gowalk-cicd 1.0.116 → 1.0.118

package/action/.daemux-version

@@ -1 +1 @@
-1.0.116
+1.0.118

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.116
+1.0.118

package/android-action/flutter-setup/action.yml

@@ -49,6 +49,13 @@ inputs:
     description: Git clone source
     required: false
     default: https://github.com/flutter/flutter.git
+  archive-budget-seconds:
+    description: >-
+      Seconds the proxied SDK archive transfer may take. Raise it in a release
+      job, whose own timeout is far longer than a validation job's; the helper
+      clamps it and the partial archive is cached either way.
+    required: false
+    default: ''
 outputs:
   CHANNEL:
     value: ${{ steps.flutter-action.outputs.CHANNEL }}
@@ -196,6 +203,7 @@ runs:
         ${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}
       GOWALK_FLUTTER_RELEASE_CACHE: ${{ steps.release-metadata.outputs.path }}
       GOWALK_FLUTTER_RELEASE_PIN: ${{ steps.release-metadata.outputs.pin }}
+      GOWALK_FLUTTER_ARCHIVE_BUDGET_S: ${{ inputs.archive-budget-seconds }}
     with:
       channel: ${{ steps.flutter-action.outputs.CHANNEL }}
       flutter-version: ${{ steps.flutter-action.outputs.VERSION }}

package/android-action/scripts/flutter_manifest.py

@@ -9,11 +9,42 @@ import time
 from urllib.parse import urlsplit
 
 import flutter_download
+
+#: Seconds an archive transfer may take before its receipt is published. The
+#: enclosing job's own room is the only thing that bounds it usefully, and the
+#: two differ by a factor of three: a validation job must report inside 30
+#: minutes, while a release job has 45-60. A default-branch deploy cannot
+#: restore the SDK cache a task branch built (GitHub scopes branch caches away
+#: from the default branch), so it downloads the whole archive through the
+#: account's residential exit at a few hundred KB/s — and a fixed 20-minute cap
+#: made that a guaranteed failure: obd-scanner's release retained 428 MB of its
+#: archive, failed on curl 28, and shipped nothing (2026-09-09).
+ARCHIVE_BUDGET_S = 1200
+MAX_ARCHIVE_BUDGET_S = 3000
+
+
+def archive_budget() -> int:
+    """The archive deadline, from ``GOWALK_FLUTTER_ARCHIVE_BUDGET_S`` when the
+    workflow declares one. Clamped: never below the current default, never
+    beyond a release job's own timeout."""
+    try:
+        declared = int(os.environ.get("GOWALK_FLUTTER_ARCHIVE_BUDGET_S", "") or ARCHIVE_BUDGET_S)
+    except ValueError:
+        return ARCHIVE_BUDGET_S
+    return max(ARCHIVE_BUDGET_S, min(declared, MAX_ARCHIVE_BUDGET_S))
 import flutter_archive_cache
 import flutter_release_cache
 
 RETRY_CODES = {5, 6, 7, 18, 28, 35, 52, 55, 56, 92, 95}
 RETRY_HTTP = {408, 429, 500, 502, 503, 504}
+#: Attempts each kind of transfer may make. The archive's deadline already
+#: bounds its pass, so four stands there. The MANIFEST is the one that gave up
+#: early: the account exit refused four TLS handshakes in ten seconds (curl 35,
+#: proxy_status 200) and the iOS release failed with fifty seconds of its own
+#: sixty-second budget unspent — an hour after the same fetch had succeeded
+#: (obd-scanner, 2026-09-09). It is a few KB, so riding out an exit that is
+#: briefly refusing costs one small request each time and nothing else.
+MAX_ATTEMPTS = {"manifest": 12, "archive": 4}
 
 
 def download(arguments: list[str], directory: Path) -> int:
@@ -23,7 +54,7 @@ def download(arguments: list[str], directory: Path) -> int:
     if kind == "archive":
         flutter_download.archive_digest()
     child_env = {**os.environ, "NO_PROXY": "", "no_proxy": ""}
-    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else 1200), 1, 0, 0
+    deadline, code, http, proxy_http = time.monotonic() + (60 if kind == "manifest" else archive_budget()), 1, 0, 0
     destination = directory / "download"
     destination.touch(mode=0o600, exist_ok=True)
     destination.chmod(0o600)
@@ -32,7 +63,8 @@ def download(arguments: list[str], directory: Path) -> int:
     if flutter_archive_cache.reuse_complete(destination, kind):
         return 0
     attempted = 0
-    for attempt in range(1, 5):
+    limit = MAX_ATTEMPTS[kind]
+    for attempt in range(1, limit + 1):
         remaining = deadline - time.monotonic()
         if remaining <= 0:
             break
@@ -48,7 +80,7 @@ def download(arguments: list[str], directory: Path) -> int:
             if attempt > 1:
                 print(f"flutter_{kind}_recovered attempts={attempt}", file=sys.stderr)
             return 0
-        if attempt == 4 or proxy_http in {401, 403, 407} or http in {401, 403}:
+        if attempt == limit or proxy_http in {401, 403, 407} or http in {401, 403}:
             break
         restart = kind == "archive" and code == 33 and http == 200
         if (not restart and code not in RETRY_CODES and http not in RETRY_HTTP
@@ -58,7 +90,13 @@ def download(arguments: list[str], directory: Path) -> int:
             destination.write_bytes(b"")
         if destination.stat().st_size > flutter_download.MAX_ARCHIVE_BYTES:
             raise ValueError("flutter_archive_size_exceeded")
-        time.sleep(min(2 ** (attempt - 1), max(0, deadline - time.monotonic())))
+        left = max(0.0, deadline - time.monotonic())
+        # The manifest waits a flat second between tries: it is riding out an
+        # exit that is refusing right now, and an exponential backoff would
+        # spend its sixty-second window sleeping instead of retrying. The
+        # archive keeps the growing wait — its attempts are minutes long.
+        pause = 1 if kind == "manifest" else 2 ** (attempt - 1)
+        time.sleep(min(pause, left))
     flutter_download.failure(kind, code, http, proxy_http, attempted, destination.stat().st_size)
     return code or 1
 

package/android-action/scripts/test_flutter_download_budget.py

@@ -38,5 +38,108 @@ class DownloadBudgetTests(unittest.TestCase):
         self.assertNotIn("fixture-secret", error.getvalue())
 
 
+class ArchiveBudgetTests(unittest.TestCase):
+    def test_a_release_job_may_declare_more_archive_room_than_a_validation_job(self):
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("GOWALK_FLUTTER_ARCHIVE_BUDGET_S", None)
+            self.assertEqual(flutter_manifest.archive_budget(), 1200)
+            os.environ["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = "2100"
+            self.assertEqual(flutter_manifest.archive_budget(), 2100)
+            # Never shorter than the default, never past a release job's timeout,
+            # and a malformed value is the default rather than a refusal.
+            os.environ["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = "60"
+            self.assertEqual(flutter_manifest.archive_budget(), 1200)
+            os.environ["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = "999999"
+            self.assertEqual(flutter_manifest.archive_budget(), 3000)
+            os.environ["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = "not-a-number"
+            self.assertEqual(flutter_manifest.archive_budget(), 1200)
+            os.environ["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = ""
+            self.assertEqual(flutter_manifest.archive_budget(), 1200)
+
+    def test_a_declared_budget_actually_extends_the_transfer_deadline(self):
+        elapsed = [0.0]
+
+        def transfer(_url, destination, _kind, remaining, _env):
+            elapsed[0] += min(600, remaining)
+            with destination.open("ab") as output:
+                output.write(b"partial")
+            return 28, 200, 200
+
+        with tempfile.TemporaryDirectory() as directory, contextlib.redirect_stderr(io.StringIO()):
+            with patch.dict(os.environ, HTTPS_PROXY="http://fixture:secret@localhost:1",
+                            GOWALK_FLUTTER_ARCHIVE_SHA256="a" * 64,
+                            GOWALK_FLUTTER_ARCHIVE_BUDGET_S="2100"):
+                with patch.object(flutter_manifest.time, "monotonic", side_effect=lambda: elapsed[0]), \
+                        patch.object(flutter_manifest.time, "sleep", side_effect=lambda seconds: None), \
+                        patch.object(flutter_manifest.flutter_download, "transfer", side_effect=transfer):
+                    flutter_manifest.download(["--connect-timeout", "15", "--retry", "5",
+                        "https://fixture.invalid/flutter_infra_release/releases/stable/linux/sdk.tar.xz"],
+                        Path(directory))
+        # The declared deadline bounds the pass, not the two 600 s attempts a
+        # 1200 s default allowed: the last attempt gets the remaining 300 s.
+        self.assertEqual(elapsed[0], 2100)
+
+
+
+
+class ManifestRetryTests(unittest.TestCase):
+    def test_a_briefly_refusing_exit_is_retried_until_the_deadline(self):
+        """The iOS release lost its manifest to four TLS refusals in ten seconds
+        (curl 35, proxy_status 200) with fifty seconds of budget unspent, an hour
+        after the same fetch succeeded."""
+        elapsed, attempts = [0.0], []
+
+        def transfer(_url, destination, _kind, _remaining, _env):
+            attempts.append(elapsed[0])
+            elapsed[0] += 2.5          # a TLS refusal fails fast
+            destination.write_bytes(b"")
+            return 35, 0, 200
+
+        with tempfile.TemporaryDirectory() as directory, contextlib.redirect_stderr(io.StringIO()) as error:
+            with patch.dict(os.environ, HTTPS_PROXY="http://fixture:secret@localhost:1"):
+                with patch.object(flutter_manifest.time, "monotonic", side_effect=lambda: elapsed[0]), \
+                        patch.object(flutter_manifest.time, "sleep",
+                                     side_effect=lambda seconds: elapsed.__setitem__(0, elapsed[0] + seconds)), \
+                        patch.object(flutter_manifest.flutter_download, "transfer", side_effect=transfer):
+                    result = flutter_manifest.download(["--silent", "--connect-timeout", "15", "--retry", "5",
+                        "https://fixture.invalid/flutter_infra_release/releases/releases_macos.json"],
+                        Path(directory))
+        self.assertEqual(result, 35)
+        # It used the manifest's whole 60 s window instead of giving up at 10 s.
+        self.assertGreater(len(attempts), 4)
+        self.assertLessEqual(len(attempts), flutter_manifest.MAX_ATTEMPTS["manifest"])
+        self.assertGreater(elapsed[0], 30)
+        # The deadline bounds the pass; the last attempt may end just past it.
+        self.assertLess(elapsed[0], 70)
+        self.assertIn("attempts=%d" % len(attempts), error.getvalue())
+        self.assertNotIn("secret", error.getvalue())
+
+    def test_an_exit_that_recovers_mid_window_still_publishes(self):
+        elapsed, calls = [0.0], []
+
+        def transfer(_url, destination, _kind, _remaining, _env):
+            calls.append(1)
+            elapsed[0] += 2.5
+            if len(calls) < 6:
+                destination.write_bytes(b"")
+                return 35, 0, 200
+            destination.write_bytes(b'{"releases": []}')
+            return 0, 200, 200
+
+        with tempfile.TemporaryDirectory() as directory, contextlib.redirect_stderr(io.StringIO()) as error:
+            with patch.dict(os.environ, HTTPS_PROXY="http://fixture:secret@localhost:1"):
+                with patch.object(flutter_manifest.time, "monotonic", side_effect=lambda: elapsed[0]), \
+                        patch.object(flutter_manifest.time, "sleep",
+                                     side_effect=lambda seconds: elapsed.__setitem__(0, elapsed[0] + seconds)), \
+                        patch.object(flutter_manifest.flutter_download, "publish", side_effect=lambda *a: None), \
+                        patch.object(flutter_manifest.flutter_download, "transfer", side_effect=transfer):
+                    result = flutter_manifest.download(["--silent", "--connect-timeout", "15", "--retry", "5",
+                        "https://fixture.invalid/flutter_infra_release/releases/releases_macos.json"],
+                        Path(directory))
+        self.assertEqual(result, 0)
+        self.assertEqual(len(calls), 6)
+        self.assertIn("flutter_manifest_recovered attempts=6", error.getvalue())
+
+
 if __name__ == "__main__":
     unittest.main()

package/android-action/scripts/test_flutter_manifest.py

@@ -5,6 +5,8 @@ import subprocess
 import tempfile
 import unittest
 
+import flutter_manifest
+
 from flutter_manifest_fixture import HOST, MANIFEST, official_setup, tls_proxy
 
 ROOT = Path(__file__).parent
@@ -47,7 +49,7 @@ class ManifestRecoveryTests(unittest.TestCase):
             env.update(HOME=str(self.root / "absent-home"), NO_PROXY="", no_proxy="")
         args = ["bash", str(self.setup), "-p", "-n", "3.44.0", "-a", "x64", "-k", "custom-:version:-:hash:"]
         result = subprocess.run([*args, *(["-t"] if test_mode else []), "stable"], env=env,
-                                capture_output=True, text=True, timeout=20)
+                                capture_output=True, text=True, timeout=120)
         self.assertNotIn("fixture-secret", result.stdout + result.stderr)
         self.assertFalse(list(self.root.glob("flutter-manifest-*")))
         return result
@@ -99,12 +101,18 @@ class ManifestRecoveryTests(unittest.TestCase):
         self.assertIn("attempts=1", result.stderr)
         self.assertEqual(result.stdout, "")
 
-    def test_repeated_tls_resets_stop_after_four_private_attempts(self):
-        with tls_proxy(self.root, ["reset"] * 4) as (server, cert):
+    def test_repeated_tls_resets_are_retried_across_the_manifest_window(self):
+        """An exit that refuses TLS is retried until the manifest's own deadline,
+        not abandoned after four handshakes: obd-scanner's iOS release lost its
+        manifest to four refusals in ten seconds with fifty seconds of its
+        sixty-second budget unspent, an hour after the same fetch succeeded
+        (2026-09-09). Nothing is ever sent to the origin."""
+        limit = flutter_manifest.MAX_ATTEMPTS["manifest"]
+        with tls_proxy(self.root, ["reset"] * limit) as (server, cert):
             result = self.invoke(server, cert)
             self.assertEqual(result.returncode, 35)
-            self.assertEqual((server.connects, server.requests), (4, []))
-        self.assertIn("attempts=4", result.stderr)
+            self.assertEqual((server.connects, server.requests), (limit, []))
+        self.assertIn(f"attempts={limit}", result.stderr)
         self.assertEqual(result.stdout, "")
 
     def test_missing_proxy_refuses_before_any_connection(self):

package/android-action/scripts/test_flutter_proxy_retry.py

@@ -7,6 +7,8 @@ import sys
 import tempfile
 import unittest
 
+import flutter_manifest
+
 from flutter_manifest_fixture import HOST, MANIFEST, tls_proxy
 
 ROOT = Path(__file__).parent
@@ -35,7 +37,7 @@ class ProxyRetryTests(unittest.TestCase):
             args.insert(0, "--silent")
         result = subprocess.run([sys.executable, str(ROOT / "flutter_manifest.py"), *args,
                                  f"https://{HOST}/flutter_infra_release/releases/{path}"],
-                                env=env, capture_output=True, timeout=20)
+                                env=env, capture_output=True, timeout=120)
         self.assertNotIn(b"fixture-secret", result.stdout + result.stderr)
         self.assertFalse(list(self.root.glob("flutter-manifest-*")))
         return result
@@ -48,12 +50,17 @@ class ProxyRetryTests(unittest.TestCase):
                 self.assertEqual((server.connects, len(server.requests)), (2, 1))
                 self.assertIn(b"flutter_manifest_recovered attempts=2", result.stderr)
 
-    def test_repeated_connect_failure_stops_after_four_attempts_without_origin_request(self):
-        with tls_proxy(self.root, ["proxy_502"] * 4) as (server, cert):
+    def test_repeated_connect_failure_never_reaches_the_origin(self):
+        """A refusing proxy is retried across the manifest's own window and the
+        origin request is never sent — the attempt count follows the manifest
+        limit, not a fixed four (see test_flutter_manifest)."""
+        limit = flutter_manifest.MAX_ATTEMPTS["manifest"]
+        with tls_proxy(self.root, ["proxy_502"] * limit) as (server, cert):
             result = self.invoke(server, cert)
             self.assertNotEqual(result.returncode, 0)
-            self.assertEqual((result.stdout, server.connects, server.requests), (b"", 4, []))
-            self.assertIn(b"http_status=0 proxy_status=502 attempts=4 retained_bytes=0", result.stderr)
+            self.assertEqual((result.stdout, server.connects, server.requests), (b"", limit, []))
+            self.assertIn(f"http_status=0 proxy_status=502 attempts={limit} retained_bytes=0".encode(),
+                          result.stderr)
 
     def test_connect_failure_preserves_partial_archive_for_a_verified_range_resume(self):
         with tls_proxy(self.root, ["partial", "proxy_502", "range"], ARCHIVE) as (server, cert):

package/android-action/scripts/test_google_bootstrap_wiring.py

@@ -20,6 +20,9 @@ class BootstrapWiringTests(unittest.TestCase):
             if step is install:
                 expected_env["GOWALK_FLUTTER_ARCHIVE_CACHE"] = (
                     "${{ inputs.cache == 'true' && format('{0}/gowalk-flutter-archives', runner.temp) || '' }}")
+                # Only the step that actually transfers the archive carries the
+                # caller's declared budget; the dry-run resolve must not.
+                expected_env["GOWALK_FLUTTER_ARCHIVE_BUDGET_S"] = "${{ inputs.archive-budget-seconds }}"
             self.assertEqual(step["env"], expected_env)
             self.assertEqual(step["with"]["cache"], "false")
             self.assertEqual(step["with"]["pub-cache"], "false")
@@ -38,6 +41,11 @@ class BootstrapWiringTests(unittest.TestCase):
                     self.assertEqual(job["env"]["GOOGLE_STORE_PROXY_URL"],
                                      "${{ secrets.GOOGLE_STORE_PROXY_URL }}")
                     self.assertNotIn("continue-on-error", step)
+                    # A release job runs on the default branch, which cannot
+                    # restore a task branch's SDK cache, so it declares the
+                    # archive room its own timeout allows (2026-09-09).
+                    if name == "deploy.yml" and int(job.get("timeout-minutes", 0)) >= 45:
+                        self.assertEqual(step["with"]["archive-budget-seconds"], "2100")
         self.assertEqual(checked, 3)
         setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
         steps = setup["runs"]["steps"]
@@ -65,7 +73,9 @@ class BootstrapWiringTests(unittest.TestCase):
         setup = yaml.safe_load((ROOT / "android-action/flutter-setup/action.yml").read_text())
         inputs = {"channel", "flutter-version", "flutter-version-file", "architecture", "cache", "cache-key",
                   "cache-path", "pub-cache", "pub-cache-key", "pub-cache-path", "dry-run", "git-source"}
-        self.assertEqual(set(setup["inputs"]), inputs)
+        # `archive-budget-seconds` is this action's own knob, not one of the
+        # official action's inputs: it reaches the transfer as an env var.
+        self.assertEqual(set(setup["inputs"]), inputs | {"archive-budget-seconds"})
         resolve = next(step for step in setup["runs"]["steps"] if step.get("id") == "flutter-action")
         for name in inputs - {"cache", "pub-cache", "dry-run"}:
             self.assertEqual(resolve["with"][name], "${{ inputs." + name + " }}")

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.116
+1.0.118

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.116",
+  "version": "1.0.118",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -101,6 +101,12 @@ jobs:
         with:
           channel: stable
           cache: true
+          # A release runs on the default branch, which cannot restore the SDK
+          # cache a task branch built, so it downloads the whole archive through
+          # the account exit. This job has an hour; the helper's own 20-minute
+          # default belongs to a validation job and turned that download into a
+          # guaranteed failure (obd-scanner, 2026-09-09: 428 MB retained, curl 28).
+          archive-budget-seconds: '2100'
       - name: Retain CocoaPods cache process scope
         id: pods-cache-scope
         if: ${{ steps.flutter.outputs.enabled == 'true' }}
@@ -411,6 +417,9 @@ jobs:
         with:
           channel: stable
           cache: true
+          # 35 of this job's 45 minutes; see the iOS job for why a release needs
+          # more archive room than a validation run.
+          archive-budget-seconds: '2100'
       # Flutter apps can depend on private git packages. Most repos in this fleet
       # embed a PAT directly in the pubspec URL, which publishes the token into
       # source and into every fork of the lockfile. Setting the optional