gowalk-cicd 1.0.122 → 1.0.124

package/action/.daemux-version

@@ -1 +1 @@
-1.0.122
+1.0.124

package/action/scripts/native_pods_retry.py

@@ -1,4 +1,4 @@
-"""Retry one positively identified interrupted Pod fetch within the existing install deadline."""
+"""Retry one positively identified transient Pod fetch fault within the existing install deadline."""
 import json
 import re
 import sys
@@ -14,6 +14,11 @@ TERMINAL = re.compile(
     r"repository not found|checksum|compatible versions|deployment mode|"
     r"returned error:\s*(?:401|403|407)\b|\bcurl(?:\s+(?:51|60)\b|:\s*\((?:51|60)\))", re.I)
 PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
+# CocoaPods reports a timed-out CDN spec fetch as its own sentence and never as a curl
+# code, so the partial-transfer evidence above cannot see it: "CDN: trunk URL couldn't be
+# downloaded: <url> Response: Timeout was reached". A timeout leaves the successfully
+# fetched specs cached, so the second attempt resumes rather than starting over.
+TIMED_OUT = re.compile(r"Response:\s*Timeout was reached|\bcurl(?:\s+28\b|:\s*\(28\))", re.I)
 
 
 def interrupted_transfer(body: str) -> bool:
@@ -21,6 +26,17 @@ def interrupted_transfer(body: str) -> bool:
         text in body.lower() for text in ("early eof", "transfer closed", "bytes of body are still expected")))
 
 
+def timed_out(body: str) -> bool:
+    return bool(TIMED_OUT.search(body) and not TERMINAL.search(body))
+
+
+def retryable(body: str) -> str:
+    """Name the transient class this failure belongs to, or "" when it is not one."""
+    if interrupted_transfer(body):
+        return "partial_transfer"
+    return "transient_timeout" if timed_out(body) else ""
+
+
 def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:
     deadline = time.monotonic() + timeout
     for attempt in (1, 2):
@@ -35,9 +51,10 @@ def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 90
         log.seek(0)
         log.truncate()
         log.write(body.encode())
-        if code == 0 or attempt == 2 or not interrupted_transfer(body):
+        reason = retryable(body)
+        if code == 0 or attempt == 2 or not reason:
             return code, attempt
-        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": "partial_transfer"}
+        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": reason}
         print("::notice title=native_pods_retry::" + json.dumps(payload, separators=(",", ":")),
               file=sys.stderr, flush=True)
     raise AssertionError("unreachable")

package/action/scripts/test_native_pods_retry.py

@@ -12,6 +12,10 @@ import native_pods_retry
 import test_native_pods
 
 PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data remaining\nfatal: early EOF"
+# Verbatim from ios-zuper-sms Mobile Deploy 34346560202, after the diagnostic's own URL
+# redaction — the form `retryable` actually sees.
+TIMEOUT = "\n".join(["CDN: trunk URL couldn't be downloaded: [URL redacted] "
+                     "Response: Timeout was reached"] * 30)
 
 
 class RetryTests(unittest.TestCase):
@@ -81,6 +85,42 @@ class RetryTests(unittest.TestCase):
                 self.assertEqual(self.fixture.run_cli()[0], 1)
                 self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
 
+    def test_timed_out_cdn_fetch_recovers_within_the_same_deadline(self):
+        self.script([TIMEOUT])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["pod_attempts"]), (0, 2))
+        attempts = json.loads((self.root / "attempts.json").read_text())
+        self.assertEqual(len(attempts), 2)
+        for attempt in attempts:
+            self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+            self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+        self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_timeout_stops_after_second_attempt(self):
+        self.script([TIMEOUT, TIMEOUT, TIMEOUT])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_terminal_evidence_dominates_a_timeout(self):
+        for failure in ("certificate verify failed", "The requested URL returned error: 403",
+                        "checksum mismatch", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([TIMEOUT + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_each_transient_class_is_named_and_unrelated_waits_are_not_retried(self):
+        self.assertEqual(native_pods_retry.retryable(TIMEOUT), "transient_timeout")
+        self.assertEqual(native_pods_retry.retryable(PARTIAL), "partial_transfer")
+        self.assertEqual(native_pods_retry.retryable("curl: (28) Operation timed out"),
+                         "transient_timeout")
+        for body in ("the timeout was generous", "Response: 404 Not Found",
+                     "waiting for the lock", "unknown network error"):
+            with self.subTest(body=body):
+                self.assertEqual(native_pods_retry.retryable(body), "")
+
     def test_one_deadline_and_no_guess_from_generic_eof(self):
         for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
             self.assertFalse(native_pods_retry.interrupted_transfer(body))

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.122
+1.0.124

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.122
+1.0.124

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.122",
+  "version": "1.0.124",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -127,6 +127,70 @@ function copyAction(source, destination, repoRoot, dryRun) {
   return { dest, existed, fileCount };
 }
 
+// A workflow overwrite is wholesale: the template replaces the consumer's file.
+// Anything that repo had tuned for itself is gone, and until now silently — the
+// only thing standing between an app and a broken deploy was somebody reading
+// the diff. obd-scanner adopted twice in one morning and both times the
+// template's `runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}` replaced an
+// inline runtime env for a secret that repo does not define; adopting it as
+// written would have deployed an empty environment (2026-09-09).
+//
+// So say what changed. This is a receipt, not a merge: the template still wins,
+// and the adopting session is told exactly which of its own bindings to put
+// back. Workflows are committed files, so nothing here is secret material —
+// values are truncated only to keep the report readable.
+const BINDING = /^\s*([A-Za-z0-9_.-]+):\s*(\S.*?)\s*$/;
+const REPORT_LIMIT = 20;
+
+function bindings(text) {
+  // Every distinct `key: value` pair, not one per key. Keys like
+  // `timeout-minutes` appear many times across jobs and an app tunes a
+  // particular one; keying by name alone reported the first occurrence and
+  // silently missed exactly the binding that had been changed.
+  const found = new Map();
+  for (const line of String(text).split('\n')) {
+    const match = BINDING.exec(line);
+    if (!match) continue;
+    const [, key, value] = match;
+    if (!found.has(key)) found.set(key, new Set());
+    found.get(key).add(value);
+  }
+  return found;
+}
+
+function short(value) {
+  const text = String(value).replace(/\s+/g, ' ').trim();
+  return text.length > 80 ? text.slice(0, 77) + '...' : text;
+}
+
+export function changedBindings(before, after) {
+  const old = bindings(before), fresh = bindings(after);
+  const changes = [];
+  for (const [key, values] of old) {
+    const now = fresh.get(key);
+    for (const value of values) {
+      if (now && now.has(value)) continue;          // this exact pair survived
+      changes.push({ key, before: value, after: now ? [...now].join(' | ') : null });
+    }
+  }
+  return changes;
+}
+
+function reportOverwrite(relative, before, after) {
+  const changes = changedBindings(before, after);
+  if (!changes.length) return changes;
+  console.log(`  ${relative}: ${changes.length} binding(s) this repo had set were replaced by the template.`);
+  console.log('  Restore the ones this app owns before committing:');
+  for (const change of changes.slice(0, REPORT_LIMIT)) {
+    console.log(`    ${change.key}: ${short(change.before)}`
+      + (change.after === null ? '  ->  (removed)' : `  ->  ${short(change.after)}`));
+  }
+  if (changes.length > REPORT_LIMIT) {
+    console.log(`    ...and ${changes.length - REPORT_LIMIT} more; read the full diff.`);
+  }
+  return changes;
+}
+
 function copyWorkflow(repoRoot, dryRun) {
   const dest = join(repoRoot, WORKFLOW_DEST_REL);
   const existed = existsSync(dest);
@@ -135,8 +199,10 @@ function copyWorkflow(repoRoot, dryRun) {
     return { dest, existed };
   }
   ensureDir(dirname(dest));
+  const previous = existed ? readFileSync(dest, 'utf8') : '';
   cpSync(WORKFLOW_TEMPLATE, dest, { force: true });
   console.log(`  ${existed ? 'Overwrote' : 'Created'} ${WORKFLOW_DEST_REL}`);
+  if (existed) reportOverwrite(WORKFLOW_DEST_REL, previous, readFileSync(dest, 'utf8'));
   return { dest, existed };
 }
 
@@ -148,8 +214,10 @@ function copyBackendWorkflow(repoRoot, dryRun) {
     return;
   }
   ensureDir(dirname(dest));
+  const previous = existed ? readFileSync(dest, 'utf8') : '';
   cpSync(BACKEND_WORKFLOW_TEMPLATE, dest, { force: true });
   console.log(`  ${existed ? 'Overwrote' : 'Created'} ${BACKEND_WORKFLOW_DEST_REL}`);
+  if (existed) reportOverwrite(BACKEND_WORKFLOW_DEST_REL, previous, readFileSync(dest, 'utf8'));
 }
 
 function writeVersionMarkers(repoRoot, dryRun) {
@@ -244,8 +312,12 @@ export async function runInstall({ dryRun = false } = {}) {
       console.log(`  [dry-run] ${webWorkflowExisted ? 'overwrite' : 'create'} ${WEB_WORKFLOW_DEST_REL}`);
     } else {
       ensureDir(dirname(webWorkflowDest));
+      const webWorkflowPrevious = webWorkflowExisted ? readFileSync(webWorkflowDest, 'utf8') : '';
       cpSync(WEB_WORKFLOW_TEMPLATE, webWorkflowDest, { force: true });
       console.log(`  ${webWorkflowExisted ? 'Overwrote' : 'Created'} ${WEB_WORKFLOW_DEST_REL}`);
+      if (webWorkflowExisted) {
+        reportOverwrite(WEB_WORKFLOW_DEST_REL, webWorkflowPrevious, readFileSync(webWorkflowDest, 'utf8'));
+      }
     }
   }