Action: upm-pack-and-sign

Pre-checks Verdaccio package versions and packs/signs updated packages using Unity's UPM CLI.

Action Path: Trickle-Charge/TrickleCharge-Infra/.github/actions/upm-pack-and-sign@main

Inputs

Input	Description	Required	Default
unity-org-id	Unity Organization ID	Yes	—
service-account-key-id	UPM Service Account Key ID	Yes	—
service-account-key-secret	UPM Service Account Key Secret	Yes	—
registry-url	Target registry URL	No	https://npm.tricklecharge.dev
package-path	Search path or glob for packages	No	Packages/*
ignore-packages	Space or comma separated list of package/folder ignores	No	""

What It Does

1. Prepares output workspace: Creates the ./signed-dist directory for output tarballs.
2. Parses ignore filters: Standardizes comma-separated or space-separated ignore-packages inputs into a unified list.
3. Discovers packages: Evaluates package-path for directories containing a valid package.json.
4. Evaluates exclusions: Compares both package name (jq .name) and folder name against the ignore list, skipping matching entries.
5. Queries remote version status: Checks Verdaccio via npm view <package>@<version> to determine if the local version is already published on the remote registry.
6. Packs & signs updated packages: For any new/unpublished versions, executes Unity UPM CLI (upm pack) authenticated with your service account credentials and outputs signed .tgz archives into ./signed-dist/.

Example Usage

- uses: Trickle-Charge/TrickleCharge-Infra/.github/actions/upm-pack-and-sign@main
  with:
    unity-org-id: ${{ secrets.UNITY_ORG_ID }}
    service-account-key-id: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_ID }}
    service-account-key-secret: ${{ secrets.UPM_SERVICE_ACCOUNT_KEY_SECRET }}
    package-path: "Packages/*"
    ignore-packages: "com.tricklecharge.test, LegacyFolder"