{"id":50607580,"url":"https://github.com/openupm/com.example.signed-upm","last_synced_at":"2026-06-06T00:30:30.892Z","repository":{"id":356294206,"uuid":"1231833935","full_name":"openupm/com.example.signed-upm","owner":"openupm","description":"Minimal signed Unity UPM package example","archived":false,"fork":false,"pushed_at":"2026-05-07T12:13:36.000Z","size":6,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-07T13:32:37.424Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openupm.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-07T10:31:57.000Z","updated_at":"2026-05-07T12:13:24.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/openupm/com.example.signed-upm","commit_stats":null,"previous_names":["openupm/com.example.signed-upm"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/openupm/com.example.signed-upm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openupm%2Fcom.example.signed-upm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openupm%2Fcom.example.signed-upm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openupm%2Fcom.example.signed-upm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openupm%2Fcom.example.signed-upm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openupm","download_url":"https://codeload.github.com/openupm/com.example.signed-upm/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openupm%2Fcom.example.signed-upm/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33965591,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-05T02:00:06.157Z","response_time":120,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-06T00:30:29.490Z","updated_at":"2026-06-06T00:30:30.883Z","avatar_url":"https://github.com/openupm.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Signed UPM Example\n\nThis repository demonstrates a minimal Unity Package Manager package that is\npacked and signed in GitHub Actions, then published as a GitHub Release asset.\nIt is intentionally small so package authors can copy the workflow into their\nown repositories without carrying unrelated project structure.\n\nUnity 6.3 provides the UPM CLI, a command-line tool for package operations such\nas packing and signing. See the\n[Unity UPM CLI documentation](https://docs.unity3d.com/6000.3/Documentation/Manual/upm-cli.html)\nfor installation and command details.\n\nThe `upm pack` command creates a `.tgz` archive from the package folder and\nsigns it with a Unity organization through service account credentials. A\nsigned UPM package contains `package/.attestation.p7m` inside the archive. The\nresulting `.tgz` file can be published to a registry such as OpenUPM.\n\n## Package Layout\n\n- `package/package.json` is the Unity package manifest.\n- `.github/workflows/ci.yml` signs the package only when a tag is pushed.\n\nThe package has no runtime code. It exists only to demonstrate release\nautomation for signed UPM tarballs.\n\n## GitHub Secrets\n\nCreate a Unity service account with package signing permission for the\norganization that should sign the package. Add these GitHub Actions secrets to\nthe repository:\n\n- `UPM_SERVICE_ACCOUNT_KEY_ID`\n- `UPM_SERVICE_ACCOUNT_KEY_SECRET`\n- `UPM_ORG_ID`\n\nFor a single package, repository secrets are enough. If several repositories in\nthe same GitHub organization sign packages for the same Unity organization,\nprefer GitHub organization secrets scoped to only the repositories that need\nthem. That keeps credential rotation centralized while avoiding broad access.\n\n## Release Flow\n\nUpdate `package/package.json`, commit the change, then push a version tag:\n\n```sh\ngit tag 1.0.0\ngit push origin main 1.0.0\n```\n\nThe workflow only runs for pushed git tags. For tag `1.0.0`, it creates a\nGitHub Release with the same tag name, installs Unity UPM CLI, and runs\n`upm pack ./package` to create a signed UPM `.tgz` file. The signed archive\ncontains `package/.attestation.p7m` for the package signature. The workflow\nalso verifies that the archive contains `package/package.json` for\n`com.example.signed-upm@1.0.0`, then attaches the signed tarball to the release.\n\nThe signed package is uploaded as a GitHub Release asset, not as a GitHub\nActions workflow artifact. Workflow artifacts and logs have retention periods,\nbut release assets remain attached to the release until the asset or release is\ndeleted. Keep release assets available so OpenUPM can process older package\nversions later.\n\n## OpenUPM\n\nTo publish a signed GitHub Release asset through OpenUPM, submit package\nmetadata with `trackingMode: githubRelease`:\n\n```yaml\ntrackingMode: githubRelease\n```\n\nWhen a release has only one `.tgz` or `.tar.gz` asset, OpenUPM selects it\nautomatically. Set `githubReleaseAssetName` only when a release has multiple\nassets. The value can be either the exact signed package filename or a stable\nfilename prefix when the filename contains the version string.\n\nOpenUPM downloads the public release asset instead of packing from the git\ncheckout.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenupm%2Fcom.example.signed-upm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenupm%2Fcom.example.signed-upm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenupm%2Fcom.example.signed-upm/lists"}