Fix checkout-free publish repository context

[hatayama]

Summary

Fix checkout-free native and dispatcher publish jobs so every gh release operation has explicit repository context.

Root cause and fix

The PR-1 publish boundary intentionally has no repository checkout. gh release view/create/upload/edit nevertheless attempted to infer the repository from a local git remote, producing fatal: not a git repository during the first real release. The publish jobs now set GH_REPO: ${{ github.repository }} at job scope, and both workflow tests assert that this context remains present.

Security and residual risk

The change does not add checkout, repository-script execution, or broader token permissions. It only makes the target repository explicit for the already-approved privileged release operations. Release metadata, target SHA, tag, manifest, attestation, and environment protections remain unchanged. A malformed or unavailable GitHub context still fails the gh operation closed.

Verification

• scripts/test-native-cli-publish-workflow.sh
• scripts/test-dispatcher-publish-workflow.sh
• go run ./cmd/check-release-triggers --base origin/v3-beta --head HEAD
• git diff --check

Recovery sequence (owner approval required; not executed by this PR)

After this fix is merged into v3-beta, confirm the merge commit is the workflow head and that no target tag or release was created by the failed runs. Then, after owner approval, dispatch each workflow from v3-beta with dry-run=false:

gh workflow run native-cli-publish.yml --ref v3-beta -f dry-run=false
gh workflow run dispatcher-publish.yml --ref v3-beta -f dry-run=false

Before allowing publish, inspect each run's resolver output: the native target must be uloop-project-runner-v3.0.0-beta.48 and the dispatcher target must be dispatcher-v3.1.0-beta.13, with each resolved target SHA equal to that run's github.sha. Confirm the approved-commit guard passes on the post-merge fix head, then monitor draft creation, asset upload, attestation verification, and final publish. Do not release the Unity package until the runner release and pin-advance ordering requirements are satisfied.

[coderabbitai]

📝 Walkthrough

Walkthrough

Both publish workflows now define GH_REPO from github.repository, and their shell-based workflow tests verify the setting.

Changes

Publish repository context

Layer / File(s)	Summary
Publish workflow repository environment .github/workflows/dispatcher-publish.yml, .github/workflows/native-cli-publish.yml	The publish jobs define GH_REPO: ${{ github.repository }}.
Repository context validation scripts/test-dispatcher-publish-workflow.sh, scripts/test-native-cli-publish-workflow.sh	New assertions verify the explicit repository context, and both tests are added to their execution sequences.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: adding explicit repository context for checkout-free publish jobs.
Description check	✅ Passed	The description accurately explains the workflow and test updates related to explicit GH_REPO handling.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-gh-repo-context

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}