gowalk-cicd 1.0.106 → 1.0.108

package/CLAUDE.md

@@ -188,10 +188,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   URL/pin/schema/release fields are checked before reuse. Blank, wildcard and version-file inputs
   resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
   account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
-- Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
-  to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
-  caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
-  The cache-only preloader also admits the pinned `restore-only`/`save-only` entrypoints.
+- Gradle caches use checksum-pinned restore/save actions, each optional and bounded to two minutes.
+  Preserve setup-java's complete keys, inputs and absolute paths; restore the same OS/architecture prefix.
+  Failed releases save distinct partial keys unless cancelled; completed keys require success. Builds remain required.
+  Only pinned cache entrypoints get cache transport; see [cache behavior](docs/GRADLE_CACHE.md) before adoption.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;

package/README.md

@@ -40,11 +40,12 @@ Merge the exact validated candidate through the repository's protected PR. Only
 web, documentation and tooling landings do not trigger a store build. Backend and web retain
 their own workflows. Web compilation no longer starts just because a plugin version marker changed.
 
-The intent binds committed source and a digest of repository variables. A changed source input
-or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
+The intent binds committed source and effective organization/repository variables, with repository
+precedence. A changed source input or compiled variable refuses before builds; prepare a new intent after the repair. Native iOS
 and Android directories are scoped to their own platform. Unknown inputs, embedded editors,
 assets, scripts, dependency locks and backend-generated resources remain in the conservative
-source fingerprint. There is no blanket editor/backend exclusion from the input proof.
+source fingerprint. Documents remain inputs because an app may bundle them. There is no blanket
+editor/backend exclusion from the input proof. These conservative hashes do not add push triggers.
 
 The gate records each platform in GitHub deployment receipts, scoped to that input fingerprint.
 A confirmed upload is reused on subsequent attempts and emits `mobile_upload_reused` with the

package/action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.108

package/action/scripts/mobile_inputs.cjs

@@ -10,7 +10,8 @@ const digest = value => createHash('sha256').update(value).digest('hex');
 
 function input(name, platform) {
   if (name === INTENT || name.startsWith('.factory/progress/') || name.startsWith('creds/')) return false;
-  if (/^(README|CHANGELOG|AGENTS|CLAUDE)\.md$/.test(name) || /^docs\/.*\.md$/.test(name)) return false;
+  // Documents may be bundled resources or test inputs. Promotion is explicit, so
+  // retaining them here cannot make an ordinary documentation push deploy mobile.
   if (platform === 'ios' && name.startsWith('android/')) return false;
   if (platform === 'android' && name.startsWith('ios/')) return false;
   // Backend and web deployment alone never promote a mobile release. Their source

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.108

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.106
+1.0.108

package/docs/GRADLE_CACHE.md

@@ -0,0 +1,32 @@
+# Gradle dependency retention
+
+The mobile release workflow retains completed dependency downloads even when its build or a
+later store operation fails. Both cache operations remain optional and bounded to two minutes;
+a cache result cannot turn a failed build or upload green. Cancelled jobs and workflows reusing
+a confirmed upload do not save Gradle caches.
+
+Successful jobs preserve the original setup-java complete key, dependency inputs and absolute
+cache paths. Failed jobs save a distinct `-partial-<run_id>-<attempt>` suffix instead, so a
+partial download cannot occupy the immutable completed key or prevent a later full save.
+Restoration first uses the complete key, then the existing same-OS/architecture key prefix.
+Required Gradle work resolves any still-missing dependencies through the assigned account exit.
+The pinned cache preloader remains confined to the official cache processes.
+
+GitHub caches are branch-scoped: task branches cannot restore sibling branches' caches, while
+default-branch caches can serve subsequent task branches. The normal default-branch release
+therefore retains useful downloads after failure as well as after successful delivery. It
+adds no warming workflow, extra main validation, upload retry or release dispatch.
+
+On adoption, preserve app-specific dependency inputs, platforms and existing restore identities.
+Candidate and release workflows need compatible keys, paths and compression versions to share
+default-branch caches. An app's custom prefix needs an explicit compatible fallback; changing a
+package pin alone does not update custom workflow bytes. Keep the current task branch and its
+cache while repairing a failed candidate; do not rotate branches merely to retry it.
+
+Verify the actual cache's branch, key, size and restore/save result. A successful cache action
+does not itself prove a hit or a complete dependency graph. Never transfer task-branch caches
+into a trusted default-branch scope by bypassing GitHub's restrictions.
+
+See [GitHub's cache restrictions and key matching][cache-rules].
+
+[cache-rules]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.106",
+  "version": "1.0.108",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "docs/GRADLE_CACHE.md"
   ],
   "keywords": [
     "ios",

package/src/release.mjs

@@ -2,6 +2,29 @@
 import {execFileSync} from 'node:child_process';
 import inputs from '../action/scripts/mobile_inputs.cjs';
 
+export function variables(repository, execute) {
+  const info = JSON.parse(execute('gh', ['api', `repos/${repository}`]));
+  if (info.full_name !== repository || !['User', 'Organization'].includes(info.owner?.type)) {
+    throw Error('mobile_release_repository_unverified');
+  }
+  const scopes = info.owner.type === 'Organization' ? ['organization-variables', 'variables'] : ['variables'];
+  const result = {};
+  for (const scope of scopes) {
+    const pages = JSON.parse(execute('gh', ['api', `repos/${repository}/actions/${scope}?per_page=100`,
+      '--paginate', '--slurp']));
+    if (!Array.isArray(pages) || pages.some(page => !Array.isArray(page.variables))) {
+      throw Error('mobile_release_configuration_unverified');
+    }
+    for (const row of pages.flatMap(page => page.variables)) {
+      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(row.name) || typeof row.value !== 'string') {
+        throw Error('mobile_release_configuration_unverified');
+      }
+      result[row.name] = row.value;
+    }
+  }
+  return result;
+}
+
 export function release(platform) {
   const execute = (command, args) => execFileSync(command, args, {
     encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 60000,
@@ -9,8 +32,5 @@ export function release(platform) {
   const remote = execute('git', ['remote', 'get-url', 'origin']);
   const match = /^(?:git@github\.com:|https:\/\/github\.com\/)([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(remote);
   if (!match) throw Error('mobile_release_repository_unverified');
-  const pages = JSON.parse(execute('gh', ['api', `repos/${match[1]}/actions/variables?per_page=100`,
-    '--paginate', '--slurp']));
-  const variables = Object.fromEntries(pages.flatMap(page => page.variables).map(row => [row.name, row.value]));
-  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables);
+  return inputs.create(platform === 'both' ? ['ios', 'android'] : [platform], variables(match[1], execute));
 }

package/templates/deploy.yml

@@ -403,6 +403,8 @@ jobs:
             ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
                 hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
                 'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+          restore-keys: >-
+            ${{ format('setup-java-{0}-{1}-gradle-', runner.os, steps.gradle_scope.outputs.arch) }}
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
@@ -581,7 +583,7 @@ jobs:
 
       - name: Save Gradle dependencies
         if: >-
-          ${{ success() && steps.mode.outputs.mode == 'local'
+          ${{ !cancelled() && steps.mode.outputs.mode == 'local'
               && steps.gradle_cache.outputs.cache-primary-key != ''
               && steps.gradle_cache.outputs.cache-hit != 'true' }}
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
@@ -593,7 +595,10 @@ jobs:
           path: |
             ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
             ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
-          key: ${{ steps.gradle_cache.outputs.cache-primary-key }}
+          key: >-
+            ${{ job.status == 'success' && steps.gradle_cache.outputs.cache-primary-key
+                || format('{0}-partial-{1}-{2}', steps.gradle_cache.outputs.cache-primary-key,
+                    github.run_id, github.run_attempt) }}
 
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the