ci: fire unity-tests on every PR (mirrors python-tests pattern)

Closes the asymmetry between python-tests.yml (auto-fires on every PR
via pull_request) and unity-tests.yml (only fires on labeled
pull_request_target, or on push events). Same-repo PRs now get a
unity-tests status check immediately on open; fork PRs also get the
check but run in the fork's secret-less context, so the existing
detect step writes unity_ok=false and the job exits clean with a
"missing license secrets" notice. The status appears but signals the
fork-PR contributor that a maintainer needs to apply 'safe-to-test'
for a real run (existing gating pattern preserved).

Three changes:

1. Add 'pull_request: branches: [main, beta]' to the workflow triggers
   with the same path filter as pull_request_target. The job-level if:
   gates already pass through non-pull_request_target events, so no
   gate edits are needed.

2. Extend the matrix selector to honor 'full-matrix' label on
   pull_request events too, not just pull_request_target. Lets
   in-repo PR contributors opt into the wide matrix at PR-open time
   without waiting for the labeled-pull_request_target event.

3. Add a workflow-level concurrency group keyed on
   `github.head_ref || github.ref`. Same-repo PRs would otherwise
   fire both push (on the branch SHA) and pull_request (on the PR
   SHA) and run the matrix twice; concurrency dedupes them.

Selector dry-run across the seven trigger cases confirms correct
behavior: default leg on unlabeled PR open / feature push; FULL on
labeled PR open + pr_target / push to beta / workflow_call /
workflow_dispatch.

Doc update in docs/development/README-DEV.md explains the new PR
status-check behavior and the fork-PR caveat.

Author: Scriptwonder

.github/workflows/unity-tests.yml

@@ -16,6 +16,19 @@ on:
       - MCPForUnity/Editor/**
       - MCPForUnity/Runtime/**
       - .github/workflows/unity-tests.yml
+  # Same-repo PRs get a unity-tests status check on every open / push via this trigger
+  # (mirrors python-tests.yml). Fork PRs ALSO fire this trigger but run in the fork's
+  # context without secrets — the detect step downstream writes unity_ok=false and the
+  # job exits clean with a "missing license secrets" notice so the status check still
+  # appears. Maintainers apply 'safe-to-test' to invoke pull_request_target below for
+  # a real fork-PR test run.
+  pull_request:
+    branches: [main, beta]
+    paths:
+      - TestProjects/UnityMCPTests/**
+      - MCPForUnity/Editor/**
+      - MCPForUnity/Runtime/**
+      - .github/workflows/unity-tests.yml
   # Fork PRs: maintainer applies the 'safe-to-test' label after reviewing
   # the diff. The workflow runs with UNITY_LICENSE in scope against the
   # PR's head SHA. Re-pushed commits do NOT auto-trigger — maintainer must
@@ -29,6 +42,13 @@ on:
       - MCPForUnity/Runtime/**
       - .github/workflows/unity-tests.yml
 
+# Dedup runs for the same branch across push / pull_request / pull_request_target / workflow_call.
+# Same-repo PRs would otherwise fire both push (on the branch SHA) AND pull_request (on the PR);
+# concurrency keeps only the newer in-flight run per branch.
+concurrency:
+  group: unity-tests-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   matrix:
     name: Compute Unity version matrix
@@ -71,12 +91,12 @@ jobs:
         run: |
           set -euo pipefail
           # Full matrix on: beta push, workflow_call (release pipelines), workflow_dispatch,
-          # or any PR labeled with 'full-matrix'.
+          # or any PR (pull_request OR pull_request_target) labeled with 'full-matrix'.
           # Default (single defaultVersion from tools/unity-versions.json) otherwise — fast PR feedback.
           if [[ "$EVENT_NAME" == "workflow_dispatch" ]] || \
              [[ "$EVENT_NAME" == "workflow_call" ]] || \
              { [[ "$EVENT_NAME" == "push" ]] && [[ "$GH_REF" == "refs/heads/beta" ]]; } || \
-             { [[ "$EVENT_NAME" == "pull_request_target" ]] && [[ "$FULL_MATRIX_LABEL" == "true" ]]; }; then
+             { { [[ "$EVENT_NAME" == "pull_request" ]] || [[ "$EVENT_NAME" == "pull_request_target" ]]; } && [[ "$FULL_MATRIX_LABEL" == "true" ]]; }; then
             versions=$(jq -c '[.versions[].id]' tools/unity-versions.json)
             echo "Trigger '$EVENT_NAME' on ref '$GH_REF' (full_matrix_label=$FULL_MATRIX_LABEL) → full matrix: $versions"
           else

docs/development/README-DEV.md

@@ -142,16 +142,18 @@ open htmlcov/index.html
 
 CI exercises the package across multiple Unity versions to catch breaks in `#if UNITY_*_OR_NEWER` branches. The matrix is configured in `tools/unity-versions.json` and consumed by `.github/workflows/unity-tests.yml`.
 
+**Every PR gets a unity-tests status check on open** (mirrors `python-tests.yml`). For same-repo PRs the default Unity 6 leg actually runs; for fork PRs the workflow appears but skips with a "missing license secrets" notice until a maintainer applies `safe-to-test` (existing secret-safety gate). The full 4-version matrix is opt-in via the `full-matrix` label.
+
 **When the full matrix runs (all 4 versions in parallel):**
 
 - Push to `beta` (the release gate).
 - `workflow_call` from `beta-release.yml` / `release.yml`.
 - Manual `workflow_dispatch` from the Actions tab.
-- Any PR (in-repo or fork) labeled with **`full-matrix`** — apply this label when your change touches compat shims, conditional compilation, or anything else version-sensitive. The workflow re-runs with the full matrix on the next `pull_request_target` event. Cost is ~6-8 min wall clock vs ~3 min for the default leg.
+- Any PR (in-repo or fork) labeled with **`full-matrix`** — apply when your change touches compat shims, conditional compilation, or anything else version-sensitive. Triggers a full-matrix run on the next `pull_request` or `pull_request_target` event. Cost is ~6-8 min wall clock vs ~3 min for the default leg.
 
-Fork PRs still need `safe-to-test` as the base gate (existing secret-safety pattern); `full-matrix` is layered on top of that for fork-PR full-matrix runs.
+Fork PRs still need `safe-to-test` as the base gate (so secrets are exposed against reviewed-only fork code); `full-matrix` is layered on top for fork-PR full-matrix runs.
 
-**Default (single leg) runs on every other path** — feature-branch pushes and unlabeled in-repo PRs run only against `defaultVersion` from `tools/unity-versions.json` (currently Unity 6.0 LTS, `6000.0.75f1`). The `floor` role (`2021.3.45f2`) still identifies the package minimum and runs as part of the full matrix; it's no longer the default-leg version.
+**Default (single leg)** — every other path runs only against `defaultVersion` from `tools/unity-versions.json` (currently Unity 6.0 LTS, `6000.0.75f1`). The `floor` role (`2021.3.45f2`) still identifies the package minimum and runs as part of the full matrix; it's no longer the default-leg version.
 
 ## Local Unity-version parity check