gowalk-cicd 1.0.102 → 1.0.104

package/CLAUDE.md

@@ -204,6 +204,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
   Backend failures emit `backend_deploy_failed` with the fixed runner/host phase and exit code.
+  Its message uses the exact schema/phase/exit envelope documented in README, without JSON braces
+  that multiline secret masking can erase. Never reconstruct masked fields or include arbitrary text.
   Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
   signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
@@ -262,6 +264,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Both Flutter configuration and the Pods helper use that bundle in their child process,
   preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
   action helper together; action-only updates cannot repair earlier custom configuration steps.
+- Locked Pod installation retries once only when its own attempt reports curl 18 and a partial-transfer
+  symptom. Both attempts share the existing 900-second budget and recheck Podfile, Podfile.lock and
+  selected Ruby bundle inputs. TLS/auth/permission, checksum, version and deployment errors never retry.
+  The assigned relay, deployment flags and completed-workspace guard remain mandatory; caches are retained.
+  `native_pods_retry` publishes only the fixed attempt/reason, and success reports `pod_attempts`.
 - Version stamping is per-build-system: Flutter takes `--build-number`, Gradle
   has no equivalent, so `set_gradle_version()` rewrites the literal in the
   checkout the way the iOS action patches the pbxproj. Never commit that edit.

package/README.md

@@ -336,6 +336,13 @@ Native bundle and Pods failures emit `native_prepare_failed` with schema
 Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
 the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
 private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+The backend message is `gowalk-cicd/backend-deploy-failed.v1 phase=<phase> exit_code=<code>`:
+fixed fields without JSON braces, which GitHub can mask when a multiline secret has brace-only lines.
+Consumers validate the complete envelope, the known phase and exit code 1–255; older JSON messages
+remain readable by the panel. Masked fields are never reconstructed and credential masking stays enabled.
+An interrupted locked Pod fetch can retry once within the existing 900-second install budget.
+`native_pods_retry` (`gowalk-cicd/native-pods-retry.v1`) reports `attempt:2` and `reason:partial_transfer`;
+successful preparation reports `pod_attempts`. Dependency locks, relay and TLS checks remain enforced.
 
 SDK transfers also emit `flutter_download_progress` notices with schema
 `gowalk-cicd/flutter-download-progress.v1`. Each carries `phase`, `event`, `elapsed_ms`

package/action/.daemux-version

@@ -1 +1 @@
-1.0.102
+1.0.104

package/action/scripts/native_bundle.py

@@ -18,9 +18,9 @@ import native_pods_process
 from native_prepare_evidence import report
 
 
-def command(argv: list[str], cwd: Path, log) -> int:
+def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
-        return native_pods_process.command(argv, cwd, log)
+        return native_pods_process.command(argv, cwd, log, timeout=timeout)
     except native_pods_process.Interrupted:
         raise guard.Refused("native_pods_operation_interrupted") from None
     except (OSError, RuntimeError, subprocess.SubprocessError):

package/action/scripts/native_pods.py

@@ -14,6 +14,7 @@ import tempfile
 
 import native_dependency_guard as guard
 import native_bundle
+import native_pods_retry
 from native_bundle import command
 from native_pods_diagnostics import refuse
 from native_prepare_evidence import report
@@ -51,9 +52,12 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
         initial = container or str(guard.selected(root, "", True).relative_to(root))
         guard.check(root, initial, before_pods=True)
         prefix, bundle_snapshot = native_bundle.prepare(root, folder, proxy_helper, log)
-        if command([sys.executable, str(proxy_helper), "--", *prefix, "pod", "install",
-                    "--deployment", "--no-repo-update"],
-                   folder, log):
+        snapshot = {**bundle_snapshot, folder / "Podfile.lock": digest,
+                    folder / "Podfile": hashlib.sha256((folder / "Podfile").read_bytes()).hexdigest()}
+        code, attempts = native_pods_retry.install(
+            [sys.executable, str(proxy_helper), "--", *prefix, "pod", "install", "--deployment", "--no-repo-update"],
+            folder, log, snapshot)
+        if code:
             refuse("native_pods_install_failed", log, guard.Refused)
         native_bundle.unchanged(bundle_snapshot)
         if digest != hashlib.sha256((folder / "Podfile.lock").read_bytes()).hexdigest():
@@ -65,7 +69,7 @@ def prepare(root: Path, container: str, proxy_helper: Path) -> dict:
                 raise guard.Refused("native_project_selection_required")
             final = str(workspaces[0].relative_to(root))
         result = guard.check(root, final)
-    return {**result, "pods": "installed", "lock_sha256": digest, "workspace": final}
+    return {**result, "pods": "installed", "pod_attempts": attempts, "lock_sha256": digest, "workspace": final}
 
 
 def interrupted(*_args) -> None:

package/action/scripts/native_pods_retry.py

@@ -0,0 +1,43 @@
+"""Retry one positively identified interrupted Pod fetch within the existing install deadline."""
+import json
+import re
+import sys
+import tempfile
+import time
+
+import native_bundle
+import native_dependency_guard as guard
+from native_pods_diagnostics import diagnostic
+
+TERMINAL = re.compile(
+    r"certificate|SSL peer|TLS|authentication|unauthorized|forbidden|permission denied|"
+    r"repository not found|checksum|compatible versions|deployment mode|"
+    r"returned error:\s*(?:401|403|407)\b|\bcurl(?:\s+(?:51|60)\b|:\s*\((?:51|60)\))", re.I)
+PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
+
+
+def interrupted_transfer(body: str) -> bool:
+    return bool(PARTIAL.search(body) and not TERMINAL.search(body) and any(
+        text in body.lower() for text in ("early eof", "transfer closed", "bytes of body are still expected")))
+
+
+def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:
+    deadline = time.monotonic() + timeout
+    for attempt in (1, 2):
+        native_bundle.unchanged(snapshot)
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise guard.Refused("native_pods_operation_interrupted")
+        with tempfile.TemporaryFile() as child_log:
+            code = native_bundle.command(argv, folder, child_log, timeout=remaining)
+            body = diagnostic(child_log)
+        native_bundle.unchanged(snapshot)
+        log.seek(0)
+        log.truncate()
+        log.write(body.encode())
+        if code == 0 or attempt == 2 or not interrupted_transfer(body):
+            return code, attempt
+        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": "partial_transfer"}
+        print("::notice title=native_pods_retry::" + json.dumps(payload, separators=(",", ":")),
+              file=sys.stderr, flush=True)
+    raise AssertionError("unreachable")

package/action/scripts/native_prepare_evidence.py

@@ -11,6 +11,7 @@ SIGNALS = {
     "tls_verification": ("certificate verify failed", "CERTIFICATE_VERIFY_FAILED"),
     "connection_timeout": ("Connection timed out", "execution expired", "Read timed out"),
     "dns_resolution": ("Could not resolve host", "getaddrinfo"),
+    "partial_transfer": ("curl 18", "curl: (18)"),
     "disk_full": ("No space left on device",),
 }
 ALL_REQUIRED = frozenset({"pod_lock_drift", "gem_missing"})

package/action/scripts/test_native_pods_retry.py

@@ -0,0 +1,100 @@
+"""Exercise interrupted installs through the actual CLI and relay, plus the shared deadline."""
+import json
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import native_dependency_guard as guard
+import native_pods_retry
+import test_native_pods
+
+PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data remaining\nfatal: early EOF"
+
+
+class RetryTests(unittest.TestCase):
+    def setUp(self):
+        self.fixture = test_native_pods.PodsTests()
+        self.fixture.setUp()
+        self.addCleanup(self.fixture.doCleanups)
+        self.fixture.locked()
+        self.root = self.fixture.root
+
+    def script(self, failures, *, change_lock=False):
+        configuration = json.dumps({"failures": failures, "change_lock": change_lock})
+        script = self.root / "pod"
+        script.write_text('#!' + sys.executable + '\nimport json,os,sys\nfrom pathlib import Path\n'
+                          'config=json.loads(' + repr(configuration) + ')\n'
+                          'p=Path("attempts.json");rows=json.loads(p.read_text()) if p.exists() else []\n'
+                          'rows.append({"argv":sys.argv[1:],"proxy":os.environ["HTTPS_PROXY"],'
+                          '"bypass":os.environ["NO_PROXY"]});p.write_text(json.dumps(rows))\n'
+                          'if len(rows)<=len(config["failures"]):\n'
+                          ' if config["change_lock"]: Path("Podfile.lock").write_text("changed")\n'
+                          ' print(config["failures"][len(rows)-1],file=sys.stderr);raise SystemExit(7)\n'
+                          'p=Path("App.xcworkspace");p.mkdir(exist_ok=True)\n'
+                          '(p/"contents.xcworkspacedata").write_text('
+                          '\'<Workspace><FileRef location="group:App.xcodeproj"/></Workspace>\')\n')
+        script.chmod(0o700)
+        self.fixture.env["PATH"] = str(self.root) + os.pathsep + self.fixture.env["PATH"]
+        self.fixture.env["NO_PROXY"] = "*"
+
+    def test_partial_transfer_recovers_with_same_lock_flags_and_private_relay(self):
+        self.script([PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["pod_attempts"]), (0, 2))
+        attempts = json.loads((self.root / "attempts.json").read_text())
+        self.assertEqual(len(attempts), 2)
+        for attempt in attempts:
+            self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+            self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+            self.assertEqual(attempt["bypass"], "")
+        self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_partial_failure_stops_after_second_attempt(self):
+        self.script([PARTIAL, PARTIAL, PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_changed_lock_refuses_before_any_retry(self):
+        self.script([PARTIAL], change_lock=True)
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_bundle_inputs_changed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_unknown_second_failure_does_not_inherit_first_attempt_classification(self):
+        self.script([PARTIAL, "unclassified failure", PARTIAL])
+        code, result = self.fixture.run_cli()
+        self.assertEqual(code, 1)
+        self.assertEqual(result["diagnostic"], "unclassified failure")
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_terminal_evidence_dominates_partial_transfer(self):
+        for failure in ("certificate verify failed", "authentication failed", "permission denied",
+                        "checksum mismatch", "could not find compatible versions", "deployment mode",
+                        "The requested URL returned error: 407", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([PARTIAL + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_one_deadline_and_no_guess_from_generic_eof(self):
+        for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
+            self.assertFalse(native_pods_retry.interrupted_transfer(body))
+        self.assertTrue(native_pods_retry.interrupted_transfer("curl: (18) transfer closed"))
+        def child(_argv, _folder, log, *, timeout):
+            log.write(PARTIAL.encode())
+            return 7
+        with tempfile.TemporaryFile() as log, patch.object(native_pods_retry.native_bundle, "command",
+                                                          side_effect=child) as command:
+            with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 700]):
+                self.assertEqual(native_pods_retry.install(["fixture"], self.root, log, {}), (7, 2))
+            self.assertEqual([c.kwargs["timeout"] for c in command.call_args_list], [899, 200])
+            command.reset_mock()
+            with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 901]):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted"):
+                    native_pods_retry.install(["fixture"], self.root, log, {})
+            self.assertEqual(command.call_count, 1)

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.102
+1.0.104

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.102
+1.0.104

package/backend-action/deploy_evidence.sh

@@ -8,8 +8,9 @@ backend_report_failure() {
     remote_setup|initialize_environment|compose_up|discover_port|local_health|configure_vhost|certificate|public_health) ;;
     *) phase=unclassified ;;
   esac
-  printf '::error title=backend_deploy_failed::{"schema":"gowalk-cicd/backend-deploy-failed.v1",'\
-'"phase":"%s","exit_code":%s}\n' "$phase" "$status"
+  # Multiline JSON secrets can make GitHub mask standalone braces. Keep fixed evidence readable.
+  printf '::error title=backend_deploy_failed::gowalk-cicd/backend-deploy-failed.v1 phase=%s exit_code=%s\n' \
+    "$phase" "$status"
   return "$status"
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.102",
+  "version": "1.0.104",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {