gowalk-cicd 1.0.113 → 1.0.115

package/CLAUDE.md

@@ -214,6 +214,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   that multiline secret masking can erase. Never reconstruct masked fields or include arbitrary text.
   Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
   signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
+  Timeout and cancellation retain the existing bounded sanitized diagnostic after owned-child cleanup;
+  preserve the failure code, install deadline and retry fences.
+  Within the bounded capture, retain the CocoaPods primary exception alongside the tail when a long
+  stack or secondary issue-search failure hides it. Redact before selecting the bounded excerpt.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.

package/README.md

@@ -380,6 +380,8 @@ Native bundle and Pods failures emit `native_prepare_failed` with schema
 Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
 the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
 private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+Timeout and cancellation preserve the bounded, sanitized child diagnostic after owned-process cleanup;
+observed signals do not authorize another attempt or change the failed result.
 The backend message is `gowalk-cicd/backend-deploy-failed.v1 phase=<phase> exit_code=<code>`:
 fixed fields without JSON braces, which GitHub can mask when a multiline secret has brace-only lines.
 Consumers validate the complete envelope, the known phase and exit code 1–255; older JSON messages

package/action/.daemux-version

@@ -1 +1 @@
-1.0.113
+1.0.115

package/action/scripts/native_bundle.py

@@ -22,7 +22,7 @@ def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
         return native_pods_process.command(argv, cwd, log, timeout=timeout)
     except native_pods_process.Interrupted:
-        raise guard.Refused("native_pods_operation_interrupted") from None
+        refuse("native_pods_operation_interrupted", log, guard.Refused)
     except (OSError, RuntimeError, subprocess.SubprocessError):
         raise guard.Refused("native_pods_process_unverified") from None
 

package/action/scripts/native_pods_diagnostics.py

@@ -23,6 +23,20 @@ def values(environment: dict[str, str]) -> set[str]:
     return {value for value in found if value}
 
 
+def excerpt(text: str) -> str:
+    lines = text.splitlines()
+    tail = "\n".join(lines[-30:])[-4000:]
+    start = next((index for index in range(len(lines) - 1, -1, -1)
+                  if lines[index].strip() == "### Error"), None)
+    if start is None:
+        return tail
+    primary = "\n".join(lines[start:start + 6])[:1200]
+    if primary in tail:
+        return tail
+    tail = "\n".join(lines[-(29 - len(primary.splitlines())):])[-(3995 - len(primary)):]
+    return primary + "\n...\n" + tail
+
+
 def diagnostic(log, environment: dict[str, str] | None = None) -> str:
     log.flush()
     log.seek(0, os.SEEK_END)
@@ -44,7 +58,7 @@ def diagnostic(log, environment: dict[str, str] | None = None) -> str:
     text = re.sub(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", "[token redacted]", text)
     text = re.sub(r"https?://[^\s\"'<>]+", "[URL redacted]", text)
     text = re.sub(r"[A-Za-z0-9_+/=-]{32,}", "[long value redacted]", text)
-    return "\n".join(text.splitlines()[-30:])[-4000:]
+    return excerpt(text)
 
 
 def refuse(code: str, log, exception):

package/action/scripts/native_pods_retry.py

@@ -7,7 +7,7 @@ import time
 
 import native_bundle
 import native_dependency_guard as guard
-from native_pods_diagnostics import diagnostic
+from native_pods_diagnostics import diagnostic, refuse
 
 TERMINAL = re.compile(
     r"certificate|SSL peer|TLS|authentication|unauthorized|forbidden|permission denied|"
@@ -27,7 +27,7 @@ def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 90
         native_bundle.unchanged(snapshot)
         remaining = deadline - time.monotonic()
         if remaining <= 0:
-            raise guard.Refused("native_pods_operation_interrupted")
+            refuse("native_pods_operation_interrupted", log, guard.Refused)
         with tempfile.TemporaryFile() as child_log:
             code = native_bundle.command(argv, folder, child_log, timeout=remaining)
             body = diagnostic(child_log)

package/action/scripts/test_native_pods.py

@@ -142,6 +142,7 @@ class PodsTests(unittest.TestCase):
         self.locked()
         script = self.root / "pod"
         script.write_text('#!' + sys.executable + '\nimport os,time\nfrom pathlib import Path\n'
+                          'print("Downloading dependencies\\nRead timed out\\nPRIVATE_SENTINEL", flush=True)\n'
                           'Path("owned-child").write_text(str(os.getpid()))\ntime.sleep(30)\n')
         script.chmod(0o700)
         self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
@@ -155,8 +156,11 @@ class PodsTests(unittest.TestCase):
             output, errors = child.communicate(timeout=10)
         self.assertTrue((self.root / "owned-child").exists())
         self.assertEqual(json.loads(output)["code"], "native_pods_operation_interrupted")
+        self.assertIn("Downloading dependencies", json.loads(output).get("diagnostic", ""))
+        self.assertNotIn("PRIVATE_SENTINEL", output + errors)
         self.assertTrue(errors.startswith("::error title=native_prepare_failed::"))
         self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["code"], "native_pods_operation_interrupted")
+        self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["signals"], ["connection_timeout"])
         owned_pid = int((self.root / "owned-child").read_text())
         deadline = time.monotonic() + 5
         while time.monotonic() < deadline:

package/action/scripts/test_native_pods_diagnostics.py

@@ -37,3 +37,30 @@ class DiagnosticsTests(unittest.TestCase):
         self.assertLessEqual(len(result.splitlines()), 30)
         pem = b"-----BEGIN PRIVATE KEY-----\nPRIVATE_PEM_VALUE\n-----END PRIVATE KEY-----\n"
         self.assertNotIn("PRIVATE_PEM_VALUE", diagnostic(io.BytesIO(pem), {}))
+
+    def test_cocoapods_primary_exception_survives_long_stack_and_secondary_failure(self):
+        body = ('Analyzing dependencies\n### Error\n\n```\n'
+                'FixturePodError - cannot install dependency 12.3\n'
+                'Authorization: Bearer fixture-private-value\n'
+                'https://fixture-user:fixture-password@example.invalid/private\n')
+        body += ''.join(f'/ruby/gems/example/file_{index}.rb:12:in helper_{index}\n' for index in range(80))
+        body += '```\nTEMPLATE END\nSearching for inspections failed: secondary query refused\n'
+        result = diagnostic(io.BytesIO(body.encode()), {})
+        self.assertIn('FixturePodError - cannot install dependency 12.3', result)
+        self.assertIn('secondary query refused', result)
+        self.assertNotIn('fixture-private-value', result)
+        self.assertNotIn('fixture-password', result)
+        self.assertNotIn('example.invalid', result)
+        self.assertLessEqual(len(result), 4000)
+        self.assertLessEqual(len(result.splitlines()), 30)
+        self.assertEqual(diagnostic(io.BytesIO(result.encode()), {}), result)
+
+    def test_primary_exception_survives_character_bound_as_well_as_line_bound(self):
+        body = '### Error\n\n```\nFixturePodError - initial failure\n'
+        body += ('frame with many ordinary path components ' * 8 + '\n') * 28
+        body += 'secondary cleanup failure\n'
+        result = diagnostic(io.BytesIO(body.encode()), {})
+        self.assertIn('FixturePodError - initial failure', result)
+        self.assertIn('secondary cleanup failure', result)
+        self.assertLessEqual(len(result), 4000)
+        self.assertLessEqual(len(result.splitlines()), 30)

package/action/scripts/test_native_pods_retry.py

@@ -95,6 +95,7 @@ class RetryTests(unittest.TestCase):
             self.assertEqual([c.kwargs["timeout"] for c in command.call_args_list], [899, 200])
             command.reset_mock()
             with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 901]):
-                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted"):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted") as caught:
                     native_pods_retry.install(["fixture"], self.root, log, {})
             self.assertEqual(command.call_count, 1)
+            self.assertEqual(caught.exception.diagnostic, PARTIAL)

package/action/scripts/test_native_pods_timeout.py

@@ -0,0 +1,34 @@
+"""Keep a real timed-out Pod child's sanitized evidence after its private log closes."""
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import native_dependency_guard as guard
+import native_pods_retry
+
+
+@unittest.skipUnless(os.name == "posix", "owned POSIX process groups")
+class TimeoutTests(unittest.TestCase):
+    def test_timeout_retains_bounded_diagnostic_without_retrying_or_leaving_child(self):
+        with tempfile.TemporaryDirectory(prefix="native-pods-timeout-") as folder:
+            root = Path(folder)
+            script = ('import os,time; from pathlib import Path; '
+                      'Path("attempts").open("a").write("attempt\\n"); '
+                      'print("x" * 20000, flush=True); '
+                      'print("Downloading dependencies\\nRead timed out\\nPRIVATE_SENTINEL", flush=True); '
+                      'Path("child").write_text(str(os.getpid())); time.sleep(30)')
+            with tempfile.TemporaryFile() as log, patch.dict(os.environ, {"TEST_TOKEN": "PRIVATE_SENTINEL"}):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted") as caught:
+                    native_pods_retry.install([sys.executable, "-c", script], root, log, {}, timeout=1)
+            self.assertEqual((root / "attempts").read_text(), "attempt\n")
+            with self.assertRaises(ProcessLookupError):
+                os.kill(int((root / "child").read_text()), 0)
+            body = getattr(caught.exception, "diagnostic", "")
+            self.assertIn("Downloading dependencies", body)
+            self.assertIn("Read timed out", body)
+            self.assertNotIn("PRIVATE_SENTINEL", body)
+            self.assertLessEqual(len(body), 4000)
+            self.assertLessEqual(len(body.splitlines()), 30)

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.113
+1.0.115

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.113
+1.0.115

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.113",
+  "version": "1.0.115",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {