ci(audience): run linux PlayMode under xvfb (SDK-317 / SDK-318)

- Reworks playmode-linux to run inside a docker container under xvfb, via
  .github/scripts/audience/playmode-linux.sh. game-ci/unity-test-runner@v4
  hardcodes -nographics, so PlayMode tests came back inconclusive and silently
  passed.
- Watchdog SIGTERMs Unity 30s after "Test run completed" so cells exit on suite
  finish; handles Unity 6's known shutdown hang.
- -force-glcore at runtime skips the Unity 6 Vulkan init and matches the Unity
  2021.3 default path.
- Suppresses in-app log pane on Unity 6 Linux to skip llvmpipe rasterising UI
  Toolkit triangles per frame.
- Stamps CI build info into Player.log on player startup; gated to CI runs only.
- Mirrors SDK output and OnError fires to Debug.Log so failures land in
  Player.log.
- DiskStore.ReadBatch treats missing queue dir as empty (matches existing
  guards).
- Live-fire test SetUp ignores cleanup-time OnError fires so background flush
  cancellations do not fail unrelated tests.
- Trims 30 unused packages from the sample-app manifest.
- Extracts the macOS and Windows playmode runners and the Windows VS Build
  Tools setup to .github/scripts/, mirroring the Linux pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

.github/linters/.powershell-psscriptanalyzer.psd1

@@ -0,0 +1,14 @@
+# PSScriptAnalyzer config for super-linter.
+# These rules don't apply to short CI helper scripts:
+#   PSAvoidUsingWriteHost - Write-Host is the right call here. Write-Output
+#     would be captured as the function's return value (e.g. Resolve-Unity
+#     returns the editor path).
+#   PSUseSingularNouns - the scripts aren't a PowerShell module; they have
+#     functions like Invoke-Tests that genuinely act on a collection.
+
+@{
+    ExcludeRules = @(
+        'PSAvoidUsingWriteHost',
+        'PSUseSingularNouns'
+    )
+}

.github/scripts/audience/check-test-results.ps1

@@ -0,0 +1,22 @@
+# Fails the cell when test-results.xml is missing, empty, or inconclusive.
+# NUnit marks tests "inconclusive" (not "failed") when the player never starts,
+# and dorny/test-reporter does not fail on inconclusive.
+# Workflow caller: .github/workflows/test-audience-sample-app.yml (playmode job).
+
+$xml = "artifacts/test-results.xml"
+if (-not (Test-Path $xml) -or (Get-Item $xml).Length -eq 0) {
+    Write-Host "::error::No test-results.xml at $xml."
+    exit 1
+}
+
+$content = Get-Content $xml -Raw
+
+if ($content -match 'inconclusive="[1-9]') {
+    Write-Host "::error::Tests came back inconclusive. Check xvfb and player launch."
+    exit 1
+}
+
+if ($content -notmatch 'passed="[1-9]' -and $content -notmatch 'failed="[1-9]') {
+    Write-Host "::error::Zero tests passed and zero failed. The suite did not execute."
+    exit 1
+}

.github/scripts/audience/check-test-results.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Fails the cell when test-results.xml is missing, empty, or inconclusive.
+# NUnit marks tests "inconclusive" (not "failed") when the player never starts,
+# and dorny/test-reporter does not fail on inconclusive.
+# Workflow caller: .github/workflows/test-audience-sample-app.yml (playmode-linux job).
+
+xml="artifacts/test-results.xml"
+test -s "$xml" || { echo "::error::No test-results.xml at $xml."; exit 1; }
+
+if grep -qE 'inconclusive="[1-9]' "$xml"; then
+    echo "::error::Tests came back inconclusive. Check xvfb and player launch."
+    exit 1
+fi
+
+if ! grep -qE 'passed="[1-9]' "$xml" && ! grep -qE 'failed="[1-9]' "$xml"; then
+    echo "::error::Zero tests passed and zero failed. The suite did not execute."
+    exit 1
+fi

.github/scripts/audience/clean-windows-workspace.ps1

@@ -0,0 +1,34 @@
+# Cleans the Windows workspace before actions/checkout@v4 clones over it.
+# Workflow caller: .github/workflows/test-audience-sample-app.yml (playmode job).
+
+# actions/checkout@v4 removes the prior workspace before cloning. If a
+# previous run's Unity build, IL2CPP linker, bee_backend, or shader compiler
+# is still holding handles, checkout dies with EBUSY on examples/audience.
+# Kill known offenders, then force-remove the workspace contents.
+Get-Process | Where-Object {
+    $_.Name -like 'Unity*' -or
+    $_.Name -like 'il2cpp*' -or
+    $_.Name -like 'UnityShaderCompiler*' -or
+    $_.Name -like 'UnityCrashHandler*' -or
+    $_.Name -like 'bee_backend*' -or
+    $_.Name -like 'mono*'
+} | ForEach-Object {
+    Write-Host "Killing stale process: $($_.Name) (pid $($_.Id))"
+    Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue
+}
+Start-Sleep -Seconds 3
+
+$ws = "$env:GITHUB_WORKSPACE"
+if (-not (Test-Path $ws)) { return }
+for ($i = 1; $i -le 6; $i++) {
+    try {
+        Get-ChildItem -Path $ws -Force -ErrorAction Stop |
+            Remove-Item -Recurse -Force -ErrorAction Stop
+        Write-Host "Cleaned $ws on attempt ${i}"
+        return
+    } catch {
+        Write-Host "Attempt ${i}: $($_.Exception.Message)"
+        Start-Sleep -Seconds 3
+    }
+}
+Write-Host "::warning::Workspace not fully cleaned; checkout may fail"

.github/scripts/audience/ensure-msvc-windows.ps1

@@ -0,0 +1,59 @@
+# Ensures Visual Studio Build Tools (VC.Tools + Win10 SDK) are present on the runner.
+# Workflow caller: .github/workflows/test-audience-sample-app.yml (Windows IL2CPP cells).
+
+$vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+
+# Match Unity's detection logic: vswhere requires VC.Tools (any version), registry
+# probe for any Win10 SDK at v10.0/InstallationFolder. Pinning a specific SDK
+# version in -requires is too strict; VCTools ships with whatever Win10 SDK is
+# current, and Unity accepts any.
+function Test-Toolchain {
+    $vc = if (Test-Path $vswhere) {
+        & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath 2>$null
+    } else { '' }
+    $sdk = (Get-ItemProperty 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows\v10.0' -ErrorAction SilentlyContinue).InstallationFolder
+    return @{ VcTools = $vc; Win10Sdk = $sdk }
+}
+
+$state = Test-Toolchain
+if ($state.VcTools -and $state.Win10Sdk) {
+    Write-Host "VC.Tools at: $($state.VcTools)"
+    Write-Host "Win10 SDK at: $($state.Win10Sdk)"
+    exit 0
+}
+Write-Host "Toolchain incomplete. VC.Tools='$($state.VcTools)' Win10Sdk='$($state.Win10Sdk)'"
+
+Write-Host "::group::Install VS 2022 Build Tools (VCTools + Win10 SDK)"
+$installer = "$env:RUNNER_TEMP\vs_BuildTools.exe"
+Invoke-WebRequest -Uri 'https://aka.ms/vs/17/release/vs_BuildTools.exe' -OutFile $installer
+
+$installArgs = @(
+    '--quiet','--wait','--norestart','--nocache',
+    '--add','Microsoft.VisualStudio.Workload.VCTools',
+    '--add','Microsoft.VisualStudio.Component.VC.Tools.x86.x64',
+    '--add','Microsoft.VisualStudio.Component.Windows10SDK.20348',
+    '--includeRecommended'
+)
+$p = Start-Process -FilePath $installer -ArgumentList $installArgs -Wait -PassThru -NoNewWindow
+# 3010 = success, reboot pending (tools are usable without reboot).
+if ($p.ExitCode -ne 0 -and $p.ExitCode -ne 3010) {
+    Write-Host "::error::VS Build Tools installer exited $($p.ExitCode)"
+    exit $p.ExitCode
+}
+Write-Host "::endgroup::"
+
+$state = Test-Toolchain
+if (-not ($state.VcTools -and $state.Win10Sdk)) {
+    Write-Host "::group::diagnostic"
+    Write-Host "VC.Tools path (vswhere): '$($state.VcTools)'"
+    Write-Host "Win10 SDK (registry v10.0/InstallationFolder): '$($state.Win10Sdk)'"
+    Write-Host "--- all VS installations ---"
+    if (Test-Path $vswhere) { & $vswhere -all -products * -format json }
+    Write-Host "--- HKLM Win10 SDK roots ---"
+    Get-ChildItem 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows' -ErrorAction SilentlyContinue | Format-List
+    Write-Host "::endgroup::"
+    Write-Host "::error::Install reported success but VC.Tools or Win10 SDK still not detected. Runner service account likely lacks admin to install system-wide. Install VS Build Tools manually on IMX_SDKBUILD: vs_BuildTools.exe --quiet --wait --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended"
+    exit 1
+}
+Write-Host "Verified VC.Tools at: $($state.VcTools)"
+Write-Host "Verified Win10 SDK at: $($state.Win10Sdk)"

.github/scripts/audience/matrix-shared.json

@@ -0,0 +1,20 @@
+{
+  "unity_versions": [
+    { "version": "2021.3.45f2", "changeset": "88f88f591b2e" },
+    { "version": "6000.4.0f1",  "changeset": "8cf496087c8f" },
+    { "version": "2022.3.62f2", "changeset": "7670c08855a9" }
+  ],
+  "scripting_backends": ["IL2CPP", "Mono2x"],
+  "desktop_targets": [
+    { "target": "StandaloneWindows64", "runner": ["self-hosted", "Windows", "X64"], "script": ".github/scripts/audience/playmode-windows.ps1" },
+    { "target": "StandaloneOSX",       "runner": ["self-hosted", "macOS",  "ARM64"], "script": ".github/scripts/audience/playmode-macos.sh" },
+    { "target": "StandaloneLinux64",   "runner": "ubuntu-latest-8-cores",            "script": ".github/scripts/audience/playmode-linux.sh" }
+  ],
+  "mobile_targets": [
+    { "target": "Android", "method": "AndroidBuilder.Build" },
+    { "target": "iOS",     "method": "IosBuilder.Build" }
+  ],
+  "pr_exclude": [
+    { "unity": { "version": "2022.3.62f2", "changeset": "7670c08855a9" } }
+  ]
+}

.github/scripts/audience/playmode-linux-container.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+# Audience SDK PlayMode test runner for Linux: in-container body.
+# Runs inside the unityci/editor:ubuntu-X-linux-il2cpp-3 container.
+# Caller: .github/scripts/audience/playmode-linux.sh (host-side docker wrapper).
+
+set -uo pipefail
+
+LOG=/github/workspace/artifacts/unity.log
+ACTIVATION_LOG=/github/workspace/artifacts/activation.log
+RESULTS=/github/workspace/artifacts/test-results.xml
+PROJECT=/github/workspace/examples/audience
+
+test_rc=1
+
+activate_license() {
+  unity-editor -batchmode -nographics -quit \
+    -username "$UNITY_EMAIL" \
+    -password "$UNITY_PASSWORD" \
+    -serial   "$UNITY_SERIAL" \
+    -logFile - 2>&1 | tee "$ACTIVATION_LOG" || true
+
+  if grep -qE "License activation has failed|\[Licensing::Client\] Error: Code [0-9]+" "$ACTIVATION_LOG"; then
+    echo "::error::Unity license activation failed."
+    exit 1
+  fi
+  if ! grep -qE "Successfully activated the entitlement license" "$ACTIVATION_LOG"; then
+    echo "::error::Unity license activation: no success marker in log."
+    exit 1
+  fi
+}
+
+run_tests_with_watchdog() {
+  # xvfb-run gives Unity a virtual X display. UI Toolkit needs GLX + render;
+  # llvmpipe in the image provides software OpenGL so no GPU is needed.
+  # -force-glcore skips the Unity 6 Vulkan init and matches the Unity 2021.3 default path.
+  xvfb-run -a --server-args="-ac +extension GLX +render -noreset" -- \
+    unity-editor \
+      -batchmode \
+      -force-glcore \
+      -screen-fullscreen 0 \
+      -screen-width 320 \
+      -screen-height 240 \
+      -projectPath "$PROJECT" \
+      -runTests \
+      -testPlatform StandaloneLinux64 \
+      -testResults "$RESULTS" \
+      -logFile "$LOG" &
+  local unity_pid=$!
+
+  # Mirror Unity log to job stdout while the editor is alive.
+  tail --pid=$unity_pid -F "$LOG" 2>/dev/null &
+
+  # Watchdog (vs fixed timeout) because per-version run length varies wildly:
+  # Unity 2021.3 cells finish in ~2 min, Unity 6 in ~22 min, and Unity 6 has a
+  # known post-test shutdown hang. SIGTERM 30 s after "Test run completed" so
+  # each cell exits as soon as its suite finishes. 40 min hard cap as fallback.
+  local deadline=$((SECONDS + 2400))
+  local flush_deadline=0
+  local kill_reason=""
+  while kill -0 "$unity_pid" 2>/dev/null; do
+    if [ "$SECONDS" -ge "$deadline" ]; then
+      kill_reason="hard-cap-40m"
+      break
+    fi
+    if [ "$flush_deadline" -eq 0 ] && grep -q "Test run completed" "$LOG" 2>/dev/null; then
+      flush_deadline=$((SECONDS + 30))
+      echo "[watchdog] saw \"Test run completed\" at ${SECONDS}s; SIGTERM after 30s flush window"
+    fi
+    if [ "$flush_deadline" -gt 0 ] && [ "$SECONDS" -ge "$flush_deadline" ]; then
+      kill_reason="flush-window-elapsed"
+      break
+    fi
+    sleep 5
+  done
+
+  if [ -n "$kill_reason" ]; then
+    echo "[watchdog] sending SIGTERM to Unity (reason: $kill_reason)"
+    kill -TERM "$unity_pid" 2>/dev/null || true
+    # 15 s grace, then SIGKILL.
+    for _ in 1 2 3; do
+      kill -0 "$unity_pid" 2>/dev/null || break
+      sleep 5
+    done
+    if kill -0 "$unity_pid" 2>/dev/null; then
+      echo "[watchdog] SIGTERM not honored, sending SIGKILL"
+      kill -KILL "$unity_pid" 2>/dev/null || true
+    fi
+  fi
+
+  wait "$unity_pid" 2>/dev/null
+  test_rc=$?
+  if [ "$kill_reason" = "hard-cap-40m" ]; then
+    echo "::warning::Unity hit the 40 min hard cap without logging \"Test run completed\". Inspect Player.log."
+  fi
+}
+
+capture_player_log() {
+  # Player runs in a separate process from the editor; copy its Player.log so
+  # HTTP traces and OnError fires are captured. Glob across companies / products.
+  find /root/.config/unity3d -name "Player.log" 2>/dev/null | while IFS= read -r f; do
+    co=$(basename "$(dirname "$(dirname "$f")")")
+    pr=$(basename "$(dirname "$f")")
+    cp "$f" "/github/workspace/artifacts/Player-${co}-${pr}.log" 2>/dev/null || true
+  done
+}
+
+return_license() {
+  # Always return the seat to keep the activation pool from exhausting on reruns.
+  unity-editor -batchmode -nographics -quit -returnlicense -logFile - 2>&1 || true
+}
+
+activate_license
+run_tests_with_watchdog
+capture_player_log
+return_license
+
+# Unity exits 2 on test failure or inconclusive; propagate so the step fails.
+exit "$test_rc"

.github/scripts/audience/playmode-linux.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+# Audience SDK PlayMode test runner for Linux: host-side docker wrapper.
+# Runs unityci/editor with the env and volume mounts the inner
+# playmode-linux-container.sh expects. Lives outside the container so the
+# workflow can launch all 3 desktop platforms from one matrix-shared.json entry.
+#
+# Manual docker run because game-ci/unity-test-runner@v4 hardcodes
+# -nographics. Without a virtual display every PlayMode test comes back
+# inconclusive, and the action's USE_EXIT_CODE=false suppresses Unity
+# exit 2, so cells went silently green.
+#
+# Workflow caller: .github/workflows/test-audience-sample-app.yml (playmode job).
+# Inputs (env): UNITY_VERSION, UNITY_EMAIL, UNITY_PASSWORD, UNITY_SERIAL,
+#               AUDIENCE_TEST_PUBLISHABLE_KEY, AUDIENCE_SCRIPTING_BACKEND.
+
+set -uo pipefail
+mkdir -p artifacts
+
+docker run --rm \
+  --workdir /github/workspace \
+  --env UNITY_EMAIL --env UNITY_PASSWORD --env UNITY_SERIAL \
+  --env AUDIENCE_TEST_PUBLISHABLE_KEY --env AUDIENCE_SCRIPTING_BACKEND \
+  --env AUDIENCE_TEST_RUN_ID --env AUDIENCE_TEST_CELL_ID \
+  --volume "$PWD":/github/workspace:z \
+  --cpus=8 --memory=30487m \
+  "unityci/editor:ubuntu-${UNITY_VERSION}-linux-il2cpp-3" \
+  bash /github/workspace/.github/scripts/audience/playmode-linux-container.sh