gowalk-cicd 1.0.107 → 1.0.109

package/CLAUDE.md

@@ -161,7 +161,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
   for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
   Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
-  manifest's SHA-256 enters action outputs. Authentication/certificate refusals remain terminal.
+  manifest's SHA-256 enters action outputs. Proxy CONNECT 502/503/504 share that retry budget even
+  when curl exits 22 with origin status 0. Authentication/certificate refusals remain terminal.
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
   Archive progress emits retained byte counts every minute and safe results after each attempt;
   the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.
@@ -188,10 +189,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   URL/pin/schema/release fields are checked before reuse. Blank, wildcard and version-file inputs
   resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
   account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
-- Gradle caches use explicit checksum-pinned restore/save actions, each optional and bounded
-  to two minutes. Preserve setup-java's key inputs and absolute cache paths to reuse existing
-  caches. Java setup, builds and store uploads remain mandatory; save runs after delivery.
-  The cache-only preloader also admits the pinned `restore-only`/`save-only` entrypoints.
+- Gradle caches use checksum-pinned restore/save actions, each optional and bounded to two minutes.
+  Preserve setup-java's complete keys, inputs and absolute paths; restore the same OS/architecture prefix.
+  Failed releases save distinct partial keys unless cancelled; completed keys require success. Builds remain required.
+  Only pinned cache entrypoints get cache transport; see [cache behavior](docs/GRADLE_CACHE.md) before adoption.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;

package/action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.109

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.109

package/android-action/scripts/flutter_manifest.py

@@ -51,7 +51,8 @@ def download(arguments: list[str], directory: Path) -> int:
         if attempt == 4 or proxy_http in {401, 403, 407} or http in {401, 403}:
             break
         restart = kind == "archive" and code == 33 and http == 200
-        if not restart and code not in RETRY_CODES and http not in RETRY_HTTP:
+        if (not restart and code not in RETRY_CODES and http not in RETRY_HTTP
+                and proxy_http not in {502, 503, 504}):
             break
         if kind == "manifest" or restart:
             destination.write_bytes(b"")

package/android-action/scripts/flutter_manifest_fixture.py

@@ -60,8 +60,10 @@ class Proxy(socketserver.StreamRequestHandler):
         with self.server.lock:
             self.server.connects += 1
             mode = self.server.modes.pop(0)
-        if mode == "proxy_auth":
-            self.wfile.write(b"HTTP/1.1 407 Proxy Authentication Required\r\nContent-Length: 0\r\n\r\n")
+        proxy_status = {"proxy_auth": 407, "proxy_401": 401, "proxy_403": 403,
+                        "proxy_502": 502, "proxy_503": 503, "proxy_504": 504}.get(mode)
+        if proxy_status:
+            self.wfile.write(f"HTTP/1.1 {proxy_status} Fixture refusal\r\nContent-Length: 0\r\n\r\n".encode())
             return
         self.wfile.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
         self.wfile.flush()

package/android-action/scripts/test_flutter_proxy_retry.py

@@ -0,0 +1,76 @@
+"""Real curl retries transient CONNECT failures without sending or publishing partial origin data."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, MANIFEST, tls_proxy
+
+ROOT = Path(__file__).parent
+ARCHIVE = bytes(range(256)) * 512
+
+
+class ProxyRetryTests(unittest.TestCase):
+    def setUp(self):
+        directory = tempfile.TemporaryDirectory()
+        self.addCleanup(directory.cleanup)
+        self.root = Path(directory.name)
+
+    def invoke(self, server, cert, kind="manifest"):
+        proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+        env = {**os.environ, "HOME": str(self.root), "RUNNER_TEMP": str(self.root),
+               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "*", "no_proxy": "*",
+               "GOWALK_FLUTTER_ARCHIVE_SHA256": hashlib.sha256(ARCHIVE).hexdigest()}
+        for key in ("CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR", "GOWALK_FLUTTER_ARCHIVE_CACHE",
+                    "GOWALK_FLUTTER_RELEASE_CACHE"):
+            env.pop(key, None)
+        env["CURL_CA_BUNDLE"] = str(cert)
+        (self.root / ".curlrc").write_text('noproxy = "*"\ninsecure\n')
+        path = "releases_linux.json" if kind == "manifest" else "stable/linux/flutter_linux_3.44.0-stable.tar.xz"
+        args = ["--connect-timeout", "15", "--retry", "5"]
+        if kind == "manifest":
+            args.insert(0, "--silent")
+        result = subprocess.run([sys.executable, str(ROOT / "flutter_manifest.py"), *args,
+                                 f"https://{HOST}/flutter_infra_release/releases/{path}"],
+                                env=env, capture_output=True, timeout=20)
+        self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
+        self.assertFalse(list(self.root.glob("flutter-manifest-*")))
+        return result
+
+    def test_transient_connect_failures_recover_through_the_same_proxy(self):
+        for status in (502, 503, 504):
+            with self.subTest(status=status), tls_proxy(self.root, [f"proxy_{status}", "ok"]) as (server, cert):
+                result = self.invoke(server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, MANIFEST), result.stderr)
+                self.assertEqual((server.connects, len(server.requests)), (2, 1))
+                self.assertIn(b"flutter_manifest_recovered attempts=2", result.stderr)
+
+    def test_repeated_connect_failure_stops_after_four_attempts_without_origin_request(self):
+        with tls_proxy(self.root, ["proxy_502"] * 4) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual((result.stdout, server.connects, server.requests), (b"", 4, []))
+            self.assertIn(b"http_status=0 proxy_status=502 attempts=4 retained_bytes=0", result.stderr)
+
+    def test_connect_failure_preserves_partial_archive_for_a_verified_range_resume(self):
+        with tls_proxy(self.root, ["partial", "proxy_502", "range"], ARCHIVE) as (server, cert):
+            result = self.invoke(server, cert, "archive")
+            self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE), result.stderr)
+            self.assertEqual(server.connects, 3)
+            self.assertEqual(server.ranges, ["", "bytes=31-"])
+            self.assertIn(b"flutter_archive_recovered attempts=3", result.stderr)
+
+    def test_proxy_authorization_refusals_remain_terminal(self):
+        for mode in ("proxy_401", "proxy_403", "proxy_auth"):
+            with self.subTest(mode=mode), tls_proxy(self.root, [mode]) as (server, cert):
+                result = self.invoke(server, cert)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual((result.stdout, server.connects, server.requests), (b"", 1, []))
+                self.assertIn(b"attempts=1", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.107
+1.0.109

package/docs/GRADLE_CACHE.md

@@ -0,0 +1,32 @@
+# Gradle dependency retention
+
+The mobile release workflow retains completed dependency downloads even when its build or a
+later store operation fails. Both cache operations remain optional and bounded to two minutes;
+a cache result cannot turn a failed build or upload green. Cancelled jobs and workflows reusing
+a confirmed upload do not save Gradle caches.
+
+Successful jobs preserve the original setup-java complete key, dependency inputs and absolute
+cache paths. Failed jobs save a distinct `-partial-<run_id>-<attempt>` suffix instead, so a
+partial download cannot occupy the immutable completed key or prevent a later full save.
+Restoration first uses the complete key, then the existing same-OS/architecture key prefix.
+Required Gradle work resolves any still-missing dependencies through the assigned account exit.
+The pinned cache preloader remains confined to the official cache processes.
+
+GitHub caches are branch-scoped: task branches cannot restore sibling branches' caches, while
+default-branch caches can serve subsequent task branches. The normal default-branch release
+therefore retains useful downloads after failure as well as after successful delivery. It
+adds no warming workflow, extra main validation, upload retry or release dispatch.
+
+On adoption, preserve app-specific dependency inputs, platforms and existing restore identities.
+Candidate and release workflows need compatible keys, paths and compression versions to share
+default-branch caches. An app's custom prefix needs an explicit compatible fallback; changing a
+package pin alone does not update custom workflow bytes. Keep the current task branch and its
+cache while repairing a failed candidate; do not rotate branches merely to retry it.
+
+Verify the actual cache's branch, key, size and restore/save result. A successful cache action
+does not itself prove a hit or a complete dependency graph. Never transfer task-branch caches
+into a trusted default-branch scope by bypassing GitHub's restrictions.
+
+See [GitHub's cache restrictions and key matching][cache-rules].
+
+[cache-rules]: https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.107",
+  "version": "1.0.109",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
-    "CLAUDE.md"
+    "CLAUDE.md",
+    "docs/GRADLE_CACHE.md"
   ],
   "keywords": [
     "ios",

package/templates/deploy.yml

@@ -403,6 +403,8 @@ jobs:
             ${{ format('setup-java-{0}-{1}-gradle-{2}', runner.os, steps.gradle_scope.outputs.arch,
                 hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'buildSrc/**/Versions.kt',
                 'buildSrc/**/Dependencies.kt', 'gradle/*.versions.toml', '**/versions.properties')) }}
+          restore-keys: >-
+            ${{ format('setup-java-{0}-{1}-gradle-', runner.os, steps.gradle_scope.outputs.arch) }}
       - name: Set up Flutter
         if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' }}
         uses: ./.github/actions/android-app/flutter-setup
@@ -581,7 +583,7 @@ jobs:
 
       - name: Save Gradle dependencies
         if: >-
-          ${{ success() && steps.mode.outputs.mode == 'local'
+          ${{ !cancelled() && steps.mode.outputs.mode == 'local'
               && steps.gradle_cache.outputs.cache-primary-key != ''
               && steps.gradle_cache.outputs.cache-hit != 'true' }}
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
@@ -593,7 +595,10 @@ jobs:
           path: |
             ${{ steps.gradle_scope.outputs.home }}/.gradle/caches
             ${{ steps.gradle_scope.outputs.home }}/.gradle/wrapper
-          key: ${{ steps.gradle_cache.outputs.cache-primary-key }}
+          key: >-
+            ${{ job.status == 'success' && steps.gradle_cache.outputs.cache-primary-key
+                || format('{0}-partial-{1}-{2}', steps.gradle_cache.outputs.cache-primary-key,
+                    github.run_id, github.run_attempt) }}
 
   # GitHub only registers a newly added workflow after it reaches the default
   # branch. A brand-new app's feature branch therefore cannot dispatch the