chore: Dispatcher pin freshness gate now runs on pushes to main and on a daily schedule

.github/workflows/build-and-test.yml

@@ -93,16 +93,6 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
         run: go run ./cmd/check-dispatcher-pin --network
 
-      # Not on pull_request: while the automated pin-stamp pull request is open, the pin on every
-      # other branch legitimately lags the newest stable dispatcher release, and failing there would
-      # turn all open pull requests red for a state only main can fix. Failing on main is the point.
-      - name: Check dispatcher pin freshness
-        if: github.event_name != 'pull_request'
-        working-directory: cli/release-automation
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: go run ./cmd/check-dispatcher-pin-freshness
-
       - name: Check release triggers
         if: github.event_name == 'pull_request'
         working-directory: cli/release-automation

.github/workflows/dispatcher-pin-freshness.yml

@@ -0,0 +1,41 @@
+name: Dispatcher Pin Freshness
+
+# Fails while Packages/src/project-runner-pin.json records an older dispatcher
+# release than the newest published stable one, so a skipped pin stamp is
+# visible on main instead of silently sending fresh installs to a stale release.
+#
+# Not on pull_request: while the automated pin-stamp pull request is open, the
+# pin on every other branch legitimately lags, and failing there would turn all
+# open pull requests red for a state only main can fix. The schedule covers the
+# case where a release is published and nothing is pushed to main afterwards.
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+        with:
+          go-version-file: cli/.go-version
+          cache: false
+
+      - name: Check dispatcher pin freshness
+        working-directory: cli/release-automation
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: go run ./cmd/check-dispatcher-pin-freshness

docs/dispatcher-pin-release-order.md

@@ -17,13 +17,15 @@ installation. Package release preparation must follow this order:
 3. Verify the resulting pin with `check-dispatcher-pin` and publish the Unity
    package.
 
-`build-and-test.yml` runs `check-dispatcher-pin-freshness` on everything except
-pull requests, so `main` fails while the pin still records an older release than
-the newest published stable `dispatcher-v*` one. The failure clears by merging
-the automated pin-stamp pull request, or by stamping by hand with
-`stamp-dispatcher-pin --tag <tag>`. The gate deliberately skips `pull_request`
-runs: until that pull request merges, every other branch carries the same lagging
-pin, and failing there would only hide the state that `main` alone can fix.
+`dispatcher-pin-freshness.yml` runs `check-dispatcher-pin-freshness` on every
+push to `main`, once a day on a schedule, and on manual dispatch, so `main` fails
+while the pin still records an older release than the newest published stable
+`dispatcher-v*` one. The failure clears by merging the automated pin-stamp pull
+request, or by stamping by hand with `stamp-dispatcher-pin --tag <tag>`. The
+gate deliberately does not run on `pull_request`: until that pull request
+merges, every other branch carries the same lagging pin, and failing there would
+only hide the state that `main` alone can fix. The schedule exists because a
+dispatcher release can be published without any later push to `main`.
 
 A pull request created with `GITHUB_TOKEN` does not trigger `pull_request`
 workflows, so `open-dispatcher-pin-pr` dispatches the required check workflows