gowalk-cicd 1.0.118 → 1.0.120

package/action/.daemux-version

@@ -1 +1 @@
-1.0.118
+1.0.120

package/action/scripts/mobile_release.cjs

@@ -66,8 +66,19 @@ async function phase(action, platform) {
   if (!id) return; // Existing consumers without release-intent wiring keep their original behavior.
   const record = await api.request('GET', `/deployments/${id}`);
   const expected = owner(platform, record.payload?.fingerprint);
+  // An EARLIER attempt of this same run owns the record legitimately. `admit`
+  // only re-runs when it failed, so "re-run failed jobs" — the ordinary way to
+  // recover a release that died in transport — leaves the record stamped with
+  // attempt 1 while the platform job runs as attempt 2. Demanding an exact
+  // match made that recovery impossible: obd-scanner's Android leg built for
+  // twenty-six minutes, then refused at the upload intent (2026-09-09).
+  // Upload-once does not rest on this number. It rests on the status check
+  // below, which admits `begin-upload` only from `building`; a record whose
+  // upload already began or finished is refused there, on any attempt.
+  const attempt = record.payload?.run_attempt;
   if (record.payload?.schema !== SCHEMA || record.payload.run_id !== expected.run_id ||
-      record.payload.run_attempt !== expected.run_attempt || record.sha !== expected.source_sha ||
+      !Number.isSafeInteger(attempt) || attempt > expected.run_attempt ||
+      record.sha !== expected.source_sha ||
       record.payload.platform !== platform) throw Error('mobile_release_phase_owner_mismatch');
   const statuses = await api.request('GET', `/deployments/${id}/statuses?per_page=1`);
   const required = action === 'begin-upload' ? 'building' : 'uploading';

package/action/scripts/native_pods_diagnostics.py

@@ -37,6 +37,23 @@ def excerpt(text: str) -> str:
     return primary + "\n...\n" + tail
 
 
+#: A long run that is a lowercase snake_case NAME rather than an opaque value.
+#: Thirteen of this helper's own error codes are 32 characters or more —
+#: `native_podfile_lock_commit_required` is 35, `native_google_transport_helper_required`
+#: is 39 — so the catch-all below erased the one token the classifier reads back
+#: out of this text: task 1185's iOS failure published `"code": "[long value
+#: redacted]"` with an empty `signals` list, and every pods failure in the fleet
+#: was diagnosed blind (2026-09-09). Requiring an underscore keeps hex digests and
+#: base32/base64 material opaque, and every environment value has already been
+#: replaced verbatim above.
+_NAME_RUN = re.compile(r"[a-z]+(?:_[a-z0-9]+)+")
+
+
+def _opaque_run(match: "re.Match[str]") -> str:
+    run = match.group(0)
+    return run if _NAME_RUN.fullmatch(run) else "[long value redacted]"
+
+
 def diagnostic(log, environment: dict[str, str] | None = None) -> str:
     log.flush()
     log.seek(0, os.SEEK_END)
@@ -57,7 +74,7 @@ def diagnostic(log, environment: dict[str, str] | None = None) -> str:
                   r'\1"[redacted]"', text)
     text = re.sub(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", "[token redacted]", text)
     text = re.sub(r"https?://[^\s\"'<>]+", "[URL redacted]", text)
-    text = re.sub(r"[A-Za-z0-9_+/=-]{32,}", "[long value redacted]", text)
+    text = re.sub(r"[A-Za-z0-9_+/=-]{32,}", _opaque_run, text)
     return excerpt(text)
 
 

package/action/scripts/test_native_pods_diagnostics.py

@@ -23,6 +23,26 @@ class DiagnosticsTests(unittest.TestCase):
                         'cHJpdmF0ZTpwYXNzd29yZA==', 'PRIVATE_JSON_MARKER', 'PRIVATE_ACCESS_MARKER', 'SECRET'):
             self.assertNotIn(private, result)
 
+    def test_error_codes_survive_while_opaque_runs_of_the_same_length_do_not(self):
+        """The classifier reads the plugin's own code back out of this text, and
+        thirteen of the twenty-seven are 32 characters or more. Task 1185's iOS
+        failure published `"code": "[long value redacted]"` with an empty
+        `signals` list because the catch-all erased it (2026-09-09)."""
+        body = ('{"code": "native_podfile_lock_commit_required", "ok": false}\n'
+                'native_google_transport_helper_required native_pods_operation_unverified\n'
+                'digest 9f2b7c1e4a8d3b6f0c5e2a9d7b4f1c8e3a6d0b5f were removed\n'
+                'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQ==\n'
+                'a_secret_looking_run_of_lowercase_words_kept\n')
+        result = diagnostic(io.BytesIO(body.encode()), {})
+        for code in ('native_podfile_lock_commit_required', 'native_google_transport_helper_required',
+                     'native_pods_operation_unverified'):
+            self.assertIn(code, result)
+        # A hex digest and base64 material carry no underscore and stay opaque.
+        for opaque in ('9f2b7c1e4a8d3b6f0c5e2a9d7b4f1c8e3a6d0b5f',
+                       'MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQ=='):
+            self.assertNotIn(opaque, result)
+        self.assertIn('[long value redacted]', result)
+
     def test_truncated_first_line_and_small_proxy_credentials_cannot_escape(self):
         body = b"x" * 17000 + b"TAIL_SECRET\n[!] Unable to satisfy dependency version 12.3.\n"
         self.assertNotIn("TAIL_SECRET", diagnostic(io.BytesIO(body), {}))

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.118
+1.0.120

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.118
+1.0.120

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.118",
+  "version": "1.0.120",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {