gowalk-cicd 1.0.103 → 1.0.105

package/CLAUDE.md

@@ -204,6 +204,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   secret. The action writes it to host-side `.runtime.env` with mode 0600 and
   supplies it to Compose after the generated `.env`; never print its content.
   Backend failures emit `backend_deploy_failed` with the fixed runner/host phase and exit code.
+  Its message uses the exact schema/phase/exit envelope documented in README, without JSON braces
+  that multiline secret masking can erase. Never reconstruct masked fields or include arbitrary text.
   Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
   signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
@@ -262,6 +264,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Both Flutter configuration and the Pods helper use that bundle in their child process,
   preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
   action helper together; action-only updates cannot repair earlier custom configuration steps.
+  Flutter `--config-only` can query Xcode and install Pods before returning. In the workflow,
+  generate Flutter inputs with `pub get`, run the locked `native_pods.py` preparation and
+  completed graph guard, then configure the release with its existing obfuscation/define flags.
+  The graph guard still applies when there is no Podfile. Preserve this order in custom CI.
 - Locked Pod installation retries once only when its own attempt reports curl 18 and a partial-transfer
   symptom. Both attempts share the existing 900-second budget and recheck Podfile, Podfile.lock and
   selected Ruby bundle inputs. TLS/auth/permission, checksum, version and deployment errors never retry.

package/README.md

@@ -58,6 +58,12 @@ When adopting this update, retain the `native_bundle.py` configuration wrapper i
 custom workflows as well as updating the action files. Apps without a Gemfile keep
 their existing CocoaPods runtime.
 
+Flutter `--config-only` can query Xcode and invoke `pod install`. The workflow first
+runs `flutter pub get` to generate the Podfile's Flutter inputs, then installs locked
+Pods and verifies the selected workspace before release configuration. Preserve this
+order in customized validation and deployment workflows; updating action directories
+alone cannot repair a configuration step that runs before the action.
+
 ## Flutter web release
 
 The conditional `deploy-web.yml` workflow runs on changes to Flutter source,
@@ -336,6 +342,10 @@ Native bundle and Pods failures emit `native_prepare_failed` with schema
 Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
 the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
 private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+The backend message is `gowalk-cicd/backend-deploy-failed.v1 phase=<phase> exit_code=<code>`:
+fixed fields without JSON braces, which GitHub can mask when a multiline secret has brace-only lines.
+Consumers validate the complete envelope, the known phase and exit code 1–255; older JSON messages
+remain readable by the panel. Masked fields are never reconstructed and credential masking stays enabled.
 An interrupted locked Pod fetch can retry once within the existing 900-second install budget.
 `native_pods_retry` (`gowalk-cicd/native-pods-retry.v1`) reports `attempt:2` and `reason:partial_transfer`;
 successful preparation reports `pod_attempts`. Dependency locks, relay and TLS checks remain enforced.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.103
+1.0.105

package/action/scripts/test_flutter_native_preparation.py

@@ -0,0 +1,107 @@
+"""Execute the shipped Flutter preparation shell with real guards and offline tool fixtures."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+
+import native_bundle
+from test_native_dependency_guard import project
+
+REPO = Path(__file__).resolve().parents[2]
+
+
+class FlutterPreparationTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="flutter-native-preparation-")
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name).resolve()
+        project(self.root, "ios/Runner.xcodeproj")
+        workspace = self.root / "ios/Runner.xcworkspace"
+        workspace.mkdir()
+        (workspace / "contents.xcworkspacedata").write_text(
+            '<Workspace><FileRef location="group:Runner.xcodeproj"/></Workspace>')
+        for name in ("Podfile", "Podfile.lock"):
+            (self.root / "ios" / name).write_text("fixture lock\n")
+        (self.root / "pubspec.yaml").write_text("name: fixture\n")
+        for argv in (["git", "init", "-q"], ["git", "add", "."],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Freeze native fixture"]):
+            subprocess.run(argv, cwd=self.root, capture_output=True, check=True)
+        actions = self.root / ".github/actions"
+        actions.mkdir(parents=True)
+        (actions / "swift-app").symlink_to(REPO / "action", target_is_directory=True)
+        (actions / "android-app").symlink_to(REPO / "android-action", target_is_directory=True)
+        self.env = {**os.environ, "PATH": str(self.root) + os.pathsep + os.environ["PATH"],
+                    "GITHUB_WORKSPACE": str(self.root), "RUNNER_TEMP": str(self.root / "scratch"),
+                    "ONBOARDING_PUBLIC_ORIGIN": "https://flow.example.invalid",
+                    "GOOGLE_STORE_PROXY_URL": "http://fixture:PRIVATE_SENTINEL@127.0.0.1:9"}
+        self.install_tools()
+
+    def executable(self, name, source):
+        path = self.root / name
+        path.write_text("#!" + sys.executable + "\n" + textwrap.dedent(source))
+        path.chmod(0o700)
+
+    def install_tools(self):
+        self.executable("flutter", '''
+            import json,sys
+            from pathlib import Path
+            if sys.argv[1:3] == ["pub", "get"]:
+                folder=Path("ios/Flutter");folder.mkdir()
+                (folder/"Generated.xcconfig").write_text("generated")
+            elif sys.argv[1:3] == ["build", "ios"]:
+                Path("configuration.json").write_text(json.dumps(sys.argv[1:]))
+                assert Path("ios/pods-ready").is_file(), "Configuration reached before locked Pods"
+            else:
+                raise SystemExit(9)
+        ''')
+        self.executable("pod", '''
+            import json,os,sys
+            from pathlib import Path
+            assert Path("Flutter/Generated.xcconfig").is_file()
+            assert sys.argv[1:] == ["install", "--deployment", "--no-repo-update"]
+            assert os.environ["HTTPS_PROXY"].startswith("http://127.0.0.1:")
+            Path("pod-called").touch()
+            if os.environ.get("FAIL_PODS"):
+                raise SystemExit(7)
+            Path("pods-ready").touch()
+        ''')
+
+    def run_preparation(self):
+        body = (REPO / "templates/deploy.yml").read_text().split(
+            "- name: Prepare Flutter iOS project\n", 1)[1].split("\n      - ", 1)[0]
+        script = textwrap.dedent(body.split("        run: |\n", 1)[1])
+        result = subprocess.run([sys.executable, native_bundle.__file__, "--folder", "ios",
+                                 "--proxy-helper", str(REPO / "android-action/scripts/play_store_proxy.py"),
+                                 "--", "bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", script],
+                                cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        return result
+
+    def test_locked_pods_precede_configuration_without_losing_release_arguments(self):
+        result = self.run_preparation()
+        self.assertEqual(result.returncode, 0, result.stdout)
+        self.assertTrue((self.root / "ios/pod-called").exists())
+        args = json.loads((self.root / "configuration.json").read_text())
+        for arg in ("--release", "--no-codesign", "--config-only", "--obfuscate",
+                    "--split-debug-info=" + str(self.root / "scratch/dart-symbols/ios"),
+                    "ONBOARDING_PUBLIC_ORIGIN=https://flow.example.invalid"):
+            self.assertIn(arg, args)
+        self.assertEqual((self.root / "ios/Podfile.lock").read_text(), "fixture lock\n")
+
+    def test_failed_locked_install_stops_before_flutter_configuration(self):
+        self.env["FAIL_PODS"] = "1"
+        self.assertNotEqual(self.run_preparation().returncode, 0)
+        self.assertTrue((self.root / "ios/pod-called").exists())
+        self.assertFalse((self.root / "configuration.json").exists())
+
+    def test_remote_package_graph_refuses_before_configuration_without_podfile(self):
+        (self.root / "ios/Podfile").unlink()
+        project(self.root, "ios/Runner.xcodeproj", {"remote": {"isa": "XCRemoteSwiftPackageReference"}})
+        self.assertNotEqual(self.run_preparation().returncode, 0)
+        self.assertFalse((self.root / "ios/pod-called").exists())
+        self.assertFalse((self.root / "configuration.json").exists())

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.103
+1.0.105

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.103
+1.0.105

package/backend-action/deploy_evidence.sh

@@ -8,8 +8,9 @@ backend_report_failure() {
     remote_setup|initialize_environment|compose_up|discover_port|local_health|configure_vhost|certificate|public_health) ;;
     *) phase=unclassified ;;
   esac
-  printf '::error title=backend_deploy_failed::{"schema":"gowalk-cicd/backend-deploy-failed.v1",'\
-'"phase":"%s","exit_code":%s}\n' "$phase" "$status"
+  # Multiline JSON secrets can make GitHub mask standalone braces. Keep fixed evidence readable.
+  printf '::error title=backend_deploy_failed::gowalk-cicd/backend-deploy-failed.v1 phase=%s exit_code=%s\n' \
+    "$phase" "$status"
   return "$status"
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.103",
+  "version": "1.0.105",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -149,6 +149,13 @@ jobs:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}
         run: |
           flutter pub get
+          # Even --config-only can query Xcode and run pod install. Pub generates
+          # the Flutter configuration needed by the Podfile without resolving Pods.
+          python3 .github/actions/swift-app/scripts/native_pods.py "$GITHUB_WORKSPACE" \
+            --container ios/Runner.xcworkspace \
+            --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py
+          python3 .github/actions/swift-app/scripts/native_dependency_guard.py "$GITHUB_WORKSPACE" \
+            --container ios/Runner.xcworkspace
           # Flutter removed the synthetic `package:flutter_gen`, so apps that use
           # AppLocalizations now generate real sources. Nothing else generates them,
           # and analyze/compile fail on the missing import if we skip this.