fastlane-plugin-rustore_publish 0.3.1

data/lib/fastlane/plugin/rustore_publish/helper/rustore_auth.rb

@@ -0,0 +1,179 @@
+require "openssl"
+require "base64"
+require "net/http"
+require "json"
+require "uri"
+require_relative "rustore_logger"
+require_relative "rustore_endpoint"
+
+module Fastlane
+  module RustorePublish
+    # Handles authentication against the RuStore Public API.
+    #
+    # Flow:
+    #   1. Load RSA private key (PEM file or inline string).
+    #   2. Build request body: { keyId, timestamp, signature }
+    #      where signature = Base64( RSA-SHA512( keyId + timestamp ) )
+    #   3. POST to /public/auth → receive a JWE token (TTL 900s).
+    #   4. Cache the token; auto-refresh when it's within REFRESH_BEFORE
+    #      seconds of expiry.
+    #
+    # Reference: https://www.rustore.ru/help/en/work-with-rustore-api/api-authorization-token
+    class RustoreAuth
+      TOKEN_TTL      = 900  # seconds (as documented by RuStore)
+      REFRESH_BEFORE = 60   # refresh the token this many seconds before expiry
+
+      def initialize(key_id:, private_key:, logger: nil)
+        @key_id     = key_id
+        @logger     = logger || RustoreLogger.new
+        @rsa_key    = load_rsa_key(private_key)
+        @token      = nil
+        @expires_at = nil
+      end
+
+      # Returns a valid JWE token, refreshing if necessary.
+      def token
+        refresh! if token_expired?
+        @token
+      end
+
+      # Force-fetches a fresh token regardless of cache state.
+      def refresh!
+        @logger.verbose("Requesting new JWE token from RuStore auth endpoint")
+        jwe = fetch_jwe_token
+        @token      = jwe
+        @expires_at = Time.now + TOKEN_TTL - REFRESH_BEFORE
+        @logger.verbose("Token cached, valid for #{TOKEN_TTL}s (refresh in #{TOKEN_TTL - REFRESH_BEFORE}s)")
+        @token
+      end
+
+      private
+
+      def token_expired?
+        @token.nil? || @expires_at.nil? || Time.now >= @expires_at
+      end
+
+      # Builds the auth request body:
+      #   keyId     — API key identifier from RuStore Console
+      #   timestamp — ISO 8601 with milliseconds and timezone offset
+      #   signature — Base64-encoded RSA-SHA512 signature of (keyId + timestamp)
+      def build_auth_body
+        timestamp = build_timestamp
+        message   = "#{@key_id}#{timestamp}"
+        digest    = OpenSSL::Digest::SHA512.new
+        signature = Base64.strict_encode64(@rsa_key.sign(digest, message))
+
+        { keyId: @key_id, timestamp: timestamp, signature: signature }
+      end
+
+      # Formats the current time as ISO 8601 with milliseconds and UTC offset.
+      # Example: "2024-01-01T10:00:00.000+03:00"
+      def build_timestamp
+        t = Time.now
+        t.strftime("%Y-%m-%dT%H:%M:%S.%3N") + t.strftime("%:z")
+      end
+
+      # POST auth body to RuStore and return the JWE token string.
+      def fetch_jwe_token
+        uri = URI(RustoreEndpoint::AUTH_URL)
+
+        request = Net::HTTP::Post.new(uri)
+        request["Content-Type"] = "application/json"
+        request.body = JSON.generate(build_auth_body)
+
+        response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true, cert_store: RustoreEndpoint.cert_store) do |http|
+          http.read_timeout = 30
+          http.open_timeout = 10
+          http.request(request)
+        end
+
+        handle_auth_response(response)
+      rescue OpenSSL::SSL::SSLError => e
+        @logger.error(
+          "TLS handshake with #{RustoreEndpoint::HOST} failed: #{e.message}",
+          hint: "The plugin trusts the system roots plus the bundled Russian Trusted Root CA. " \
+                "Check that no proxy replaces the certificate and that the system CA store is readable (SSL_CERT_FILE)",
+          raise_error: true
+        )
+      rescue Net::OpenTimeout, Net::ReadTimeout => e
+        @logger.error(
+          "RuStore did not respond to the auth request: #{e.class}",
+          hint: "Rerun the lane; if it keeps failing, check network access to #{RustoreEndpoint::HOST}:443",
+          raise_error: true
+        )
+      rescue SocketError, SystemCallError => e
+        @logger.error(
+          "Could not connect to #{RustoreEndpoint::HOST}: #{e.message}",
+          hint: "Check DNS, proxy and firewall from this machine to #{RustoreEndpoint::HOST}:443",
+          raise_error: true
+        )
+      end
+
+      def handle_auth_response(response)
+        unless response.is_a?(Net::HTTPSuccess)
+          body    = safe_parse_json(response.body)
+          message = body&.dig("message") || response.body.to_s.slice(0, 300)
+          @logger.error(
+            "Authentication failed: #{message}",
+            hint: "Verify key_id and private_key are correct and the key has API access enabled in RuStore Console",
+            raise_error: true
+          )
+        end
+
+        body = safe_parse_json(response.body)
+        jwe  = body&.dig("body", "jwe") || body&.dig("jwe")
+
+        if jwe.nil? || jwe.empty?
+          @logger.error(
+            "Authentication response did not contain a JWE token",
+            hint: "Unexpected API response format: #{response.body.to_s.slice(0, 200)}",
+            raise_error: true
+          )
+        end
+
+        jwe
+      end
+
+      def load_rsa_key(private_key)
+        pem = if File.exist?(private_key.to_s)
+                File.read(private_key)
+              else
+                private_key
+              end
+
+        if pem.strip.start_with?("-----")
+          OpenSSL::PKey::RSA.new(pem)
+        else
+          # Raw base64 without PEM headers (e.g. CI secret stored without BEGIN/END lines).
+          # Try PKCS#8 first (RuStore keys), then fall back to traditional PKCS#1.
+          load_bare_base64(pem.strip.gsub(/\s+/, ""))
+        end
+      rescue OpenSSL::PKey::RSAError => e
+        @logger.error(
+          "Failed to load RSA private key: #{e.message}",
+          hint: "Ensure the key is a valid RSA PEM — either a full PEM string " \
+                "(with -----BEGIN PRIVATE KEY----- header) or raw base64 content",
+          raise_error: true
+        )
+      end
+
+      # Tries to load a bare base64 DER blob by wrapping it in PEM headers.
+      # Attempts PKCS#8 first (RuStore generates PKCS#8 keys), then PKCS#1.
+      def load_bare_base64(b64)
+        body = b64.scan(/.{1,64}/).join("\n")
+
+        begin
+          OpenSSL::PKey::RSA.new("-----BEGIN PRIVATE KEY-----\n#{body}\n-----END PRIVATE KEY-----\n")
+        rescue OpenSSL::PKey::RSAError
+          OpenSSL::PKey::RSA.new("-----BEGIN RSA PRIVATE KEY-----\n#{body}\n-----END RSA PRIVATE KEY-----\n")
+        end
+      end
+
+      def safe_parse_json(str)
+        JSON.parse(str.to_s)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/rustore_publish/helper/rustore_client.rb

@@ -0,0 +1,353 @@
+require "faraday"
+require "faraday/multipart"
+require "json"
+require_relative "rustore_auth"
+require_relative "rustore_logger"
+require_relative "rustore_endpoint"
+
+module Fastlane
+  module RustorePublish
+    # HTTP client for the RuStore Public API.
+    #
+    # All methods raise via RustoreLogger#error on non-2xx responses and on
+    # network failures, so that callers never need to inspect raw HTTP status
+    # codes or Faraday exceptions.
+    #
+    # Base URL: https://public-api-m.rustore.ru/public/v1 (see RustoreEndpoint)
+    class RustoreClient
+      # RuStore answers a file upload only after it has checked the file
+      # (permissions, SDKs), which can take minutes
+      DEFAULT_UPLOAD_TIMEOUT = 900
+      REQUEST_TIMEOUT        = 300
+      WAIT_LOG_INTERVAL      = 60
+
+      # Supported values for servicesType query param
+      SERVICES_TYPE_UNKNOWN = "Unknown"
+      SERVICES_TYPE_HMS     = "HMS"
+
+      def initialize(auth:, logger: nil, upload_timeout: DEFAULT_UPLOAD_TIMEOUT, wait_log_interval: WAIT_LOG_INTERVAL)
+        @auth              = auth
+        @logger            = logger || RustoreLogger.new
+        @upload_timeout    = upload_timeout
+        @wait_log_interval = wait_log_interval
+        @conn              = build_connection
+      end
+
+      # ── Version Draft ───────────────────────────────────────────────────────
+
+      # POST /application/{package}/version
+      # Creates a new version draft and returns the versionId (Integer).
+      def create_draft(package_name:, **metadata)
+        resp = post(
+          "application/#{package_name}/version",
+          metadata
+        )
+        body       = resp["body"]
+        version_id = if body.is_a?(Hash)
+                       body["publishId"] || body["versionId"]
+                     else
+                       body  # API returns the version ID directly as an integer
+                     end
+
+        if version_id.nil?
+          @logger.error(
+            "RuStore API did not return a versionId after draft creation",
+            hint: "Response body: #{resp.inspect.slice(0, 300)}"
+          )
+        end
+
+        version_id.to_i
+      end
+
+      # GET /application/{package}/version?versionStatuses=DRAFT
+      # Returns the current draft if present.
+      def find_existing_draft(package_name:)
+        resp = get("application/#{package_name}/version?versionStatuses=DRAFT")
+        versions = resp.dig("body", "content") || resp["body"] || []
+        versions.find { |v| v["versionStatus"] == "DRAFT" }
+      end
+
+      # DELETE /application/{package}/version/{versionId}
+      def delete_draft(package_name:, version_id:)
+        delete("application/#{package_name}/version/#{version_id}")
+      end
+
+      # ── File Upload ─────────────────────────────────────────────────────────
+
+      # POST /application/{package}/version/{id}/aab
+      # Uploads an AAB file. The AAB is always treated as the main artifact.
+      #
+      # @param file_path [String] absolute path to the .aab file
+      # @return [Hash] parsed response (body has permissions and autoDetectedSdks)
+      def upload_aab(package_name:, version_id:, file_path:)
+        upload_file(
+          path:         "application/#{package_name}/version/#{version_id}/aab",
+          version_id:   version_id,
+          file_path:    file_path,
+          content_type: "application/octet-stream"
+        )
+      end
+
+      # POST /application/{package}/version/{id}/apk
+      # Uploads an APK file.
+      #
+      # @param services_type [String] "Unknown" (default/GMS) or "HMS"
+      # @param is_main_apk   [Boolean] true if this is the primary APK
+      # @return [Hash] parsed response (body has permissions and autoDetectedSdks)
+      def upload_apk(package_name:, version_id:, file_path:,
+                     services_type: SERVICES_TYPE_UNKNOWN, is_main_apk: true)
+        upload_file(
+          path:         "application/#{package_name}/version/#{version_id}/apk",
+          version_id:   version_id,
+          file_path:    file_path,
+          content_type: "application/vnd.android.package-archive",
+          query:        { servicesType: services_type, isMainApk: is_main_apk }
+        )
+      end
+
+      # ── Submission ──────────────────────────────────────────────────────────
+
+      # POST /application/{package}/version/{id}/commit?priorityUpdate={n}
+      # Submits the draft for moderation.
+      #
+      # @param update_priority [Integer] in-app update priority, 0 (min) to 5 (max)
+      def submit_for_review(package_name:, version_id:, update_priority: 0)
+        post(
+          "application/#{package_name}/version/#{version_id}/commit?priorityUpdate=#{update_priority}",
+          {}
+        )
+      end
+
+      private
+
+      # ── HTTP Helpers ─────────────────────────────────────────────────────────
+
+      def get(path)
+        resp = with_network_errors(path) do
+          @conn.get(path) { |r| r.headers["Public-Token"] = @auth.token }
+        end
+        handle_response(resp, path)
+      end
+
+      def post(path, body)
+        resp = with_network_errors(path) do
+          @conn.post(path) do |r|
+            r.headers["Public-Token"]  = @auth.token
+            r.headers["Content-Type"]  = "application/json"
+            r.body                     = JSON.generate(body)
+          end
+        end
+        handle_response(resp, path)
+      end
+
+      def delete(path)
+        resp = with_network_errors(path) do
+          @conn.delete(path) { |r| r.headers["Public-Token"] = @auth.token }
+        end
+        handle_response(resp, path)
+      end
+
+      # Multipart file upload. Logs when the file has been sent, a heartbeat
+      # while RuStore is processing it, and the response time.
+      def upload_file(path:, version_id:, file_path:, content_type:, query: {})
+        filename = File.basename(file_path)
+        size_mb  = (File.size(file_path) / 1_048_576.0).round(1)
+        url      = query.empty? ? path : "#{path}?#{URI.encode_www_form(query)}"
+
+        @logger.info("Sending #{filename} (#{size_mb} MB)")
+        started_at  = monotonic_now
+        tracked_io  = SendTrackingIO.new(file_path) do |finished_at|
+          @logger.info("#{filename} sent in #{(finished_at - started_at).round(1)}s, waiting for RuStore to check it")
+        end
+        upload      = { filename: filename, version_id: version_id }
+        heartbeat   = start_heartbeat(tracked_io, filename)
+
+        resp = with_network_errors(path, upload: upload) do
+          @conn.post(url) do |req|
+            req.options.timeout = @upload_timeout
+            req.headers["Public-Token"] = @auth.token
+            req.body = {
+              file: Faraday::UploadIO.new(tracked_io, content_type, filename)
+            }
+          end
+        end
+
+        sent_at = tracked_io.finished_at || started_at
+        @logger.info("RuStore responded in #{(monotonic_now - sent_at).round}s")
+
+        result = handle_response(resp, path)
+        log_detected_items(result["body"])
+        result
+      ensure
+        heartbeat&.kill&.join
+        tracked_io&.close
+      end
+
+      # Logs every @wait_log_interval seconds until the response arrives,
+      # so a long wait does not look like a hung job.
+      def start_heartbeat(tracked_io, filename)
+        Thread.new do
+          loop do
+            sleep(@wait_log_interval)
+            finished_at = tracked_io.finished_at
+            if finished_at.nil?
+              @logger.info("Still sending #{filename}: #{(tracked_io.bytes / 1_048_576.0).round(1)} MB so far")
+              next
+            end
+            @logger.info("Waiting for RuStore response: #{(monotonic_now - finished_at).round}s / #{@upload_timeout}s")
+          end
+        end
+      end
+
+      # RuStore returns the permissions and SDKs it found in the uploaded file.
+      def log_detected_items(body)
+        return unless body.is_a?(Hash)
+
+        permissions = (body["permissions"] || {}).flat_map do |_category, items|
+          Array(items).map { |item| item.is_a?(Hash) ? item["permission"] : item }
+        end.compact
+        @logger.info("Permissions detected by RuStore: #{permissions.join(', ')}") unless permissions.empty?
+
+        sdks = (body["autoDetectedSdks"] || {}).reject { |_category, names| Array(names).empty? }
+        unless sdks.empty?
+          @logger.info("SDKs detected by RuStore: " + sdks.map { |category, names| "#{category}: #{Array(names).join(', ')}" }.join("; "))
+        end
+      end
+
+      # Turns Faraday network exceptions into a logged error with a hint.
+      # SSLError is rescued first: in Faraday it is not a ConnectionFailed.
+      def with_network_errors(path, upload: nil)
+        yield
+      rescue Faraday::SSLError => e
+        @logger.error(
+          "TLS handshake with #{RustoreEndpoint::HOST} failed: #{e.message}",
+          hint: "The plugin trusts the system roots plus the bundled Russian Trusted Root CA. " \
+                "Check that no proxy replaces the certificate and that the system CA store is readable (SSL_CERT_FILE)"
+        )
+      rescue Faraday::TimeoutError => e
+        if upload
+          @logger.error(
+            "RuStore did not respond to the upload of #{upload[:filename]} within #{@upload_timeout}s " \
+            "(versionId=#{upload[:version_id]}): #{e.message}",
+            hint: "The draft stays in RuStore and is replaced on the next run, so rerunning the lane is safe. " \
+                  "If RuStore is just slow, raise `upload_timeout` (RUSTORE_UPLOAD_TIMEOUT)"
+          )
+        else
+          @logger.error(
+            "RuStore did not respond to #{path} within #{REQUEST_TIMEOUT}s: #{e.message}",
+            hint: "Rerunning the lane is safe: an unfinished draft is replaced on the next run"
+          )
+        end
+      rescue Faraday::ConnectionFailed => e
+        @logger.error(
+          "Could not connect to #{RustoreEndpoint::HOST}: #{e.message}",
+          hint: "Check DNS, proxy and firewall from this machine to #{RustoreEndpoint::HOST}:443"
+        )
+      end
+
+      def handle_response(resp, path, raise_error: true)
+        body = safe_parse_json(resp.body)
+
+        unless resp.success?
+          api_message = body&.dig("message") || body&.dig("body", "message")
+          if api_message.nil? && resp.status >= 500
+            api_message = "RuStore returned a non-JSON response (#{resp.body.to_s.bytesize} bytes)"
+          end
+          api_message ||= resp.body.to_s.slice(0, 300)
+          api_message = "(empty response body)" if api_message.to_s.strip.empty?
+
+          if raise_error
+            @logger.error(
+              "API request failed [#{resp.status}] #{path}: #{api_message}",
+              hint: error_hint(resp.status, api_message)
+            )
+          else
+            @logger.warning("API request failed [#{resp.status}] #{path}: #{api_message}")
+            return nil
+          end
+        end
+
+        # RuStore sometimes returns 200 with code != "OK"
+        api_code = body&.dig("code")
+        if api_code && api_code != "OK" && api_code != "200"
+          api_message = body&.dig("message") || "code=#{api_code}"
+          @logger.error(
+            "API returned error code '#{api_code}' on #{path}: #{api_message}",
+            hint: error_hint(nil, api_message)
+          )
+        end
+
+        body || {}
+      end
+
+      def error_hint(status, message)
+        text = message.to_s
+        return "Upload the file in RuStore Console, fill in the permission declaration and submit the draft from there" if text.include?("new sensitive permissions")
+        return "Remove the listed permissions from the build and upload it again" if text.include?("illegal permissions")
+
+        case status
+        when 401 then "Token is invalid or expired — check key_id and private_key"
+        when 403 then "Key does not have permission for this operation — check RuStore Console API key settings"
+        when 404 then "Resource not found — verify package_name and that at least 1 active version exists in RuStore Console"
+        when 422 then "Validation error: #{message}"
+        when 429 then "Rate limited — wait before retrying"
+        when 500..599 then "Failure on the RuStore side; the draft is not submitted, rerunning the lane is safe"
+        else message
+        end
+      end
+
+      def build_connection
+        Faraday.new(url: RustoreEndpoint::BASE_URL, ssl: { cert_store: RustoreEndpoint.cert_store }) do |f|
+          f.request  :multipart
+          f.request  :url_encoded
+          f.response :logger, nil, { headers: false, bodies: false } if ENV["RUSTORE_DEBUG"]
+          f.adapter  Faraday.default_adapter
+          f.options.timeout      = REQUEST_TIMEOUT
+          f.options.open_timeout = 15
+        end
+      end
+
+      def safe_parse_json(str)
+        JSON.parse(str.to_s)
+      rescue StandardError
+        {}
+      end
+
+      def monotonic_now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+
+      # Wraps a file IO and records when the last byte has been read, i.e. the
+      # moment the file has been handed to the socket, and calls the block once
+      # at that moment. Fully compatible with Faraday::UploadIO (responds to
+      # read, size, eof?, rewind, close, path).
+      class SendTrackingIO
+        attr_reader :bytes, :finished_at
+
+        def initialize(file_path, &on_finish)
+          @io          = File.open(file_path, "rb")
+          @total       = File.size(file_path)
+          @bytes       = 0
+          @finished_at = nil
+          @on_finish   = on_finish
+        end
+
+        def read(length = nil, outbuf = nil)
+          chunk = length ? @io.read(length) : @io.read
+          @bytes += chunk.bytesize if chunk
+          if @finished_at.nil? && @bytes >= @total
+            @finished_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            @on_finish&.call(@finished_at)
+          end
+          outbuf ? (outbuf.replace(chunk || ""); outbuf) : chunk
+        end
+
+        def size;   @total;                                end
+        def eof?;   @io.eof?;                              end
+        def rewind; @io.rewind; @bytes = 0; @finished_at = nil; end
+        def close;  @io.close unless @io.closed?;          end
+        def path;   @io.path;                              end
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/rustore_publish/helper/rustore_endpoint.rb

@@ -0,0 +1,33 @@
+require "openssl"
+
+module Fastlane
+  module RustorePublish
+    # RuStore Public API host and TLS trust settings.
+    #
+    # RuStore moved the Public API to the "-m" domain, which is served with a
+    # certificate issued by the Russian Trusted Root CA (Ministry of Digital
+    # Development). That root is not in the default OS/Ruby trust stores, so the
+    # plugin ships it and adds it on top of the system roots.
+    #
+    # Reference: https://www.rustore.ru/developer/blog/rustore-obnovlyaet-sertifikaty-i-domeny-chto-nuzhno-sdelat-razrabotchikam
+    module RustoreEndpoint
+      HOST     = "public-api-m.rustore.ru"
+      BASE_URL = "https://#{HOST}/public/v1"
+      AUTH_URL = "https://#{HOST}/public/auth"
+      CA_FILE  = File.expand_path("../certs/russian_trusted_root_ca.crt", __dir__)
+
+      # System roots + Russian Trusted Root CA.
+      def self.cert_store
+        store = OpenSSL::X509::Store.new
+        store.set_default_paths
+        root = OpenSSL::X509::Certificate.new(File.read(CA_FILE))
+        begin
+          store.add_cert(root)
+        rescue OpenSSL::X509::StoreError
+          # Root is already present in the system store
+        end
+        store
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/rustore_publish/helper/rustore_logger.rb

@@ -0,0 +1,108 @@
+require "fastlane_core/ui/ui"
+
+module Fastlane
+  module RustorePublish
+    # Structured logger for RuStore plugin.
+    #
+    # In standard mode outputs via FastlaneCore::UI.* helpers.
+    # When GITLAB_CI env var is set, wraps each step in GitLab CI
+    # collapsible section markers so they appear as foldable blocks
+    # in the Pipeline web UI.
+    #
+    # Usage:
+    #   logger = RustoreLogger.new(total_steps: 7)
+    #   logger.step(1, "Authentication")
+    #   logger.success("Token obtained")
+    #   logger.info("Expires in 900s")
+    #   logger.error("Something failed", hint: "Check your key_id")
+    class RustoreLogger
+      PREFIX = "[RuStore]"
+
+      # ANSI / GitLab CI section escape sequences
+      SECTION_START = "\e[0Ksection_start:%<ts>d:%<name>s[collapsed=true]\r\e[0K"
+      SECTION_END   = "\e[0Ksection_end:%<ts>d:%<name>s\r\e[0K"
+
+      UI = FastlaneCore::UI
+
+      def initialize(total_steps: 0)
+        @total_steps  = total_steps
+        @gitlab_ci    = ENV["GITLAB_CI"] == "true" || ENV["GITLAB_CI"] == "1"
+        @open_section = nil
+      end
+
+      # ── Step header ──────────────────────────────────────────────────────────
+
+      def step(number, title)
+        close_section if @open_section
+
+        label        = @total_steps > 0 ? "Step #{number}/#{@total_steps}: #{title}" : title
+        section_name = "rustore_step_#{number}"
+
+        if @gitlab_ci
+          ts = Time.now.to_i
+          $stdout.print(format(SECTION_START, ts: ts, name: section_name) + "#{PREFIX} #{label}\n")
+          $stdout.flush
+          @open_section = { name: section_name }
+        else
+          UI.header("#{PREFIX} #{label}")
+        end
+      end
+
+      # ── Message levels ───────────────────────────────────────────────────────
+
+      def info(message)
+        UI.message("#{PREFIX} #{message}")
+      end
+
+      def success(message)
+        UI.success("#{PREFIX} ✓ #{message}")
+      end
+
+      def warning(message)
+        UI.important("#{PREFIX} ⚠ #{message}")
+      end
+
+      def verbose(message)
+        UI.verbose("#{PREFIX} #{message}")
+      end
+
+      # Logs a structured error with an optional actionable hint, then raises
+      # so the pipeline fails cleanly.
+      #
+      # @param message     [String]  what went wrong
+      # @param hint        [String]  how to fix it (optional)
+      # @param raise_error [Boolean] whether to raise after logging (default true)
+      def error(message, hint: nil, raise_error: true)
+        close_section if @open_section
+        UI.error("#{PREFIX} ✗ #{message}")
+        UI.error("#{PREFIX}   → #{hint}") if hint
+        UI.user_error!(message) if raise_error
+      end
+
+      # Logs a key/value table for step context (e.g. upload params)
+      def table(rows)
+        max_key = rows.map { |k, _| k.to_s.length }.max || 0
+        rows.each do |key, value|
+          UI.message("#{PREFIX}   %-#{max_key}s : %s" % [key, value])
+        end
+      end
+
+      # Close the currently open GitLab CI section (called automatically
+      # before each new step and at the end of the workflow).
+      def finalize
+        close_section
+      end
+
+      private
+
+      def close_section
+        return unless @gitlab_ci && @open_section
+
+        ts = Time.now.to_i
+        $stdout.print(format(SECTION_END, ts: ts, name: @open_section[:name]) + "\n")
+        $stdout.flush
+        @open_section = nil
+      end
+    end
+  end
+end

data/lib/fastlane/plugin/rustore_publish/version.rb

@@ -0,0 +1,5 @@
+module Fastlane
+  module RustorePublish
+    VERSION = "0.3.1"
+  end
+end

data/lib/fastlane/plugin/rustore_publish.rb

@@ -0,0 +1,13 @@
+require "fastlane/plugin/rustore_publish/version"
+
+module Fastlane
+  module RustorePublish
+    # Returns all actions in the plugin
+    def self.all_classes
+      Dir[File.expand_path("rustore_publish/**/*.rb", __dir__)]
+    end
+  end
+end
+
+# Autoload all actions and helpers
+Fastlane::RustorePublish.all_classes.each { |c| require(c) }