gowalk-cicd 1.0.110 → 1.0.111

package/CLAUDE.md

@@ -369,6 +369,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   refusal permits a review hold. Unknown/transport/post-commit uncertainty does not replay.
   The existing signed AAB, proxy, track/status/rollout and notes survive one bounded retry;
   only a successful hold emits `play_review_pending`. Keep raw child output out of receipts.
+  Each attempt also emits brace-free `play_upload_diagnostic` with fixed observed progress,
+  process outcome and error signals from bounded private stdout/stderr line buffers.
+  Preserve the v1 upload result and retry rules; diagnostics never authorize replay or prove
+  an operation completed. See README for the independent diagnostic schema and field vocabulary.
 - The JDK is chosen by `scripts/select_jdk.py`, called from the workflow before
   `setup-java`. The `JAVA_VERSION` repo variable always wins; otherwise Flutter
   gets 17 and native Gradle gets 21, except that a positively-detected Kotlin

package/README.md

@@ -360,6 +360,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | --- | --- | --- |
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
+| `play_upload_diagnostic` | `gowalk-cicd/play-upload-diagnostic.v1` | Fixed process evidence; see below |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `mobile_upload_reused` | `gowalk-cicd/mobile-upload-reused.v1` | `platform`, `fingerprint`, `run_id`, `run_attempt`, `source_sha`, `deployment_id`, `next_action` |
@@ -460,6 +461,20 @@ successful review-hold retry emits the existing `play_review_pending` receipt.
 Ordinary retry success never misreports an unsubmitted release. The wrapper does
 not depend on check-run annotations becoming visible while its job is running.
 
+Every completed uploader attempt also emits `play_upload_diagnostic`, independently of the
+unchanged v1 result. Its brace-free message starts with `gowalk-cicd/play-upload-diagnostic.v1`
+and carries these space-separated fields in order: `attempt=<1|2>`, `phase=<phase>`,
+`exit_code=<0-255|unknown>`, `signal=<signal>`, `error_count=<count|unknown>`,
+`cancelled=<true|false>`, `commit_reported=<true|false>`, `signals=<signals>`.
+The phase is the last observed official progress line: `startup`, `edit_create`, `tracks_read`,
+`bundle_upload`, `track_update` or `edit_commit`. It does not prove that operation completed.
+The signal is `none`, `SIGTERM`, `SIGINT`, `SIGKILL` or `other`; observed error signals are
+comma-separated `connection_reset`, `connection_refused`, `connection_timeout`, `dns_failure`,
+`tls_verification`, `output_truncated`, or `none`. Each private stdout/stderr line buffer is
+bounded to 16 KiB. No provider message, path, URL, track or credential is republished.
+These observations never authorize a retry. Missing commit output does not prove no mutation,
+and a reported commit does not prove review submission. Unknown failures remain unclassified.
+
 An expired/deleted edit does not identify its cause. Another edit opened with the
 same API user/package can invalidate it; avoid competing read edits while uploading.
 An external actor is not proven by an expired-edit error alone. Ambiguous outcomes

package/action/.daemux-version

@@ -1 +1 @@
-1.0.110
+1.0.111

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.110
+1.0.111

package/android-action/play-upload/diagnostics.cjs

@@ -0,0 +1,73 @@
+// Observe only fixed progress/error patterns; never retain provider text in a receipt.
+const phases = new Map([
+  ['Creating a new Edit for this release', 'edit_create'],
+  ['Committing the Edit', 'edit_commit'],
+]);
+const prefixes = new Map([
+  ["Validating tracks: '", 'tracks_read'], ['Uploading ', 'bundle_upload'],
+  ['::debug::Creating release for:', 'track_update'],
+]);
+const tlsCodes = ['CERT_HAS_EXPIRED', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN',
+  'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'ERR_TLS_CERT_ALTNAME_INVALID'];
+const patterns = new Map([
+  ['connection_reset', /\bECONNRESET\b|\bsocket hang up\b/i],
+  ['connection_refused', /\bECONNREFUSED\b/],
+  ['connection_timeout', /\b(?:ETIMEDOUT|ESOCKETTIMEDOUT|ECONNABORTED)\b/],
+  ['dns_failure', /\b(?:ENOTFOUND|EAI_AGAIN)\b/],
+  ['tls_verification', new RegExp(`\\b(?:${tlsCodes.join('|')})\\b`)],
+]);
+const knownPhases = new Set(['startup', ...phases.values(), ...prefixes.values()]);
+const knownSignals = new Set([...patterns.keys(), 'output_truncated']);
+const limit = 16384;
+
+function create() {
+  return {phase: 'startup', signals: new Set(), pending: {stdout: '', stderr: ''},
+    discard: {stdout: false, stderr: false}};
+}
+
+function line(state, stream, value) {
+  if (stream === 'stdout') {
+    if (phases.has(value)) state.phase = phases.get(value);
+    for (const [prefix, phase] of prefixes) if (value.startsWith(prefix)) state.phase = phase;
+    if (!value.startsWith('::error')) return;
+    value = value.replace(/%0D/g, '\r').replace(/%0A/g, '\n').replace(/%25/g, '%');
+  }
+  for (const [signal, pattern] of patterns) if (pattern.test(value)) state.signals.add(signal);
+}
+
+function consume(state, stream, chunk) {
+  state.pending[stream] += chunk;
+  let end;
+  while ((end = state.pending[stream].indexOf('\n')) !== -1) {
+    const value = state.pending[stream].slice(0, end).replace(/\r$/, '');
+    state.pending[stream] = state.pending[stream].slice(end + 1);
+    if (state.discard[stream]) state.discard[stream] = false;
+    else if (value.length <= limit) line(state, stream, value);
+    else state.signals.add('output_truncated');
+  }
+  if (state.pending[stream].length > limit) {
+    state.pending[stream] = ''; state.discard[stream] = true; state.signals.add('output_truncated');
+  }
+}
+
+function snapshot(state) {
+  return {phase: state.phase, signals: [...state.signals].sort()};
+}
+
+function annotation(attempt, result) {
+  const diagnostic = result.diagnostic || {};
+  const phase = knownPhases.has(diagnostic.phase) ? diagnostic.phase : 'startup';
+  const signals = Array.isArray(diagnostic.signals)
+    ? [...new Set(diagnostic.signals.filter(value => knownSignals.has(value)))].sort() : [];
+  const exit = Number.isInteger(result.status) && result.status >= 0 && result.status <= 255
+    ? result.status : 'unknown';
+  const signal = ['SIGTERM', 'SIGINT', 'SIGKILL'].includes(result.signal)
+    ? result.signal : result.signal ? 'other' : 'none';
+  const errors = Number.isSafeInteger(result.errors) && result.errors >= 0 ? result.errors : 'unknown';
+  return '::notice title=play_upload_diagnostic::gowalk-cicd/play-upload-diagnostic.v1'
+    + ` attempt=${attempt === 2 ? 2 : 1} phase=${phase} exit_code=${exit} signal=${signal}`
+    + ` error_count=${errors} cancelled=${result.cancelled === true} commit_reported=${result.committed === true}`
+    + ` signals=${signals.join(',') || 'none'}`;
+}
+
+module.exports = {create, consume, snapshot, annotation};

package/android-action/play-upload/process.cjs

@@ -2,6 +2,7 @@
 const {spawn} = require('node:child_process');
 const {readFileSync, writeFileSync} = require('node:fs');
 const {join} = require('node:path');
+const diagnostics = require('./diagnostics.cjs');
 const messages = new Map([
   ['This edit has expired, please create a new Edit.', 'edit_expired'],
   ['This Edit has been deleted.', 'edit_deleted'],
@@ -40,6 +41,7 @@ function execute(program, env, directory, timeout) {
     const output = join(directory, 'output'), exports = join(directory, 'environment');
     writeFileSync(output, '', {mode: 0o600}); writeFileSync(exports, '', {mode: 0o600});
     const state = {pending: '', errors: 0, code: 'unclassified_failure', ambiguous: false};
+    const diagnostic = diagnostics.create();
     const child = spawn(process.execPath, [program], {
       env: {...env, GITHUB_OUTPUT: output, GITHUB_ENV: exports}, stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -50,15 +52,19 @@ function execute(program, env, directory, timeout) {
     };
     const timer = setTimeout(stop, timeout);
     process.on('SIGTERM', stop); process.on('SIGINT', stop);
-    child.stdout.setEncoding('utf8'); child.stdout.on('data', chunk => consume(state, chunk));
-    child.stderr.resume();
+    child.stdout.setEncoding('utf8'); child.stdout.on('data', chunk => {
+      consume(state, chunk); diagnostics.consume(diagnostic, 'stdout', chunk);
+    });
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', chunk => diagnostics.consume(diagnostic, 'stderr', chunk));
     child.on('error', () => { state.ambiguous = true; });
     child.on('close', (status, signal) => {
       clearTimeout(timer); clearTimeout(force); process.off('SIGTERM', stop); process.off('SIGINT', stop);
       consume(state, '\n');
+      diagnostics.consume(diagnostic, 'stdout', '\n'); diagnostics.consume(diagnostic, 'stderr', '\n');
       const committed = /(?:^|\n)committedEditId(?:=|<<)/.test(readFileSync(output, 'utf8'));
       resolve({status, signal, cancelled, committed, errors: state.errors,
-        code: state.ambiguous ? 'unclassified_failure' : state.code});
+        code: state.ambiguous ? 'unclassified_failure' : state.code, diagnostic: diagnostics.snapshot(diagnostic)});
     });
   });
 }

package/android-action/play-upload/run.cjs

@@ -4,9 +4,10 @@ const {join} = require('node:path');
 const source = require('./source.cjs');
 const processRunner = require('./process.cjs');
 const owner = require('./owner.cjs');
+const diagnostics = require('./diagnostics.cjs');
 
 async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
-  cancelled = () => false) {
+  cancelled = () => false, report = () => {}) {
   const deadline = Date.now() + timeout;
   let mode = 'false';
   for (let attempt = 1; attempt <= 2; attempt++) {
@@ -14,6 +15,7 @@ async function upload(program, env, directory, execute = processRunner.execute,
     const target = join(directory, String(attempt)); mkdirSync(target, {mode: 0o700});
     const result = await execute(program, {...env, INPUT_CHANGESNOTSENTFORREVIEW: mode}, target,
       Math.max(1, deadline - Date.now()));
+    report(attempt, result);
     const reviewPending = mode === 'true';
     if (result.status === 0 && !result.signal && !result.cancelled && result.errors === 0) {
       return {ok: true, code: reviewPending ? 'review_pending' : 'uploaded', attempts: attempt,
@@ -39,7 +41,8 @@ async function main() {
     directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-upload-'));
     const program = await source.prepare(directory);
     receipt = await owner.withOwner(env, env.INPUT_PACKAGENAME, cancelled =>
-      upload(program, env, directory, processRunner.execute, 3600000, cancelled));
+      upload(program, env, directory, processRunner.execute, 3600000, cancelled,
+        (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
   } catch (error) {
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
       'uploader_source_unavailable', ...owner.codes];

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.110
+1.0.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.110",
+  "version": "1.0.111",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {