gowalk-cicd 1.0.104 → 1.0.106

package/CLAUDE.md

@@ -12,8 +12,8 @@ Consumer runs `npx gowalk-cicd` and gets:
 - `.github/workflows/deploy-web.yml` — Flutter web release artifact workflow
   (only when `web/index.html` exists)
 
-Re-running the command is both install and update. No scope flag, no
-uninstall. Keep it simple.
+Re-running the installer updates it. `gowalk-cicd release [ios|android|both]` creates the
+explicit source-and-configuration intent; it does not build or upload. Keep this surface small.
 
 ## Structure
 
@@ -264,6 +264,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   Both Flutter configuration and the Pods helper use that bundle in their child process,
   preserving Podfile.lock and the parent job environment. Deliver the workflow wrapper and
   action helper together; action-only updates cannot repair earlier custom configuration steps.
+  Flutter `--config-only` can query Xcode and install Pods before returning. In the workflow,
+  generate Flutter inputs with `pub get`, run the locked `native_pods.py` preparation and
+  completed graph guard, then configure the release with its existing obfuscation/define flags.
+  The graph guard still applies when there is no Podfile. Preserve this order in custom CI.
 - Locked Pod installation retries once only when its own attempt reports curl 18 and a partial-transfer
   symptom. Both attempts share the existing 900-second budget and recheck Podfile, Podfile.lock and
   selected Ruby bundle inputs. TLS/auth/permission, checksum, version and deployment errors never retry.
@@ -385,3 +389,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   refuse before provider work; only exact terminal run/attempt/source proof permits recovery.
   Other packages stay parallel. The GitHub coordination request is fixed-origin and does not
   change the Google account proxy. Update workflow wiring as well as action directories.
+
+- Mobile Deploy watches `.factory/releases/mobile.json`, produced from committed task source and
+  repository variables. Unknown inputs and embedded editors remain in its source proof; native trees
+  are platform-scoped. Backend/web deployments remain independent. Confirmed store uploads are
+  recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
+  An uncertain upload never starts another binary automatically. Preserve its signed artifact,
+  complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
+  Actions without `MOBILE_RELEASE_DEPLOYMENT_ID` preserve legacy consumer behavior. All new
+  receipt helper reads are fixed-origin GitHub requests; Apple/Google still use their assigned exits.

package/README.md

@@ -2,8 +2,8 @@
 
 One installer for iOS TestFlight, Android Google Play, and Flutter web release
 artifacts. It supports native Swift/SwiftUI iOS projects, native Kotlin/Gradle
-Android projects, and Flutter apps. Put the platform keys under `creds/`, push
-to `main`, and the applicable builds run only on GitHub Actions.
+Android projects, and Flutter apps. Provision encrypted repository secrets, validate a
+task candidate, and promote its release intent. Store builds and uploads run only in GitHub Actions.
 
 ## Install
 
@@ -26,19 +26,46 @@ are unaffected.
 
 Re-run the same command anytime to pull the latest version.
 
-Mobile releases run for changes to the app or its release inputs. Documentation,
-marketing, `tools/recovery/`, tests, `.factory/progress/`, backend-only changes and
-the standard validation/web workflows do not upload another mobile binary. Mixed
-commits still release when they change any app input, including embedded editors,
-assets and build scripts. Backend action changes deploy the backend; updating only
-its `.daemux-version` marker does not. Keep runtime assets outside these excluded
-directories, or customize the filters if your build deliberately includes them.
+Mobile delivery requires an explicit frozen release intent. After source, signing, account transport,
+and integration readiness pass, run on the task branch:
 
-These filters take effect after updating and committing the consumer workflow
-files with this installer; CI self-update refreshes action directories only.
-Follow an existing push-triggered release before dispatching another one. Manual
-dispatch remains available after an actual release-input or credential repair;
-it bypasses push path filters and can repeat a successful release.
+```bash
+npx --yes gowalk-cicd release both # or ios / android
+# Inspect and commit this deterministic manifest with the candidate.
+git add -f .factory/releases/mobile.json
+```
+
+Merge the exact validated candidate through the repository's protected PR. Only a change to
+`.factory/releases/mobile.json` triggers Mobile Deploy on main. Ordinary checkpoint, backend,
+web, documentation and tooling landings do not trigger a store build. Backend and web retain
+their own workflows. Web compilation no longer starts just because a plugin version marker changed.
+
+The intent binds committed source and a digest of repository variables. A changed source input
+or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
+and Android directories are scoped to their own platform. Unknown inputs, embedded editors,
+assets, scripts, dependency locks and backend-generated resources remain in the conservative
+source fingerprint. There is no blanket editor/backend exclusion from the input proof.
+
+The gate records each platform in GitHub deployment receipts, scoped to that input fingerprint.
+A confirmed upload is reused on subsequent attempts and emits `mobile_upload_reused` with the
+original run/attempt/source. Read that run's annotations and current store state: upload reuse
+still requires unfinished metadata, symbols, policy replies and review submission to be completed
+through the existing scoped commands. It never proves store review approval.
+
+Store-upload intent is persisted before provider writes, and success immediately after the uploader
+confirms. An interrupted upload refuses another build: inspect the retained signed binary/upload
+receipt and read back its exact version with the account-pinned store tooling. Resume that same
+upload when necessary. After positive upload readback, reconcile the named GitHub deployment to
+`success` with description `uploaded`, retaining the provider evidence in the app task. Never clear
+an uncertain receipt based on elapsed time or a missing response. A terminal attempt that failed
+before the upload marker may retry. Rerun the whole workflow so admission and platform jobs share
+one run attempt; a failed-jobs-only rerun with an older admission receipt refuses.
+
+Mobile runs serialize without cancelling an in-flight upload. Manual dispatch obeys the same
+intent and receipts; it cannot silently rebuild an already-uploaded input. Feature-branch dispatch
+retains backend preview, while store delivery requires the default branch's validated intent.
+Existing consumer workflows keep their behavior until deliberately adopting this template;
+action-only updates do not change triggers. Preserve custom build inputs and readiness when adopting.
 
 Flutter's optional SDK and pub cache restores have a one-minute timeout per
 download segment. A slow segment becomes a cache miss and normal SDK setup
@@ -58,6 +85,12 @@ When adopting this update, retain the `native_bundle.py` configuration wrapper i
 custom workflows as well as updating the action files. Apps without a Gemfile keep
 their existing CocoaPods runtime.
 
+Flutter `--config-only` can query Xcode and invoke `pod install`. The workflow first
+runs `flutter pub get` to generate the Podfile's Flutter inputs, then installs locked
+Pods and verifies the selected workspace before release configuration. Preserve this
+order in customized validation and deployment workflows; updating action directories
+alone cannot repair a configuration step that runs before the action.
+
 ## Flutter web release
 
 The conditional `deploy-web.yml` workflow runs on changes to Flutter source,
@@ -321,6 +354,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
+| `mobile_upload_reused` | `gowalk-cicd/mobile-upload-reused.v1` | `platform`, `fingerprint`, `run_id`, `run_attempt`, `source_sha`, `deployment_id`, `next_action` |
 | `source_maintenance_pending` | `gowalk-cicd/source-maintenance-pending.v1` | `repo`, `base_sha`, `head_sha`, `branch`, `run_id` |
 | `apple_build_upload_failed` (error) | `gowalk-cicd/apple-build-upload-failed.v2` | `category`, `stage`, `receipt_available`, receipt identifiers (`cfBundleVersion`, `upload_id`, `file_id`, `state`, `provider_status`, `provider_code`, `provider_pointer`), `action` |
 | `flutter_download_failed` (error) | `gowalk-cicd/flutter-download-failed.v1` | `phase`, `curl_exit`, `http_status`, `proxy_status`, `attempts`, `retained_bytes` |
@@ -1061,10 +1095,9 @@ on a verified task branch (under both `.github/actions/swift-app/` and
 | Candidates | Action updates and later version changes have separate verified receipts |
 | Failure mode | npm discovery remains optional; unconfirmed source preservation fails the job |
 
-The shipped `deploy.yml` template already includes the required
-`paths-ignore` entries for both action directories. If you have an
-older `deploy.yml` checked in, add both entries to prevent the
-tooling-only source landing from re-triggering the mobile workflow.
+The shipped `deploy.yml` watches only the frozen release intent. Adopting an action-directory
+update on its own therefore does not launch another mobile upload. Review and adopt the template
+as well as the action directories to enable this behavior in an existing consumer.
 
 ### deploy.yml is not auto-updated
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.104
+1.0.106

package/action/action.yml

@@ -718,6 +718,11 @@ runs:
         path: ${{ runner.temp }}/firebase-symbols/
         if-no-files-found: ignore
 
+    - name: Record iOS upload intent
+      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
+      shell: bash
+      run: node "$SWIFT_APP_ACTION/scripts/mobile_release.cjs" begin-upload ios
+
     - name: Upload to TestFlight
       id: upload
       if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
@@ -729,6 +734,11 @@ runs:
         python3 "$SWIFT_APP_ACTION/scripts/upload_build.py" "$IPA" \
           --report "$RUNNER_TEMP/apple-build-upload.json"
 
+    - name: Record confirmed iOS upload
+      if: ${{ steps.upload.outcome == 'success' }}
+      shell: bash
+      run: node "$SWIFT_APP_ACTION/scripts/mobile_release.cjs" finish-upload ios
+
     - name: Retain Apple upload receipt
       if: ${{ always() && inputs.archive == 'true' && inputs.upload == 'true' }}
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4

package/action/scripts/mobile_inputs.cjs

@@ -0,0 +1,55 @@
+/* Frozen mobile build inputs. Unknown source paths remain inputs, including embedded editors. */
+'use strict';
+const {execFileSync} = require('node:child_process');
+const {createHash} = require('node:crypto');
+const fs = require('node:fs');
+const INTENT = '.factory/releases/mobile.json';
+const SCHEMA = 'gowalk-cicd/mobile-release.v1';
+const git = (...args) => execFileSync('git', args, {encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']});
+const digest = value => createHash('sha256').update(value).digest('hex');
+
+function input(name, platform) {
+  if (name === INTENT || name.startsWith('.factory/progress/') || name.startsWith('creds/')) return false;
+  if (/^(README|CHANGELOG|AGENTS|CLAUDE)\.md$/.test(name) || /^docs\/.*\.md$/.test(name)) return false;
+  if (platform === 'ios' && name.startsWith('android/')) return false;
+  if (platform === 'android' && name.startsWith('ios/')) return false;
+  // Backend and web deployment alone never promote a mobile release. Their source
+  // remains in this conservative fingerprint in case the app embeds or generates it.
+  return true;
+}
+
+function configuration(value = {}) {
+  return digest(JSON.stringify(Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)))));
+}
+
+function fingerprint(platform, ref = 'HEAD') {
+  if (!['ios', 'android'].includes(platform)) throw Error('mobile_release_platform_invalid');
+  return digest(git('ls-tree', '-r', '-z', ref).split('\0').filter(row =>
+    row && input(row.slice(row.indexOf('\t') + 1), platform)).sort().join('\0'));
+}
+
+function create(platforms = ['ios', 'android'], variables = {}) {
+  if (['main', 'master', ''].includes(git('branch', '--show-current').trim())) {
+    throw Error('mobile_release_task_branch_required');
+  }
+  const dirty = git('status', '--porcelain', '-z', '--untracked-files=all').split('\0').filter(Boolean);
+  if (dirty.some(row => row.slice(3) !== INTENT)) throw Error('mobile_release_source_not_committed');
+  const manifest = {schema: SCHEMA, configuration_sha256: configuration(variables),
+    platforms: Object.fromEntries(platforms.map(p => [p, fingerprint(p)]))};
+  fs.mkdirSync('.factory/releases', {recursive: true});
+  fs.writeFileSync(INTENT, JSON.stringify(manifest, null, 2) + '\n');
+  return {ok: true, file: INTENT, ...manifest};
+}
+
+function read(variables = {}) {
+  const manifest = JSON.parse(fs.readFileSync(INTENT, 'utf8'));
+  if (manifest.configuration_sha256 !== configuration(variables)) throw Error('mobile_release_configuration_changed');
+  if (manifest.schema !== SCHEMA || !manifest.platforms || !Object.keys(manifest.platforms).length ||
+      Object.entries(manifest.platforms).some(([p, sha]) =>
+        !['ios', 'android'].includes(p) || !/^[a-f0-9]{64}$/.test(sha))) throw Error('mobile_release_intent_invalid');
+  for (const [p, sha] of Object.entries(manifest.platforms)) {
+    if (fingerprint(p) !== sha) throw Error('mobile_release_intent_stale');
+  }
+  return manifest;
+}
+module.exports = {INTENT, SCHEMA, input, fingerprint, create, read, configuration};

package/action/scripts/mobile_release.cjs

@@ -0,0 +1,97 @@
+/* An explicit source intent admits each platform once; uncertain uploads never replay automatically. */
+'use strict';
+const fs = require('node:fs');
+const inputs = require('./mobile_inputs.cjs');
+const api = require('./mobile_release_api.cjs');
+const SCHEMA = 'gowalk-cicd/mobile-upload-owner.v1';
+
+function owner(platform, fingerprint) {
+  return {schema: SCHEMA, platform, fingerprint, run_id: Number(process.env.GITHUB_RUN_ID),
+    run_attempt: Number(process.env.GITHUB_RUN_ATTEMPT), source_sha: process.env.GITHUB_SHA};
+}
+
+async function reusable(record, expected) {
+  const payload = record.payload;
+  if (payload?.schema !== SCHEMA || payload.platform !== expected.platform ||
+      payload.fingerprint !== expected.fingerprint || !Number.isSafeInteger(payload.run_id) ||
+      !Number.isSafeInteger(payload.run_attempt) || !/^[a-f0-9]{40}$/.test(payload.source_sha)) {
+    throw Error('mobile_release_previous_owner_invalid');
+  }
+  const run = await api.request('GET', `/actions/runs/${payload.run_id}/attempts/${payload.run_attempt}`);
+  if (run.head_sha !== payload.source_sha || run.path !== '.github/workflows/deploy.yml') {
+    throw Error('mobile_release_previous_run_unverified');
+  }
+  const statuses = await api.request('GET', `/deployments/${record.id}/statuses?per_page=1`);
+  const last = statuses[0];
+  if (last?.state === 'success' && last.description === 'uploaded') {
+    console.log('::notice title=mobile_upload_reused::' + JSON.stringify({schema: 'gowalk-cicd/mobile-upload-reused.v1',
+      platform: expected.platform, fingerprint: expected.fingerprint, run_id: payload.run_id,
+      run_attempt: payload.run_attempt, source_sha: payload.source_sha, deployment_id: record.id,
+      next_action: 'Read prior run annotations and current store state; finish pending metadata and review work'}));
+    return true;
+  }
+  if (run.status !== 'completed') throw Error('mobile_release_owner_busy_or_unverified');
+  // No upload marker means that terminal attempt never crossed the store-write boundary.
+  if (!last || last.description === 'building') return false;
+  throw Error('mobile_release_upload_unconfirmed_read_back_retained_binary_before_retry');
+}
+
+async function admit(platforms = 'both') {
+  if (!['both', 'ios', 'android'].includes(platforms)) throw Error('mobile_release_platform_invalid');
+  const manifest = inputs.read(JSON.parse(process.env.MOBILE_RELEASE_VARIABLES || '{}'));
+  const selected = {};
+  for (const [platform, source] of Object.entries(manifest.platforms)) {
+    const fingerprint = require('node:crypto').createHash('sha256')
+      .update(source + manifest.configuration_sha256).digest('hex');
+    if (platforms !== 'both' && platforms !== '' && platforms !== platform) continue;
+    const expected = owner(platform, fingerprint);
+    const environment = `mobile-${platform}-${fingerprint}`;
+    const records = await api.request('GET', `/deployments?environment=${environment}&per_page=100`);
+    if (!Array.isArray(records) || records.length >= 100) throw Error('mobile_release_inventory_unbounded');
+    if (records.length && await reusable(records[0], expected)) continue;
+    const record = await api.request('POST', '/deployments', {ref: process.env.GITHUB_SHA,
+      auto_merge: false, required_contexts: [], environment, task: 'mobile-upload', payload: expected,
+      transient_environment: false, production_environment: true});
+    if (!Number.isSafeInteger(record.id) || record.sha !== expected.source_sha) {
+      throw Error('mobile_release_owner_write_unconfirmed');
+    }
+    await api.status(record.id, 'building');
+    selected[platform] = record.id;
+  }
+  return selected;
+}
+
+async function phase(action, platform) {
+  const id = Number(process.env.MOBILE_RELEASE_DEPLOYMENT_ID);
+  if (!id) return; // Existing consumers without release-intent wiring keep their original behavior.
+  const record = await api.request('GET', `/deployments/${id}`);
+  const expected = owner(platform, record.payload?.fingerprint);
+  if (record.payload?.schema !== SCHEMA || record.payload.run_id !== expected.run_id ||
+      record.payload.run_attempt !== expected.run_attempt || record.sha !== expected.source_sha ||
+      record.payload.platform !== platform) throw Error('mobile_release_phase_owner_mismatch');
+  const statuses = await api.request('GET', `/deployments/${id}/statuses?per_page=1`);
+  const required = action === 'begin-upload' ? 'building' : 'uploading';
+  if (statuses[0]?.description !== required) throw Error('mobile_release_upload_phase_unconfirmed');
+  await api.status(id, action === 'begin-upload' ? 'uploading' : 'uploaded',
+                   action === 'begin-upload' ? 'in_progress' : 'success');
+}
+
+async function main(args) {
+  if (args[0] === 'admit') {
+    const selected = await admit(args[1] || 'both');
+    for (const platform of ['ios', 'android']) {
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `${platform}=${selected[platform] || ''}\n`);
+    }
+    return;
+  }
+  if (['begin-upload', 'finish-upload'].includes(args[0]) && ['ios', 'android'].includes(args[1])) {
+    return phase(args[0], args[1]);
+  }
+  throw Error('mobile_release_command_invalid');
+}
+if (require.main === module) main(process.argv.slice(2)).catch(error => {
+  const code = /^mobile_release_[a-z0-9_]+$/.test(error.message) ? error.message : 'mobile_release_unavailable';
+  console.error(`::error title=mobile_release_refused::${code}`);
+  process.exitCode = 1;
+});
+module.exports = {owner, reusable, admit, phase};

package/action/scripts/mobile_release_api.cjs

@@ -0,0 +1,38 @@
+/* Repository-local GitHub deployment receipts; never a store credential or transport. */
+'use strict';
+const https = require('node:https');
+
+function request(method, path, body) {
+  const repo = process.env.GITHUB_REPOSITORY;
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo || '') || !path.startsWith('/') || path.includes('..')) {
+    throw Error('mobile_release_repository_invalid');
+  }
+  const data = body === undefined ? null : JSON.stringify(body);
+  return new Promise((resolve, reject) => {
+    const req = https.request({hostname: 'api.github.com', path: `/repos/${repo}${path}`, method,
+      headers: {'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json',
+        Authorization: `Bearer ${process.env.GITHUB_TOKEN || ''}`, 'X-GitHub-Api-Version': '2022-11-28',
+        ...(data ? {'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data)} : {})}}, res => {
+      let text = '';
+      res.on('data', chunk => { text += chunk; if (text.length > 4 * 1024 * 1024) res.destroy(); });
+      res.on('error', () => reject(Error('mobile_release_receipt_read_unavailable')));
+      res.on('end', () => {
+        if (res.statusCode < 200 || res.statusCode >= 300) {
+          return reject(Error(`mobile_release_http_${res.statusCode}`));
+        }
+        try { resolve(JSON.parse(text)); } catch { reject(Error('mobile_release_receipt_invalid')); }
+      });
+    });
+    req.setTimeout(30000, () => req.destroy(Error('timeout')));
+    req.on('error', () => reject(Error('mobile_release_receipt_transport_unconfirmed')));
+    req.end(data);
+  });
+}
+
+async function status(id, phase, state = 'in_progress') {
+  const result = await request('POST', `/deployments/${id}/statuses`, {state, description: phase, auto_inactive: false,
+    log_url: `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`});
+  if (result.state !== state || result.description !== phase) throw Error('mobile_release_receipt_unconfirmed');
+  return result;
+}
+module.exports = {request, status};

package/action/scripts/test_flutter_native_preparation.py

@@ -0,0 +1,107 @@
+"""Execute the shipped Flutter preparation shell with real guards and offline tool fixtures."""
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import textwrap
+import unittest
+
+import native_bundle
+from test_native_dependency_guard import project
+
+REPO = Path(__file__).resolve().parents[2]
+
+
+class FlutterPreparationTests(unittest.TestCase):
+    def setUp(self):
+        temporary = tempfile.TemporaryDirectory(prefix="flutter-native-preparation-")
+        self.addCleanup(temporary.cleanup)
+        self.root = Path(temporary.name).resolve()
+        project(self.root, "ios/Runner.xcodeproj")
+        workspace = self.root / "ios/Runner.xcworkspace"
+        workspace.mkdir()
+        (workspace / "contents.xcworkspacedata").write_text(
+            '<Workspace><FileRef location="group:Runner.xcodeproj"/></Workspace>')
+        for name in ("Podfile", "Podfile.lock"):
+            (self.root / "ios" / name).write_text("fixture lock\n")
+        (self.root / "pubspec.yaml").write_text("name: fixture\n")
+        for argv in (["git", "init", "-q"], ["git", "add", "."],
+                     ["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                      "commit", "-qm", "Freeze native fixture"]):
+            subprocess.run(argv, cwd=self.root, capture_output=True, check=True)
+        actions = self.root / ".github/actions"
+        actions.mkdir(parents=True)
+        (actions / "swift-app").symlink_to(REPO / "action", target_is_directory=True)
+        (actions / "android-app").symlink_to(REPO / "android-action", target_is_directory=True)
+        self.env = {**os.environ, "PATH": str(self.root) + os.pathsep + os.environ["PATH"],
+                    "GITHUB_WORKSPACE": str(self.root), "RUNNER_TEMP": str(self.root / "scratch"),
+                    "ONBOARDING_PUBLIC_ORIGIN": "https://flow.example.invalid",
+                    "GOOGLE_STORE_PROXY_URL": "http://fixture:PRIVATE_SENTINEL@127.0.0.1:9"}
+        self.install_tools()
+
+    def executable(self, name, source):
+        path = self.root / name
+        path.write_text("#!" + sys.executable + "\n" + textwrap.dedent(source))
+        path.chmod(0o700)
+
+    def install_tools(self):
+        self.executable("flutter", '''
+            import json,sys
+            from pathlib import Path
+            if sys.argv[1:3] == ["pub", "get"]:
+                folder=Path("ios/Flutter");folder.mkdir()
+                (folder/"Generated.xcconfig").write_text("generated")
+            elif sys.argv[1:3] == ["build", "ios"]:
+                Path("configuration.json").write_text(json.dumps(sys.argv[1:]))
+                assert Path("ios/pods-ready").is_file(), "Configuration reached before locked Pods"
+            else:
+                raise SystemExit(9)
+        ''')
+        self.executable("pod", '''
+            import json,os,sys
+            from pathlib import Path
+            assert Path("Flutter/Generated.xcconfig").is_file()
+            assert sys.argv[1:] == ["install", "--deployment", "--no-repo-update"]
+            assert os.environ["HTTPS_PROXY"].startswith("http://127.0.0.1:")
+            Path("pod-called").touch()
+            if os.environ.get("FAIL_PODS"):
+                raise SystemExit(7)
+            Path("pods-ready").touch()
+        ''')
+
+    def run_preparation(self):
+        body = (REPO / "templates/deploy.yml").read_text().split(
+            "- name: Prepare Flutter iOS project\n", 1)[1].split("\n      - ", 1)[0]
+        script = textwrap.dedent(body.split("        run: |\n", 1)[1])
+        result = subprocess.run([sys.executable, native_bundle.__file__, "--folder", "ios",
+                                 "--proxy-helper", str(REPO / "android-action/scripts/play_store_proxy.py"),
+                                 "--", "bash", "--noprofile", "--norc", "-e", "-o", "pipefail", "-c", script],
+                                cwd=self.root, env=self.env, capture_output=True, text=True, timeout=20)
+        self.assertNotIn("PRIVATE_SENTINEL", result.stdout + result.stderr)
+        return result
+
+    def test_locked_pods_precede_configuration_without_losing_release_arguments(self):
+        result = self.run_preparation()
+        self.assertEqual(result.returncode, 0, result.stdout)
+        self.assertTrue((self.root / "ios/pod-called").exists())
+        args = json.loads((self.root / "configuration.json").read_text())
+        for arg in ("--release", "--no-codesign", "--config-only", "--obfuscate",
+                    "--split-debug-info=" + str(self.root / "scratch/dart-symbols/ios"),
+                    "ONBOARDING_PUBLIC_ORIGIN=https://flow.example.invalid"):
+            self.assertIn(arg, args)
+        self.assertEqual((self.root / "ios/Podfile.lock").read_text(), "fixture lock\n")
+
+    def test_failed_locked_install_stops_before_flutter_configuration(self):
+        self.env["FAIL_PODS"] = "1"
+        self.assertNotEqual(self.run_preparation().returncode, 0)
+        self.assertTrue((self.root / "ios/pod-called").exists())
+        self.assertFalse((self.root / "configuration.json").exists())
+
+    def test_remote_package_graph_refuses_before_configuration_without_podfile(self):
+        (self.root / "ios/Podfile").unlink()
+        project(self.root, "ios/Runner.xcodeproj", {"remote": {"isa": "XCRemoteSwiftPackageReference"}})
+        self.assertNotEqual(self.run_preparation().returncode, 0)
+        self.assertFalse((self.root / "ios/pod-called").exists())
+        self.assertFalse((self.root / "configuration.json").exists())

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.104
+1.0.106

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.104
+1.0.106

package/bin/cli.mjs

@@ -21,6 +21,22 @@ async function loadNotifier() {
 }
 
 const args = process.argv.slice(2);
+if (args[0] === 'release') {
+  const platform = args[1] || 'both';
+  if (args.length > 2 || !['ios', 'android', 'both'].includes(platform)) {
+    console.error('Usage: gowalk-cicd release [ios|android|both]');
+    process.exit(2);
+  }
+  const {release} = await import('../src/release.mjs');
+  try {
+    console.log(JSON.stringify(release(platform)));
+    process.exit(0);
+  } catch (error) {
+    const code = /^mobile_release_[a-z_]+$/.test(error.message) ? error.message : 'mobile_release_prepare_unavailable';
+    console.error(code);
+    process.exit(1);
+  }
+}
 let dryRun = false;
 
 for (const arg of args) {
@@ -44,6 +60,7 @@ What it writes:
   .github/workflows/deploy-web.yml - Flutter web release workflow when web/ exists
 
 Options:
+  release [ios|android|both]  Prepare a frozen mobile release intent on the task branch
   --dry-run        Print what would happen without writing files
   -v, --version    Show version number
   -h, --help       Show this help message
@@ -53,10 +70,10 @@ Examples:
   npx --yes gowalk-cicd --dry-run
 
 After install:
-  1. Place your App Store Connect API key at creds/AuthKey_<KEY_ID>_Issuer_<UUID>.p8
-  2. Add the Android upload keystore, signing properties, and Play service account
-  3. Make the repo PRIVATE (credentials are read from creds/)
-  4. Commit + push to main -- CI builds both platforms`);
+  1. Provision repository secrets through your account-scoped tooling
+  2. Finish source and readiness checks on the protected task branch
+  3. Run gowalk-cicd release, then commit .factory/releases/mobile.json
+  4. Merge the validated candidate; its release intent admits the selected stores`);
       process.exit(0);
     case '--dry-run':
       dryRun = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.104",
+  "version": "1.0.106",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -219,7 +219,7 @@ function printSummary() {
   console.log('    GOOGLE_PLAY_SERVICE_ACCOUNT_JSON');
   console.log('  The workflow materializes them with mode 0600 only on its ephemeral runner.');
   console.log('  Existing checkout credentials remain a backward-compatible fallback.');
-  console.log('  Push to main after configuring the secrets; GitHub Actions builds both platforms.');
+  console.log('  Validate committed task source, run gowalk-cicd release, and merge its frozen intent through a PR.');
   console.log('');
   console.log('Re-run this installer anytime to update the vendored action:');
   console.log('  npx --yes gowalk-cicd');

package/src/release.mjs

@@ -0,0 +1,16 @@
+// Freeze committed source and the repository variables the workflow will actually read.
+import {execFileSync} from 'node:child_process';
+import inputs from '../action/scripts/mobile_inputs.cjs';
+
+export function release(platform) {
+  const execute = (command, args) => execFileSync(command, args, {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 60000,
+  }).trim();
+  const remote = execute('git', ['remote', 'get-url', 'origin']);
+  const match = /^(?:git@github\.com:|https:\/\/github\.com\/)([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(remote);
+  if (!match) throw Error('mobile_release_repository_unverified');
+  const pages = JSON.parse(execute('gh', ['api', `repos/${match[1]}/actions/variables?per_page=100`,
+    '--paginate', '--slurp']));
+  const variables = Object.fromEntries(pages.flatMap(page => page.variables).map(row => [row.name, row.value]));
+  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables);
+}

package/templates/deploy-web.yml

@@ -10,7 +10,6 @@ on:
       - 'pubspec.lock'
       - 'l10n.yaml'
       - 'analysis_options.yaml'
-      - '.github/actions/*/.daemux-version'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
 

package/templates/deploy.yml

@@ -2,41 +2,38 @@ name: Mobile Deploy
 on:
   push:
     branches: [main]
-    paths-ignore:
-      - '**/*.md'
-      - '.gitignore'
-      - 'creds/**'
-      # Durable task records and independently deployed backend sources do not
-      # change a native binary. Mixed commits still run when any mobile input changes.
-      - '.factory/progress/**'
-      - 'docs/**'
-      - 'marketing/**'
-      - 'tools/recovery/**'
-      - 'test/**'
-      - 'tests/**'
-      - 'integration_test/**'
-      - 'backend/**'
-      - 'server/**'
-      - 'docker-compose.yml'
-      - '.github/workflows/deploy-backend.yml'
-      - '.github/workflows/deploy-web.yml'
-      - '.github/workflows/flutter-ci.yml'
-      - '.github/workflows/ios-ci.yml'
-      - '.github/actions/swift-app/**'
-      - '.github/actions/android-app/**'
-      - '.github/actions/backend-app/**'
+    paths:
+      - '.factory/releases/mobile.json'
   workflow_dispatch:
 
 permissions:
   contents: write
   actions: read
   models: read
+  deployments: write
 
 concurrency:
   group: mobile-deploy-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
+  release:
+    name: Admit frozen mobile release
+    if: ${{ github.ref_name == github.event.repository.default_branch }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      ios: ${{ steps.intent.outputs.ios }}
+      android: ${{ steps.intent.outputs.android }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Verify release intent and prior upload receipts
+        id: intent
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          DEPLOY_PLATFORMS: ${{ vars.DEPLOY_PLATFORMS || 'both' }}
+          MOBILE_RELEASE_VARIABLES: ${{ toJSON(vars) }}
+        run: node .github/actions/swift-app/scripts/mobile_release.cjs admit "$DEPLOY_PLATFORMS"
   # Repository variable DEPLOY_PLATFORMS selects which stores this repo ships to:
   #   unset / 'both' — iOS and Android (the default)
   #   'android'      — Android only; skip the iOS job entirely
@@ -44,11 +41,14 @@ jobs:
   # Use it when one platform is intentionally out of scope for a repo, so an
   # unrelated failure on the other platform cannot block the release you want.
   ios:
+    needs: release
     name: iOS TestFlight
     env:
+      MOBILE_RELEASE_DEPLOYMENT_ID: ${{ needs.release.outputs.ios }}
+      GITHUB_TOKEN: ${{ github.token }}
       APPLE_STORE_PROXY_URL: ${{ secrets.APPLE_STORE_PROXY_URL }}
       GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
-    if: ${{ vars.DEPLOY_PLATFORMS != 'android' }}
+    if: ${{ needs.release.outputs.ios != '' }}
     runs-on: macos-15
     timeout-minutes: 60
     steps:
@@ -149,6 +149,13 @@ jobs:
           ONBOARDING_PUBLIC_ORIGIN: ${{ vars.ONBOARDING_PUBLIC_ORIGIN }}
         run: |
           flutter pub get
+          # Even --config-only can query Xcode and run pod install. Pub generates
+          # the Flutter configuration needed by the Podfile without resolving Pods.
+          python3 .github/actions/swift-app/scripts/native_pods.py "$GITHUB_WORKSPACE" \
+            --container ios/Runner.xcworkspace \
+            --proxy-helper .github/actions/android-app/scripts/play_store_proxy.py
+          python3 .github/actions/swift-app/scripts/native_dependency_guard.py "$GITHUB_WORKSPACE" \
+            --container ios/Runner.xcworkspace
           # Flutter removed the synthetic `package:flutter_gen`, so apps that use
           # AppLocalizations now generate real sources. Nothing else generates them,
           # and analyze/compile fail on the missing import if we skip this.
@@ -240,11 +247,14 @@ jobs:
           if-no-files-found: error
 
   android:
+    needs: release
     name: Android Google Play
     env:
+      MOBILE_RELEASE_DEPLOYMENT_ID: ${{ needs.release.outputs.android }}
+      GITHUB_TOKEN: ${{ github.token }}
       GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
       PLAY_EDIT_BINDING: ${{ vars.APP_ROBOT_PLAY_EDIT_BINDING }}
-    if: ${{ vars.DEPLOY_PLATFORMS != 'ios' }}
+    if: ${{ needs.release.outputs.android != '' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -286,12 +296,19 @@ jobs:
           fi
 
       # --- Bitrise mode ---------------------------------------------------
+      - name: Record Bitrise upload intent
+        if: ${{ steps.mode.outputs.mode == 'bitrise' }}
+        run: node .github/actions/swift-app/scripts/mobile_release.cjs begin-upload android
       - name: Deploy Android via Bitrise
+        id: bitrise
         if: ${{ steps.mode.outputs.mode == 'bitrise' }}
         shell: bash
         env:
           BITRISE_API_TOKEN: ${{ secrets.BITRISE_API_TOKEN }}
         run: python3 .github/actions/android-app/scripts/bitrise_deploy.py
+      - name: Record confirmed Bitrise delivery
+        if: ${{ steps.bitrise.outcome == 'success' }}
+        run: node .github/actions/swift-app/scripts/mobile_release.cjs finish-upload android
 
       # --- Local mode -----------------------------------------------------
       # Native Gradle apps must not pay for a Flutter install, and their AGP
@@ -522,6 +539,9 @@ jobs:
       # The wrapper verifies the unchanged pinned official uploader and classifies
       # its immediate result. Only explicit expired/deleted edits retry normally;
       # only Play's explicit review-hold refusal changes the review flag.
+      - name: Record Android upload intent
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
+        run: node .github/actions/swift-app/scripts/mobile_release.cjs begin-upload android
       - name: Upload Android release to Google Play
         id: play-upload
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
@@ -540,6 +560,10 @@ jobs:
           whatsNewDirectory: ${{ hashFiles('distribution/whatsnew/**') != '' && 'distribution/whatsnew' || '' }}
 
       # The retry landed the bundle without submitting it. That is a fact for
+      - name: Record confirmed Android upload
+        if: ${{ steps.play-upload.outcome == 'success' }}
+        run: node .github/actions/swift-app/scripts/mobile_release.cjs finish-upload android
+
       # the panel that merged this commit, not a chore for a person: the panel
       # reads this typed check-run annotation off the job (title + JSON with a
       # versioned schema, never the log text) and opens its own Play console