gowalk-cicd 1.0.107 → 1.0.108

package/CLAUDE.md

@@ -188,10 +188,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   URL/pin/schema/release fields are checked before reuse. Blank, wildcard and version-file inputs
   resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
   account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
-- Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
-  to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
-  caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
-  The cache-only preloader also admits the pinned `restore-only`/`save-only` entrypoints.
+- Gradle caches use checksum-pinned restore/save actions, each optional and bounded to two minutes.
+  Preserve setup-java's complete keys, inputs and absolute paths; restore the same OS/architecture prefix.
+  Failed releases save distinct partial keys unless cancelled; completed keys require success. Builds remain required.
+  Only pinned cache entrypoints get cache transport; see [cache behavior](docs/GRADLE_CACHE.md) before adoption.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;

package/action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.108

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.108

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.108

package/docs/GRADLE_CACHE.md

@@ -0,0 +1,32 @@
+# Gradle dependency retention
+
+The mobile release workflow retains completed dependency downloads even when its build or a
+later store operation fails. Both cache operations remain optional and bounded to two minutes;
+a cache result cannot turn a failed build or upload green. Cancelled jobs and workflows reusing
+a confirmed upload do not save Gradle caches.
+
+Successful jobs preserve the original setup-java complete key, dependency inputs and absolute
+cache paths. Failed jobs save a distinct `-partial-<run_id>-<attempt>` suffix instead, so a
+partial download cannot occupy the immutable completed key or prevent a later full save.
+Restoration first uses the complete key, then the existing same-OS/architecture key prefix.
+Required Gradle work resolves any still-missing dependencies through the assigned account exit.
+The pinned cache preloader remains confined to the official cache processes.
+
+GitHub caches are branch-scoped: task branches cannot restore sibling branches' caches, while
+default-branch caches can serve subsequent task branches. The normal default-branch release
+therefore retains useful downloads after failure as well as after successful delivery. It
+adds no warming workflow, extra main validation, upload retry or release dispatch.
+
+On adoption, preserve app-specific dependency inputs, platforms and existing restore identities.
+Candidate and release workflows need compatible keys, paths and compression versions to share
+default-branch caches. An app's custom prefix needs an explicit compatible fallback; changing a
+package pin alone does not update custom workflow bytes. Keep the current task branch and its
+cache while repairing a failed candidate; do not rotate branches merely to retry it.
+
+Verify the actual cache's branch, key, size and restore/save result. A successful cache action
+does not itself prove a hit or a complete dependency graph. Never transfer task-branch caches
+into a trusted default-branch scope by bypassing GitHub's restrictions.
+
+See [GitHub's cache restrictions and key matching][cache-rules].
+
+[cache-rules]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.107",
+  "version": "1.0.108",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "docs/GRADLE_CACHE.md"
   ],
   "keywords": [
     "ios",

package/templates/deploy.yml

@@ -403,6 +403,8 @@ jobs:
             ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
                 hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
                 'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+          restore-keys: >-
+            ${{ format('setup-java-{0}-{1}-gradle-', runner.os, steps.gradle_scope.outputs.arch) }}
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
@@ -581,7 +583,7 @@ jobs:
 
       - name: Save Gradle dependencies
         if: >-
-          ${{ success() && steps.mode.outputs.mode == 'local'
+          ${{ !cancelled() && steps.mode.outputs.mode == 'local'
               && steps.gradle_cache.outputs.cache-primary-key != ''
               && steps.gradle_cache.outputs.cache-hit != 'true' }}
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
@@ -593,7 +595,10 @@ jobs:
           path: |
             ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
             ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
-          key: ${{ steps.gradle_cache.outputs.cache-primary-key }}
+          key: >-
+            ${{ job.status == 'success' && steps.gradle_cache.outputs.cache-primary-key
+                || format('{0}-partial-{1}-{2}', steps.gradle_cache.outputs.cache-primary-key,
+                    github.run_id, github.run_attempt) }}
 
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the