@mmerterden/multi-agent-pipeline 20.9.0 → 20.11.0

package/pipeline/skills/shared/core/multi-agent-setup/SKILL.md

@@ -76,6 +76,8 @@ These are the RECOMMENDED key names. When creating NEW keys, use these. But exis
 | `fortify` | `${USER}_Fortify_Access_Token` | `fortify` |
 | `firebase` | `${USER}_Firebase_Access_Json` | `firebase` (any variant: `sa`, `service`, `account`, `access`, `json`) |
 | `jenkins` | `${USER}_Jenkins_Access_Token` | `jenkins` |
+| `appstore_connect_private_key` | `${USER}_AppStoreConnect_Private_Key` | (`appstore` or `asc` or `app_store`) + (`private` or `p8`) |
+| `google_play` | `${USER}_GooglePlay_Access_Json` | (`googleplay` or `google_play` or `play_console` or `play`) + (`service` or `account` or `access` or `json` or `console`), NOT `firebase` |
 
 **1c. Resolution logic (per service):**
 
@@ -256,6 +258,8 @@ Standard key names (used when creating NEW tokens). Discovery may find existing
 | `fortify` | `${USER}_Fortify_Access_Token` | API Token | Fortify SSC -> Token Management (VPN required) |
 | `firebase` | `${USER}_Firebase_Access_Json` | Firebase service-account JSON | Firebase Console -> Project settings -> Service accounts -> Generate new private key. Store the file as issued; project id is read straight out of it. |
 | `jenkins` | `${USER}_Jenkins_Access_Token` | API Token | Jenkins -> User -> Configure -> API Token |
+| `appstore_connect_private_key` | `${USER}_AppStoreConnect_Private_Key` | Full PEM text of `AuthKey_<keyId>.p8` | App Store Connect -> Users and Access -> Integrations -> App Store Connect API. Stored from the file via stdin after `probe-store-key.mjs --asc` accepts it |
+| `google_play` | `${USER}_GooglePlay_Access_Json` | Service-account JSON, as issued | Play Console -> Setup -> API access. Stored from the file via stdin after `probe-store-key.mjs --play` accepts it |
 |  -  | Git Identities | JSON (preferences) | Stored in `$HOME/.claude/multi-agent-preferences.json`  -  not Keychain |
 
 ### Inline Token Save Pattern
@@ -312,16 +316,35 @@ the reason, never as a pass.
 
 Ask (picker): **API key** / **Apple ID + app-specific password** / **Skip**.
 
-**API key**  -  needs an Admin or App Manager role in App Store Connect. Map the key
-id and issuer id as `appstore_connect_key_id` / `appstore_connect_issuer_id`. The
-private key is a FILE and never enters the credential store; it goes to one of the
-directories altool searches:
+**API key**  -  needs an Admin or App Manager role in App Store Connect. Every part
+lives in the Keychain, the `.p8` included. Map the key id and issuer id as
+`appstore_connect_key_id` / `appstore_connect_issuer_id` (identifiers, stored as
+plain values). Ask for the `.p8` as a path, never its contents, and validate it
+BEFORE saving:
 
 ```bash
-ls ~/.appstoreconnect/private_keys/AuthKey_*.p8 2>/dev/null \
-  || echo "MISSING: put AuthKey_<keyId>.p8 in ~/.appstoreconnect/private_keys/"
+node "$HOME/.copilot/scripts/probe-store-key.mjs" --asc \
+  --key-id "<key id>" --issuer-id "<issuer id>" --p8 "<path to AuthKey_<keyId>.p8>"
 ```
 
+It prints `{ok, store, status, hint}` and no key material. On exit 1 show the
+`hint` (`401`: key id / issuer id do not match this `.p8`, the key was revoked, or
+the clock is off; `403`: the key's role cannot read apps) and save nothing. On
+exit 0, map `appstore_connect_private_key` first (`set` resolves the logical key
+through the mapping), then store the file through stdin and write the toolkit's
+store reference file:
+
+```bash
+~/.copilot/lib/credential-store.sh set appstore_connect_private_key - < "<path to AuthKey_<keyId>.p8>"
+node "$HOME/.copilot/scripts/write-store-config.mjs"
+```
+
+Then offer (picker, default **Keep file**) to delete the `.p8` from disk; Apple
+does not let it be downloaded again, so the choice is the user's. The toolkit's
+`store_asc_*` tools and `ios_testflight_validate` (called with neither
+`api_key_id` nor `apple_id`) read the key from the Keychain through that
+reference file.
+
 **Apple ID + app-specific password**  -  usable by **any Apple ID holder, no elevated
 role**, which is the realistic path when API-key creation is not permitted on the
 account. Lead with this option when the user says they cannot create an API key.
@@ -348,6 +371,35 @@ A credential that resolves but is rejected (401/403) follows the Expired-token
 decision (Regenerate / Use a different token / Skip and continue) rather than
 being silently dropped.
 
+### Google Play Credentials (optional, Android only)
+
+Asked only when the target repo is Android, as the App Store Connect block is asked
+only for iOS. One entry, `google_play`: the service-account JSON the toolkit's
+`store_play_*` tools authenticate with. With it, `multi-agent-store-ready` hands
+Android Gate 2 to Google instead of reporting it `SKIPPED`.
+
+Ask (picker): **Add Google Play** / **Skip**. Before asking for the file, say what
+the account needs: Play Console -> Setup -> API access (link a Cloud project,
+create the service account, download its JSON key); Play Console -> Users and
+permissions (invite the account's `client_email` with app permissions); and the
+**Google Play Android Developer API** plus the **Google Play Developer Reporting
+API** enabled in that Cloud project.
+
+Ask for the JSON's path, never its contents. Validate BEFORE saving:
+
+```bash
+node "$HOME/.copilot/scripts/probe-store-key.mjs" --play --service-account "<path to service-account.json>"
+```
+
+On exit 1 show the `hint` and save nothing: `403` with `SERVICE_DISABLED` means an
+API is off in the Cloud project; any other `403` means the account is not invited
+in Play Console. On exit 0, map `google_play` first, then:
+
+```bash
+~/.copilot/lib/credential-store.sh set google_play - < "<path to service-account.json>"
+node "$HOME/.copilot/scripts/write-store-config.mjs"
+```
+
 ### Firebase / Crashlytics Access (optional, any platform)
 
 Discovery maps a stored service-account JSON like any other credential, but it

package/pipeline/skills/shared/core/multi-agent-store-ready/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: multi-agent-store-ready
-description: "Pre-submission store readiness for a built package, iOS and Android, local-only. Three symmetric gates per platform: a static package audit, the store's own authoritative validation, and a policy review against repo source. Separate verdict per gate, a skipped gate never counted as a pass. Validates only, never uploads. Use when a build is about to go to TestFlight or a Play track, or when a submission was rejected and the reason is not obvious."
+description: "Pre-submission store readiness for a built package, iOS and Android, local-only. Three symmetric gates per platform: a static package audit, the store's own authoritative validation, and a policy review against repo source. Separate verdict per gate, a skipped gate never counted as a pass. Validates only, never ships a build. Use when a build is about to go to TestFlight or a Play track, or when a submission was rejected and the reason is not obvious."
 user-invocable: true
 argument-hint: "[repo]  -  empty = pick; repo name or path; --ipa= | --archive= | --aab= | --apk=; --skip-sweep; --resume"
 metadata:
@@ -12,8 +12,10 @@ metadata:
 Catch, before you upload, what App Store Connect or the Play Console would send
 back after you do.
 
-**Local-only.** No commits, no push, no PR. **It never uploads**: iOS runs
-`--validate-app`, never `--upload-app`; Android never commits a Play edit.
+**Local-only.** No commits, no push, no PR. **It never ships**: iOS runs
+`--validate-app`, never `--upload-app`; Android never commits a Play edit, and
+uploads into a throwaway edit only with Google Play onboarded and the user's
+approval.
 
 **Input**: $ARGUMENTS
 
@@ -37,7 +39,7 @@ doc is the contract.
 | Gate | iOS | Android |
 |---|---|---|
 | 1 Static | `ios_app_store_audit` 18 rules, needs an `.xcarchive` | `android_apk_audit` + `google-play-compliance` 21 rules, needs an `.aab` |
-| 2 Authoritative | `ios_testflight_validate` → `altool --validate-app`, needs credentials | `SKIPPED`  -  Play's authoritative check is server-side only and no client ships here |
+| 2 Authoritative | `ios_testflight_validate` → `altool --validate-app`, needs credentials; `store_asc_next_build_number` says whether the build number is already used | With `google_play` onboarded: `store_play_validate_bundle` validates the `.aab` in a throwaway edit that is deleted, never committed, after the user approves the upload. Otherwise `SKIPPED (no local Play validator)`, reason `Google Play not onboarded` |
 | 3 Policy | `ai-ios-toolkit:app-store-review` skill vs repo source | `ai-android-toolkit:play-store-review` skill vs repo source |
 
 Gate 1 also fails the package on its own, without the MCP tool, when the archive
@@ -45,9 +47,11 @@ carries no dSYM (iOS) or a `minifyEnabled true` module produced no `mapping.txt`
 (Android). Gate 3 carries a `Crash symbolication` row on both platforms: a dSYM
 upload step for iOS, a `mapping.txt` upload for Android.
 
-Gate 2's asymmetry is reported as an asymmetry. An Android run clears at most 2 of 3
-gates and must never print `passed`. A skipped gate is never folded into the pass
-count on either platform.
+Gate 2's asymmetry is reported as an asymmetry. An Android run whose Gate 2 did not
+run clears at most 2 of 3 gates and must never print `passed`. A skipped gate is
+never folded into the pass count on either platform. The `store_*` tools need
+`@mmerterden/multi-agent-toolkit-mcp` ≥ v3.17.0; the Android upload is refused
+when `MULTI_AGENT_UNATTENDED=1`, and Gate 2 then reports `SKIPPED` with that reason.
 
 ## Related surfaces