From 929e3ebb58bc8dff2143de1b36855453580b015a Mon Sep 17 00:00:00 2001
From: hatayama <booqle@gmail.com>
Date: Tue, 1 Sep 2026 00:22:17 +0900
Subject: [PATCH] Run the dispatcher pin freshness gate from its own main-push
 workflow

build-and-test.yml only runs on tag pushes, pull requests, and manual
dispatch, so the step added there in #2474 never executed on a push to
main and the lagging-pin gate was effectively inert. Give the check its
own workflow triggered by pushes to main, a daily schedule (a release can
be published without any later push), and workflow_dispatch.
---
 .github/workflows/build-and-test.yml          | 10 -----
 .../workflows/dispatcher-pin-freshness.yml    | 41 +++++++++++++++++++
 docs/dispatcher-pin-release-order.md          | 16 ++++----
 3 files changed, 50 insertions(+), 17 deletions(-)
 create mode 100644 .github/workflows/dispatcher-pin-freshness.yml

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 92e2eaceea..37e3daaddf 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -93,16 +93,6 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: go run ./cmd/check-dispatcher-pin --network
 
-      # Not on pull_request: while the automated pin-stamp pull request is open, the pin on every
-      # other branch legitimately lags the newest stable dispatcher release, and failing there would
-      # turn all open pull requests red for a state only main can fix. Failing on main is the point.
-      - name: Check dispatcher pin freshness
-        if: github.event_name != 'pull_request'
-        working-directory: cli/release-automation
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: go run ./cmd/check-dispatcher-pin-freshness
-
       - name: Check release triggers
         if: github.event_name == 'pull_request'
         working-directory: cli/release-automation
diff --git a/.github/workflows/dispatcher-pin-freshness.yml b/.github/workflows/dispatcher-pin-freshness.yml
new file mode 100644
index 0000000000..4b8eedb644
--- /dev/null
+++ b/.github/workflows/dispatcher-pin-freshness.yml
@@ -0,0 +1,41 @@
+name: Dispatcher Pin Freshness
+
+# Fails while Packages/src/project-runner-pin.json records an older dispatcher
+# release than the newest published stable one, so a skipped pin stamp is
+# visible on main instead of silently sending fresh installs to a stale release.
+#
+# Not on pull_request: while the automated pin-stamp pull request is open, the
+# pin on every other branch legitimately lags, and failing there would turn all
+# open pull requests red for a state only main can fix. The schedule covers the
+# case where a release is published and nothing is pushed to main afterwards.
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+        with:
+          go-version-file: cli/.go-version
+          cache: false
+
+      - name: Check dispatcher pin freshness
+        working-directory: cli/release-automation
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: go run ./cmd/check-dispatcher-pin-freshness
diff --git a/docs/dispatcher-pin-release-order.md b/docs/dispatcher-pin-release-order.md
index 0d0aecadf2..48364e046e 100644
--- a/docs/dispatcher-pin-release-order.md
+++ b/docs/dispatcher-pin-release-order.md
@@ -17,13 +17,15 @@ installation. Package release preparation must follow this order:
 3. Verify the resulting pin with `check-dispatcher-pin` and publish the Unity
    package.
 
-`build-and-test.yml` runs `check-dispatcher-pin-freshness` on everything except
-pull requests, so `main` fails while the pin still records an older release than
-the newest published stable `dispatcher-v*` one. The failure clears by merging
-the automated pin-stamp pull request, or by stamping by hand with
-`stamp-dispatcher-pin --tag <tag>`. The gate deliberately skips `pull_request`
-runs: until that pull request merges, every other branch carries the same lagging
-pin, and failing there would only hide the state that `main` alone can fix.
+`dispatcher-pin-freshness.yml` runs `check-dispatcher-pin-freshness` on every
+push to `main`, once a day on a schedule, and on manual dispatch, so `main` fails
+while the pin still records an older release than the newest published stable
+`dispatcher-v*` one. The failure clears by merging the automated pin-stamp pull
+request, or by stamping by hand with `stamp-dispatcher-pin --tag <tag>`. The
+gate deliberately does not run on `pull_request`: until that pull request
+merges, every other branch carries the same lagging pin, and failing there would
+only hide the state that `main` alone can fix. The schedule exists because a
+dispatcher release can be published without any later push to `main`.
 
 A pull request created with `GITHUB_TOKEN` does not trigger `pull_request`
 workflows, so `open-dispatcher-pin-pr` dispatches the required check workflows