[mackysoft]

Summary

• Sign OpenUPM packages in Release CI using Unity's standalone UPM CLI and service-account credentials.
• Publish the signed archive through GitHub Release assets instead of letting OpenUPM repack Git source.

Scope

• Sign the same commit used by the existing example build and .unitypackage export.
• Require signing credentials and the OpenUPM metadata migration before preparing a version; verify the package manifest and signing attestation before uploading the archive.
• Preserve draft Releases for release-note review. On publication, use OpenUPM's OIDC action and require a signed registry version.
• Document the maintainer setup in .github/RELEASING.md.

Verification

• ShellCheck, bash -n, and git diff --check passed.
• 10 archive cases cover unchanged accepted bytes, missing/empty attestations, invalid manifests, multiple/missing archives, signer failure, and version mismatch.
• Credential preflight checks passed without logging credential values; the metadata check accepts Release-asset tracking and rejects Git tracking.
• Actionlint passed with its outdated checks for the existing create-github-app-token@v3 inputs excluded; the current upstream action definition confirms client-id is valid.
• Isolated Ubuntu CI signing passed using this PR's exact source commit, UPM CLI v9.35.0, and the configured Unity service account.
• Downloaded the generated archive: all 94 source files are present, the original manifest fields are preserved, and Unity's added repository revision identifies the tested commit. The attestation's CMS signature verifies; this local check does not evaluate certificate-chain trust.
• A new tag, public Release, and OpenUPM package version were not created for validation. Full publication will run on the next package release.
• Unity source and project settings are unchanged; Editor tests are not required.

References

• Companion OpenUPM metadata migration
• OpenUPM signing and migration
• Unity UPM CLI service-account setup