gowalk-cicd 1.0.108 → 1.0.109

package/CLAUDE.md

@@ -161,7 +161,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   It retains the account proxy and allows four attempts within 60 seconds for manifests or 20 minutes
   for archives, with an 8 GiB archive bound. Interrupted archives resume private bytes with HTTP Range; an origin ignoring
   Range permits a bounded full restart. Only complete JSON or an archive matching the selected official
-  manifest's SHA-256 enters action outputs. Authentication/certificate refusals remain terminal.
+  manifest's SHA-256 enters action outputs. Proxy CONNECT 502/503/504 share that retry budget even
+  when curl exits 22 with origin status 0. Authentication/certificate refusals remain terminal.
   `flutter_download_failed` emits fixed transport codes and retained-byte counts, never curl stderr.
   Archive progress emits retained byte counts every minute and safe results after each attempt;
   the transfer deadline leaves room for a failure receipt before a 30-minute validation job ends.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.108
+1.0.109

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.108
+1.0.109

package/android-action/scripts/flutter_manifest.py

@@ -51,7 +51,8 @@ def download(arguments: list[str], directory: Path) -> int:
         if attempt == 4 or proxy_http in {401, 403, 407} or http in {401, 403}:
             break
         restart = kind == "archive" and code == 33 and http == 200
-        if not restart and code not in RETRY_CODES and http not in RETRY_HTTP:
+        if (not restart and code not in RETRY_CODES and http not in RETRY_HTTP
+                and proxy_http not in {502, 503, 504}):
             break
         if kind == "manifest" or restart:
             destination.write_bytes(b"")

package/android-action/scripts/flutter_manifest_fixture.py

@@ -60,8 +60,10 @@ class Proxy(socketserver.StreamRequestHandler):
         with self.server.lock:
             self.server.connects += 1
             mode = self.server.modes.pop(0)
-        if mode == "proxy_auth":
-            self.wfile.write(b"HTTP/1.1 407 Proxy Authentication Required\r\nContent-Length: 0\r\n\r\n")
+        proxy_status = {"proxy_auth": 407, "proxy_401": 401, "proxy_403": 403,
+                        "proxy_502": 502, "proxy_503": 503, "proxy_504": 504}.get(mode)
+        if proxy_status:
+            self.wfile.write(f"HTTP/1.1 {proxy_status} Fixture refusal\r\nContent-Length: 0\r\n\r\n".encode())
             return
         self.wfile.write(b"HTTP/1.1 200 Connection established\r\n\r\n")
         self.wfile.flush()

package/android-action/scripts/test_flutter_proxy_retry.py

@@ -0,0 +1,76 @@
+"""Real curl retries transient CONNECT failures without sending or publishing partial origin data."""
+import hashlib
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+from flutter_manifest_fixture import HOST, MANIFEST, tls_proxy
+
+ROOT = Path(__file__).parent
+ARCHIVE = bytes(range(256)) * 512
+
+
+class ProxyRetryTests(unittest.TestCase):
+    def setUp(self):
+        directory = tempfile.TemporaryDirectory()
+        self.addCleanup(directory.cleanup)
+        self.root = Path(directory.name)
+
+    def invoke(self, server, cert, kind="manifest"):
+        proxy = f"http://fixture-user:fixture-secret@127.0.0.1:{server.server_address[1]}"
+        env = {**os.environ, "HOME": str(self.root), "RUNNER_TEMP": str(self.root),
+               "HTTPS_PROXY": proxy, "https_proxy": proxy, "NO_PROXY": "*", "no_proxy": "*",
+               "GOWALK_FLUTTER_ARCHIVE_SHA256": hashlib.sha256(ARCHIVE).hexdigest()}
+        for key in ("CURL_CA_BUNDLE", "SSL_CERT_FILE", "SSL_CERT_DIR", "GOWALK_FLUTTER_ARCHIVE_CACHE",
+                    "GOWALK_FLUTTER_RELEASE_CACHE"):
+            env.pop(key, None)
+        env["CURL_CA_BUNDLE"] = str(cert)
+        (self.root / ".curlrc").write_text('noproxy = "*"\ninsecure\n')
+        path = "releases_linux.json" if kind == "manifest" else "stable/linux/flutter_linux_3.44.0-stable.tar.xz"
+        args = ["--connect-timeout", "15", "--retry", "5"]
+        if kind == "manifest":
+            args.insert(0, "--silent")
+        result = subprocess.run([sys.executable, str(ROOT / "flutter_manifest.py"), *args,
+                                 f"https://{HOST}/flutter_infra_release/releases/{path}"],
+                                env=env, capture_output=True, timeout=20)
+        self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
+        self.assertFalse(list(self.root.glob("flutter-manifest-*")))
+        return result
+
+    def test_transient_connect_failures_recover_through_the_same_proxy(self):
+        for status in (502, 503, 504):
+            with self.subTest(status=status), tls_proxy(self.root, [f"proxy_{status}", "ok"]) as (server, cert):
+                result = self.invoke(server, cert)
+                self.assertEqual((result.returncode, result.stdout), (0, MANIFEST), result.stderr)
+                self.assertEqual((server.connects, len(server.requests)), (2, 1))
+                self.assertIn(b"flutter_manifest_recovered attempts=2", result.stderr)
+
+    def test_repeated_connect_failure_stops_after_four_attempts_without_origin_request(self):
+        with tls_proxy(self.root, ["proxy_502"] * 4) as (server, cert):
+            result = self.invoke(server, cert)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertEqual((result.stdout, server.connects, server.requests), (b"", 4, []))
+            self.assertIn(b"http_status=0 proxy_status=502 attempts=4 retained_bytes=0", result.stderr)
+
+    def test_connect_failure_preserves_partial_archive_for_a_verified_range_resume(self):
+        with tls_proxy(self.root, ["partial", "proxy_502", "range"], ARCHIVE) as (server, cert):
+            result = self.invoke(server, cert, "archive")
+            self.assertEqual((result.returncode, result.stdout), (0, ARCHIVE), result.stderr)
+            self.assertEqual(server.connects, 3)
+            self.assertEqual(server.ranges, ["", "bytes=31-"])
+            self.assertIn(b"flutter_archive_recovered attempts=3", result.stderr)
+
+    def test_proxy_authorization_refusals_remain_terminal(self):
+        for mode in ("proxy_401", "proxy_403", "proxy_auth"):
+            with self.subTest(mode=mode), tls_proxy(self.root, [mode]) as (server, cert):
+                result = self.invoke(server, cert)
+                self.assertNotEqual(result.returncode, 0)
+                self.assertEqual((result.stdout, server.connects, server.requests), (b"", 1, []))
+                self.assertIn(b"attempts=1", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.108
+1.0.109

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.108",
+  "version": "1.0.109",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {