gowalk-cicd 1.0.1 → 1.0.3

package/action/.daemux-version

@@ -1 +1 @@
-1.0.1
+1.0.3

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.1
+1.0.3

package/android-action/action.yml

@@ -10,7 +10,10 @@ inputs:
     required: false
     default: ""
   build-number:
-    description: Android versionCode override; defaults to GITHUB_RUN_NUMBER
+    description: >-
+      Android versionCode override. When unset, the action uses
+      max(GITHUB_RUN_NUMBER, highest versionCode already on Play + 1), so a repo whose
+      CI run numbers start at 1 cannot collide with codes Play already holds.
     required: false
     default: ""
   build-name:
@@ -39,6 +42,13 @@ outputs:
 runs:
   using: composite
   steps:
+    # resolve_android.py asks Google Play for the highest versionCode already
+    # uploaded, so it needs these. Installing them here (rather than relying on the
+    # caller) keeps the action self-contained.
+    - name: Install Play API dependencies
+      shell: bash
+      run: python3 -m pip install --disable-pip-version-check -q 'google-auth>=2.40,<3' 'requests>=2.32,<3' || true
+
     - name: Resolve Android app and credentials
       id: config
       shell: bash
@@ -56,10 +66,17 @@ runs:
       shell: bash
       run: flutter analyze
 
+    # `flutter test` hard-fails with "Test directory \"test\" not found" when a repo
+    # has no tests, which is not a real failure. Skip instead of blowing up the deploy.
     - name: Test Flutter app
       if: ${{ inputs.run-tests == 'true' }}
       shell: bash
-      run: flutter test
+      run: |
+        if [ -d test ]; then
+          flutter test
+        else
+          echo "No test/ directory; skipping flutter test."
+        fi
 
     - name: Build release Android App Bundle
       shell: bash

package/android-action/scripts/resolve_android.py

@@ -30,6 +30,76 @@ def resolve_build_number(raw: str) -> int:
     return number
 
 
+def highest_play_version_code(package_name: str, service_account: Path) -> int | None:
+    """Highest versionCode Google Play already holds for this package, or None.
+
+    Best-effort: any failure (offline, no permission, app not yet created) returns
+    None so the caller falls back to GITHUB_RUN_NUMBER.
+    """
+    try:
+        import google.auth.transport.requests  # noqa: PLC0415
+        import requests  # noqa: PLC0415
+        from google.oauth2 import service_account as gsa  # noqa: PLC0415
+
+        creds = gsa.Credentials.from_service_account_file(
+            str(service_account),
+            scopes=["https://www.googleapis.com/auth/androidpublisher"],
+        )
+        creds.refresh(google.auth.transport.requests.Request())
+        base = "https://androidpublisher.googleapis.com/androidpublisher/v3"
+        headers = {"Authorization": f"Bearer {creds.token}"}
+
+        edit = requests.post(
+            f"{base}/applications/{package_name}/edits", headers=headers, timeout=60
+        )
+        edit.raise_for_status()
+        edit_id = edit.json()["id"]
+        try:
+            listed = requests.get(
+                f"{base}/applications/{package_name}/edits/{edit_id}/bundles",
+                headers=headers,
+                timeout=60,
+            )
+            listed.raise_for_status()
+            codes = [
+                int(b["versionCode"])
+                for b in listed.json().get("bundles", [])
+                if b.get("versionCode") is not None
+            ]
+        finally:
+            requests.delete(
+                f"{base}/applications/{package_name}/edits/{edit_id}",
+                headers=headers,
+                timeout=60,
+            )
+        return max(codes) if codes else None
+    except Exception as exc:  # noqa: BLE001 - never fail the build over this
+        print(f"::warning::Could not read existing Play versionCodes ({exc}); "
+              f"falling back to GITHUB_RUN_NUMBER")
+        return None
+
+
+def auto_build_number(package_name: str, service_account: Path) -> int:
+    """versionCode to use when the caller did not pin one.
+
+    GITHUB_RUN_NUMBER alone is wrong: it restarts at 1 on a freshly-onboarded repo,
+    so it collides with versionCodes Play already holds and every upload is rejected
+    ("Version code N has already been used"). Take whichever is higher: the run
+    number, or one past the highest code Play knows about.
+    """
+    run_number = resolve_build_number(os.environ.get("GITHUB_RUN_NUMBER", "1"))
+    highest = highest_play_version_code(package_name, service_account)
+    if highest is None:
+        return run_number
+    candidate = max(run_number, highest + 1)
+    if candidate != run_number:
+        print(
+            f"Play already holds versionCode {highest}; using {candidate} "
+            f"instead of GITHUB_RUN_NUMBER {run_number}"
+        )
+    return candidate
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
     env_path = Path(os.environ["GITHUB_ENV"])
@@ -40,8 +110,11 @@ def main() -> None:
         signing = find_signing_config(workspace)
         service_account = find_play_service_account(workspace)
         package_name = os.environ.get("INPUT_PACKAGE_NAME") or detect_package_name(workspace)
-        raw_number = os.environ.get("INPUT_BUILD_NUMBER") or os.environ.get("GITHUB_RUN_NUMBER", "")
-        build_number = resolve_build_number(raw_number)
+        pinned = os.environ.get("INPUT_BUILD_NUMBER") or ""
+        if pinned:
+            build_number = resolve_build_number(pinned)
+        else:
+            build_number = auto_build_number(package_name, service_account)
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc

package/android-action/scripts/test_android_config.py

@@ -3,9 +3,11 @@
 from __future__ import annotations
 
 import json
+import os
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from android_config import (
     ConfigError,
@@ -95,3 +97,38 @@ class AndroidConfigTest(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class AutoBuildNumberTest(unittest.TestCase):
+    """versionCode must never collide with what Play already holds."""
+
+    def test_uses_play_high_water_mark_when_run_number_is_lower(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=173):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "1"}):
+                # A freshly-onboarded repo starts at run 1; Play already has 173.
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    174,
+                )
+
+    def test_uses_run_number_when_it_is_already_higher(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=5):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "42"}):
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    42,
+                )
+
+    def test_falls_back_to_run_number_when_play_is_unreachable(self) -> None:
+        import resolve_android
+
+        with mock.patch.object(resolve_android, "highest_play_version_code", return_value=None):
+            with mock.patch.dict(os.environ, {"GITHUB_RUN_NUMBER": "7"}):
+                self.assertEqual(
+                    resolve_android.auto_build_number("com.example.app", Path("sa.json")),
+                    7,
+                )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -61,6 +61,13 @@ jobs:
           # AppLocalizations now generate real sources. Nothing else generates them,
           # and analyze/compile fail on the missing import if we skip this.
           if [ -f l10n.yaml ]; then flutter gen-l10n; fi
+          # Apps wired up by `flutterfire configure` carry an Xcode run-script phase that
+          # shells out to the flutterfire CLI to upload Crashlytics dSYMs. That CLI is not
+          # on a clean runner, so the phase exits non-zero and fails the whole archive.
+          if grep -q "firebase_crashlytics:" pubspec.yaml 2>/dev/null; then
+            dart pub global activate flutterfire_cli >/dev/null 2>&1 || true
+            echo "$HOME/.pub-cache/bin" >> "$GITHUB_PATH"
+          fi
           flutter build ios --release --no-codesign --config-only
       - uses: ./.github/actions/swift-app
         with: