gowalk-cicd 1.0.106 → 1.0.107

package/README.md

@@ -40,11 +40,12 @@ Merge the exact validated candidate through the repository's protected PR. Only
 web, documentation and tooling landings do not trigger a store build. Backend and web retain
 their own workflows. Web compilation no longer starts just because a plugin version marker changed.
 
-The intent binds committed source and a digest of repository variables. A changed source input
-or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
+The intent binds committed source and effective organization/repository variables, with repository
+precedence. A changed source input or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
 and Android directories are scoped to their own platform. Unknown inputs, embedded editors,
 assets, scripts, dependency locks and backend-generated resources remain in the conservative
-source fingerprint. There is no blanket editor/backend exclusion from the input proof.
+source fingerprint. Documents remain inputs because an app may bundle them. There is no blanket
+editor/backend exclusion from the input proof. These conservative hashes do not add push triggers.
 
 The gate records each platform in GitHub deployment receipts, scoped to that input fingerprint.
 A confirmed upload is reused on subsequent attempts and emits `mobile_upload_reused` with the

package/action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.107

package/action/scripts/mobile_inputs.cjs

@@ -10,7 +10,8 @@ const digest = value => createHash('sha256').update(value).digest('hex');
 
 function input(name, platform) {
   if (name === INTENT || name.startsWith('.factory/progress/') || name.startsWith('creds/')) return false;
-  if (/^(README|CHANGELOG|AGENTS|CLAUDE)\.md$/.test(name) || /^docs\/.*\.md$/.test(name)) return false;
+  // Documents may be bundled resources or test inputs. Promotion is explicit, so
+  // retaining them here cannot make an ordinary documentation push deploy mobile.
   if (platform === 'ios' && name.startsWith('android/')) return false;
   if (platform === 'android' && name.startsWith('ios/')) return false;
   // Backend and web deployment alone never promote a mobile release. Their source

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.107

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.107

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.106",
+  "version": "1.0.107",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/release.mjs

@@ -2,6 +2,29 @@
 import {execFileSync} from 'node:child_process';
 import inputs from '../action/scripts/mobile_inputs.cjs';
 
+export function variables(repository, execute) {
+  const info = JSON.parse(execute('gh', ['api', `repos/${repository}`]));
+  if (info.full_name !== repository || !['User', 'Organization'].includes(info.owner?.type)) {
+    throw Error('mobile_release_repository_unverified');
+  }
+  const scopes = info.owner.type === 'Organization' ? ['organization-variables', 'variables'] : ['variables'];
+  const result = {};
+  for (const scope of scopes) {
+    const pages = JSON.parse(execute('gh', ['api', `repos/${repository}/actions/${scope}?per_page=100`,
+      '--paginate', '--slurp']));
+    if (!Array.isArray(pages) || pages.some(page => !Array.isArray(page.variables))) {
+      throw Error('mobile_release_configuration_unverified');
+    }
+    for (const row of pages.flatMap(page => page.variables)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(row.name) || typeof row.value !== 'string') {
+        throw Error('mobile_release_configuration_unverified');
+      }
+      result[row.name] = row.value;
+    }
+  }
+  return result;
+}
+
 export function release(platform) {
   const execute = (command, args) => execFileSync(command, args, {
     encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 60000,
@@ -9,8 +32,5 @@ export function release(platform) {
   const remote = execute('git', ['remote', 'get-url', 'origin']);
   const match = /^(?:git@github\.com:|https:\/\/github\.com\/)([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(remote);
   if (!match) throw Error('mobile_release_repository_unverified');
-  const pages = JSON.parse(execute('gh', ['api', `repos/${match[1]}/actions/variables?per_page=100`,
-    '--paginate', '--slurp']));
-  const variables = Object.fromEntries(pages.flatMap(page => page.variables).map(row => [row.name, row.value]));
-  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables);
+  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables(match[1], execute));
 }