gowalk-cicd 1.0.109 → 1.0.111

package/CLAUDE.md

@@ -122,6 +122,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   and Play service account into an ephemeral runner checkout.
   Tracked `creds/` files remain a backward-compatible read fallback. Refreshed signing
   files stay ephemeral and are never staged; `persist-signing-cache` is ignored.
+  Signing preparation never issues a distribution certificate on a cache miss: the ephemeral
+  job cannot retain its new private key. Require a supplied usable identity, preserve failed
+  material for reconciliation and report `apple_signing_identity_required` without provider writes.
   Version source staged before signing is preserved separately with its original index bytes.
 - App Group identifiers come from each archive target's entitlements. `app_groups.py`
   checks exact values in cached and fresh profiles; a fresh mismatch fails before profile
@@ -366,6 +369,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
   The existing signed AAB, proxy, track/status/rollout and notes survive one bounded retry;
   only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
+  Each attempt also emits brace-free `play_upload_diagnostic` with fixed observed progress,
+  process outcome and error signals from bounded private stdout/stderr line buffers.
+  Preserve the v1 upload result and retry rules; diagnostics never authorize replay or prove
+  an operation completed. See README for the independent diagnostic schema and field vocabulary.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -124,9 +124,16 @@ registry digests over those bytes—survive the secret round trip. The workflow
 materializes them with mode `0600` only in the ephemeral runner
 checkout. Refreshed signing files are never staged or committed by the
 composite action, including when a legacy workflow passes `persist-signing-cache: true`.
-That input is retained as an ignored compatibility input. The distribution identity
-files come from the signing registry provisioner; pass their paths to the secret tooling without printing
-their contents.
+That input is retained as an ignored compatibility input.
+
+The action reuses a supplied identity and never issues a new distribution certificate. A missing,
+invalid or revoked legacy identity fails with `apple_signing_identity_required`; reconcile and
+provision retained material through the encrypted inputs above before retrying. A temporary
+job cannot be the sole owner of a new private key. Existing legacy cache files remain readable
+and are preserved after refusal; registry identities retain their stricter ownership checks.
+
+Distribution identity files come from the signing registry provisioner; pass their paths
+to the secret tooling without printing their contents.
 
 Legacy private repositories can still provide the API key at:
 
@@ -353,6 +360,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
+| `play_upload_diagnostic` | `gowalk-cicd/play-upload-diagnostic.v1` | Fixed process evidence; see below |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `mobile_upload_reused` | `gowalk-cicd/mobile-upload-reused.v1` | `platform`, `fingerprint`, `run_id`, `run_attempt`, `source_sha`, `deployment_id`, `next_action` |
@@ -453,6 +461,20 @@ successful review-hold retry emits the existing `play_review_pending` receipt.
 Ordinary retry success never misreports an unsubmitted release. The wrapper does
 not depend on check-run annotations becoming visible while its job is running.
 
+Every completed uploader attempt also emits `play_upload_diagnostic`, independently of the
+unchanged v1 result. Its brace-free message starts with `gowalk-cicd/play-upload-diagnostic.v1`
+and carries these space-separated fields in order: `attempt=<1|2>`, `phase=<phase>`,
+`exit_code=<0-255|unknown>`, `signal=<signal>`, `error_count=<count|unknown>`,
+`cancelled=<true|false>`, `commit_reported=<true|false>`, `signals=<signals>`.
+The phase is the last observed official progress line: `startup`, `edit_create`, `tracks_read`,
+`bundle_upload`, `track_update` or `edit_commit`. It does not prove that operation completed.
+The signal is `none`, `SIGTERM`, `SIGINT`, `SIGKILL` or `other`; observed error signals are
+comma-separated `connection_reset`, `connection_refused`, `connection_timeout`, `dns_failure`,
+`tls_verification`, `output_truncated`, or `none`. Each private stdout/stderr line buffer is
+bounded to 16 KiB. No provider message, path, URL, track or credential is republished.
+These observations never authorize a retry. Missing commit output does not prove no mutation,
+and a reported commit does not prove review submission. Unknown failures remain unclassified.
+
 An expired/deleted edit does not identify its cause. Another edit opened with the
 same API user/package can invalidate it; avoid competing read edits while uploading.
 An external actor is not proven by an expired-edit error alone. Ambiguous outcomes

package/action/.daemux-version

@@ -1 +1 @@
-1.0.109
+1.0.111

package/action/scripts/creds_store.py

@@ -3,10 +3,9 @@
 Persistent cache for the Apple Distribution cert + per-bundle provisioning
 profiles, stored under the workspace's ``creds/`` directory.
 
-CI no longer regenerates a fresh cert and N profiles on every run. Apple
-caps each team at 2 distribution certs and 7-day-rolling profile churn
-triggers throttling, so re-using the same identity across runs is the
-only sane long-term strategy. We keep:
+The caller supplies a retained identity through encrypted CI inputs or an existing
+legacy cache. CI reuses it and may refresh per-app profiles, but never issues a
+replacement distribution identity in its temporary checkout. The layout is:
 
   creds/
     cert.p12                       PKCS12 with cert + private key
@@ -28,12 +27,8 @@ Reuse rules (encoded in :func:`load_cached_cert` and
     has matching cert_id AND expiration is more than 30 days away AND
     the .mobileprovision file is on disk.
 
-Anything outside reuse triggers regen + cache replacement (atomic).
-
-`p12_password` stays ``"ci"`` deliberately. Encryption-at-rest of the
-PKCS12 is decorative when the ``.p8`` ASC API key sits next to it in
-plaintext — anyone who can read one can read the other. The repo MUST
-stay private; the cert lives there for warm-cache reasons, not secrecy.
+An unusable identity is preserved for reconciliation by its credential owner.
+New signing files remain ephemeral and are never staged into source.
 """
 
 from __future__ import annotations
@@ -59,24 +54,14 @@ from profile_store import (
 )
 
 
-# Auto-renew when the cert (or any profile) is within this many days of
-# expiring. Apple distribution certs are valid for 1 year and profiles
-# for 1 year, so 30 days is plenty of headroom for CI to roll.
+# Refuse identity reuse inside this window; the credential owner provisions its replacement.
 RENEW_THRESHOLD_DAYS = 30
 
 # Surface a non-fatal warning when the cert is within this many days of
-# expiry but not yet inside the auto-renew window. Gives operators
-# visibility before the renew actually fires.
+# expiry but not yet inside the refusal window, so its owner can provision a replacement.
 WARN_THRESHOLD_DAYS = 60
 
-# DESIGN DECISION (intentional, not a bug):
-# P12 password is a hardcoded literal because encryption-at-rest is
-# decorative in this storage model: the .p12 lives next to the .p8 ASC
-# API key in the same private repo. Both are private keys; protecting one
-# with a sourced password while the other sits in plaintext alongside
-# adds bug surface (password drift between meta.json and actual encryption)
-# without raising the security floor. If this storage model changes (e.g.
-# .p8 moves to GH Secrets), revisit and source this from a secret too.
+# Compatibility default for existing legacy metadata; supplied identities carry their own password.
 P12_PASSWORD = "ci"
 
 # File-name layout under creds/. Centralised so callers never compute

package/action/scripts/prepare_signing.py

@@ -2,28 +2,14 @@
 """
 Prepare iOS code signing on a fresh CI runner (manual-signing variant).
 
-Caching: the Apple Distribution cert + per-bundle provisioning profiles
-live under the workspace's ``creds/`` directory and are reused across
-runs. See ``creds_store.py`` for the on-disk layout and reuse rules.
-This script orchestrates the load-or-regen flow:
-
-  1. Try to reuse the cached cert (decrypts + NotAfter > 30d +
-     ``GET /certificates/{cert_id}`` = 200).
-  2. On a legacy cache miss, invalidate the cache and create a fresh cert via
-     ``cert_factory``. A registry-managed identity instead fails closed: this
-     action never creates, replaces, or revokes centrally owned certificates.
-  3. Hand the cert id + cache_hit flag to ``provision_all_bundles``,
-     which decides per-bundle whether to reuse a cached profile or
-     create a new one and updates the manifest.
-  4. Orphan profiles (manifest entries for bundles no longer in the
-     target list) get GC'd from disk + manifest.
-  5. After successful prep the workspace ``creds/`` tree is dirty with
-     any refreshed artifacts; ``action.yml`` commits the diff back when
-     the run is on the default branch.
-
-Sibling modules: ``cert_factory`` (key+CSR+ASC POST), ``keychain``
-(throwaway runner keychain), ``profile_manager`` (per-bundle profile
-lifecycle), ``profile_io`` (CMS decode), ``creds_store`` (on-disk cache).
+The action consumes a retained Apple Distribution identity from encrypted CI inputs
+or an existing legacy cache. It never creates, replaces or revokes a certificate:
+new private keys in this ephemeral checkout would be lost at job cleanup.
+
+After confirming the supplied identity is usable and live on Apple, create/reuse
+per-bundle provisioning profiles, patch the ephemeral Xcode project and import
+that identity into the job keychain. Registry ownership and digest checks remain
+mandatory when its marker is present. No signing files enter source maintenance.
 
 Env inputs: ASC_KEY_ID, ASC_ISSUER_ID, ASC_KEY_PATH (key trio), PROJECT
 (.xcodeproj), TEAM_ID (optional; derived from profile plist when empty),
@@ -41,7 +27,6 @@ from pathlib import Path
 
 import app_groups
 import capabilities
-import cert_factory
 import creds_store
 from asc_common import make_jwt
 from keychain import setup_keychain
@@ -67,15 +52,15 @@ def _warn_if_renewal_near(cached: creds_store.CachedCert) -> None:
     if renew_at < cached.not_after <= warn_at:
         print(
             f"::warning::Cert {cached.cert_id} expires in "
-            f"{(cached.not_after - now).days}d; auto-renew fires at "
+            f"{(cached.not_after - now).days}d; provision its replacement before "
             f"{creds_store.RENEW_THRESHOLD_DAYS}d remaining."
         )
 
 
-def _load_or_create_cert(
+def _load_signing_identity(
     token: str, creds_dir: Path
 ) -> tuple[str, bytes, str, bool]:
-    """Load a usable identity or create one only for an unmanaged legacy repo."""
+    """Reuse retained signing material; CI cannot durably own newly issued keys."""
     managed = creds_store.registry_managed(creds_dir)
     cached = creds_store.load_cached_cert(creds_dir)
     expected_digest = cached.certificate_sha256 if cached and managed else None
@@ -97,25 +82,15 @@ def _load_or_create_cert(
             "Reconcile and replace the account identity in app-robot."
         )
 
-    if cached:
-        print(
-            f"Cached cert {cached.cert_id} no longer alive on Apple; "
-            "invalidating cache and regenerating"
-        )
-    creds_store.invalidate_cache(creds_dir)
-
-    private_key, csr_pem = cert_factory.generate_key_and_csr()
-    cert_id, cert_der = cert_factory.create_distribution_cert(
-        token, csr_pem.decode("ascii")
-    )
-    password = creds_store.P12_PASSWORD
-    p12_bytes = cert_factory.serialize_p12(private_key, cert_der, password)
-    not_after = creds_store.cert_not_after_from_der(cert_der)
-    creds_store.write_cert_bundle(
-        creds_dir, cert_id, p12_bytes, password, not_after
+    reason = "unusable" if cached else "missing_or_invalid"
+    evidence = {"schema": "gowalk-cicd/apple-signing-identity-required.v1", "mode": "legacy",
+                "reason": reason, "certificate_creation_attempted": False}
+    print("::error title=apple_signing_identity_required::" + json.dumps(evidence, separators=(",", ":")))
+    raise SystemExit(
+        "A retained Apple Distribution signing identity is required; provision it through encrypted CI inputs. "
+        "Refusing certificate creation because this job cannot retain a new private key durably. "
+        "Existing signing files are preserved."
     )
-    print(f"Persisted fresh cert bundle to {creds_dir}")
-    return cert_id, p12_bytes, password, False
 
 
 def _resolve_creds_dir() -> Path:
@@ -232,7 +207,7 @@ def main() -> None:
         )
 
     groups_by_bundle = app_groups.declared_by_bundle(project, targets)
-    cert_id, p12_bytes, p12_pass, cache_hit = _load_or_create_cert(
+    cert_id, p12_bytes, p12_pass, cache_hit = _load_signing_identity(
         token, creds_dir
     )
     mappings, effective_team = provision_all_bundles(

package/action/scripts/test_app_group_requirements.py

@@ -68,7 +68,7 @@ class GroupRequirementsTest(unittest.TestCase):
             with mock.patch.dict(prepare_signing.os.environ, env, clear=True), \
                     mock.patch.object(prepare_signing, "make_jwt", return_value="test"), \
                     mock.patch.object(prepare_signing, "discover_signable_targets", return_value=targets), \
-                    mock.patch.object(prepare_signing, "_load_or_create_cert", return_value=("C", b"p12", "", True)), \
+                    mock.patch.object(prepare_signing, "_load_signing_identity", return_value=("C", b"p12", "", True)), \
                     mock.patch.object(
                         prepare_signing, "provision_all_bundles", return_value=([], "TEAM")) as provision, \
                     mock.patch.object(prepare_signing, "patch_project_signing"), \

package/action/scripts/test_registry_managed_signing.py

@@ -14,6 +14,7 @@ from unittest import mock
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 
+import cert_factory  # noqa: E402
 import creds_store  # noqa: E402
 import prepare_signing  # noqa: E402
 
@@ -39,11 +40,11 @@ class RegistryManagedSigningTests(unittest.TestCase):
         with self._managed_dir() as raw:
             creds_dir = Path(raw)
             (creds_dir / "cert.p12").unlink()
-            with mock.patch.object(prepare_signing.cert_factory, "generate_key_and_csr") as generate:
-                with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+            with mock.patch.object(cert_factory, "generate_key_and_csr") as generate:
+                with mock.patch.object(cert_factory, "create_distribution_cert") as create:
                     with mock.patch.object(prepare_signing.creds_store, "invalidate_cache") as invalidate:
                         with self.assertRaisesRegex(SystemExit, "bundle is incomplete"):
-                            prepare_signing._load_or_create_cert("token", creds_dir)
+                            prepare_signing._load_signing_identity("token", creds_dir)
         generate.assert_not_called()
         create.assert_not_called()
         invalidate.assert_not_called()
@@ -59,9 +60,9 @@ class RegistryManagedSigningTests(unittest.TestCase):
         with self._managed_dir() as raw:
             with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
                 with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=False):
-                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
+                    with mock.patch.object(cert_factory, "create_distribution_cert") as create:
                         with self.assertRaisesRegex(SystemExit, "not active on Apple or does not match"):
-                            prepare_signing._load_or_create_cert("token", Path(raw))
+                            prepare_signing._load_signing_identity("token", Path(raw))
         create.assert_not_called()
 
     def test_active_managed_identity_is_reused(self):
@@ -75,8 +76,8 @@ class RegistryManagedSigningTests(unittest.TestCase):
         with self._managed_dir() as raw:
             with mock.patch.object(prepare_signing.creds_store, "load_cached_cert", return_value=cached):
                 with mock.patch.object(prepare_signing.creds_store, "verify_cert_alive", return_value=True):
-                    with mock.patch.object(prepare_signing.cert_factory, "create_distribution_cert") as create:
-                        result = prepare_signing._load_or_create_cert("token", Path(raw))
+                    with mock.patch.object(cert_factory, "create_distribution_cert") as create:
+                        result = prepare_signing._load_signing_identity("token", Path(raw))
         self.assertEqual(result, ("CERT1", b"p12", "secret", True))
         create.assert_not_called()
 
@@ -95,14 +96,14 @@ class RegistryManagedSigningTests(unittest.TestCase):
         with self._managed_dir(state="updating") as raw:
             with mock.patch.object(prepare_signing.creds_store, "load_cached_cert") as load:
                 with self.assertRaisesRegex(SystemExit, "not committed and ready"):
-                    prepare_signing._load_or_create_cert("token", Path(raw))
+                    prepare_signing._load_signing_identity("token", Path(raw))
         load.assert_not_called()
 
     def test_ready_marker_rejects_tampered_bundle(self):
         with self._managed_dir() as raw:
             (Path(raw) / "cert.p12").write_bytes(b"tampered")
             with self.assertRaisesRegex(SystemExit, "digest mismatch"):
-                prepare_signing._load_or_create_cert("token", Path(raw))
+                prepare_signing._load_signing_identity("token", Path(raw))
 
     def test_metadata_without_ownership_marker_remains_legacy(self):
         with tempfile.TemporaryDirectory() as raw:

package/action/scripts/test_retained_signing_identity.py

@@ -0,0 +1,110 @@
+"""Temporary release checkouts must never issue an identity whose private key they cannot retain."""
+from contextlib import ExitStack, redirect_stdout
+from datetime import datetime, timedelta, timezone
+import io
+import json
+from pathlib import Path
+import tempfile
+import unittest
+from unittest import mock
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.primitives.serialization import pkcs12
+from cryptography.x509.oid import NameOID
+
+import cert_factory
+import creds_store
+import prepare_signing
+
+
+def retained_identity(root, *, expires=90):
+    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, 'Synthetic signing test')])
+    now = datetime.now(timezone.utc)
+    cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key())
+            .serial_number(x509.random_serial_number()).not_valid_before(now - timedelta(days=1))
+            .not_valid_after(now + timedelta(days=expires)).sign(key, hashes.SHA256()))
+    p12 = pkcs12.serialize_key_and_certificates(b'test', key, cert, None,
+                                               serialization.BestAvailableEncryption(b'synthetic'))
+    (root / 'cert.p12').write_bytes(p12)
+    (root / 'cert.meta.json').write_text(json.dumps({
+        'cert_id': 'SYNTHETIC', 'not_after': (now + timedelta(days=expires)).isoformat(),
+        'p12_password': 'synthetic'}))
+    (root / 'profiles.manifest.json').write_text('{"profiles":[]}')
+    return p12
+
+
+def files(root):
+    return {str(p.relative_to(root)): p.read_bytes() for p in root.rglob('*') if p.is_file()}
+
+
+class RetainedSigningIdentityTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = ExitStack()
+        self.addCleanup(self.stack.close)
+        self.root = Path(self.stack.enter_context(tempfile.TemporaryDirectory()))
+        self.generate = self.stack.enter_context(mock.patch.object(cert_factory, 'generate_key_and_csr'))
+        self.create = self.stack.enter_context(mock.patch.object(cert_factory, 'create_distribution_cert'))
+        self.provider = self.stack.enter_context(mock.patch.object(creds_store, 'request'))
+        self.output = self.stack.enter_context(redirect_stdout(io.StringIO()))
+
+    def assert_refused_and_preserved(self):
+        before = files(self.root)
+        with self.assertRaisesRegex(SystemExit, 'retained Apple Distribution signing identity'):
+            prepare_signing._load_signing_identity('synthetic-token', self.root)
+        self.assertTrue(before == files(self.root))
+        self.generate.assert_not_called()
+        self.create.assert_not_called()
+        annotation = next(line.split('::', 2)[2] for line in self.output.getvalue().splitlines()
+                          if line.startswith('::error title=apple_signing_identity_required::'))
+        self.assertFalse(json.loads(annotation)['certificate_creation_attempted'])
+
+    def test_empty_checkout_refuses_without_provider_traffic(self):
+        self.assert_refused_and_preserved()
+        self.provider.assert_not_called()
+
+    def test_corrupt_retained_material_is_preserved_without_provider_traffic(self):
+        retained_identity(self.root)
+        (self.root / 'cert.p12').write_bytes(b'synthetic-corrupt-p12')
+        self.assert_refused_and_preserved()
+        self.provider.assert_not_called()
+
+    def test_near_expiry_material_is_preserved_for_reconciliation(self):
+        retained_identity(self.root, expires=2)
+        self.assert_refused_and_preserved()
+        self.provider.assert_not_called()
+
+    def test_revoked_retained_identity_only_reads_apple(self):
+        retained_identity(self.root)
+        self.provider.return_value = mock.Mock(status_code=404)
+        self.assert_refused_and_preserved()
+        self.provider.assert_called_once()
+        self.assertEqual(self.provider.call_args.args[:2], ('GET', '/certificates/SYNTHETIC'))
+
+    def test_indeterminate_apple_read_does_not_create_or_destroy_material(self):
+        retained_identity(self.root)
+        before = files(self.root)
+        self.provider.side_effect = SystemExit('synthetic transport unavailable')
+        with self.assertRaisesRegex(SystemExit, 'transport unavailable'):
+            prepare_signing._load_signing_identity('synthetic-token', self.root)
+        self.assertTrue(before == files(self.root))
+        self.generate.assert_not_called()
+        self.create.assert_not_called()
+
+    def test_active_legacy_identity_reuses_identical_material_across_runs(self):
+        p12 = retained_identity(self.root)
+        before = files(self.root)
+        self.provider.return_value = mock.Mock(status_code=200)
+        for _ in range(2):
+            identity = prepare_signing._load_signing_identity('synthetic-token', self.root)
+            self.assertTrue(identity == ('SYNTHETIC', p12, 'synthetic', True))
+        self.assertTrue(before == files(self.root))
+        self.assertEqual(self.provider.call_count, 2)
+        self.generate.assert_not_called()
+        self.create.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()

package/action/scripts/test_team_fallback_wiring.py

@@ -56,7 +56,7 @@ class PrepareSigningTeamIdOptionalTests(unittest.TestCase):
                 ):
                     with mock.patch.object(
                         prepare_signing,
-                        "_load_or_create_cert",
+                        "_load_signing_identity",
                         return_value=("CERTID", b"FAKEP12", "password", False),
                     ):
                         with mock.patch.object(
@@ -95,7 +95,7 @@ class PrepareSigningTeamIdOptionalTests(unittest.TestCase):
                 ):
                     with mock.patch.object(
                         prepare_signing,
-                        "_load_or_create_cert",
+                        "_load_signing_identity",
                         return_value=("CID", b"P12", "password", False),
                     ):
                         with mock.patch.object(

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.109
+1.0.111

package/android-action/play-upload/diagnostics.cjs

@@ -0,0 +1,73 @@
+// Observe only fixed progress/error patterns; never retain provider text in a receipt.
+const phases = new Map([
+  ['Creating a new Edit for this release', 'edit_create'],
+  ['Committing the Edit', 'edit_commit'],
+]);
+const prefixes = new Map([
+  ["Validating tracks: '", 'tracks_read'], ['Uploading ', 'bundle_upload'],
+  ['::debug::Creating release for:', 'track_update'],
+]);
+const tlsCodes = ['CERT_HAS_EXPIRED', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN',
+  'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'ERR_TLS_CERT_ALTNAME_INVALID'];
+const patterns = new Map([
+  ['connection_reset', /\bECONNRESET\b|\bsocket hang up\b/i],
+  ['connection_refused', /\bECONNREFUSED\b/],
+  ['connection_timeout', /\b(?:ETIMEDOUT|ESOCKETTIMEDOUT|ECONNABORTED)\b/],
+  ['dns_failure', /\b(?:ENOTFOUND|EAI_AGAIN)\b/],
+  ['tls_verification', new RegExp(`\\b(?:${tlsCodes.join('|')})\\b`)],
+]);
+const knownPhases = new Set(['startup', ...phases.values(), ...prefixes.values()]);
+const knownSignals = new Set([...patterns.keys(), 'output_truncated']);
+const limit = 16384;
+
+function create() {
+  return {phase: 'startup', signals: new Set(), pending: {stdout: '', stderr: ''},
+    discard: {stdout: false, stderr: false}};
+}
+
+function line(state, stream, value) {
+  if (stream === 'stdout') {
+    if (phases.has(value)) state.phase = phases.get(value);
+    for (const [prefix, phase] of prefixes) if (value.startsWith(prefix)) state.phase = phase;
+    if (!value.startsWith('::error')) return;
+    value = value.replace(/%0D/g, '\r').replace(/%0A/g, '\n').replace(/%25/g, '%');
+  }
+  for (const [signal, pattern] of patterns) if (pattern.test(value)) state.signals.add(signal);
+}
+
+function consume(state, stream, chunk) {
+  state.pending[stream] += chunk;
+  let end;
+  while ((end = state.pending[stream].indexOf('\n')) !== -1) {
+    const value = state.pending[stream].slice(0, end).replace(/\r$/, '');
+    state.pending[stream] = state.pending[stream].slice(end + 1);
+    if (state.discard[stream]) state.discard[stream] = false;
+    else if (value.length <= limit) line(state, stream, value);
+    else state.signals.add('output_truncated');
+  }
+  if (state.pending[stream].length > limit) {
+    state.pending[stream] = ''; state.discard[stream] = true; state.signals.add('output_truncated');
+  }
+}
+
+function snapshot(state) {
+  return {phase: state.phase, signals: [...state.signals].sort()};
+}
+
+function annotation(attempt, result) {
+  const diagnostic = result.diagnostic || {};
+  const phase = knownPhases.has(diagnostic.phase) ? diagnostic.phase : 'startup';
+  const signals = Array.isArray(diagnostic.signals)
+    ? [...new Set(diagnostic.signals.filter(value => knownSignals.has(value)))].sort() : [];
+  const exit = Number.isInteger(result.status) && result.status >= 0 && result.status <= 255
+    ? result.status : 'unknown';
+  const signal = ['SIGTERM', 'SIGINT', 'SIGKILL'].includes(result.signal)
+    ? result.signal : result.signal ? 'other' : 'none';
+  const errors = Number.isSafeInteger(result.errors) && result.errors >= 0 ? result.errors : 'unknown';
+  return '::notice title=play_upload_diagnostic::gowalk-cicd/play-upload-diagnostic.v1'
+    + ` attempt=${attempt === 2 ? 2 : 1} phase=${phase} exit_code=${exit} signal=${signal}`
+    + ` error_count=${errors} cancelled=${result.cancelled === true} commit_reported=${result.committed === true}`
+    + ` signals=${signals.join(',') || 'none'}`;
+}
+
+module.exports = {create, consume, snapshot, annotation};

package/android-action/play-upload/process.cjs

@@ -2,6 +2,7 @@
 const {spawn} = require('node:child_process');
 const {readFileSync, writeFileSync} = require('node:fs');
 const {join} = require('node:path');
+const diagnostics = require('./diagnostics.cjs');
 const messages = new Map([
   ['This edit has expired, please create a new Edit.', 'edit_expired'],
   ['This Edit has been deleted.', 'edit_deleted'],
@@ -40,6 +41,7 @@ function execute(program, env, directory, timeout) {
     const output = join(directory, 'output'), exports = join(directory, 'environment');
     writeFileSync(output, '', {mode: 0o600}); writeFileSync(exports, '', {mode: 0o600});
     const state = {pending: '', errors: 0, code: 'unclassified_failure', ambiguous: false};
+    const diagnostic = diagnostics.create();
     const child = spawn(process.execPath, [program], {
       env: {...env, GITHUB_OUTPUT: output, GITHUB_ENV: exports}, stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -50,15 +52,19 @@ function execute(program, env, directory, timeout) {
     };
     const timer = setTimeout(stop, timeout);
     process.on('SIGTERM', stop); process.on('SIGINT', stop);
-    child.stdout.setEncoding('utf8'); child.stdout.on('data', chunk => consume(state, chunk));
-    child.stderr.resume();
+    child.stdout.setEncoding('utf8'); child.stdout.on('data', chunk => {
+      consume(state, chunk); diagnostics.consume(diagnostic, 'stdout', chunk);
+    });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', chunk => diagnostics.consume(diagnostic, 'stderr', chunk));
     child.on('error', () => { state.ambiguous = true; });
     child.on('close', (status, signal) => {
       clearTimeout(timer); clearTimeout(force); process.off('SIGTERM', stop); process.off('SIGINT', stop);
       consume(state, '\n');
+      diagnostics.consume(diagnostic, 'stdout', '\n'); diagnostics.consume(diagnostic, 'stderr', '\n');
       const committed = /(?:^|\n)committedEditId(?:=|<<)/.test(readFileSync(output, 'utf8'));
       resolve({status, signal, cancelled, committed, errors: state.errors,
-        code: state.ambiguous ? 'unclassified_failure' : state.code});
+        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic)});
     });
   });
 }

package/android-action/play-upload/run.cjs

@@ -4,9 +4,10 @@ const {join} = require('node:path');
 const source = require('./source.cjs');
 const processRunner = require('./process.cjs');
 const owner = require('./owner.cjs');
+const diagnostics = require('./diagnostics.cjs');
 
 async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
-  cancelled = () => false) {
+  cancelled = () => false, report = () => {}) {
   const deadline = Date.now() + timeout;
   let mode = 'false';
   for (let attempt = 1; attempt <= 2; attempt++) {
@@ -14,6 +15,7 @@ async function upload(program, env, directory, execute = processRunner.execute,
     const target = join(directory, String(attempt)); mkdirSync(target, {mode: 0o700});
     const result = await execute(program, {...env, INPUT_CHANGESNOTSENTFORREVIEW: mode}, target,
       Math.max(1, deadline - Date.now()));
+    report(attempt, result);
     const reviewPending = mode === 'true';
     if (result.status === 0 && !result.signal && !result.cancelled && result.errors === 0) {
       return {ok: true, code: reviewPending ? 'review_pending' : 'uploaded', attempts: attempt,
@@ -39,7 +41,8 @@ async function main() {
     directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-upload-'));
     const program = await source.prepare(directory);
     receipt = await owner.withOwner(env, env.INPUT_PACKAGENAME, cancelled =>
-      upload(program, env, directory, processRunner.execute, 3600000, cancelled));
+      upload(program, env, directory, processRunner.execute, 3600000, cancelled,
+        (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
   } catch (error) {
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
       'uploader_source_unavailable', ...owner.codes];

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.109
+1.0.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.109",
+  "version": "1.0.111",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {