gowalk-cicd 1.0.128 → 1.0.129

package/action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.129

package/action/scripts/crashlytics_dsyms.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import argparse
 import os
+import plistlib
 import re
 import subprocess
 import sys
@@ -46,6 +47,43 @@ def select_app_id(raw: str, platform: str) -> str | None:
     return _pick(parse_app_ids(raw), platform)
 
 
+CONFIG_NAME = "GoogleService-Info.plist"
+
+
+def app_id_from_config(search_root: Path, platform: str) -> str | None:
+    """Read the Firebase app ID out of the app's own GoogleService-Info.plist.
+
+    Firebase reads this file at runtime, it is committed beside the Xcode project and it
+    is already inside the archive, so requiring the same value in a separate secret adds
+    a way to be wrong without adding a source of truth. An explicit FIREBASE_APP_ID still
+    wins; this is only consulted when it names no app for the platform.
+    """
+    if not search_root.is_dir():
+        return None
+    root = search_root.resolve()
+    found: dict[str, Path] = {}
+    for path in sorted(root.rglob(CONFIG_NAME)):
+        # A pod ships its own fixtures; only the app's committed config speaks for it.
+        if path.is_symlink() or root not in path.resolve().parents:
+            continue
+        if "Pods" in path.relative_to(root).parts:
+            continue
+        try:
+            with path.open("rb") as stream:
+                raw = plistlib.load(stream).get("GOOGLE_APP_ID", "")
+        except (OSError, ValueError, plistlib.InvalidFileException):
+            continue
+        match = APP_ID_RE.match(str(raw).strip())
+        if match and match.group(3) == platform:
+            found.setdefault(match.group(0), path)
+    if len(found) > 1:
+        listing = ", ".join(f"{path.relative_to(root)} -> {app_id}"
+                            for app_id, path in sorted(found.items()))
+        raise AppIdError(f"more than one {platform} Firebase app is configured ({listing}); "
+                         "set FIREBASE_APP_ID to say which one owns these symbols")
+    return next(iter(found), None)
+
+
 def find_upload_symbols(search_root: Path, home: Path | None = None) -> Path | None:
     """Locate the FirebaseCrashlytics `upload-symbols` tool.
 

package/action/scripts/prepare_crashlytics_build.py

@@ -12,21 +12,129 @@ import subprocess
 
 MARKER = "echo 'Crashlytics dSYMs are retained by CI for the account-proxied console upload'"
 UPLOADS = ("upload-crashlytics-symbols", "upload-symbols", "Crashlytics/run")
+# Shell words a symbol-upload phase may legitimately run besides the upload itself.
+# `dart pub global activate flutterfire_cli` is how the FlutterFire CLI installs the
+# uploader it is about to call; the rest are the inert built-ins the generated guards use
+# to skip the upload when the tool is absent (Firebase via SwiftPM, for instance).
+INERT = frozenset({"echo", "exit", "true", "false", ":", "[", "[[", "test", "return"})
+KEYWORDS = frozenset({"if", "then", "else", "elif", "fi", "do", "done", "while", "until"})
+ASSIGNMENT = re.compile(r"[A-Za-z_][A-Za-z_0-9]*=")
+OPERATOR = set(";&|<>")
+REDIRECT = set("<>")
 
 
-def dedicated(script: str) -> bool:
-    lines = [line.strip() for line in script.replace("\\\n", " ").splitlines()
-             if line.strip() and not line.lstrip().startswith("#")]
-    commands = [line for line in lines if not re.fullmatch(r'(?:export )?PATH=[^;&|<>`]+', line)]
-    if len(commands) != 1 or any(token in script for token in ("$(", "`")):
+def continued(script: str) -> list[str]:
+    """Split into logical lines, joining only a REAL backslash-newline continuation.
+
+    `echo done\\` ends in an escaped backslash, so the newline still separates commands and
+    the next line runs. Joining unconditionally turned that next command into an argument
+    of the echo and hid it, so count the trailing backslashes: an odd number continues.
+    """
+    lines: list[str] = []
+    pending = ""
+    for line in script.split("\n"):
+        line = pending + line
+        if (len(line) - len(line.rstrip("\\"))) % 2:
+            pending = line[:-1] + " "
+            continue
+        lines.append(line)
+        pending = ""
+    if pending:
+        lines.append(pending)
+    return lines
+
+
+def commands(script: str) -> list[list[str]] | None:
+    """Every command in `script` as a token list, or None when it cannot be read safely.
+
+    A newline separates commands just as `;` does, and shlex treats it as plain
+    whitespace, so each line is tokenized on its own after continuations are joined.
+    """
+    if "$(" in script or "`" in script:
+        return None
+    parsed = []
+    for line in continued(script):
+        lexer = shlex.shlex(line, posix=True, punctuation_chars=";&|<>")
+        lexer.whitespace_split = True
+        # shlex would treat a '#' ANYWHERE outside quotes as starting a comment, but the
+        # shell only does so at the start of a word: in `upload-symbols#; rm -rf /` the
+        # rm really runs. Read comments the way the shell does instead.
+        lexer.commenters = ""
+        try:
+            tokens = list(lexer)
+        except ValueError:
+            return None
+        current = []
+        target = False
+        for token in tokens:
+            if target:                      # the file a redirect writes, not a command
+                target = False
+                continue
+            if token.startswith("#"):
+                break
+            if token and set(token) <= OPERATOR:
+                if set(token) & REDIRECT:   # a redirect belongs to the command it follows
+                    target = True
+                    continue
+                if current:
+                    parsed.append(current)
+                current = []
+            elif token in KEYWORDS:
+                if current:
+                    parsed.append(current)
+                current = []
+            else:
+                current.append(token)
+        if current:
+            parsed.append(current)
+    return parsed
+
+
+def invoked(tokens: list[str]) -> list[str]:
+    """What the command actually runs, after any leading VAR=value prefixes.
+
+    `CONFIG=release rm -rf build` runs rm; treating the assignment as the whole command
+    would approve anything hiding behind one.
+    """
+    index = 0
+    while index < len(tokens) and ASSIGNMENT.match(tokens[index]):
+        index += 1
+    return tokens[index:]
+
+
+def uploads_symbols(tokens: list[str]) -> bool:
+    words = invoked(tokens)
+    if not words:
         return False
-    lexer = shlex.shlex(commands[0], posix=True, punctuation_chars=";&|<>")
-    lexer.whitespace_split = True
-    tokens = list(lexer)
-    if not tokens or any(set(token) <= set(";&|<>") for token in tokens):
+    return (words[0].endswith(("upload-symbols", "Crashlytics/run"))
+            or (words[0] == "flutterfire" and words[1:2] == ["upload-crashlytics-symbols"]))
+
+
+def permitted(tokens: list[str]) -> bool:
+    words = invoked(tokens)
+    if not words:
+        return True
+    if words[0] == "export" and all(ASSIGNMENT.match(word) for word in words[1:]):
+        return True                          # `export PATH=...` is the same inert prologue
+    return (uploads_symbols(words)
+            or words[0] in INERT
+            or words[:5] == ["dart", "pub", "global", "activate", "flutterfire_cli"])
+
+
+def dedicated(script: str) -> bool:
+    """True when the phase uploads symbols and does nothing else the archive needs.
+
+    The uploader is generated, not hand-written: `flutterfire configure` emits a guard
+    clause, a PATH export, a `dart pub global activate` and the upload, and the Firebase
+    documentation emits an if/else around `$PODS_ROOT/FirebaseCrashlytics/upload-symbols`.
+    Demanding a single command rejected both, so the phase every Flutter app actually has
+    could never be deferred. What matters is that nothing ELSE in the phase builds
+    anything, since the whole script is replaced.
+    """
+    parsed = commands(script)
+    if parsed is None:
         return False
-    return (tokens[0].endswith(("upload-symbols", "Crashlytics/run"))
-            or (tokens[0] == "flutterfire" and tokens[1:2] == ["upload-crashlytics-symbols"]))
+    return any(uploads_symbols(tokens) for tokens in parsed) and all(map(permitted, parsed))
 
 
 def rewrite(document: dict) -> list[str]:
@@ -38,8 +146,10 @@ def rewrite(document: dict) -> list[str]:
         active = "\n".join(line for line in script.splitlines() if not line.lstrip().startswith("#"))
         if not any(token in active for token in UPLOADS):
             continue
-        if "crashlytics" not in str(phase.get("name", "")).lower() or not dedicated(script):
-            raise ValueError("Crashlytics upload is in a mixed build phase; separate it before archiving")
+        if not dedicated(script):
+            raise ValueError(
+                f"Crashlytics upload shares the build phase {phase.get('name') or identity!r} with other "
+                "work; move the upload into its own phase before archiving")
         phase["shellScript"] = MARKER
         changed.append(identity)
     return changed

package/action/scripts/prepare_crashlytics_dsyms.py

@@ -10,7 +10,8 @@ from pathlib import Path
 import subprocess
 import zipfile
 
-from crashlytics_dsyms import find_upload_symbols, select_app_id
+from crashlytics_dsyms import (CONFIG_NAME, app_id_from_config, find_upload_symbols,
+                               select_app_id)
 
 SCHEMA = "gowalk-cicd/firebase-symbols-pending.v1"
 
@@ -50,7 +51,12 @@ def main() -> None:
         print("No Crashlytics SDK upload tool found; no Firebase symbol delivery is required.")
         return
     if not app_id:
-        raise SystemExit("The app embeds Crashlytics but FIREBASE_APP_ID names no iOS app")
+        app_id = app_id_from_config(args.search_root, "ios")
+    if not app_id:
+        raise SystemExit(
+            "The app embeds Crashlytics but no iOS Firebase app is named: FIREBASE_APP_ID is "
+            f"unset or names another platform, and no {CONFIG_NAME} under "
+            f"{args.search_root} carries an iOS GOOGLE_APP_ID")
     receipt = prepare(args.archive, args.output, app_id)
     print("::notice title=firebase_symbols_pending::" + json.dumps(receipt, separators=(",", ":")))
 

package/action/scripts/test_prepare_crashlytics.py

@@ -2,6 +2,7 @@
 import hashlib
 import json
 import os
+import plistlib
 from pathlib import Path
 import sys
 import tempfile
@@ -39,6 +40,116 @@ class BuildPhaseTests(unittest.TestCase):
         self.assertTrue(build.dedicated('#!/bin/sh\nPATH="$PATH:$HOME/bin"\n'
                                        'flutterfire upload-crashlytics-symbols --platform=ios'))
 
+    # Verbatim from gowalk-public/obd_scanner_app @3aa60211, whose iOS leg this refused
+    # after pods, signing and the App Store version slot had all already succeeded.
+    FLUTTERFIRE = (
+        '\n#!/bin/bash\n'
+        'if [ ! -f "$PODS_ROOT/FirebaseCrashlytics/upload-symbols" ]; then '
+        'echo "warning: FirebaseCrashlytics upload-symbols not found at '
+        '$PODS_ROOT/FirebaseCrashlytics/upload-symbols; skipping Crashlytics symbol upload '
+        '(Firebase via SwiftPM)"; exit 0; fi\n'
+        'PATH="${PATH}:$FLUTTER_ROOT/bin:$HOME/.pub-cache/bin"\n'
+        'dart pub global activate flutterfire_cli\n'
+        'flutterfire upload-crashlytics-symbols '
+        '--upload-symbols-script-path="$PODS_ROOT/FirebaseCrashlytics/upload-symbols" '
+        '--platform=ios --apple-project-path="${SRCROOT}" '
+        '--env-platform-name="${PLATFORM_NAME}" --env-configuration="${CONFIGURATION}"\n')
+    FIREBASE_DOCS = (
+        'if [ -f "$PODS_ROOT/FirebaseCrashlytics/upload-symbols" ]; then '
+        '$PODS_ROOT/FirebaseCrashlytics/upload-symbols '
+        '-gsp $PROJECT_DIR/Runner/GoogleService-Info.plist -p ios '
+        '$DWARF_DSYM_FOLDER_PATH/$DWARF_DSYM_FILE_NAME; '
+        'else echo "warning: FirebaseCrashlytics upload-symbols not found; '
+        'skipping dSYM upload (Firebase via SwiftPM)"; fi\n')
+
+    def test_the_phases_flutterfire_and_firebase_actually_generate_are_deferred(self):
+        doc = {"objects": {
+            "flutterfire": {"isa": "PBXShellScriptBuildPhase",
+                            "name": 'FlutterFire: "flutterfire upload-crashlytics-symbols"',
+                            "shellScript": self.FLUTTERFIRE},
+            "docs": {"isa": "PBXShellScriptBuildPhase", "name": "Upload dSYMs",
+                     "shellScript": self.FIREBASE_DOCS}}}
+        self.assertEqual(sorted(build.rewrite(doc)), ["docs", "flutterfire"])
+        for identity in ("flutterfire", "docs"):
+            self.assertEqual(doc["objects"][identity]["shellScript"], build.MARKER)
+
+    def test_an_upload_phase_is_deferred_whatever_the_phase_is_called(self):
+        # "Upload dSYMs" is what the Firebase documentation tells you to name it, and a
+        # name has never been evidence about what a script does.
+        doc = {"objects": {"phase": {"isa": "PBXShellScriptBuildPhase", "name": "Upload dSYMs",
+                                     "shellScript": self.FIREBASE_DOCS}}}
+        self.assertEqual(build.rewrite(doc), ["phase"])
+
+    def test_build_work_beside_the_upload_still_refuses_and_names_the_phase(self):
+        for script in ('/bin/sh "$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh" build\n'
+                       '"$PODS_ROOT/FirebaseCrashlytics/run"',
+                       'upload-symbols && rm -rf "$SRCROOT/build"',
+                       'upload-symbols; curl https://example.invalid/x'):
+            with self.subTest(script=script):
+                doc = {"objects": {"p": {"isa": "PBXShellScriptBuildPhase",
+                                         "name": "Crashlytics", "shellScript": script}}}
+                with self.assertRaises(ValueError) as caught:
+                    build.rewrite(doc)
+                self.assertIn("Crashlytics", str(caught.exception))
+                self.assertEqual(doc["objects"]["p"]["shellScript"], script)
+
+    def test_a_hidden_command_is_never_treated_as_an_upload_only_phase(self):
+        for script in ('upload-symbols "$(curl https://example.invalid/x)"',
+                       'upload-symbols `id`',
+                       '$RUNNER upload-symbols',
+                       'echo hi; "unbalanced'):
+            with self.subTest(script=script):
+                self.assertFalse(build.dedicated(script))
+
+    def test_a_command_hiding_behind_an_assignment_prefix_is_still_a_command(self):
+        # `CONFIG=release rm -rf build` RUNS rm. Reading only the first token saw an
+        # assignment and approved the phase, which would have deleted the build tree.
+        for script in ('upload-symbols\nCONFIG=release rm -rf "$SRCROOT/build"',
+                       'A=1 B=2 curl https://example.invalid/x\nupload-symbols'):
+            with self.subTest(script=script):
+                self.assertFalse(build.dedicated(script))
+        self.assertTrue(build.dedicated('FOO=bar upload-symbols -p ios'))
+        self.assertEqual(build.invoked(["A=1", "B=2", "rm", "-rf", "/"]), ["rm", "-rf", "/"])
+        self.assertEqual(build.invoked(["A=1"]), [])
+
+    def test_a_hash_only_starts_a_comment_at_the_start_of_a_word(self):
+        # shlex would treat the '#' as a comment and never see the rm; bash runs it.
+        self.assertFalse(build.dedicated('upload-symbols#; rm -rf /'))
+        self.assertTrue(build.dedicated('upload-symbols -p ios  # upload the dSYMs'))
+        self.assertTrue(build.dedicated('#!/bin/bash\nupload-symbols'))
+
+    def test_an_escaped_backslash_does_not_swallow_the_next_command(self):
+        # `echo done\\` prints a backslash and ENDS; joining every backslash-newline made
+        # the rm an argument of the echo and hid it from the check.
+        self.assertFalse(build.dedicated('"$PODS_ROOT/FirebaseCrashlytics/run"\n'
+                                        'echo done\\\\\nrm -rf /'))
+        self.assertTrue(build.dedicated('upload-symbols \\\n  -p ios'))
+        self.assertEqual(build.continued('a\\\nb'), ["a b"])
+        self.assertEqual(build.continued('a\\\\\nb'), ["a\\\\", "b"])
+
+    def test_inert_prologues_and_redirects_do_not_refuse_a_real_upload_phase(self):
+        for script in ('export PATH=/x\nupload-symbols',
+                       'upload-symbols > /dev/null 2>&1',
+                       'export FLUTTER_ROOT=/f\nflutterfire upload-crashlytics-symbols --platform=ios'):
+            with self.subTest(script=script):
+                self.assertTrue(build.dedicated(script))
+
+    def test_a_destructive_redirect_is_removed_rather_than_refused(self):
+        # The whole script is replaced, so a phase whose only extra effect is a redirect
+        # stops doing it. Refusing would fail the archive and LEAVE the write in place.
+        self.assertTrue(build.dedicated('upload-symbols > "$HOME/.ssh/authorized_keys"'))
+
+    def test_a_redirect_never_hides_a_following_command(self):
+        self.assertFalse(build.dedicated('upload-symbols > f; rm -rf /'))
+        self.assertFalse(build.dedicated('export EVIL=1 rm -rf /\nupload-symbols'))
+
+    def test_a_phase_that_only_mentions_the_uploader_is_left_alone(self):
+        # No upload actually happens, so there is nothing to defer and nothing to refuse.
+        self.assertFalse(build.dedicated('echo "run upload-symbols by hand"'))
+        doc = {"objects": {"p": {"isa": "PBXShellScriptBuildPhase", "name": "Notes",
+                                 "shellScript": "# upload-symbols runs in CI\necho done"}}}
+        self.assertEqual(build.rewrite(doc), [])
+
     def test_legacy_native_entrypoint_never_starts_the_binary(self):
         with mock.patch.object(crashlytics_dsyms.subprocess, "run") as run:
             with self.assertRaises(SystemExit):
@@ -53,14 +164,90 @@ class BuildPhaseTests(unittest.TestCase):
             for parent in (first, second):
                 (parent / "project.pbxproj").write_text("original")
             documents = [json.dumps({"objects": {"phase": {"isa": "PBXShellScriptBuildPhase",
-                         "name": name, "shellScript": "upload-symbols"}}}).encode()
-                         for name in ("Crashlytics", "Mixed")]
+                         "name": "Crashlytics", "shellScript": script}}}).encode()
+                         for script in ("upload-symbols", "upload-symbols; compile-app")]
             with mock.patch.object(build.subprocess, "check_output", side_effect=documents):
                 with self.assertRaises(ValueError):
                     build.prepare(root)
             self.assertEqual((first / "project.pbxproj").read_text(), "original")
 
 
+
+class FirebaseAppIdTests(unittest.TestCase):
+    """The iOS app ID is committed beside the Xcode project; CI need not be told it twice."""
+
+    # Verbatim from gowalk-public/obd_scanner_app, whose archive and IPA both succeeded
+    # and which then failed on "FIREBASE_APP_ID names no iOS app" with the value below
+    # sitting in ios/Runner/GoogleService-Info.plist.
+    IOS_ID = "1:361949697659:ios:493e38c05202a939d9f4de"
+    ANDROID_ID = "1:361949697659:android:0d9dbd2b1c1f4a2b9f4de1"
+
+    def config(self, directory: Path, app_id: str) -> Path:
+        directory.mkdir(parents=True, exist_ok=True)
+        target = directory / crashlytics_dsyms.CONFIG_NAME
+        with target.open("wb") as stream:
+            plistlib.dump({"BUNDLE_ID": "com.gowalk.obdscanner", "GOOGLE_APP_ID": app_id}, stream)
+        return target
+
+    def test_the_committed_config_names_the_app_when_the_secret_does_not(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "android"))
+
+    def test_an_explicit_secret_still_wins_over_the_committed_config(self):
+        override = "1:999999999999:ios:aaaabbbbccccdddd"
+        self.assertEqual(crashlytics_dsyms.select_app_id(override, "ios"), override)
+
+    def test_a_pod_fixture_never_speaks_for_the_app(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Pods" / "SomePod" / "Example", self.IOS_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+
+    def test_two_ios_apps_refuse_rather_than_guess(self):
+        other = "1:361949697659:ios:ffffffffffffffffffffff"
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.config(root / "Watch", other)
+            with self.assertRaises(crashlytics_dsyms.AppIdError) as caught:
+                crashlytics_dsyms.app_id_from_config(root, "ios")
+            for expected in (self.IOS_ID, other, "FIREBASE_APP_ID"):
+                self.assertIn(expected, str(caught.exception))
+
+    def test_the_same_app_configured_twice_is_not_a_conflict(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.config(root / "Runner" / "Resources", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+
+    def test_an_android_only_config_never_answers_for_ios(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.ANDROID_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+
+    def test_unreadable_or_escaping_configs_are_skipped_not_fatal(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            (root / "Broken").mkdir()
+            (root / "Broken" / crashlytics_dsyms.CONFIG_NAME).write_text("not a plist")
+            outside = Path(temporary) / "outside.plist"
+            with outside.open("wb") as stream:
+                plistlib.dump({"GOOGLE_APP_ID": self.IOS_ID}, stream)
+            (root / "Linked").mkdir()
+            (root / "Linked" / crashlytics_dsyms.CONFIG_NAME).symlink_to(outside)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+            self.config(root / "Runner", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+
+    def test_a_missing_directory_is_simply_no_answer(self):
+        self.assertIsNone(crashlytics_dsyms.app_id_from_config(Path("/nonexistent-xyz"), "ios"))
+
+
 @mock.patch.dict(os.environ, {"GITHUB_RUN_ID": "123", "GITHUB_RUN_ATTEMPT": "2", "GITHUB_SHA": "source-sha"})
 class ArchiveTests(unittest.TestCase):
     def test_zip_manifest_and_notice_identify_the_same_build(self):

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.129

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.129

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.128",
+  "version": "1.0.129",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {