gowalk-cicd 1.0.123 → 1.0.125

package/action/.daemux-version

@@ -1 +1 @@
-1.0.123
+1.0.125

package/action/scripts/native_pods_retry.py

@@ -1,4 +1,4 @@
-"""Retry one positively identified interrupted Pod fetch within the existing install deadline."""
+"""Retry one positively identified transient Pod fetch fault within the existing install deadline."""
 import json
 import re
 import sys
@@ -14,6 +14,11 @@ TERMINAL = re.compile(
     r"repository not found|checksum|compatible versions|deployment mode|"
     r"returned error:\s*(?:401|403|407)\b|\bcurl(?:\s+(?:51|60)\b|:\s*\((?:51|60)\))", re.I)
 PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
+# CocoaPods reports a timed-out CDN spec fetch as its own sentence and never as a curl
+# code, so the partial-transfer evidence above cannot see it: "CDN: trunk URL couldn't be
+# downloaded: <url> Response: Timeout was reached". A timeout leaves the successfully
+# fetched specs cached, so the second attempt resumes rather than starting over.
+TIMED_OUT = re.compile(r"Response:\s*Timeout was reached|\bcurl(?:\s+28\b|:\s*\(28\))", re.I)
 
 
 def interrupted_transfer(body: str) -> bool:
@@ -21,6 +26,17 @@ def interrupted_transfer(body: str) -> bool:
         text in body.lower() for text in ("early eof", "transfer closed", "bytes of body are still expected")))
 
 
+def timed_out(body: str) -> bool:
+    return bool(TIMED_OUT.search(body) and not TERMINAL.search(body))
+
+
+def retryable(body: str) -> str:
+    """Name the transient class this failure belongs to, or "" when it is not one."""
+    if interrupted_transfer(body):
+        return "partial_transfer"
+    return "transient_timeout" if timed_out(body) else ""
+
+
 def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:
     deadline = time.monotonic() + timeout
     for attempt in (1, 2):
@@ -35,9 +51,10 @@ def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 90
         log.seek(0)
         log.truncate()
         log.write(body.encode())
-        if code == 0 or attempt == 2 or not interrupted_transfer(body):
+        reason = retryable(body)
+        if code == 0 or attempt == 2 or not reason:
             return code, attempt
-        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": "partial_transfer"}
+        payload = {"schema": "gowalk-cicd/native-pods-retry.v1", "attempt": 2, "reason": reason}
         print("::notice title=native_pods_retry::" + json.dumps(payload, separators=(",", ":")),
               file=sys.stderr, flush=True)
     raise AssertionError("unreachable")

package/action/scripts/test_native_pods_retry.py

@@ -12,6 +12,10 @@ import native_pods_retry
 import test_native_pods
 
 PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data remaining\nfatal: early EOF"
+# Verbatim from ios-zuper-sms Mobile Deploy 34346560202, after the diagnostic's own URL
+# redaction — the form `retryable` actually sees.
+TIMEOUT = "\n".join(["CDN: trunk URL couldn't be downloaded: [URL redacted] "
+                     "Response: Timeout was reached"] * 30)
 
 
 class RetryTests(unittest.TestCase):
@@ -81,6 +85,42 @@ class RetryTests(unittest.TestCase):
                 self.assertEqual(self.fixture.run_cli()[0], 1)
                 self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
 
+    def test_timed_out_cdn_fetch_recovers_within_the_same_deadline(self):
+        self.script([TIMEOUT])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["pod_attempts"]), (0, 2))
+        attempts = json.loads((self.root / "attempts.json").read_text())
+        self.assertEqual(len(attempts), 2)
+        for attempt in attempts:
+            self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+            self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+        self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_timeout_stops_after_second_attempt(self):
+        self.script([TIMEOUT, TIMEOUT, TIMEOUT])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_terminal_evidence_dominates_a_timeout(self):
+        for failure in ("certificate verify failed", "The requested URL returned error: 403",
+                        "checksum mismatch", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([TIMEOUT + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_each_transient_class_is_named_and_unrelated_waits_are_not_retried(self):
+        self.assertEqual(native_pods_retry.retryable(TIMEOUT), "transient_timeout")
+        self.assertEqual(native_pods_retry.retryable(PARTIAL), "partial_transfer")
+        self.assertEqual(native_pods_retry.retryable("curl: (28) Operation timed out"),
+                         "transient_timeout")
+        for body in ("the timeout was generous", "Response: 404 Not Found",
+                     "waiting for the lock", "unknown network error"):
+            with self.subTest(body=body):
+                self.assertEqual(native_pods_retry.retryable(body), "")
+
     def test_one_deadline_and_no_guess_from_generic_eof(self):
         for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
             self.assertFalse(native_pods_retry.interrupted_transfer(body))

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.123
+1.0.125

package/android-action/play-upload/owner.cjs

@@ -3,17 +3,31 @@ const record = require('./owner_record.cjs');
 const {performance} = require('node:perf_hooks');
 const {setTimeout: delay} = require('node:timers/promises');
 
+// The last ownership write's outcome, as one allow-listed token. A release that
+// cannot be verified used to name nothing at all, so a 403 (token identity), a
+// 409 (CAS race) and a silent transport fault were one indistinguishable code
+// and no session could act on it (Foundy, 2026-09-09, run 34345638488).
+function evidence(status) {
+  if (Number.isInteger(status) && status >= 100 && status <= 599) return `release_write_status=${status}`;
+  return 'release_write_status=error';
+}
+
 async function seal(client, selected) {
+  let detail = 'release_write_status=none';
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = record.validate(await client.read(selected.path), selected);
     if (row.value.owner !== null && !record.same(row.value.owner, selected.owner)) return;
     const idle = record.replacement(row, null);
-    try { await client.write(selected.path, row, idle); } catch { /* Reconcile a possibly applied write. */ }
+    // Reconcile a possibly applied write; keep only its status as evidence.
+    try { detail = evidence(await client.write(selected.path, row, idle)); }
+    catch { detail = evidence(undefined); }
     const after = record.validate(await client.read(selected.path), selected);
     if (after.value.revision === idle.revision && after.value.owner === null) return;
     if (after.value.owner !== null && !record.same(after.value.owner, selected.owner)) return;
   }
-  throw new Error('play_owner_release_unverified');
+  const failure = new Error('play_owner_release_unverified');
+  failure.detail = detail;
+  throw failure;
 }
 
 async function acquire(client, selected, attempted = () => {}, waiting = {}) {
@@ -59,7 +73,22 @@ async function withOwner(env, packageName, operation, transport, timing = {}) {
     result = await operation(() => cancelled);
   } catch (error) { failure = error; }
   finally {
-    try { if (dirty) await seal(client, selected); } catch { failure = new Error('play_owner_release_unverified'); }
+    // An unverified release must not erase why the operation itself failed: the
+    // build's real error is the actionable one, and overwriting it left a
+    // session with a fence code and no cause. Keep the first failure and carry
+    // the release problem alongside it.
+    try { if (dirty) await seal(client, selected); }
+    catch (error) {
+      // The classified code is always what leaves this function: a raw read or
+      // transport error carries provider text that must never reach a receipt
+      // or an annotation. Only this file's own allow-listed token travels.
+      const detail = typeof error?.detail === 'string' ? error.detail : undefined;
+      if (failure) { if (detail) failure.releaseUnverified = detail; }
+      else {
+        failure = new Error('play_owner_release_unverified');
+        if (detail) failure.detail = detail;
+      }
+    }
     process.off('SIGTERM', stop); process.off('SIGINT', stop);
   }
   if (cancelled && (!failure || failure.name === 'AbortError')) failure = new Error('play_owner_cancelled');
@@ -72,10 +101,14 @@ async function withOwner(env, packageName, operation, transport, timing = {}) {
 
 const codes = ['play_owner_binding_required', 'play_owner_unverified', 'play_owner_busy',
   'play_owner_release_unverified', 'play_owner_cancelled', 'play_owner_principal_unverified'];
-function annotation(reason, childExit) {
+function annotation(reason, childExit, detail) {
   const allowed = [...codes, 'play_owner_child_failed', 'play_owner_package_unverified'];
   const code = allowed.includes(reason) ? reason : 'play_owner_unverified';
   const exit = Number.isInteger(childExit) && childExit >= 0 && childExit <= 255 ? childExit : 'unknown';
-  return `::error title=play_edit_owner::gowalk-cicd/play-owner.v1 code=${code} child_exit_code=${exit}`;
+  // An optional trailing token, admitted only in the shape this file mints, so
+  // a provider message can never reach the annotation through it.
+  const extra = typeof detail === 'string' && /^release_write_status=(?:[1-5][0-9]{2}|error|none)$/.test(detail)
+    ? ` ${detail}` : '';
+  return `::error title=play_edit_owner::gowalk-cicd/play-owner.v1 code=${code} child_exit_code=${exit}${extra}`;
 }
 module.exports = {acquire, seal, withOwner, codes, annotation};

package/android-action/play-upload/owner_http.cjs

@@ -55,6 +55,10 @@ function client(repo, token, transport = request) {
       const response = await send('PUT', `/contents/${path}`, {branch, sha: old.sha,
         message: 'Update scoped Play edit ownership', content: Buffer.from(JSON.stringify(value)).toString('base64')});
       if (![200, 201, 409, 422].includes(response.status)) throw new Error('play_owner_unverified');
+      // The status is the only safe evidence a failed ownership write leaves:
+      // 409/422 is a CAS race, 403 a token identity. Callers reconcile through
+      // a readback and would otherwise discard it (`owner.cjs`).
+      return response.status;
     },
     run: owner => send('GET', `/actions/runs/${owner.run_id}/attempts/${owner.run_attempt}`),
   };

package/android-action/play-upload/owner_run.cjs

@@ -51,7 +51,8 @@ async function main(argv = process.argv.slice(2), env = process.env) {
   } catch (error) {
     const code = [...owner.codes, 'play_owner_child_failed', 'play_owner_package_unverified'].includes(error.message)
       ? error.message : 'play_owner_unverified';
-    console.log(owner.annotation(code, error.operationResult?.code));
+    console.log(owner.annotation(code, error.operationResult?.code,
+      error.detail || (typeof error.releaseUnverified === 'string' ? error.releaseUnverified : undefined)));
     process.exitCode = 1;
   }
 }

package/android-action/play-upload/run.cjs

@@ -44,7 +44,8 @@ async function main() {
       upload(program, env, directory, processRunner.execute, 3600000, cancelled,
         (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
   } catch (error) {
-    if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message));
+    if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message, undefined,
+      error.detail || (typeof error.releaseUnverified === 'string' ? error.releaseUnverified : undefined)));
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
       'uploader_source_unavailable', ...owner.codes];
     receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.123
+1.0.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.123",
+  "version": "1.0.125",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {