, taxonomy filtering, and structured test results.
+
+See GitHub Issue for full specification.

src/model/orchestrator/workflows/async-workflow.ts

@@ -27,6 +27,7 @@ printenv
 git config --global advice.detachedHead false
 git config --global filter.lfs.smudge "git-lfs smudge --skip -- %f"
 git config --global filter.lfs.process "git-lfs filter-process --skip"
+${OrchestratorFolders.gitAuthConfigScript}
 BRANCH="${Orchestrator.buildParameters.orchestratorBranch}"
 REPO="${OrchestratorFolders.unityBuilderRepoUrl}"
 if [ -n "$(git ls-remote --heads "$REPO" "$BRANCH" 2>/dev/null)" ]; then

src/model/orchestrator/workflows/build-automation-workflow.ts

@@ -92,6 +92,7 @@ export class BuildAutomationWorkflow implements WorkflowInterface {
     const commands = `mkdir -p ${OrchestratorFolders.ToLinuxFolder(
       OrchestratorFolders.builderPathAbsolute,
     )}
+${OrchestratorFolders.gitAuthConfigScript}
 BRANCH="${Orchestrator.buildParameters.orchestratorBranch}"
 REPO="${OrchestratorFolders.unityBuilderRepoUrl}"
 DEST="${OrchestratorFolders.ToLinuxFolder(OrchestratorFolders.builderPathAbsolute)}"

yarn.lock

@@ -1006,6 +1006,15 @@
     eslint-visitor-keys "^2.1.0"
     semver "^6.3.1"
 
+"@babel/generator@7.18.2":
+  version "7.18.2"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.18.2.tgz#33873d6f89b21efe2da63fe554460f3df1c5880d"
+  integrity sha512-W1lG5vUwFvfMd8HVXqdfbuG7RuaSrTCCD8cl8fP8wOivdbtbIg2Db3IWUcgvfxKbbn6ZBGYRW/Zk1MIwK49mgw==
+  dependencies:
+    "@babel/types" "^7.18.2"
+    "@jridgewell/gen-mapping" "^0.3.0"
+    jsesc "^2.5.1"
+
 "@babel/generator@^7.22.10", "@babel/generator@^7.7.2":
   version "7.22.10"
   resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.22.10.tgz#c92254361f398e160645ac58831069707382b722"
@@ -1099,11 +1108,21 @@
   dependencies:
     "@babel/types" "^7.22.5"
 
+"@babel/helper-string-parser@^7.18.10", "@babel/helper-string-parser@^7.27.1":
+  version "7.27.1"
+  resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz#54da796097ab19ce67ed9f88b47bb2ec49367687"
+  integrity sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==
+
 "@babel/helper-string-parser@^7.22.5":
   version "7.22.5"
   resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz#533f36457a25814cf1df6488523ad547d784a99f"
   integrity sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==
 
+"@babel/helper-validator-identifier@^7.18.6", "@babel/helper-validator-identifier@^7.28.5":
+  version "7.28.5"
+  resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz#010b6938fab7cb7df74aa2bbc06aa503b8fe5fb4"
+  integrity sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==
+
 "@babel/helper-validator-identifier@^7.22.20":
   version "7.22.20"
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz#c4ae002c61d2879e724581d96665583dbc1dc0e0"
@@ -1146,6 +1165,11 @@
     chalk "^2.4.2"
     js-tokens "^4.0.0"
 
+"@babel/parser@7.18.4":
+  version "7.18.4"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.18.4.tgz#6774231779dd700e0af29f6ad8d479582d7ce5ef"
+  integrity sha512-FDge0dFazETFcxGw/EXzOkN8uJp0PC7Qbm+Pe9T+av2zlBpOgunFHkQPPn+eRuClU73JF+98D531UgayY89tow==
+
 "@babel/parser@^7.1.0", "@babel/parser@^7.14.7", "@babel/parser@^7.20.7", "@babel/parser@^7.22.10", "@babel/parser@^7.22.5":
   version "7.22.10"
   resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.22.10.tgz#e37634f9a12a1716136c44624ef54283cabd3f55"
@@ -1288,6 +1312,15 @@
     debug "^4.1.0"
     globals "^11.1.0"
 
+"@babel/types@7.19.0":
+  version "7.19.0"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.19.0.tgz#75f21d73d73dc0351f3368d28db73465f4814600"
+  integrity sha512-YuGopBq3ke25BVSiS6fgF49Ul9gH1x70Bcr6bqRLjWCkcX8Hre1/5+z+IiWOIerRMSSEfGZVB9z9kyq7wVs9YA==
+  dependencies:
+    "@babel/helper-string-parser" "^7.18.10"
+    "@babel/helper-validator-identifier" "^7.18.6"
+    to-fast-properties "^2.0.0"
+
 "@babel/types@^7.0.0", "@babel/types@^7.20.7", "@babel/types@^7.22.10", "@babel/types@^7.22.5", "@babel/types@^7.3.3":
   version "7.22.10"
   resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.22.10.tgz#4a9e76446048f2c66982d1a989dd12b8a2d2dc03"
@@ -1297,6 +1330,14 @@
     "@babel/helper-validator-identifier" "^7.22.5"
     to-fast-properties "^2.0.0"
 
+"@babel/types@^7.18.2":
+  version "7.29.0"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.29.0.tgz#9f5b1e838c446e72cf3cd4b918152b8c605e37c7"
+  integrity sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==
+  dependencies:
+    "@babel/helper-string-parser" "^7.27.1"
+    "@babel/helper-validator-identifier" "^7.28.5"
+
 "@babel/types@^7.22.15", "@babel/types@^7.23.0":
   version "7.23.0"
   resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.23.0.tgz#8c1f020c9df0e737e4e247c0619f58c68458aaeb"
@@ -2667,6 +2708,13 @@
   dependencies:
     "@types/yargs-parser" "*"
 
+"@types/yargs@^17.0.35":
+  version "17.0.35"
+  resolved "https://registry.yarnpkg.com/@types/yargs/-/yargs-17.0.35.tgz#07013e46aa4d7d7d50a49e15604c1c5340d4eb24"
+  integrity sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==
+  dependencies:
+    "@types/yargs-parser" "*"
+
 "@types/yarnpkg__lockfile@^1.1.6":
   version "1.1.6"
   resolved "https://registry.yarnpkg.com/@types/yarnpkg__lockfile/-/yarnpkg__lockfile-1.1.6.tgz#60a35ede6197d8cbedd5bb8393f3921e8d56d44b"
@@ -3115,6 +3163,11 @@ asynckit@^0.4.0:
   resolved "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz"
   integrity sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==
 
+at-least-node@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/at-least-node/-/at-least-node-1.0.0.tgz#602cd4b46e844ad4effc92a8011a3c46e0238dc2"
+  integrity sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==
+
 available-typed-arrays@^1.0.5:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz#92f95616501069d07d10edb2fc37d3e1c65123b7"
@@ -3229,7 +3282,7 @@ base-64@^1.0.0:
   resolved "https://registry.yarnpkg.com/base-64/-/base-64-1.0.0.tgz#09d0f2084e32a3fd08c2475b973788eee6ae8f4a"
   integrity sha512-kwDPIFCGx0NZHog36dj+tHiwP4QMzsZ3AgMViUBKI0+V5n4U0ufTCUMhnQ04diaRI8EX/QcPfql7zlhZ7j4zgg==
 
-base64-js@^1.0.2:
+base64-js@^1.0.2, base64-js@^1.3.1:
   version "1.5.1"
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
@@ -3277,6 +3330,15 @@ big-integer@^1.6.44:
   resolved "https://registry.yarnpkg.com/big-integer/-/big-integer-1.6.51.tgz#0df92a5d9880560d3ff2d5fd20245c889d130686"
   integrity sha512-GPEid2Y9QU1Exl1rpO9B2IPJGHPSupF5GnVIP0blYvNOMer2bTvSWs1jGOUg04hTmu67nmLsQ9TBo1puaotBHg==
 
+bl@^4.0.3:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/bl/-/bl-4.1.0.tgz#451535264182bec2fbbc83a62ab98cf11d9f7b3a"
+  integrity sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==
+  dependencies:
+    buffer "^5.5.0"
+    inherits "^2.0.4"
+    readable-stream "^3.4.0"
+
 bowser@^2.11.0:
   version "2.11.0"
   resolved "https://registry.yarnpkg.com/bowser/-/bowser-2.11.0.tgz#5ca3c35757a7aa5771500c70a73a9f91ef420a8f"
@@ -3347,6 +3409,14 @@ buffer@4.9.2:
     ieee754 "^1.1.4"
     isarray "^1.0.0"
 
+buffer@^5.5.0:
+  version "5.7.1"
+  resolved "https://registry.yarnpkg.com/buffer/-/buffer-5.7.1.tgz#ba62e7c13133053582197160851a8f648e99eed0"
+  integrity sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==
+  dependencies:
+    base64-js "^1.3.1"
+    ieee754 "^1.1.13"
+
 bundle-name@^3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/bundle-name/-/bundle-name-3.0.0.tgz#ba59bcc9ac785fb67ccdbf104a2bf60c099f0e1a"
@@ -3440,7 +3510,7 @@ chalk@^2.4.2:
     escape-string-regexp "^1.0.5"
     supports-color "^5.3.0"
 
-chalk@^4.0.0, chalk@^4.1.0:
+chalk@^4.0.0, chalk@^4.1.0, chalk@^4.1.2:
   version "4.1.2"
   resolved "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz"
   integrity sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==
@@ -3463,6 +3533,11 @@ charenc@0.0.2:
   resolved "https://registry.yarnpkg.com/charenc/-/charenc-0.0.2.tgz#c0a1d2f3a7092e03774bfa83f14c0fc5790a8667"
   integrity sha512-yrLQ/yVUFXkzg7EDQsPieE/53+0RlaWTs+wBrvW36cyilJ2SaDWfl4Yj7MtLTXleV9uEKefbAGUPv2/iWSooRA==
 
+chownr@^1.1.1:
+  version "1.1.4"
+  resolved "https://registry.yarnpkg.com/chownr/-/chownr-1.1.4.tgz#6fc9d7b42d32a583596337666e7d08084da2cc6b"
+  integrity sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==
+
 chownr@^2.0.0:
   version "2.0.0"
   resolved "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz"
@@ -3504,6 +3579,15 @@ cliui@^7.0.2:
     strip-ansi "^6.0.0"
     wrap-ansi "^7.0.0"
 
+cliui@^8.0.1:
+  version "8.0.1"
+  resolved "https://registry.yarnpkg.com/cliui/-/cliui-8.0.1.tgz#0c04b075db02cbfe60dc8e6cf2f5486b1a3608aa"
+  integrity sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==
+  dependencies:
+    string-width "^4.2.0"
+    strip-ansi "^6.0.1"
+    wrap-ansi "^7.0.0"
+
 clone-response@^1.0.2:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/clone-response/-/clone-response-1.0.3.tgz#af2032aa47816399cf5f0a1d0db902f517abb8c3"
@@ -3614,6 +3698,11 @@ core-util-is@1.0.2:
   resolved "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz"
   integrity sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==
 
+core-util-is@~1.0.0:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz#a6042d3634c2b27e9328f837b965fac83808db85"
+  integrity sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==
+
 create-require@^1.1.0:
   version "1.1.1"
   resolved "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz"
@@ -3732,6 +3821,11 @@ dedent@^0.7.0:
   resolved "https://registry.yarnpkg.com/dedent/-/dedent-0.7.0.tgz#2495ddbaf6eb874abb0e1be9df22d2e5a544326c"
   integrity sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==
 
+deep-extend@^0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/deep-extend/-/deep-extend-0.6.0.tgz#c4fa7c95404a17a9c3e8ca7e1537312b736330ac"
+  integrity sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==
+
 deep-is@^0.1.3:
   version "0.1.4"
   resolved "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz"
@@ -3803,6 +3897,11 @@ dequal@^2.0.3:
   resolved "https://registry.yarnpkg.com/dequal/-/dequal-2.0.3.tgz#2644214f1997d39ed0ee0ece72335490a7ac67be"
   integrity sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==
 
+detect-libc@^2.0.0:
+  version "2.1.2"
+  resolved "https://registry.yarnpkg.com/detect-libc/-/detect-libc-2.1.2.tgz#689c5dcdc1900ef5583a4cb9f6d7b473742074ad"
+  integrity sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==
+
 detect-newline@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/detect-newline/-/detect-newline-3.1.0.tgz#576f5dfc63ae1a192ff192d8ad3af6308991b651"
@@ -3899,6 +3998,13 @@ end-of-stream@^1.1.0:
   dependencies:
     once "^1.4.0"
 
+end-of-stream@^1.4.1:
+  version "1.4.5"
+  resolved "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.5.tgz#7344d711dea40e0b74abc2ed49778743ccedb08c"
+  integrity sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==
+  dependencies:
+    once "^1.4.0"
+
 enquirer@^2.3.5:
   version "2.4.1"
   resolved "https://registry.yarnpkg.com/enquirer/-/enquirer-2.4.1.tgz#93334b3fbd74fc7097b224ab4a8fb7e40bf4ae56"
@@ -4398,6 +4504,11 @@ exit@^0.1.2:
   resolved "https://registry.yarnpkg.com/exit/-/exit-0.1.2.tgz#0632638f8d877cc82107d30a0fff1a17cba1cd0c"
   integrity sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==
 
+expand-template@^2.0.3:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/expand-template/-/expand-template-2.0.3.tgz#6e14b3fcee0f3a6340ecb57d2e8918692052a47c"
+  integrity sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==
+
 expect@^27.5.1:
   version "27.5.1"
   resolved "https://registry.npmjs.org/expect/-/expect-27.5.1.tgz"
@@ -4581,6 +4692,19 @@ form-data@~2.3.2:
     combined-stream "^1.0.6"
     mime-types "^2.1.12"
 
+from2@^2.3.0:
+  version "2.3.0"
+  resolved "https://registry.yarnpkg.com/from2/-/from2-2.3.0.tgz#8bfb5502bde4a4d36cfdeea007fcca21d7e382af"
+  integrity sha512-OMcX/4IC/uqEPVgGeyfN22LJk6AZrMkRZHxcHBMBvHScDGgwTm2GT2Wkgtocyd3JfZffjj2kYUDXXII0Fk9W0g==
+  dependencies:
+    inherits "^2.0.1"
+    readable-stream "^2.0.0"
+
+fs-constants@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/fs-constants/-/fs-constants-1.0.0.tgz#6be0de9be998ce16af8afc24497b9ee9b7ccd9ad"
+  integrity sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==
+
 fs-extra@^11.1.1:
   version "11.1.1"
   resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-11.1.1.tgz#da69f7c39f3b002378b0954bb6ae7efdc0876e2d"
@@ -4590,6 +4714,16 @@ fs-extra@^11.1.1:
     jsonfile "^6.0.1"
     universalify "^2.0.0"
 
+fs-extra@^9.1.0:
+  version "9.1.0"
+  resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-9.1.0.tgz#5954460c764a8da2094ba3554bf839e6b9a7c86d"
+  integrity sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==
+  dependencies:
+    at-least-node "^1.0.0"
+    graceful-fs "^4.2.0"
+    jsonfile "^6.0.1"
+    universalify "^2.0.0"
+
 fs-minipass@^2.0.0:
   version "2.1.0"
   resolved "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz"
@@ -4612,6 +4746,11 @@ function-bind@^1.1.1:
   resolved "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz"
   integrity sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==
 
+function-bind@^1.1.2:
+  version "1.1.2"
+  resolved "https://registry.yarnpkg.com/function-bind/-/function-bind-1.1.2.tgz#2c02d864d97f3ea6c8830c464cbd11ab6eab7a1c"
+  integrity sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==
+
 function.prototype.name@^1.1.5:
   version "1.1.5"
   resolved "https://registry.yarnpkg.com/function.prototype.name/-/function.prototype.name-1.1.5.tgz#cce0505fe1ffb80503e6f9e46cc64e46a12a9621"
@@ -4691,6 +4830,11 @@ getpass@^0.1.1:
   dependencies:
     assert-plus "^1.0.0"
 
+github-from-package@0.0.0:
+  version "0.0.0"
+  resolved "https://registry.yarnpkg.com/github-from-package/-/github-from-package-0.0.0.tgz#97fb5d96bfde8973313f20e8288ef9a167fa64ce"
+  integrity sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==
+
 glob-parent@^5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.2.tgz#869832c58034fe68a4093c17dc15e8340d8401c4"
@@ -4875,6 +5019,13 @@ has@^1.0.3:
   dependencies:
     function-bind "^1.1.1"
 
+hasown@^2.0.2:
+  version "2.0.2"
+  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.2.tgz#003eaf91be7adc372e84ec59dc37252cedb80003"
+  integrity sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==
+  dependencies:
+    function-bind "^1.1.2"
+
 hosted-git-info@^2.1.4:
   version "2.8.9"
   resolved "https://registry.yarnpkg.com/hosted-git-info/-/hosted-git-info-2.8.9.tgz#dffc0bf9a21c02209090f2aa69429e1414daf3f9"
@@ -4953,7 +5104,7 @@ ieee754@1.1.13:
   resolved "https://registry.yarnpkg.com/ieee754/-/ieee754-1.1.13.tgz#ec168558e95aa181fd87d37f55c32bbcb6708b84"
   integrity sha512-4vf7I2LYV/HaWerSo3XmlMkp5eZ83i+/CDluXi/IGTs/O1sejBNhTtnxzmRZfvOUqj7lZjqHkeTvpgSFDlWZTg==
 
-ieee754@^1.1.4:
+ieee754@^1.1.13, ieee754@^1.1.4:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/ieee754/-/ieee754-1.2.1.tgz#8eb7a10a63fff25d15a57b001586d177d1b0d352"
   integrity sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==
@@ -5007,11 +5158,16 @@ inflight@^1.0.4:
     once "^1.3.0"
     wrappy "1"
 
-inherits@2, inherits@^2.0.3:
+inherits@2, inherits@^2.0.1, inherits@^2.0.3, inherits@^2.0.4, inherits@~2.0.3:
   version "2.0.4"
   resolved "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz"
   integrity sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==
 
+ini@~1.3.0:
+  version "1.3.8"
+  resolved "https://registry.yarnpkg.com/ini/-/ini-1.3.8.tgz#a29da425b48806f34767a4efce397269af28432c"
+  integrity sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==
+
 internal-slot@^1.0.5:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/internal-slot/-/internal-slot-1.0.5.tgz#f2a2ee21f668f8627a4667f309dc0f4fb6674986"
@@ -5026,6 +5182,14 @@ interpret@^1.0.0:
   resolved "https://registry.npmjs.org/interpret/-/interpret-1.4.0.tgz"
   integrity sha512-agE4QfB2Lkp9uICn7BAqoscw4SZP9kTE2hxiFI3jBPmXJfdqiahTbUuKGsMoN2GtqL9AxhYioAcVvgsb1HvRbA==
 
+into-stream@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.yarnpkg.com/into-stream/-/into-stream-6.0.0.tgz#4bfc1244c0128224e18b8870e85b2de8e66c6702"
+  integrity sha512-XHbaOAvP+uFKUFsOgoNPRjLkwB+I22JFPFe5OjTkQ0nwgj6+pSjb4NmB6VMxaPshLiOf+zcpOCBQuLwC1KHhZA==
+  dependencies:
+    from2 "^2.3.0"
+    p-is-promise "^3.0.0"
+
 is-arguments@^1.0.4:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/is-arguments/-/is-arguments-1.1.1.tgz#15b3f88fda01f2a97fec84ca761a560f123efa9b"
@@ -5073,6 +5237,13 @@ is-callable@^1.1.3, is-callable@^1.1.4, is-callable@^1.2.7:
   resolved "https://registry.yarnpkg.com/is-callable/-/is-callable-1.2.7.tgz#3bc2a85ea742d9e36205dcacdd72ca1fdc51b055"
   integrity sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==
 
+is-core-module@2.9.0:
+  version "2.9.0"
+  resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.9.0.tgz#e1c34429cd51c6dd9e09e0799e396e27b19a9c69"
+  integrity sha512-+5FPy5PnwmO3lvfMb0AsoPaBG+5KHUI0wYFXOtYPnVVVspTFUuMZNfNaNVRt3FZadstu2c8x23vykRW/NBoU6A==
+  dependencies:
+    has "^1.0.3"
+
 is-core-module@^2.12.1, is-core-module@^2.13.0:
   version "2.13.0"
   resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.13.0.tgz#bb52aa6e2cbd49a30c2ba68c42bf3435ba6072db"
@@ -5080,6 +5251,13 @@ is-core-module@^2.12.1, is-core-module@^2.13.0:
   dependencies:
     has "^1.0.3"
 
+is-core-module@^2.16.1:
+  version "2.16.1"
+  resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.16.1.tgz#2a98801a849f43e2add644fbb6bc6229b19a4ef4"
+  integrity sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==
+  dependencies:
+    hasown "^2.0.2"
+
 is-date-object@^1.0.1:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/is-date-object/-/is-date-object-1.0.5.tgz#0841d5536e724c25597bf6ea62e1bd38298df31f"
@@ -5235,7 +5413,7 @@ is-wsl@^2.2.0:
   dependencies:
     is-docker "^2.0.0"
 
-isarray@^1.0.0:
+isarray@^1.0.0, isarray@~1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/isarray/-/isarray-1.0.0.tgz#bb935d48582cba168c06834957a54a3e07124f11"
   integrity sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==
@@ -6197,7 +6375,7 @@ minimatch@^3.0.4, minimatch@^3.1.1, minimatch@^3.1.2:
   dependencies:
     brace-expansion "^1.1.7"
 
-minimist@^1.2.0, minimist@^1.2.6:
+minimist@^1.2.0, minimist@^1.2.3, minimist@^1.2.6:
   version "1.2.8"
   resolved "https://registry.yarnpkg.com/minimist/-/minimist-1.2.8.tgz#c1a464e7693302e082a075cee0c057741ac4772c"
   integrity sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==
@@ -6227,6 +6405,11 @@ minizlib@^2.1.1:
     minipass "^3.0.0"
     yallist "^4.0.0"
 
+mkdirp-classic@^0.5.2, mkdirp-classic@^0.5.3:
+  version "0.5.3"
+  resolved "https://registry.yarnpkg.com/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz#fa10c9115cc6d8865be221ba47ee9bed78601113"
+  integrity sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==
+
 mkdirp@^1.0.3:
   version "1.0.4"
   resolved "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz"
@@ -6247,11 +6430,24 @@ multimap@^1.1.0:
   resolved "https://registry.yarnpkg.com/multimap/-/multimap-1.1.0.tgz#5263febc085a1791c33b59bb3afc6a76a2a10ca8"
   integrity sha512-0ZIR9PasPxGXmRsEF8jsDzndzHDj7tIav+JUmvIFB/WHswliFnquxECT/De7GR4yg99ky/NlRKJT82G1y271bw==
 
+multistream@^4.1.0:
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/multistream/-/multistream-4.1.0.tgz#7bf00dfd119556fbc153cff3de4c6d477909f5a8"
+  integrity sha512-J1XDiAmmNpRCBfIWJv+n0ymC4ABcf/Pl+5YvC5B/D2f/2+8PtHvCNxMPKiQcZyi922Hq69J2YOpb1pTywfifyw==
+  dependencies:
+    once "^1.4.0"
+    readable-stream "^3.6.0"
+
 nanoid@^3.3.1:
   version "3.3.6"
   resolved "https://registry.yarnpkg.com/nanoid/-/nanoid-3.3.6.tgz#443380c856d6e9f9824267d960b4236ad583ea4c"
   integrity sha512-BGcqMMJuToF7i1rt+2PWSNVnWIkGCU78jBG3RxO/bZlnZPK2Cmi2QaffxGO/2RvWi9sL+FAiRiXMgsyxQ1DIDA==
 
+napi-build-utils@^1.0.1:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/napi-build-utils/-/napi-build-utils-1.0.2.tgz#b1fddc0b2c46e380a0b7a76f984dd47c41a13806"
+  integrity sha512-ONmRUqK7zj7DWX0D9ADe03wbwOBZxNAfF20PlGfCWQcD3+/MakShIHrMqx9YwPTfxDdF1zLeL+RGZiR9kGMLdg==
+
 natural-compare@^1.4.0:
   version "1.4.0"
   resolved "https://registry.yarnpkg.com/natural-compare/-/natural-compare-1.4.0.tgz#4abebfeed7541f2c27acfb29bdbbd15c8d5ba4f7"
@@ -6272,7 +6468,14 @@ no-case@^3.0.4:
     lower-case "^2.0.2"
     tslib "^2.0.3"
 
-node-fetch@2:
+node-abi@^3.3.0:
+  version "3.87.0"
+  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.87.0.tgz#423e28fea5c2f195fddd98acded9938c001ae6dd"
+  integrity sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==
+  dependencies:
+    semver "^7.3.5"
+
+node-fetch@2, node-fetch@^2.6.6, node-fetch@^2.7.0:
   version "2.7.0"
   resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
   integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
@@ -6286,13 +6489,6 @@ node-fetch@^2.6.7:
   dependencies:
     whatwg-url "^5.0.0"
 
-node-fetch@^2.7.0:
-  version "2.7.0"
-  resolved "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.7.0.tgz#d0f0fa6e3e2dc1d27efcd8ad99d550bda94d187d"
-  integrity sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==
-  dependencies:
-    whatwg-url "^5.0.0"
-
 node-int64@^0.4.0:
   version "0.4.0"
   resolved "https://registry.yarnpkg.com/node-int64/-/node-int64-0.4.0.tgz#87a9065cdb355d3182d8f94ce11188b825c68a3b"
@@ -6508,6 +6704,11 @@ p-cancelable@^2.0.0:
   resolved "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.1.1.tgz"
   integrity sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==
 
+p-is-promise@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/p-is-promise/-/p-is-promise-3.0.0.tgz#58e78c7dfe2e163cf2a04ff869e7c1dba64a5971"
+  integrity sha512-Wo8VsW4IRQSKVXsJCn7TomUaVtyfjVDn3nUP7kE967BQk0CwFpdbZs0X0uk5sW9mkBa9eNM7hCMaG93WUAwxYQ==
+
 p-limit@^2.2.0:
   version "2.3.0"
   resolved "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz#3dd33c647a214fdfffd835933eb086da0dc21db1"
@@ -6653,11 +6854,63 @@ pkg-dir@^7.0.0:
   dependencies:
     find-up "^6.3.0"
 
+pkg-fetch@3.4.2:
+  version "3.4.2"
+  resolved "https://registry.yarnpkg.com/pkg-fetch/-/pkg-fetch-3.4.2.tgz#6f68ebc54842b73f8c0808959a9df3739dcb28b7"
+  integrity sha512-0+uijmzYcnhC0hStDjm/cl2VYdrmVVBpe7Q8k9YBojxmR5tG8mvR9/nooQq3QSXiQqORDVOTY3XqMEqJVIzkHA==
+  dependencies:
+    chalk "^4.1.2"
+    fs-extra "^9.1.0"
+    https-proxy-agent "^5.0.0"
+    node-fetch "^2.6.6"
+    progress "^2.0.3"
+    semver "^7.3.5"
+    tar-fs "^2.1.1"
+    yargs "^16.2.0"
+
+pkg@^5.8.1:
+  version "5.8.1"
+  resolved "https://registry.yarnpkg.com/pkg/-/pkg-5.8.1.tgz#862020f3c0575638ef7d1146f951a54d65ddc984"
+  integrity sha512-CjBWtFStCfIiT4Bde9QpJy0KeH19jCfwZRJqHFDFXfhUklCx8JoFmMj3wgnEYIwGmZVNkhsStPHEOnrtrQhEXA==
+  dependencies:
+    "@babel/generator" "7.18.2"
+    "@babel/parser" "7.18.4"
+    "@babel/types" "7.19.0"
+    chalk "^4.1.2"
+    fs-extra "^9.1.0"
+    globby "^11.1.0"
+    into-stream "^6.0.0"
+    is-core-module "2.9.0"
+    minimist "^1.2.6"
+    multistream "^4.1.0"
+    pkg-fetch "3.4.2"
+    prebuild-install "7.1.1"
+    resolve "^1.22.0"
+    stream-meter "^1.0.4"
+
 pluralize@^8.0.0:
   version "8.0.0"
   resolved "https://registry.yarnpkg.com/pluralize/-/pluralize-8.0.0.tgz#1a6fa16a38d12a1901e0320fa017051c539ce3b1"
   integrity sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==
 
+prebuild-install@7.1.1:
+  version "7.1.1"
+  resolved "https://registry.yarnpkg.com/prebuild-install/-/prebuild-install-7.1.1.tgz#de97d5b34a70a0c81334fd24641f2a1702352e45"
+  integrity sha512-jAXscXWMcCK8GgCoHOfIr0ODh5ai8mj63L2nWrjuAgXE6tDyYGnx4/8o/rCgU+B4JSyZBKbeZqzhtwtC3ovxjw==
+  dependencies:
+    detect-libc "^2.0.0"
+    expand-template "^2.0.3"
+    github-from-package "0.0.0"
+    minimist "^1.2.3"
+    mkdirp-classic "^0.5.3"
+    napi-build-utils "^1.0.1"
+    node-abi "^3.3.0"
+    pump "^3.0.0"
+    rc "^1.2.7"
+    simple-get "^4.0.0"
+    tar-fs "^2.0.0"
+    tunnel-agent "^0.6.0"
+
 prelude-ls@^1.2.1:
   version "1.2.1"
   resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
@@ -6694,12 +6947,17 @@ pretty-format@^27.0.0, pretty-format@^27.5.1:
     ansi-styles "^5.0.0"
     react-is "^17.0.1"
 
+process-nextick-args@~2.0.0:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.1.tgz#7820d9b16120cc55ca9ae7792680ae7dba6d7fe2"
+  integrity sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==
+
 process@^0.11.10:
   version "0.11.10"
   resolved "https://registry.npmjs.org/process/-/process-0.11.10.tgz"
   integrity sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==
 
-progress@^2.0.0:
+progress@^2.0.0, progress@^2.0.3:
   version "2.0.3"
   resolved "https://registry.yarnpkg.com/progress/-/progress-2.0.3.tgz#7e8cf8d8f5b8f239c1bc68beb4eb78567d572ef8"
   integrity sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==
@@ -6772,6 +7030,16 @@ quick-lru@^5.1.1:
   resolved "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz"
   integrity sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==
 
+rc@^1.2.7:
+  version "1.2.8"
+  resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.8.tgz#cd924bf5200a075b83c188cd6b9e211b7fc0d3ed"
+  integrity sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==
+  dependencies:
+    deep-extend "^0.6.0"
+    ini "~1.3.0"
+    minimist "^1.2.0"
+    strip-json-comments "~2.0.1"
+
 react-is@^17.0.1:
   version "17.0.2"
   resolved "https://registry.yarnpkg.com/react-is/-/react-is-17.0.2.tgz#e691d4a8e9c789365655539ab372762b0efb54f0"
@@ -6796,6 +7064,28 @@ read-pkg@^5.2.0:
     parse-json "^5.0.0"
     type-fest "^0.6.0"
 
+readable-stream@^2.0.0, readable-stream@^2.1.4:
+  version "2.3.8"
+  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.8.tgz#91125e8042bba1b9887f49345f6277027ce8be9b"
+  integrity sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==
+  dependencies:
+    core-util-is "~1.0.0"
+    inherits "~2.0.3"
+    isarray "~1.0.0"
+    process-nextick-args "~2.0.0"
+    safe-buffer "~5.1.1"
+    string_decoder "~1.1.1"
+    util-deprecate "~1.0.1"
+
+readable-stream@^3.1.1, readable-stream@^3.4.0, readable-stream@^3.6.0:
+  version "3.6.2"
+  resolved "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.6.2.tgz#56a9b36ea965c00c5a93ef31eb111a0f11056967"
+  integrity sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==
+  dependencies:
+    inherits "^2.0.3"
+    string_decoder "^1.1.1"
+    util-deprecate "^1.0.1"
+
 rechoir@^0.6.2:
   version "0.6.2"
   resolved "https://registry.yarnpkg.com/rechoir/-/rechoir-0.6.2.tgz#85204b54dba82d5742e28c96756ef43af50e3384"
@@ -6914,6 +7204,15 @@ resolve@^1.1.6, resolve@^1.10.0, resolve@^1.20.0, resolve@^1.22.3, resolve@^1.22
     path-parse "^1.0.7"
     supports-preserve-symlinks-flag "^1.0.0"
 
+resolve@^1.22.0:
+  version "1.22.11"
+  resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.22.11.tgz#aad857ce1ffb8bfa9b0b1ac29f1156383f68c262"
+  integrity sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==
+  dependencies:
+    is-core-module "^2.16.1"
+    path-parse "^1.0.7"
+    supports-preserve-symlinks-flag "^1.0.0"
+
 responselike@^1.0.2:
   version "1.0.2"
   resolved "https://registry.yarnpkg.com/responselike/-/responselike-1.0.2.tgz#918720ef3b631c5642be068f15ade5a46f4ba1e7"
@@ -6969,11 +7268,16 @@ safe-array-concat@^1.0.0:
     has-symbols "^1.0.3"
     isarray "^2.0.5"
 
-safe-buffer@^5.0.1, safe-buffer@^5.1.2:
+safe-buffer@^5.0.1, safe-buffer@^5.1.2, safe-buffer@~5.2.0:
   version "5.2.1"
   resolved "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz"
   integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
 
+safe-buffer@~5.1.0, safe-buffer@~5.1.1:
+  version "5.1.2"
+  resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.1.2.tgz#991ec69d296e0313747d59bdfd2b745c35f8828d"
+  integrity sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==
+
 safe-regex-test@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/safe-regex-test/-/safe-regex-test-1.0.0.tgz#793b874d524eb3640d1873aad03596db2d4f2295"
@@ -7081,6 +7385,20 @@ signal-exit@^3.0.2, signal-exit@^3.0.3, signal-exit@^3.0.7:
   resolved "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz"
   integrity sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==
 
+simple-concat@^1.0.0:
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/simple-concat/-/simple-concat-1.0.1.tgz#f46976082ba35c2263f1c8ab5edfe26c41c9552f"
+  integrity sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==
+
+simple-get@^4.0.0:
+  version "4.0.1"
+  resolved "https://registry.yarnpkg.com/simple-get/-/simple-get-4.0.1.tgz#4a39db549287c979d352112fa03fd99fd6bc3543"
+  integrity sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==
+  dependencies:
+    decompress-response "^6.0.0"
+    once "^1.3.1"
+    simple-concat "^1.0.0"
+
 sisteransi@^1.0.5:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/sisteransi/-/sisteransi-1.0.5.tgz#134d681297756437cc05ca01370d3a7a571075ed"
@@ -7186,6 +7504,13 @@ stream-buffers@^3.0.2:
   resolved "https://registry.npmjs.org/stream-buffers/-/stream-buffers-3.0.2.tgz"
   integrity sha512-DQi1h8VEBA/lURbSwFtEHnSTb9s2/pwLEaFuNhXwy1Dx3Sa0lOuYT2yNUr4/j2fs8oCAMANtrZ5OrPZtyVs3MQ==
 
+stream-meter@^1.0.4:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/stream-meter/-/stream-meter-1.0.4.tgz#52af95aa5ea760a2491716704dbff90f73afdd1d"
+  integrity sha512-4sOEtrbgFotXwnEuzzsQBYEV1elAeFSO8rSGeTwabuX1RRn/kEq9JVH7I0MRBhKVRR0sJkr0M0QCH7yOLf9fhQ==
+  dependencies:
+    readable-stream "^2.1.4"
+
 string-length@^4.0.1:
   version "4.0.2"
   resolved "https://registry.yarnpkg.com/string-length/-/string-length-4.0.2.tgz#a8a8dc7bd5c1a82b9b3c8b87e125f66871b6e57a"
@@ -7230,6 +7555,20 @@ string.prototype.trimstart@^1.0.6:
     define-properties "^1.1.4"
     es-abstract "^1.20.4"
 
+string_decoder@^1.1.1:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.3.0.tgz#42f114594a46cf1a8e30b0a84f56c78c3edac21e"
+  integrity sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==
+  dependencies:
+    safe-buffer "~5.2.0"
+
+string_decoder@~1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.1.1.tgz#9cf1611ba62685d7030ae9e4ba34149c3af03fc8"
+  integrity sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==
+  dependencies:
+    safe-buffer "~5.1.0"
+
 strip-ansi@^6.0.0, strip-ansi@^6.0.1:
   version "6.0.1"
   resolved "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz"
@@ -7262,6 +7601,11 @@ strip-json-comments@^3.1.0, strip-json-comments@^3.1.1:
   resolved "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-3.1.1.tgz#31f1281b3832630434831c310c01cccda8cbe006"
   integrity sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==
 
+strip-json-comments@~2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-2.0.1.tgz#3c531942e908c2697c0ec344858c286c7ca0a60a"
+  integrity sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==
+
 strnum@^1.0.5:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/strnum/-/strnum-1.1.2.tgz#57bca4fbaa6f271081715dbc9ed7cee5493e28e4"
@@ -7354,6 +7698,27 @@ table@^6.0.9:
     string-width "^4.2.3"
     strip-ansi "^6.0.1"
 
+tar-fs@^2.0.0, tar-fs@^2.1.1:
+  version "2.1.4"
+  resolved "https://registry.yarnpkg.com/tar-fs/-/tar-fs-2.1.4.tgz#800824dbf4ef06ded9afea4acafe71c67c76b930"
+  integrity sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==
+  dependencies:
+    chownr "^1.1.1"
+    mkdirp-classic "^0.5.2"
+    pump "^3.0.0"
+    tar-stream "^2.1.4"
+
+tar-stream@^2.1.4:
+  version "2.2.0"
+  resolved "https://registry.yarnpkg.com/tar-stream/-/tar-stream-2.2.0.tgz#acad84c284136b060dc3faa64474aa9aebd77287"
+  integrity sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==
+  dependencies:
+    bl "^4.0.3"
+    end-of-stream "^1.4.1"
+    fs-constants "^1.0.0"
+    inherits "^2.0.3"
+    readable-stream "^3.1.1"
+
 tar@^6.1.11:
   version "6.1.15"
   resolved "https://registry.yarnpkg.com/tar/-/tar-6.1.15.tgz#c9738b0b98845a3b344d334b8fa3041aaba53a69"
@@ -7758,6 +8123,11 @@ url@0.10.3:
     punycode "1.3.2"
     querystring "0.2.0"
 
+util-deprecate@^1.0.1, util-deprecate@~1.0.1:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"
+  integrity sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==
+
 util@^0.12.4:
   version "0.12.5"
   resolved "https://registry.yarnpkg.com/util/-/util-0.12.5.tgz#5f17a6059b73db61a875668781a1c2b136bd6fbc"
@@ -8032,6 +8402,11 @@ yargs-parser@20.x, yargs-parser@^20.2.2:
   resolved "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz"
   integrity sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==
 
+yargs-parser@^21.1.1:
+  version "21.1.1"
+  resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-21.1.1.tgz#9096bceebf990d21bb31fa9516e0ede294a77d35"
+  integrity sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==
+
 yargs@^16.2.0:
   version "16.2.0"
   resolved "https://registry.npmjs.org/yargs/-/yargs-16.2.0.tgz"
@@ -8045,6 +8420,19 @@ yargs@^16.2.0:
     y18n "^5.0.5"
     yargs-parser "^20.2.2"
 
+yargs@^17.7.2:
+  version "17.7.2"
+  resolved "https://registry.yarnpkg.com/yargs/-/yargs-17.7.2.tgz#991df39aca675a192b816e1e0363f9d75d2aa269"
+  integrity sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==
+  dependencies:
+    cliui "^8.0.1"
+    escalade "^3.1.1"
+    get-caller-file "^2.0.5"
+    require-directory "^2.1.1"
+    string-width "^4.2.3"
+    y18n "^5.0.5"
+    yargs-parser "^21.1.1"
+
 yarn-audit-fix@^9.3.8:
   version "9.3.12"
   resolved "https://registry.yarnpkg.com/yarn-audit-fix/-/yarn-audit-fix-9.3.12.tgz#cc34e87aa080bace32f2f105be6b581a3cb6eb24"