ci: canonical pair — hanzo.yml + forge caller

github.com has no runner for hanzo-build-linux-amd64, so a caller under
.github/workflows is a gate that can never be scheduled. This is the ~7-line
caller on the plane that can (git.hanzo.ai git-runner fleet), pinned @v1.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/cicd.yml

@@ -0,0 +1,15 @@
+# Canonical caller — every knob lives in /hanzo.yml, none here.
+# Runs on the git-runner fleet at git.hanzo.ai, the only pool serving these
+# labels. github.com resolves only .github/workflows and has no runner for
+# them, so a caller placed there is a gate that cannot be scheduled.
+name: CI/CD
+on:
+  push:
+    branches: [master]
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+jobs:
+  cicd:
+    uses: hanzoai/ci/.hanzo/workflows/build.yml@v1
+    secrets: inherit

hanzo.yml

@@ -0,0 +1,45 @@
+# ProjectTinySamples — a Unity project. No Unity Editor and no licence exists on the
+# linux/amd64 fleet, so an editor build cannot be the gate here. The invariant
+# that CAN be checked is the one Unity itself runs on and git silently breaks:
+# every asset and every folder under Assets/ carries a sibling .meta holding its
+# GUID. Lose the .meta and Unity mints a fresh GUID on next open, so every
+# prefab, scene and material that referenced that asset quietly points at
+# nothing — a defect no compiler, and no reviewer reading a diff of YAML, sees.
+#
+# It is a real gate, not a formality: run across this batch it refused
+# BoatAttack (Assets/Scripts/Boat/AiController.cs against an AIcontroller.cs.meta
+# — a case-only rename that orphaned the script's GUID) and FPSSample (three
+# more, Building_A/Building_a and Backdrop/bACKDROP), while passing six healthy
+# trees untouched.
+#
+# Two exemptions, both because git and Unity disagree rather than because the
+# repo is wrong: a .meta the repo deliberately .gitignores, and a FOLDER .meta
+# whose directory is empty (git cannot track an empty directory, so the .meta
+# legitimately outlives it — a FILE .meta with no file is still refused).
+test:
+  - name: unity-meta-integrity
+    run: |
+      set -eu
+      t=$(mktemp -d)
+      # Unity's rule: every tracked file AND folder under Assets/ carries a sibling
+      # .meta holding its GUID. Hidden entries (leading dot) and Unity-ignored ones
+      # (trailing ~) are exempt. A missing .meta makes Unity mint a fresh GUID on the
+      # next open and every reference to that asset silently breaks; an orphan .meta
+      # is a reference to something no longer in the tree.
+      git ls-files | grep -E '(^|/)Assets/' | grep -vE '(^|/)[.~][^/]*(/|$)' | grep -vE '~(/|$)' | sort -u > "$t/all"
+      grep -E '\.meta$' "$t/all" | sed 's/\.meta$//' | sort -u > "$t/meta"
+      grep -vE '\.meta$' "$t/all" > "$t/files"
+      sed 's:/[^/]*$::' "$t/files" | awk '{p="";n=split($0,s,"/");for(i=1;i<=n;i++){p=(i==1?s[1]:p"/"s[i]);print p}}' | sort -u > "$t/dirs"
+      cat "$t/files" "$t/dirs" | grep -E '(^|/)Assets/' | sort -u > "$t/need"
+      # A .meta the repo deliberately .gitignores is a choice, not a defect (and the
+      # inverse — ignored yet tracked — is already refused upstream by ignoretracked).
+      comm -23 "$t/need" "$t/meta" | while IFS= read -r p; do git check-ignore -q "$p.meta" || echo "$p"; done > "$t/missing"
+      # An orphan FOLDER .meta is git, not the repo: git cannot track an empty
+      # directory, so its .meta legitimately outlives it. An orphan FILE .meta is a
+      # real dangling reference.
+      comm -13 "$t/need" "$t/meta" | while IFS= read -r p; do grep -qs 'folderAsset: yes' "$p.meta" || echo "$p"; done > "$t/orphan"
+      m=$(wc -l < "$t/missing"); o=$(wc -l < "$t/orphan"); n=$(wc -l < "$t/need")
+      echo "checked $n assets+folders under Assets/"
+      [ "$m" = 0 ] || { echo "::error::$m asset(s) tracked with no .meta — Unity will remint their GUIDs and break every reference:"; head -40 "$t/missing"; }
+      [ "$o" = 0 ] || { echo "::error::$o orphan .meta with no asset:"; head -40 "$t/orphan"; }
+      [ "$m" = 0 ] && [ "$o" = 0 ]