gowalk-cicd 1.0.124 → 1.0.125

package/action/.daemux-version

@@ -1 +1 @@
-1.0.124
+1.0.125

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.124
+1.0.125

package/android-action/play-upload/owner.cjs

@@ -3,17 +3,31 @@ const record = require('./owner_record.cjs');
 const {performance} = require('node:perf_hooks');
 const {setTimeout: delay} = require('node:timers/promises');
 
+// The last ownership write's outcome, as one allow-listed token. A release that
+// cannot be verified used to name nothing at all, so a 403 (token identity), a
+// 409 (CAS race) and a silent transport fault were one indistinguishable code
+// and no session could act on it (Foundy, 2026-09-09, run 34345638488).
+function evidence(status) {
+  if (Number.isInteger(status) && status >= 100 && status <= 599) return `release_write_status=${status}`;
+  return 'release_write_status=error';
+}
+
 async function seal(client, selected) {
+  let detail = 'release_write_status=none';
   for (let attempt = 0; attempt < 3; attempt++) {
     const row = record.validate(await client.read(selected.path), selected);
     if (row.value.owner !== null && !record.same(row.value.owner, selected.owner)) return;
     const idle = record.replacement(row, null);
-    try { await client.write(selected.path, row, idle); } catch { /* Reconcile a possibly applied write. */ }
+    // Reconcile a possibly applied write; keep only its status as evidence.
+    try { detail = evidence(await client.write(selected.path, row, idle)); }
+    catch { detail = evidence(undefined); }
     const after = record.validate(await client.read(selected.path), selected);
     if (after.value.revision === idle.revision && after.value.owner === null) return;
     if (after.value.owner !== null && !record.same(after.value.owner, selected.owner)) return;
   }
-  throw new Error('play_owner_release_unverified');
+  const failure = new Error('play_owner_release_unverified');
+  failure.detail = detail;
+  throw failure;
 }
 
 async function acquire(client, selected, attempted = () => {}, waiting = {}) {
@@ -59,7 +73,22 @@ async function withOwner(env, packageName, operation, transport, timing = {}) {
     result = await operation(() => cancelled);
   } catch (error) { failure = error; }
   finally {
-    try { if (dirty) await seal(client, selected); } catch { failure = new Error('play_owner_release_unverified'); }
+    // An unverified release must not erase why the operation itself failed: the
+    // build's real error is the actionable one, and overwriting it left a
+    // session with a fence code and no cause. Keep the first failure and carry
+    // the release problem alongside it.
+    try { if (dirty) await seal(client, selected); }
+    catch (error) {
+      // The classified code is always what leaves this function: a raw read or
+      // transport error carries provider text that must never reach a receipt
+      // or an annotation. Only this file's own allow-listed token travels.
+      const detail = typeof error?.detail === 'string' ? error.detail : undefined;
+      if (failure) { if (detail) failure.releaseUnverified = detail; }
+      else {
+        failure = new Error('play_owner_release_unverified');
+        if (detail) failure.detail = detail;
+      }
+    }
     process.off('SIGTERM', stop); process.off('SIGINT', stop);
   }
   if (cancelled && (!failure || failure.name === 'AbortError')) failure = new Error('play_owner_cancelled');
@@ -72,10 +101,14 @@ async function withOwner(env, packageName, operation, transport, timing = {}) {
 
 const codes = ['play_owner_binding_required', 'play_owner_unverified', 'play_owner_busy',
   'play_owner_release_unverified', 'play_owner_cancelled', 'play_owner_principal_unverified'];
-function annotation(reason, childExit) {
+function annotation(reason, childExit, detail) {
   const allowed = [...codes, 'play_owner_child_failed', 'play_owner_package_unverified'];
   const code = allowed.includes(reason) ? reason : 'play_owner_unverified';
   const exit = Number.isInteger(childExit) && childExit >= 0 && childExit <= 255 ? childExit : 'unknown';
-  return `::error title=play_edit_owner::gowalk-cicd/play-owner.v1 code=${code} child_exit_code=${exit}`;
+  // An optional trailing token, admitted only in the shape this file mints, so
+  // a provider message can never reach the annotation through it.
+  const extra = typeof detail === 'string' && /^release_write_status=(?:[1-5][0-9]{2}|error|none)$/.test(detail)
+    ? ` ${detail}` : '';
+  return `::error title=play_edit_owner::gowalk-cicd/play-owner.v1 code=${code} child_exit_code=${exit}${extra}`;
 }
 module.exports = {acquire, seal, withOwner, codes, annotation};

package/android-action/play-upload/owner_http.cjs

@@ -55,6 +55,10 @@ function client(repo, token, transport = request) {
       const response = await send('PUT', `/contents/${path}`, {branch, sha: old.sha,
         message: 'Update scoped Play edit ownership', content: Buffer.from(JSON.stringify(value)).toString('base64')});
       if (![200, 201, 409, 422].includes(response.status)) throw new Error('play_owner_unverified');
+      // The status is the only safe evidence a failed ownership write leaves:
+      // 409/422 is a CAS race, 403 a token identity. Callers reconcile through
+      // a readback and would otherwise discard it (`owner.cjs`).
+      return response.status;
     },
     run: owner => send('GET', `/actions/runs/${owner.run_id}/attempts/${owner.run_attempt}`),
   };

package/android-action/play-upload/owner_run.cjs

@@ -51,7 +51,8 @@ async function main(argv = process.argv.slice(2), env = process.env) {
   } catch (error) {
     const code = [...owner.codes, 'play_owner_child_failed', 'play_owner_package_unverified'].includes(error.message)
       ? error.message : 'play_owner_unverified';
-    console.log(owner.annotation(code, error.operationResult?.code));
+    console.log(owner.annotation(code, error.operationResult?.code,
+      error.detail || (typeof error.releaseUnverified === 'string' ? error.releaseUnverified : undefined)));
     process.exitCode = 1;
   }
 }

package/android-action/play-upload/run.cjs

@@ -44,7 +44,8 @@ async function main() {
       upload(program, env, directory, processRunner.execute, 3600000, cancelled,
         (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
   } catch (error) {
-    if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message));
+    if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message, undefined,
+      error.detail || (typeof error.releaseUnverified === 'string' ? error.releaseUnverified : undefined)));
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
       'uploader_source_unavailable', ...owner.codes];
     receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.124
+1.0.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.124",
+  "version": "1.0.125",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {