From 62cdd9459ebfabd8d49632c5ac924ecc4a0e445a Mon Sep 17 00:00:00 2001
From: bitsandfoxes <reg@bitfox.at>
Date: Thu, 2 Apr 2026 13:57:27 +0200
Subject: [PATCH 1/2] run package accept on deps

---
 .github/workflows/ci.yml | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e6ae3d48c..3142a349f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,6 +71,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        with:
+          ref: ${{ github.head_ref || github.ref }}
+          ssh-key: ${{ secrets.CI_DEPLOY_KEY }}
 
       - name: Download UPM package
         uses: vaind/download-artifact@e7141b6a94ef28aa3d828b52830cfa1f406a1848 # v4-with-wait-timeout
@@ -78,12 +81,32 @@ jobs:
           name: package-release
           wait-timeout: 3600
 
-      - name: Verify package content against snapshot
-        # If this step fails, you can accept the new file content by
-        # running the following script locally with 'accept' as an argument
-        # and committing the new snapshot file to your branch. i.e:
-        # ./test/Scripts.Tests/test-pack-contents.ps1 accept
-        run: ./test/Scripts.Tests/test-pack-contents.ps1
+      - name: Check snapshot
+        id: snapshot-check
+        run: |
+          $exitCode = 0
+          try {
+            ./test/Scripts.Tests/test-pack-contents.ps1
+          } catch {
+            $exitCode = 1
+          }
+          "result=$exitCode" >> $env:GITHUB_OUTPUT
+
+      - name: Update snapshot for dependency bumps
+        if: steps.snapshot-check.outputs.result != '0' && github.event_name == 'pull_request' && startsWith(github.head_ref, 'deps/')
+        run: |
+          ./test/Scripts.Tests/test-pack-contents.ps1 accept
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add test/Scripts.Tests/package-release.zip.snapshot
+          git commit -m "Update package release snapshot"
+          git push
+
+      - name: Fail on unexpected snapshot changes
+        if: steps.snapshot-check.outputs.result != '0' && !(github.event_name == 'pull_request' && startsWith(github.head_ref, 'deps/'))
+        run: |
+          Write-Error "Package contents do not match snapshot. Run './test/Scripts.Tests/test-pack-contents.ps1 accept' locally and commit the update."
+          exit 1
 
   # This produces the `samples/IntegrationTest` as `test-${{ matrix.unity-version }}`.
   test-create:

From 8d234588298c7c7b363850c45dad2e9595c9d6ec Mon Sep 17 00:00:00 2001
From: bitsandfoxes <reg@bitfox.at>
Date: Thu, 2 Apr 2026 14:20:57 +0200
Subject: [PATCH 2/2] just pwsh stuff

---
 .github/workflows/ci.yml | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3142a349f..08662e4f3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -83,14 +83,11 @@ jobs:
 
       - name: Check snapshot
         id: snapshot-check
+        shell: pwsh
         run: |
-          $exitCode = 0
-          try {
-            ./test/Scripts.Tests/test-pack-contents.ps1
-          } catch {
-            $exitCode = 1
-          }
-          "result=$exitCode" >> $env:GITHUB_OUTPUT
+          $ErrorActionPreference = 'Continue'
+          & ./test/Scripts.Tests/test-pack-contents.ps1
+          "result=$LASTEXITCODE" >> $env:GITHUB_OUTPUT
 
       - name: Update snapshot for dependency bumps
         if: steps.snapshot-check.outputs.result != '0' && github.event_name == 'pull_request' && startsWith(github.head_ref, 'deps/')