gowalk-cicd 1.0.101 → 1.0.103

package/CLAUDE.md

@@ -203,6 +203,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - Backend runtime credentials use the single encrypted `BACKEND_RUNTIME_ENV`
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
+  Backend failures emit `backend_deploy_failed` with the fixed runner/host phase and exit code.
+  Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
+  signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
@@ -259,6 +262,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Both Flutter configuration and the Pods helper use that bundle in their child process,
   preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
   action helper together; action-only updates cannot repair earlier custom configuration steps.
+- Locked Pod installation retries once only when its own attempt reports curl 18 and a partial-transfer
+  symptom. Both attempts share the existing 900-second budget and recheck Podfile, Podfile.lock and
+  selected Ruby bundle inputs. TLS/auth/permission, checksum, version and deployment errors never retry.
+  The assigned relay, deployment flags and completed-workspace guard remain mandatory; caches are retained.
+  `native_pods_retry` publishes only the fixed attempt/reason, and success reports `pod_attempts`.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -331,6 +331,15 @@ describe observed error patterns, not retry permission or a unique root cause. S
 emit `android_build_progress` notices (`gowalk-cicd/android-build-progress.v1`) every minute
 with `phase` and `elapsed_seconds`; successful compiler output is not republished.
 
+Native bundle and Pods failures emit `native_prepare_failed` with schema
+`gowalk-cicd/native-prepare-failed.v1`, `phase`, a fixed refusal `code` and fixed observed `signals`.
+Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
+the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
+private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+An interrupted locked Pod fetch can retry once within the existing 900-second install budget.
+`native_pods_retry` (`gowalk-cicd/native-pods-retry.v1`) reports `attempt:2` and `reason:partial_transfer`;
+successful preparation reports `pod_attempts`. Dependency locks, relay and TLS checks remain enforced.
+
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`
 and `retained_bytes`; `attempt_finished` adds `attempt`, `curl_exit`, `http_status`

package/action/.daemux-version

@@ -1 +1 @@
-1.0.101
+1.0.103

package/action/scripts/native_bundle.py

@@ -15,11 +15,12 @@ import tempfile
 import native_dependency_guard as guard
 from native_pods_diagnostics import refuse
 import native_pods_process
+from native_prepare_evidence import report
 
 
-def command(argv: list[str], cwd: Path, log) -> int:
+def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
-        return native_pods_process.command(argv, cwd, log)
+        return native_pods_process.command(argv, cwd, log, timeout=timeout)
     except native_pods_process.Interrupted:
         raise guard.Refused("native_pods_operation_interrupted") from None
     except (OSError, RuntimeError, subprocess.SubprocessError):
@@ -104,6 +105,7 @@ def main(argv: list[str]) -> int:
                   "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
+    report(answer, "bundle")
     print(json.dumps(answer, sort_keys=True))
     return 0 if answer["ok"] else 1
 

package/action/scripts/native_pods.py

@@ -14,8 +14,10 @@ import tempfile
 
 import native_dependency_guard as guard
 import native_bundle
+import native_pods_retry
 from native_bundle import command
 from native_pods_diagnostics import refuse
+from native_prepare_evidence import report
 
 
 def committed(root: Path, lock: Path) -> str:
@@ -50,9 +52,12 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
         initial = container or str(guard.selected(root, "", True).relative_to(root))
         guard.check(root, initial, before_pods=True)
         prefix, bundle_snapshot = native_bundle.prepare(root, folder, proxy_helper, log)
-        if command([sys.executable, str(proxy_helper), "--", *prefix, "pod", "install",
-                    "--deployment", "--no-repo-update"],
-                   folder, log):
+        snapshot = {**bundle_snapshot, folder / "Podfile.lock": digest,
+                    folder / "Podfile": hashlib.sha256((folder / "Podfile").read_bytes()).hexdigest()}
+        code, attempts = native_pods_retry.install(
+            [sys.executable, str(proxy_helper), "--", *prefix, "pod", "install", "--deployment", "--no-repo-update"],
+            folder, log, snapshot)
+        if code:
             refuse("native_pods_install_failed", log, guard.Refused)
         native_bundle.unchanged(bundle_snapshot)
         if digest != hashlib.sha256((folder / "Podfile.lock").read_bytes()).hexdigest():
@@ -64,7 +69,7 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
                 raise guard.Refused("native_project_selection_required")
             final = str(workspaces[0].relative_to(root))
         result = guard.check(root, final)
-    return {**result, "pods": "installed", "lock_sha256": digest, "workspace": final}
+    return {**result, "pods": "installed", "pod_attempts": attempts, "lock_sha256": digest, "workspace": final}
 
 
 def interrupted(*_args) -> None:
@@ -85,6 +90,7 @@ def main(argv: list[str]) -> int:
         answer = {"ok": False, "code": code, "next": guard.REMEDIATION}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
+    report(answer, "pods")
     print(json.dumps(answer, sort_keys=True))
     return 0 if answer["ok"] else 1
 

package/action/scripts/native_pods_retry.py

@@ -0,0 +1,43 @@
+"""Retry one positively identified interrupted Pod fetch within the existing install deadline."""
+import json
+import re
+import sys
+import tempfile
+import time
+
+import native_bundle
+import native_dependency_guard as guard
+from native_pods_diagnostics import diagnostic
+
+TERMINAL = re.compile(
+    r"certificate|SSL peer|TLS|authentication|unauthorized|forbidden|permission denied|"
+    r"repository not found|checksum|compatible versions|deployment mode|"
+    r"returned error:\s*(?:401|403|407)\b|\bcurl(?:\s+(?:51|60)\b|:\s*\((?:51|60)\))", re.I)
+PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
+
+
+def interrupted_transfer(body: str) -> bool:
+    return bool(PARTIAL.search(body) and not TERMINAL.search(body) and any(
+        text in body.lower() for text in ("early eof", "transfer closed", "bytes of body are still expected")))
+
+
+def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:
+    deadline = time.monotonic() + timeout
+    for attempt in (1, 2):
+        native_bundle.unchanged(snapshot)
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise guard.Refused("native_pods_operation_interrupted")
+        with tempfile.TemporaryFile() as child_log:
+            code = native_bundle.command(argv, folder, child_log, timeout=remaining)
+            body = diagnostic(child_log)
+        native_bundle.unchanged(snapshot)
+        log.seek(0)
+        log.truncate()
+        log.write(body.encode())
+        if code == 0 or attempt == 2 or not interrupted_transfer(body):
+            return code, attempt
+        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": "partial_transfer"}
+        print("::notice title=native_pods_retry::" + json.dumps(payload, separators=(",", ":")),
+              file=sys.stderr, flush=True)
+    raise AssertionError("unreachable")

package/action/scripts/native_prepare_evidence.py

@@ -0,0 +1,42 @@
+"""Publish fixed native failure evidence without moving private child output into annotations."""
+import json
+import sys
+
+SIGNALS = {
+    "pod_version_conflict": ("could not find compatible versions for pod", "Unable to satisfy the following requirements"),
+    "pod_lock_drift": ("Podfile.lock", "deployment mode"),
+    "ruby_version_incompatible": ("requires Ruby version", "Your Ruby version is"),
+    "gem_missing": ("Could not find", "in locally installed gems"),
+    "bundler_version_missing": ("Could not find 'bundler'",),
+    "tls_verification": ("certificate verify failed", "CERTIFICATE_VERIFY_FAILED"),
+    "connection_timeout": ("Connection timed out", "execution expired", "Read timed out"),
+    "dns_resolution": ("Could not resolve host", "getaddrinfo"),
+    "partial_transfer": ("curl 18", "curl: (18)"),
+    "disk_full": ("No space left on device",),
+}
+ALL_REQUIRED = frozenset({"pod_lock_drift", "gem_missing"})
+CODES = frozenset({
+    "native_bundle_install_failed", "native_bundle_inputs_changed", "native_bundle_path_unverified",
+    "native_bundle_operation_unverified", "native_configuration_failed", "native_google_proxy_required",
+    "native_google_transport_helper_required", "native_pods_install_failed", "native_pods_operation_unverified",
+    "native_pods_operation_interrupted", "native_pods_process_unverified", "native_podfile_lock_required",
+    "native_podfile_lock_commit_required", "native_podfile_lock_changed", "native_gemfile_required",
+    "native_gemfile_commit_required", "native_gemfile_lock_required", "native_gemfile_lock_commit_required",
+    "native_workspace_reference_unverified", "native_project_generation_failed", "native_project_selection_required",
+    "native_project_parse_unverified", "native_project_inventory_unverified", "native_project_inventory_missing",
+    "native_package_proxy_transport_required", "native_initial_lock_phase_required",
+})
+
+
+def report(answer: dict, phase: str) -> None:
+    if answer.get("ok"):
+        return
+    body = str(answer.get("diagnostic", ""))[-4000:]
+    signals = sorted(name for name, patterns in SIGNALS.items()
+                     if (all if name in ALL_REQUIRED else any)(part in body for part in patterns))
+    code = answer.get("code")
+    payload = {"schema": "gowalk-cicd/native-prepare-failed.v1",
+               "phase": phase if phase in {"bundle", "pods"} else "unclassified",
+               "code": code if code in CODES else "native_prepare_unclassified", "signals": signals}
+    print("::error title=native_prepare_failed::" + json.dumps(payload, separators=(",", ":")),
+          file=sys.stderr, flush=True)

package/action/scripts/test_native_bundle.py

@@ -51,6 +51,13 @@ class BundleTests(unittest.TestCase):
                                  "--proxy-helper", str(PROXY), "--", sys.executable, "-c", script],
                                 cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
         self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        annotations = [line for line in result.stderr.splitlines()
+                       if line.startswith("::error title=native_prepare_failed::")]
+        if result.returncode:
+            self.assertEqual(len(annotations), 1)
+            self.assertEqual(json.loads(annotations[0].split("::", 2)[2])["phase"], "bundle")
+        else:
+            self.assertEqual(annotations, [])
         return result.returncode, json.loads(result.stdout)
 
     def test_unconfigured_app_keeps_the_proxied_command(self):

package/action/scripts/test_native_pods.py

@@ -155,7 +155,8 @@ class PodsTests(unittest.TestCase):
             output, errors = child.communicate(timeout=10)
         self.assertTrue((self.root / "owned-child").exists())
         self.assertEqual(json.loads(output)["code"], "native_pods_operation_interrupted")
-        self.assertEqual(errors, "")
+        self.assertTrue(errors.startswith("::error title=native_prepare_failed::"))
+        self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["code"], "native_pods_operation_interrupted")
         owned_pid = int((self.root / "owned-child").read_text())
         deadline = time.monotonic() + 5
         while time.monotonic() < deadline:

package/action/scripts/test_native_pods_retry.py

@@ -0,0 +1,100 @@
+"""Exercise interrupted installs through the actual CLI and relay, plus the shared deadline."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import native_dependency_guard as guard
+import native_pods_retry
+import test_native_pods
+
+PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data remaining\nfatal: early EOF"
+
+
+class RetryTests(unittest.TestCase):
+    def setUp(self):
+        self.fixture = test_native_pods.PodsTests()
+        self.fixture.setUp()
+        self.addCleanup(self.fixture.doCleanups)
+        self.fixture.locked()
+        self.root = self.fixture.root
+
+    def script(self, failures, *, change_lock=False):
+        configuration = json.dumps({"failures": failures, "change_lock": change_lock})
+        script = self.root / "pod"
+        script.write_text('#!' + sys.executable + '\nimport json,os,sys\nfrom pathlib import Path\n'
+                          'config=json.loads(' + repr(configuration) + ')\n'
+                          'p=Path("attempts.json");rows=json.loads(p.read_text()) if p.exists() else []\n'
+                          'rows.append({"argv":sys.argv[1:],"proxy":os.environ["HTTPS_PROXY"],'
+                          '"bypass":os.environ["NO_PROXY"]});p.write_text(json.dumps(rows))\n'
+                          'if len(rows)<=len(config["failures"]):\n'
+                          ' if config["change_lock"]: Path("Podfile.lock").write_text("changed")\n'
+                          ' print(config["failures"][len(rows)-1],file=sys.stderr);raise SystemExit(7)\n'
+                          'p=Path("App.xcworkspace");p.mkdir(exist_ok=True)\n'
+                          '(p/"contents.xcworkspacedata").write_text('
+                          '\'<Workspace><FileRef location="group:App.xcodeproj"/></Workspace>\')\n')
+        script.chmod(0o700)
+        self.fixture.env["PATH"] = str(self.root) + os.pathsep + self.fixture.env["PATH"]
+        self.fixture.env["NO_PROXY"] = "*"
+
+    def test_partial_transfer_recovers_with_same_lock_flags_and_private_relay(self):
+        self.script([PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["pod_attempts"]), (0, 2))
+        attempts = json.loads((self.root / "attempts.json").read_text())
+        self.assertEqual(len(attempts), 2)
+        for attempt in attempts:
+            self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+            self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+            self.assertEqual(attempt["bypass"], "")
+        self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_partial_failure_stops_after_second_attempt(self):
+        self.script([PARTIAL, PARTIAL, PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_changed_lock_refuses_before_any_retry(self):
+        self.script([PARTIAL], change_lock=True)
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_bundle_inputs_changed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_unknown_second_failure_does_not_inherit_first_attempt_classification(self):
+        self.script([PARTIAL, "unclassified failure", PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual(code, 1)
+        self.assertEqual(result["diagnostic"], "unclassified failure")
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_terminal_evidence_dominates_partial_transfer(self):
+        for failure in ("certificate verify failed", "authentication failed", "permission denied",
+                        "checksum mismatch", "could not find compatible versions", "deployment mode",
+                        "The requested URL returned error: 407", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([PARTIAL + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_one_deadline_and_no_guess_from_generic_eof(self):
+        for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
+            self.assertFalse(native_pods_retry.interrupted_transfer(body))
+        self.assertTrue(native_pods_retry.interrupted_transfer("curl: (18) transfer closed"))
+        def child(_argv, _folder, log, *, timeout):
+            log.write(PARTIAL.encode())
+            return 7
+        with tempfile.TemporaryFile() as log, patch.object(native_pods_retry.native_bundle, "command",
+                                                          side_effect=child) as command:
+            with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 700]):
+                self.assertEqual(native_pods_retry.install(["fixture"], self.root, log, {}), (7, 2))
+            self.assertEqual([c.kwargs["timeout"] for c in command.call_args_list], [899, 200])
+            command.reset_mock()
+            with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 901]):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted"):
+                    native_pods_retry.install(["fixture"], self.root, log, {})
+            self.assertEqual(command.call_count, 1)

package/action/scripts/test_native_prepare_evidence.py

@@ -0,0 +1,50 @@
+"""Native entrypoints preserve JSON callers while emitting only fixed public failure fields."""
+import contextlib
+import io
+import json
+import unittest
+from unittest.mock import patch
+
+import native_bundle
+import native_pods
+from native_prepare_evidence import report
+from native_project_graph import Refused
+
+
+class EvidenceTests(unittest.TestCase):
+    def test_both_entrypoints_emit_failures_without_copying_private_diagnostic_text(self):
+        for module, operation, argv, phase in [
+            (native_bundle, "run", ["--proxy-helper", ".", "--", "true"], "bundle"),
+            (native_pods, "prepare", [".", "--proxy-helper", "."], "pods"),
+        ]:
+            error = Refused("native_configuration_failed")
+            error.diagnostic = 'PRIVATE_SENTINEL could not find compatible versions for pod "Fixture"'
+            out, err = io.StringIO(), io.StringIO()
+            with self.subTest(phase=phase), patch.object(module, operation, side_effect=error):
+                with contextlib.redirect_stdout(out), contextlib.redirect_stderr(err):
+                    code = module.main(argv)
+                self.assertEqual(code, 1)
+                self.assertFalse(json.loads(out.getvalue())["ok"])
+                self.assertNotIn("PRIVATE_SENTINEL", err.getvalue())
+                receipt = json.loads(err.getvalue().strip().split("::", 2)[2])
+                self.assertEqual(receipt["phase"], phase)
+                self.assertEqual(receipt["signals"], ["pod_version_conflict"])
+
+    def test_success_is_silent_and_unknown_failures_cannot_inject_annotations(self):
+        err = io.StringIO()
+        with contextlib.redirect_stderr(err):
+            report({"ok": True}, "bundle")
+        self.assertEqual(err.getvalue(), "")
+        with contextlib.redirect_stderr(err):
+            report({"ok": False, "code": "PRIVATE_SENTINEL\n::error::injected",
+                    "diagnostic": "PRIVATE_SENTINEL"}, "PRIVATE_SENTINEL")
+        self.assertNotIn("PRIVATE_SENTINEL", err.getvalue())
+        receipt = json.loads(err.getvalue().strip().split("::", 2)[2])
+        self.assertEqual(receipt["code"], "native_prepare_unclassified")
+        self.assertEqual(receipt["signals"], [])
+
+    def test_a_lockfile_mention_alone_does_not_claim_a_deployment_lock_conflict(self):
+        err = io.StringIO()
+        with contextlib.redirect_stderr(err):
+            report({"ok": False, "code": "native_configuration_failed", "diagnostic": "Using Podfile.lock"}, "bundle")
+        self.assertEqual(json.loads(err.getvalue().strip().split("::", 2)[2])["signals"], [])

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.101
+1.0.103

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.101
+1.0.103

package/backend-action/action.yml

@@ -64,6 +64,8 @@ runs:
         COMPOSE_FILE_INPUT: ${{ inputs.compose-file }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=validate_inputs
         COMPOSE_FILE="${COMPOSE_FILE_INPUT:-$BACKEND_DIR/docker-compose.yml}"
         test -d "$BACKEND_DIR" \
           || { echo "::error::no backend directory $BACKEND_DIR"; exit 1; }
@@ -91,6 +93,8 @@ runs:
         DEPLOY_SSH_KEY: ${{ inputs.ssh-key }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=configure_ssh
         mkdir -p ~/.ssh && chmod 700 ~/.ssh
         printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/backend_deploy
         chmod 600 ~/.ssh/backend_deploy
@@ -104,6 +108,8 @@ runs:
         COMPOSE_FILE: ${{ steps.layout.outputs.compose-file }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=sync_backend
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
         DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" "mkdir -p '$DEST'"
@@ -129,6 +135,7 @@ runs:
           "${{ github.action_path }}/select_certbot_account.sh" \
           "${{ github.action_path }}/ensure_certificate.sh" \
           "${{ github.action_path }}/configure_vhost.py" \
+          "${{ github.action_path }}/deploy_evidence.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host
@@ -137,6 +144,8 @@ runs:
         RUNTIME_ENV: ${{ inputs.runtime-env }}
       run: |
         set -euo pipefail
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=write_runtime_env
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
         DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
         if [ -n "${RUNTIME_ENV:-}" ]; then
@@ -144,6 +153,7 @@ runs:
             "${{ inputs.ssh-user }}@${{ inputs.host }}" \
             "umask 077; cat > '$DEST/.runtime.env'"
         fi
+        BACKEND_DEPLOY_PHASE=remote_deploy
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
@@ -152,4 +162,7 @@ runs:
     - name: Cleanup key
       if: always()
       shell: bash
-      run: rm -f ~/.ssh/backend_deploy
+      run: |
+        source "${{ github.action_path }}/deploy_evidence.sh"
+        BACKEND_DEPLOY_PHASE=cleanup_key
+        rm -f ~/.ssh/backend_deploy

package/backend-action/deploy_evidence.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Source inside the owning deploy shell. Never print the failed command or environment.
+backend_report_failure() {
+  local status="$1" phase="${BACKEND_DEPLOY_PHASE:-unclassified}"
+  [ "$status" -ne 0 ] || return 0
+  case "$phase" in
+    validate_inputs|configure_ssh|sync_backend|write_runtime_env|remote_deploy|cleanup_key|\
+    remote_setup|initialize_environment|compose_up|discover_port|local_health|configure_vhost|certificate|public_health) ;;
+    *) phase=unclassified ;;
+  esac
+  printf '::error title=backend_deploy_failed::{"schema":"gowalk-cicd/backend-deploy-failed.v1",'\
+'"phase":"%s","exit_code":%s}\n' "$phase" "$status"
+  return "$status"
+}
+
+trap 'backend_report_failure "$?"' EXIT

package/backend-action/remote_deploy.sh

@@ -9,6 +9,8 @@ DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
 HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
+source "$(dirname "${BASH_SOURCE[0]}")/deploy_evidence.sh"
+BACKEND_DEPLOY_PHASE=remote_setup
 cd "$DIR"
 source "$DIR/select_certbot_account.sh"
 source "$DIR/ensure_certificate.sh"
@@ -16,6 +18,7 @@ source "$DIR/ensure_certificate.sh"
 log() { echo "[deploy $APP] $*"; }
 
 # ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
+BACKEND_DEPLOY_PHASE=initialize_environment
 if [ ! -f .env ]; then
   log "first deploy — generating .env (POSTGRES_PASSWORD)"
   {
@@ -32,6 +35,7 @@ if [ -s .runtime.env ]; then
 fi
 
 # ── bring the stack up
+BACKEND_DEPLOY_PHASE=compose_up
 log "docker compose up -d --build"
 docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" \
   up -d --build --remove-orphans
@@ -43,6 +47,7 @@ detect_port() {
   docker compose "${COMPOSE_ENV[@]}" --project-name "$APP" ps 2>/dev/null \
     | sed -nE 's/.*127\.0\.0\.1:([0-9]+)->.*/\1/p' | head -1
 }
+BACKEND_DEPLOY_PHASE=discover_port
 PORT="$(detect_port || true)"
 [ -n "${PORT:-}" ] || { log "ERROR: no 127.0.0.1:<port> publish found in compose ps"; \
   docker compose --project-name "$APP" ps; exit 1; }
@@ -50,6 +55,7 @@ log "service published on 127.0.0.1:$PORT"
 
 # ── local health-check first (fast failure, no DNS/cert dependency).
 # Generous: a first-ever deploy cold-inits Postgres and pulls base images.
+BACKEND_DEPLOY_PHASE=local_health
 HEALTHY=""
 for i in $(seq 1 90); do
   if curl -fsS "http://127.0.0.1:$PORT$HEALTH" >/dev/null 2>&1; then
@@ -72,6 +78,7 @@ if [ -z "$DOMAIN" ]; then
 fi
 
 # ── nginx vhost → proxy the domain to the published port
+BACKEND_DEPLOY_PHASE=configure_vhost
 VHOST="/etc/nginx/conf.d/backend-$APP.conf"
 VHOST_STATE="$(python3 "$DIR/configure_vhost.py" "$VHOST" "$DOMAIN" "$PORT")"
 if [ "$VHOST_STATE" = changed ]; then
@@ -80,6 +87,7 @@ if [ "$VHOST_STATE" = changed ]; then
 fi
 
 # ── Let's Encrypt cert: failed inventory is never absence; only lock contention retries.
+BACKEND_DEPLOY_PHASE=certificate
 if ensure_certificate "$DOMAIN" "$CERT_EMAIL"; then
   log "certificate ready for $DOMAIN"
 else
@@ -90,6 +98,7 @@ fi
 
 # ── public health-check. This validates DNS, the certificate, nginx routing,
 # and the application together; a green deploy must mean the public API works.
+BACKEND_DEPLOY_PHASE=public_health
 PUBLIC_HEALTHY=""
 for i in $(seq 1 15); do
   CURL_EXIT=0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.101",
+  "version": "1.0.103",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {