gowalk-cicd 1.0.100 → 1.0.102

package/CLAUDE.md

@@ -203,6 +203,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
+  Backend failures emit `backend_deploy_failed` with the fixed runner/host phase and exit code.
+  Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
+  signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.

package/README.md

@@ -331,6 +331,12 @@ describe observed error patterns, not retry permission or a unique root cause. S
 emit `android_build_progress` notices (`gowalk-cicd/android-build-progress.v1`) every minute
 with `phase` and `elapsed_seconds`; successful compiler output is not republished.
 
+Native bundle and Pods failures emit `native_prepare_failed` with schema
+`gowalk-cicd/native-prepare-failed.v1`, `phase`, a fixed refusal `code` and fixed observed `signals`.
+Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
+the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
+private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`
 and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_status`

package/action/.daemux-version

@@ -1 +1 @@
-1.0.100
+1.0.102

package/action/scripts/native_bundle.py

@@ -15,6 +15,7 @@ import tempfile
 import native_dependency_guard as guard
 from native_pods_diagnostics import refuse
 import native_pods_process
+from native_prepare_evidence import report
 
 
 def command(argv: list[str], cwd: Path, log) -> int:
@@ -104,6 +105,7 @@ def main(argv: list[str]) -> int:
                   "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
+    report(answer, "bundle")
     print(json.dumps(answer, sort_keys=True))
     return 0 if answer["ok"] else 1
 

package/action/scripts/native_pods.py

@@ -16,6 +16,7 @@ import native_dependency_guard as guard
 import native_bundle
 from native_bundle import command
 from native_pods_diagnostics import refuse
+from native_prepare_evidence import report
 
 
 def committed(root: Path, lock: Path) -> str:
@@ -40,6 +41,7 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
     digest = committed(root, folder / "Podfile.lock")
     if not proxy_helper.is_file():
         raise guard.Refused("native_google_transport_helper_required")
+    proxy_helper = proxy_helper.resolve(strict=True)
     with tempfile.TemporaryFile() as log:
         if command([sys.executable, str(proxy_helper)], root, log):
             raise guard.Refused("native_google_proxy_required")
@@ -84,6 +86,7 @@ def main(argv: list[str]) -> int:
         answer = {"ok": False, "code": code, "next": guard.REMEDIATION}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
+    report(answer, "pods")
     print(json.dumps(answer, sort_keys=True))
     return 0 if answer["ok"] else 1
 

package/action/scripts/native_prepare_evidence.py

@@ -0,0 +1,41 @@
+"""Publish fixed native failure evidence without moving private child output into annotations."""
+import json
+import sys
+
+SIGNALS = {
+    "pod_version_conflict": ("could not find compatible versions for pod", "Unable to satisfy the following requirements"),
+    "pod_lock_drift": ("Podfile.lock", "deployment mode"),
+    "ruby_version_incompatible": ("requires Ruby version", "Your Ruby version is"),
+    "gem_missing": ("Could not find", "in locally installed gems"),
+    "bundler_version_missing": ("Could not find 'bundler'",),
+    "tls_verification": ("certificate verify failed", "CERTIFICATE_VERIFY_FAILED"),
+    "connection_timeout": ("Connection timed out", "execution expired", "Read timed out"),
+    "dns_resolution": ("Could not resolve host", "getaddrinfo"),
+    "disk_full": ("No space left on device",),
+}
+ALL_REQUIRED = frozenset({"pod_lock_drift", "gem_missing"})
+CODES = frozenset({
+    "native_bundle_install_failed", "native_bundle_inputs_changed", "native_bundle_path_unverified",
+    "native_bundle_operation_unverified", "native_configuration_failed", "native_google_proxy_required",
+    "native_google_transport_helper_required", "native_pods_install_failed", "native_pods_operation_unverified",
+    "native_pods_operation_interrupted", "native_pods_process_unverified", "native_podfile_lock_required",
+    "native_podfile_lock_commit_required", "native_podfile_lock_changed", "native_gemfile_required",
+    "native_gemfile_commit_required", "native_gemfile_lock_required", "native_gemfile_lock_commit_required",
+    "native_workspace_reference_unverified", "native_project_generation_failed", "native_project_selection_required",
+    "native_project_parse_unverified", "native_project_inventory_unverified", "native_project_inventory_missing",
+    "native_package_proxy_transport_required", "native_initial_lock_phase_required",
+})
+
+
+def report(answer: dict, phase: str) -> None:
+    if answer.get("ok"):
+        return
+    body = str(answer.get("diagnostic", ""))[-4000:]
+    signals = sorted(name for name, patterns in SIGNALS.items()
+                     if (all if name in ALL_REQUIRED else any)(part in body for part in patterns))
+    code = answer.get("code")
+    payload = {"schema": "gowalk-cicd/native-prepare-failed.v1",
+               "phase": phase if phase in {"bundle", "pods"} else "unclassified",
+               "code": code if code in CODES else "native_prepare_unclassified", "signals": signals}
+    print("::error title=native_prepare_failed::" + json.dumps(payload, separators=(",", ":")),
+          file=sys.stderr, flush=True)

package/action/scripts/test_native_bundle.py

@@ -51,6 +51,13 @@ class BundleTests(unittest.TestCase):
                                  "--proxy-helper", str(PROXY), "--", sys.executable, "-c", script],
                                 cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
         self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        annotations = [line for line in result.stderr.splitlines()
+                       if line.startswith("::error title=native_prepare_failed::")]
+        if result.returncode:
+            self.assertEqual(len(annotations), 1)
+            self.assertEqual(json.loads(annotations[0].split("::", 2)[2])["phase"], "bundle")
+        else:
+            self.assertEqual(annotations, [])
         return result.returncode, json.loads(result.stdout)
 
     def test_unconfigured_app_keeps_the_proxied_command(self):

package/action/scripts/test_native_pods.py

@@ -56,6 +56,38 @@ class PodsTests(unittest.TestCase):
         self.env.pop("GOOGLE_STORE_PROXY_URL")
         self.assertEqual(self.run_cli()[1]["code"], "native_google_proxy_required")
 
+    def test_relative_relay_survives_the_nested_pod_working_directory(self):
+        self.locked()
+        folder = self.root / "mobile app/ios"
+        folder.mkdir(parents=True)
+        for name in ("App.xcodeproj", "Podfile", "Podfile.lock"):
+            (self.root / name).rename(folder / name)
+        for argv in (["git", "add", "-A"],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Move the native project into its app folder"]):
+            subprocess.run(argv, cwd=self.root, check=True, capture_output=True)
+        pod = self.root / "pod"
+        pod.write_text('#!' + sys.executable + '\nimport json,os,sys\nfrom pathlib import Path\n'
+                       'Path("child.json").write_text(json.dumps({"cwd":str(Path.cwd()),'
+                       '"argv":sys.argv[1:],"proxy":os.environ["HTTPS_PROXY"]}))\n'
+                       'workspace=Path("App.xcworkspace");workspace.mkdir()\n'
+                       '(workspace/"contents.xcworkspacedata").write_text('
+                       '\'<Workspace><FileRef location="group:App.xcodeproj"/></Workspace>\')\n')
+        pod.chmod(0o700)
+        self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
+        result = subprocess.run([sys.executable, native_pods.__file__, str(self.root),
+                                 "--container", "mobile app/ios/App.xcodeproj", "--proxy-helper",
+                                 os.path.relpath(PROXY, self.root)], cwd=self.root,
+                                capture_output=True, text=True, env=self.env, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        self.assertEqual(result.returncode, 0, result.stdout)
+        self.assertTrue(json.loads(result.stdout)["ok"])
+        child = json.loads((folder / "child.json").read_text())
+        self.assertEqual(child["cwd"], str(folder))
+        self.assertEqual(child["argv"], ["install", "--deployment", "--no-repo-update"])
+        self.assertTrue(child["proxy"].startswith("http://127.0.0.1:"))
+        self.assertEqual((folder / "Podfile.lock").read_text(), "fixture-lock")
+
     def test_declared_bundle_controls_the_actual_pod_child(self):
         self.locked()
         (self.root / "Gemfile").write_text('source "https://rubygems.org"\ngem "cocoapods", "1.16.2"\n')
@@ -123,7 +155,8 @@ class PodsTests(unittest.TestCase):
             output, errors = child.communicate(timeout=10)
         self.assertTrue((self.root / "owned-child").exists())
         self.assertEqual(json.loads(output)["code"], "native_pods_operation_interrupted")
-        self.assertEqual(errors, "")
+        self.assertTrue(errors.startswith("::error title=native_prepare_failed::"))
+        self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["code"], "native_pods_operation_interrupted")
         owned_pid = int((self.root / "owned-child").read_text())
         deadline = time.monotonic() + 5
         while time.monotonic() < deadline:

package/action/scripts/test_native_prepare_evidence.py

@@ -0,0 +1,50 @@
+"""Native entrypoints preserve JSON callers while emitting only fixed public failure fields."""
+import contextlib
+import io
+import json
+import unittest
+from unittest.mock import patch
+
+import native_bundle
+import native_pods
+from native_prepare_evidence import report
+from native_project_graph import Refused
+
+
+class EvidenceTests(unittest.TestCase):
+    def test_both_entrypoints_emit_failures_without_copying_private_diagnostic_text(self):
+        for module, operation, argv, phase in [
+            (native_bundle, "run", ["--proxy-helper", ".", "--", "true"], "bundle"),
+            (native_pods, "prepare", [".", "--proxy-helper", "."], "pods"),
+        ]:
+            error = Refused("native_configuration_failed")
+            error.diagnostic = 'PRIVATE_SENTINEL could not find compatible versions for pod "Fixture"'
+            out, err = io.StringIO(), io.StringIO()
+            with self.subTest(phase=phase), patch.object(module, operation, side_effect=error):
+                with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+                    code = module.main(argv)
+                self.assertEqual(code, 1)
+                self.assertFalse(json.loads(out.getvalue())["ok"])
+                self.assertNotIn("PRIVATE_SENTINEL", err.getvalue())
+                receipt = json.loads(err.getvalue().strip().split("::", 2)[2])
+                self.assertEqual(receipt["phase"], phase)
+                self.assertEqual(receipt["signals"], ["pod_version_conflict"])
+
+    def test_success_is_silent_and_unknown_failures_cannot_inject_annotations(self):
+        err = io.StringIO()
+        with contextlib.redirect_stderr(err):
+            report({"ok": True}, "bundle")
+        self.assertEqual(err.getvalue(), "")
+        with contextlib.redirect_stderr(err):
+            report({"ok": False, "code": "PRIVATE_SENTINEL\n::error::injected",
+                    "diagnostic": "PRIVATE_SENTINEL"}, "PRIVATE_SENTINEL")
+        self.assertNotIn("PRIVATE_SENTINEL", err.getvalue())
+        receipt = json.loads(err.getvalue().strip().split("::", 2)[2])
+        self.assertEqual(receipt["code"], "native_prepare_unclassified")
+        self.assertEqual(receipt["signals"], [])
+
+    def test_a_lockfile_mention_alone_does_not_claim_a_deployment_lock_conflict(self):
+        err = io.StringIO()
+        with contextlib.redirect_stderr(err):
+            report({"ok": False, "code": "native_configuration_failed", "diagnostic": "Using Podfile.lock"}, "bundle")
+        self.assertEqual(json.loads(err.getvalue().strip().split("::", 2)[2])["signals"], [])

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.100
+1.0.102

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.100
+1.0.102

package/backend-action/action.yml

@@ -64,6 +64,8 @@ runs:
         COMPOSE_FILE_INPUT: ${{ inputs.compose-file }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=validate_inputs
         COMPOSE_FILE="${COMPOSE_FILE_INPUT:-$BACKEND_DIR/docker-compose.yml}"
         test -d "$BACKEND_DIR" \
           || { echo "::error::no backend directory $BACKEND_DIR"; exit 1; }
@@ -91,6 +93,8 @@ runs:
         DEPLOY_SSH_KEY: ${{ inputs.ssh-key }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=configure_ssh
         mkdir -p ~/.ssh && chmod 700 ~/.ssh
         printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/backend_deploy
         chmod 600 ~/.ssh/backend_deploy
@@ -104,6 +108,8 @@ runs:
         COMPOSE_FILE: ${{ steps.layout.outputs.compose-file }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=sync_backend
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
         DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" "mkdir -p '$DEST'"
@@ -129,6 +135,7 @@ runs:
           "${{ github.action_path }}/select_certbot_account.sh" \
           "${{ github.action_path }}/ensure_certificate.sh" \
           "${{ github.action_path }}/configure_vhost.py" \
+          "${{ github.action_path }}/deploy_evidence.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host
@@ -137,6 +144,8 @@ runs:
         RUNTIME_ENV: ${{ inputs.runtime-env }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=write_runtime_env
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
         DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
         if [ -n "${RUNTIME_ENV:-}" ]; then
@@ -144,6 +153,7 @@ runs:
             "${{ inputs.ssh-user }}@${{ inputs.host }}" \
             "umask 077; cat > '$DEST/.runtime.env'"
         fi
+        BACKEND_DEPLOY_PHASE=remote_deploy
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
@@ -152,4 +162,7 @@ runs:
     - name: Cleanup key
       if: always()
       shell: bash
-      run: rm -f ~/.ssh/backend_deploy
+      run: |
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=cleanup_key
+        rm -f ~/.ssh/backend_deploy

package/backend-action/deploy_evidence.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Source inside the owning deploy shell. Never print the failed command or environment.
+backend_report_failure() {
+  local status="$1" phase="${BACKEND_DEPLOY_PHASE:-unclassified}"
+  [ "$status" -ne 0 ] || return 0
+  case "$phase" in
+    validate_inputs|configure_ssh|sync_backend|write_runtime_env|remote_deploy|cleanup_key|\
+    remote_setup|initialize_environment|compose_up|discover_port|local_health|configure_vhost|certificate|public_health) ;;
+    *) phase=unclassified ;;
+  esac
+  printf '::error title=backend_deploy_failed::{"schema":"gowalk-cicd/backend-deploy-failed.v1",'\
+'"phase":"%s","exit_code":%s}\n' "$phase" "$status"
+  return "$status"
+}
+
+trap 'backend_report_failure "$?"' EXIT

package/backend-action/remote_deploy.sh

@@ -9,6 +9,8 @@ DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
 HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
+source "$(dirname "${BASH_SOURCE[0]}")/deploy_evidence.sh"
+BACKEND_DEPLOY_PHASE=remote_setup
 cd "$DIR"
 source "$DIR/select_certbot_account.sh"
 source "$DIR/ensure_certificate.sh"
@@ -16,6 +18,7 @@ source "$DIR/ensure_certificate.sh"
 log() { echo "[deploy $APP] $*"; }
 
 # ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
+BACKEND_DEPLOY_PHASE=initialize_environment
 if [ ! -f .env ]; then
   log "first deploy — generating .env (POSTGRES_PASSWORD)"
   {
@@ -32,6 +35,7 @@ if [ -s .runtime.env ]; then
 fi
 
 # ── bring the stack up
+BACKEND_DEPLOY_PHASE=compose_up
 log "docker compose up -d --build"
 docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" \
   up -d --build --remove-orphans
@@ -43,6 +47,7 @@ detect_port() {
   docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" ps 2>/dev/null \
     | sed -nE 's/.*127\.0\.0\.1:([0-9]+)->.*/\1/p' | head -1
 }
+BACKEND_DEPLOY_PHASE=discover_port
 PORT="$(detect_port || true)"
 [ -n "${PORT:-}" ] || { log "ERROR: no 127.0.0.1:<port> publish found in compose ps"; \
   docker compose --project-name "$APP" ps; exit 1; }
@@ -50,6 +55,7 @@ log "service published on 127.0.0.1:$PORT"
 
 # ── local health-check first (fast failure, no DNS/cert dependency).
 # Generous: a first-ever deploy cold-inits Postgres and pulls base images.
+BACKEND_DEPLOY_PHASE=local_health
 HEALTHY=""
 for i in $(seq 1 90); do
   if curl -fsS "http://127.0.0.1:$PORT$HEALTH" >/dev/null 2>&1; then
@@ -72,6 +78,7 @@ if [ -z "$DOMAIN" ]; then
 fi
 
 # ── nginx vhost → proxy the domain to the published port
+BACKEND_DEPLOY_PHASE=configure_vhost
 VHOST="/etc/nginx/conf.d/backend-$APP.conf"
 VHOST_STATE="$(python3 "$DIR/configure_vhost.py" "$VHOST" "$DOMAIN" "$PORT")"
 if [ "$VHOST_STATE" = changed ]; then
@@ -80,6 +87,7 @@ if [ "$VHOST_STATE" = changed ]; then
 fi
 
 # ── Let's Encrypt cert: failed inventory is never absence; only lock contention retries.
+BACKEND_DEPLOY_PHASE=certificate
 if ensure_certificate "$DOMAIN" "$CERT_EMAIL"; then
   log "certificate ready for $DOMAIN"
 else
@@ -90,6 +98,7 @@ fi
 
 # ── public health-check. This validates DNS, the certificate, nginx routing,
 # and the application together; a green deploy must mean the public API works.
+BACKEND_DEPLOY_PHASE=public_health
 PUBLIC_HEALTHY=""
 for i in $(seq 1 15); do
   CURL_EXIT=0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.100",
+  "version": "1.0.102",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {