gowalk-cicd 1.0.128 → 1.0.130

package/CLAUDE.md

@@ -434,3 +434,9 @@ workflow after a protected package release/adoption; never run hand-SSH or expos
 The diagnostic reader accepts the product-independent standard WARNING logger envelope, discards its
 logger name and rejects trailing fields. Structured remote failure codes survive exit1; SSH transport,
 read bounds and scope refusals have a closed vocabulary. Unknown exceptions remain unclassified.
+
+The same validated envelope is retained in the dedicated `backend-identity-diagnostics-<job>-<attempt>`
+artifact on success and classified reader failure. Download `result.json` from that exact run;
+GitHub secret masking can alter structural braces in logs. The artifact contains only schema,
+ok, fixed failure and fixed stage/reason records. Raw host output, configuration and identities
+never enter it. Its pinned upload uses the same process-scoped artifact transport as mobile actions.

package/README.md

@@ -1229,6 +1229,12 @@ it does not prove authentication succeeded. Match the bounded observation window
 
 Reader failures retain only: `invalid_scope`, `invalid_window`, `invalid_destination`,
 `container_ambiguous_or_absent`, `container_scope_mismatch`, `command_timeout`, `output_limit`,
-`command_failed`, `transport_failure`, `remote_invalid`, or `unclassified`. Structured remote refusals
+`command_failed`, `transport_failure`, `remote_invalid`, `artifact_write_failed`, or `unclassified`. Structured remote refusals
 survive a remote exit1. SSH transport failures remain distinct. Unknown exceptions never contribute text.
 The optional standard `WARNING:<logger>:` prefix is discarded; logger names and trailing fields are never returned.
+
+Download the dedicated `backend-identity-diagnostics-<job>-<attempt>` artifact from that exact run.
+Its `result.json` contains the validated envelope on success and classified failure, without raw logs,
+headers, environment values, provider exceptions or identities. Normal GitHub artifact integrity checks
+apply. The console copy is supplementary: secret masking can replace JSON punctuation in logs.
+Each invocation uses a fresh local directory so a failed reader cannot publish a prior result.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.130

package/action/scripts/crashlytics_dsyms.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 
 import argparse
 import os
+import plistlib
 import re
 import subprocess
 import sys
@@ -46,6 +47,43 @@ def select_app_id(raw: str, platform: str) -> str | None:
     return _pick(parse_app_ids(raw), platform)
 
 
+CONFIG_NAME = "GoogleService-Info.plist"
+
+
+def app_id_from_config(search_root: Path, platform: str) -> str | None:
+    """Read the Firebase app ID out of the app's own GoogleService-Info.plist.
+
+    Firebase reads this file at runtime, it is committed beside the Xcode project and it
+    is already inside the archive, so requiring the same value in a separate secret adds
+    a way to be wrong without adding a source of truth. An explicit FIREBASE_APP_ID still
+    wins; this is only consulted when it names no app for the platform.
+    """
+    if not search_root.is_dir():
+        return None
+    root = search_root.resolve()
+    found: dict[str, Path] = {}
+    for path in sorted(root.rglob(CONFIG_NAME)):
+        # A pod ships its own fixtures; only the app's committed config speaks for it.
+        if path.is_symlink() or root not in path.resolve().parents:
+            continue
+        if "Pods" in path.relative_to(root).parts:
+            continue
+        try:
+            with path.open("rb") as stream:
+                raw = plistlib.load(stream).get("GOOGLE_APP_ID", "")
+        except (OSError, ValueError, plistlib.InvalidFileException):
+            continue
+        match = APP_ID_RE.match(str(raw).strip())
+        if match and match.group(3) == platform:
+            found.setdefault(match.group(0), path)
+    if len(found) > 1:
+        listing = ", ".join(f"{path.relative_to(root)} -> {app_id}"
+                            for app_id, path in sorted(found.items()))
+        raise AppIdError(f"more than one {platform} Firebase app is configured ({listing}); "
+                         "set FIREBASE_APP_ID to say which one owns these symbols")
+    return next(iter(found), None)
+
+
 def find_upload_symbols(search_root: Path, home: Path | None = None) -> Path | None:
     """Locate the FirebaseCrashlytics `upload-symbols` tool.
 

package/action/scripts/prepare_crashlytics_build.py

@@ -12,21 +12,129 @@ import subprocess
 
 MARKER = "echo 'Crashlytics dSYMs are retained by CI for the account-proxied console upload'"
 UPLOADS = ("upload-crashlytics-symbols", "upload-symbols", "Crashlytics/run")
+# Shell words a symbol-upload phase may legitimately run besides the upload itself.
+# `dart pub global activate flutterfire_cli` is how the FlutterFire CLI installs the
+# uploader it is about to call; the rest are the inert built-ins the generated guards use
+# to skip the upload when the tool is absent (Firebase via SwiftPM, for instance).
+INERT = frozenset({"echo", "exit", "true", "false", ":", "[", "[[", "test", "return"})
+KEYWORDS = frozenset({"if", "then", "else", "elif", "fi", "do", "done", "while", "until"})
+ASSIGNMENT = re.compile(r"[A-Za-z_][A-Za-z_0-9]*=")
+OPERATOR = set(";&|<>")
+REDIRECT = set("<>")
 
 
-def dedicated(script: str) -> bool:
-    lines = [line.strip() for line in script.replace("\\\n", " ").splitlines()
-             if line.strip() and not line.lstrip().startswith("#")]
-    commands = [line for line in lines if not re.fullmatch(r'(?:export )?PATH=[^;&|<>`]+', line)]
-    if len(commands) != 1 or any(token in script for token in ("$(", "`")):
+def continued(script: str) -> list[str]:
+    """Split into logical lines, joining only a REAL backslash-newline continuation.
+
+    `echo done\\` ends in an escaped backslash, so the newline still separates commands and
+    the next line runs. Joining unconditionally turned that next command into an argument
+    of the echo and hid it, so count the trailing backslashes: an odd number continues.
+    """
+    lines: list[str] = []
+    pending = ""
+    for line in script.split("\n"):
+        line = pending + line
+        if (len(line) - len(line.rstrip("\\"))) % 2:
+            pending = line[:-1] + " "
+            continue
+        lines.append(line)
+        pending = ""
+    if pending:
+        lines.append(pending)
+    return lines
+
+
+def commands(script: str) -> list[list[str]] | None:
+    """Every command in `script` as a token list, or None when it cannot be read safely.
+
+    A newline separates commands just as `;` does, and shlex treats it as plain
+    whitespace, so each line is tokenized on its own after continuations are joined.
+    """
+    if "$(" in script or "`" in script:
+        return None
+    parsed = []
+    for line in continued(script):
+        lexer = shlex.shlex(line, posix=True, punctuation_chars=";&|<>")
+        lexer.whitespace_split = True
+        # shlex would treat a '#' ANYWHERE outside quotes as starting a comment, but the
+        # shell only does so at the start of a word: in `upload-symbols#; rm -rf /` the
+        # rm really runs. Read comments the way the shell does instead.
+        lexer.commenters = ""
+        try:
+            tokens = list(lexer)
+        except ValueError:
+            return None
+        current = []
+        target = False
+        for token in tokens:
+            if target:                      # the file a redirect writes, not a command
+                target = False
+                continue
+            if token.startswith("#"):
+                break
+            if token and set(token) <= OPERATOR:
+                if set(token) & REDIRECT:   # a redirect belongs to the command it follows
+                    target = True
+                    continue
+                if current:
+                    parsed.append(current)
+                current = []
+            elif token in KEYWORDS:
+                if current:
+                    parsed.append(current)
+                current = []
+            else:
+                current.append(token)
+        if current:
+            parsed.append(current)
+    return parsed
+
+
+def invoked(tokens: list[str]) -> list[str]:
+    """What the command actually runs, after any leading VAR=value prefixes.
+
+    `CONFIG=release rm -rf build` runs rm; treating the assignment as the whole command
+    would approve anything hiding behind one.
+    """
+    index = 0
+    while index < len(tokens) and ASSIGNMENT.match(tokens[index]):
+        index += 1
+    return tokens[index:]
+
+
+def uploads_symbols(tokens: list[str]) -> bool:
+    words = invoked(tokens)
+    if not words:
         return False
-    lexer = shlex.shlex(commands[0], posix=True, punctuation_chars=";&|<>")
-    lexer.whitespace_split = True
-    tokens = list(lexer)
-    if not tokens or any(set(token) <= set(";&|<>") for token in tokens):
+    return (words[0].endswith(("upload-symbols", "Crashlytics/run"))
+            or (words[0] == "flutterfire" and words[1:2] == ["upload-crashlytics-symbols"]))
+
+
+def permitted(tokens: list[str]) -> bool:
+    words = invoked(tokens)
+    if not words:
+        return True
+    if words[0] == "export" and all(ASSIGNMENT.match(word) for word in words[1:]):
+        return True                          # `export PATH=...` is the same inert prologue
+    return (uploads_symbols(words)
+            or words[0] in INERT
+            or words[:5] == ["dart", "pub", "global", "activate", "flutterfire_cli"])
+
+
+def dedicated(script: str) -> bool:
+    """True when the phase uploads symbols and does nothing else the archive needs.
+
+    The uploader is generated, not hand-written: `flutterfire configure` emits a guard
+    clause, a PATH export, a `dart pub global activate` and the upload, and the Firebase
+    documentation emits an if/else around `$PODS_ROOT/FirebaseCrashlytics/upload-symbols`.
+    Demanding a single command rejected both, so the phase every Flutter app actually has
+    could never be deferred. What matters is that nothing ELSE in the phase builds
+    anything, since the whole script is replaced.
+    """
+    parsed = commands(script)
+    if parsed is None:
         return False
-    return (tokens[0].endswith(("upload-symbols", "Crashlytics/run"))
-            or (tokens[0] == "flutterfire" and tokens[1:2] == ["upload-crashlytics-symbols"]))
+    return any(uploads_symbols(tokens) for tokens in parsed) and all(map(permitted, parsed))
 
 
 def rewrite(document: dict) -> list[str]:
@@ -38,8 +146,10 @@ def rewrite(document: dict) -> list[str]:
         active = "\n".join(line for line in script.splitlines() if not line.lstrip().startswith("#"))
         if not any(token in active for token in UPLOADS):
             continue
-        if "crashlytics" not in str(phase.get("name", "")).lower() or not dedicated(script):
-            raise ValueError("Crashlytics upload is in a mixed build phase; separate it before archiving")
+        if not dedicated(script):
+            raise ValueError(
+                f"Crashlytics upload shares the build phase {phase.get('name') or identity!r} with other "
+                "work; move the upload into its own phase before archiving")
         phase["shellScript"] = MARKER
         changed.append(identity)
     return changed

package/action/scripts/prepare_crashlytics_dsyms.py

@@ -10,7 +10,8 @@ from pathlib import Path
 import subprocess
 import zipfile
 
-from crashlytics_dsyms import find_upload_symbols, select_app_id
+from crashlytics_dsyms import (CONFIG_NAME, app_id_from_config, find_upload_symbols,
+                               select_app_id)
 
 SCHEMA = "gowalk-cicd/firebase-symbols-pending.v1"
 
@@ -50,7 +51,12 @@ def main() -> None:
         print("No Crashlytics SDK upload tool found; no Firebase symbol delivery is required.")
         return
     if not app_id:
-        raise SystemExit("The app embeds Crashlytics but FIREBASE_APP_ID names no iOS app")
+        app_id = app_id_from_config(args.search_root, "ios")
+    if not app_id:
+        raise SystemExit(
+            "The app embeds Crashlytics but no iOS Firebase app is named: FIREBASE_APP_ID is "
+            f"unset or names another platform, and no {CONFIG_NAME} under "
+            f"{args.search_root} carries an iOS GOOGLE_APP_ID")
     receipt = prepare(args.archive, args.output, app_id)
     print("::notice title=firebase_symbols_pending::" + json.dumps(receipt, separators=(",", ":")))
 

package/action/scripts/test_prepare_crashlytics.py

@@ -2,6 +2,7 @@
 import hashlib
 import json
 import os
+import plistlib
 from pathlib import Path
 import sys
 import tempfile
@@ -39,6 +40,116 @@ class BuildPhaseTests(unittest.TestCase):
         self.assertTrue(build.dedicated('#!/bin/sh\nPATH="$PATH:$HOME/bin"\n'
                                        'flutterfire upload-crashlytics-symbols --platform=ios'))
 
+    # Verbatim from gowalk-public/obd_scanner_app @3aa60211, whose iOS leg this refused
+    # after pods, signing and the App Store version slot had all already succeeded.
+    FLUTTERFIRE = (
+        '\n#!/bin/bash\n'
+        'if [ ! -f "$PODS_ROOT/FirebaseCrashlytics/upload-symbols" ]; then '
+        'echo "warning: FirebaseCrashlytics upload-symbols not found at '
+        '$PODS_ROOT/FirebaseCrashlytics/upload-symbols; skipping Crashlytics symbol upload '
+        '(Firebase via SwiftPM)"; exit 0; fi\n'
+        'PATH="${PATH}:$FLUTTER_ROOT/bin:$HOME/.pub-cache/bin"\n'
+        'dart pub global activate flutterfire_cli\n'
+        'flutterfire upload-crashlytics-symbols '
+        '--upload-symbols-script-path="$PODS_ROOT/FirebaseCrashlytics/upload-symbols" '
+        '--platform=ios --apple-project-path="${SRCROOT}" '
+        '--env-platform-name="${PLATFORM_NAME}" --env-configuration="${CONFIGURATION}"\n')
+    FIREBASE_DOCS = (
+        'if [ -f "$PODS_ROOT/FirebaseCrashlytics/upload-symbols" ]; then '
+        '$PODS_ROOT/FirebaseCrashlytics/upload-symbols '
+        '-gsp $PROJECT_DIR/Runner/GoogleService-Info.plist -p ios '
+        '$DWARF_DSYM_FOLDER_PATH/$DWARF_DSYM_FILE_NAME; '
+        'else echo "warning: FirebaseCrashlytics upload-symbols not found; '
+        'skipping dSYM upload (Firebase via SwiftPM)"; fi\n')
+
+    def test_the_phases_flutterfire_and_firebase_actually_generate_are_deferred(self):
+        doc = {"objects": {
+            "flutterfire": {"isa": "PBXShellScriptBuildPhase",
+                            "name": 'FlutterFire: "flutterfire upload-crashlytics-symbols"',
+                            "shellScript": self.FLUTTERFIRE},
+            "docs": {"isa": "PBXShellScriptBuildPhase", "name": "Upload dSYMs",
+                     "shellScript": self.FIREBASE_DOCS}}}
+        self.assertEqual(sorted(build.rewrite(doc)), ["docs", "flutterfire"])
+        for identity in ("flutterfire", "docs"):
+            self.assertEqual(doc["objects"][identity]["shellScript"], build.MARKER)
+
+    def test_an_upload_phase_is_deferred_whatever_the_phase_is_called(self):
+        # "Upload dSYMs" is what the Firebase documentation tells you to name it, and a
+        # name has never been evidence about what a script does.
+        doc = {"objects": {"phase": {"isa": "PBXShellScriptBuildPhase", "name": "Upload dSYMs",
+                                     "shellScript": self.FIREBASE_DOCS}}}
+        self.assertEqual(build.rewrite(doc), ["phase"])
+
+    def test_build_work_beside_the_upload_still_refuses_and_names_the_phase(self):
+        for script in ('/bin/sh "$FLUTTER_ROOT/packages/flutter_tools/bin/xcode_backend.sh" build\n'
+                       '"$PODS_ROOT/FirebaseCrashlytics/run"',
+                       'upload-symbols && rm -rf "$SRCROOT/build"',
+                       'upload-symbols; curl https://example.invalid/x'):
+            with self.subTest(script=script):
+                doc = {"objects": {"p": {"isa": "PBXShellScriptBuildPhase",
+                                         "name": "Crashlytics", "shellScript": script}}}
+                with self.assertRaises(ValueError) as caught:
+                    build.rewrite(doc)
+                self.assertIn("Crashlytics", str(caught.exception))
+                self.assertEqual(doc["objects"]["p"]["shellScript"], script)
+
+    def test_a_hidden_command_is_never_treated_as_an_upload_only_phase(self):
+        for script in ('upload-symbols "$(curl https://example.invalid/x)"',
+                       'upload-symbols `id`',
+                       '$RUNNER upload-symbols',
+                       'echo hi; "unbalanced'):
+            with self.subTest(script=script):
+                self.assertFalse(build.dedicated(script))
+
+    def test_a_command_hiding_behind_an_assignment_prefix_is_still_a_command(self):
+        # `CONFIG=release rm -rf build` RUNS rm. Reading only the first token saw an
+        # assignment and approved the phase, which would have deleted the build tree.
+        for script in ('upload-symbols\nCONFIG=release rm -rf "$SRCROOT/build"',
+                       'A=1 B=2 curl https://example.invalid/x\nupload-symbols'):
+            with self.subTest(script=script):
+                self.assertFalse(build.dedicated(script))
+        self.assertTrue(build.dedicated('FOO=bar upload-symbols -p ios'))
+        self.assertEqual(build.invoked(["A=1", "B=2", "rm", "-rf", "/"]), ["rm", "-rf", "/"])
+        self.assertEqual(build.invoked(["A=1"]), [])
+
+    def test_a_hash_only_starts_a_comment_at_the_start_of_a_word(self):
+        # shlex would treat the '#' as a comment and never see the rm; bash runs it.
+        self.assertFalse(build.dedicated('upload-symbols#; rm -rf /'))
+        self.assertTrue(build.dedicated('upload-symbols -p ios  # upload the dSYMs'))
+        self.assertTrue(build.dedicated('#!/bin/bash\nupload-symbols'))
+
+    def test_an_escaped_backslash_does_not_swallow_the_next_command(self):
+        # `echo done\\` prints a backslash and ENDS; joining every backslash-newline made
+        # the rm an argument of the echo and hid it from the check.
+        self.assertFalse(build.dedicated('"$PODS_ROOT/FirebaseCrashlytics/run"\n'
+                                        'echo done\\\\\nrm -rf /'))
+        self.assertTrue(build.dedicated('upload-symbols \\\n  -p ios'))
+        self.assertEqual(build.continued('a\\\nb'), ["a b"])
+        self.assertEqual(build.continued('a\\\\\nb'), ["a\\\\", "b"])
+
+    def test_inert_prologues_and_redirects_do_not_refuse_a_real_upload_phase(self):
+        for script in ('export PATH=/x\nupload-symbols',
+                       'upload-symbols > /dev/null 2>&1',
+                       'export FLUTTER_ROOT=/f\nflutterfire upload-crashlytics-symbols --platform=ios'):
+            with self.subTest(script=script):
+                self.assertTrue(build.dedicated(script))
+
+    def test_a_destructive_redirect_is_removed_rather_than_refused(self):
+        # The whole script is replaced, so a phase whose only extra effect is a redirect
+        # stops doing it. Refusing would fail the archive and LEAVE the write in place.
+        self.assertTrue(build.dedicated('upload-symbols > "$HOME/.ssh/authorized_keys"'))
+
+    def test_a_redirect_never_hides_a_following_command(self):
+        self.assertFalse(build.dedicated('upload-symbols > f; rm -rf /'))
+        self.assertFalse(build.dedicated('export EVIL=1 rm -rf /\nupload-symbols'))
+
+    def test_a_phase_that_only_mentions_the_uploader_is_left_alone(self):
+        # No upload actually happens, so there is nothing to defer and nothing to refuse.
+        self.assertFalse(build.dedicated('echo "run upload-symbols by hand"'))
+        doc = {"objects": {"p": {"isa": "PBXShellScriptBuildPhase", "name": "Notes",
+                                 "shellScript": "# upload-symbols runs in CI\necho done"}}}
+        self.assertEqual(build.rewrite(doc), [])
+
     def test_legacy_native_entrypoint_never_starts_the_binary(self):
         with mock.patch.object(crashlytics_dsyms.subprocess, "run") as run:
             with self.assertRaises(SystemExit):
@@ -53,14 +164,90 @@ class BuildPhaseTests(unittest.TestCase):
             for parent in (first, second):
                 (parent / "project.pbxproj").write_text("original")
             documents = [json.dumps({"objects": {"phase": {"isa": "PBXShellScriptBuildPhase",
-                         "name": name, "shellScript": "upload-symbols"}}}).encode()
-                         for name in ("Crashlytics", "Mixed")]
+                         "name": "Crashlytics", "shellScript": script}}}).encode()
+                         for script in ("upload-symbols", "upload-symbols; compile-app")]
             with mock.patch.object(build.subprocess, "check_output", side_effect=documents):
                 with self.assertRaises(ValueError):
                     build.prepare(root)
             self.assertEqual((first / "project.pbxproj").read_text(), "original")
 
 
+
+class FirebaseAppIdTests(unittest.TestCase):
+    """The iOS app ID is committed beside the Xcode project; CI need not be told it twice."""
+
+    # Verbatim from gowalk-public/obd_scanner_app, whose archive and IPA both succeeded
+    # and which then failed on "FIREBASE_APP_ID names no iOS app" with the value below
+    # sitting in ios/Runner/GoogleService-Info.plist.
+    IOS_ID = "1:361949697659:ios:493e38c05202a939d9f4de"
+    ANDROID_ID = "1:361949697659:android:0d9dbd2b1c1f4a2b9f4de1"
+
+    def config(self, directory: Path, app_id: str) -> Path:
+        directory.mkdir(parents=True, exist_ok=True)
+        target = directory / crashlytics_dsyms.CONFIG_NAME
+        with target.open("wb") as stream:
+            plistlib.dump({"BUNDLE_ID": "com.gowalk.obdscanner", "GOOGLE_APP_ID": app_id}, stream)
+        return target
+
+    def test_the_committed_config_names_the_app_when_the_secret_does_not(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "android"))
+
+    def test_an_explicit_secret_still_wins_over_the_committed_config(self):
+        override = "1:999999999999:ios:aaaabbbbccccdddd"
+        self.assertEqual(crashlytics_dsyms.select_app_id(override, "ios"), override)
+
+    def test_a_pod_fixture_never_speaks_for_the_app(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Pods" / "SomePod" / "Example", self.IOS_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+
+    def test_two_ios_apps_refuse_rather_than_guess(self):
+        other = "1:361949697659:ios:ffffffffffffffffffffff"
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.config(root / "Watch", other)
+            with self.assertRaises(crashlytics_dsyms.AppIdError) as caught:
+                crashlytics_dsyms.app_id_from_config(root, "ios")
+            for expected in (self.IOS_ID, other, "FIREBASE_APP_ID"):
+                self.assertIn(expected, str(caught.exception))
+
+    def test_the_same_app_configured_twice_is_not_a_conflict(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.IOS_ID)
+            self.config(root / "Runner" / "Resources", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+
+    def test_an_android_only_config_never_answers_for_ios(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            self.config(root / "Runner", self.ANDROID_ID)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+
+    def test_unreadable_or_escaping_configs_are_skipped_not_fatal(self):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            (root / "Broken").mkdir()
+            (root / "Broken" / crashlytics_dsyms.CONFIG_NAME).write_text("not a plist")
+            outside = Path(temporary) / "outside.plist"
+            with outside.open("wb") as stream:
+                plistlib.dump({"GOOGLE_APP_ID": self.IOS_ID}, stream)
+            (root / "Linked").mkdir()
+            (root / "Linked" / crashlytics_dsyms.CONFIG_NAME).symlink_to(outside)
+            self.assertIsNone(crashlytics_dsyms.app_id_from_config(root, "ios"))
+            self.config(root / "Runner", self.IOS_ID)
+            self.assertEqual(crashlytics_dsyms.app_id_from_config(root, "ios"), self.IOS_ID)
+
+    def test_a_missing_directory_is_simply_no_answer(self):
+        self.assertIsNone(crashlytics_dsyms.app_id_from_config(Path("/nonexistent-xyz"), "ios"))
+
+
 @mock.patch.dict(os.environ, {"GITHUB_RUN_ID": "123", "GITHUB_RUN_ATTEMPT": "2", "GITHUB_SHA": "source-sha"})
 class ArchiveTests(unittest.TestCase):
     def test_zip_manifest_and_notice_identify_the_same_build(self):

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.130

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.128
+1.0.130

package/backend-action/action.yml

@@ -182,6 +182,7 @@ runs:
              '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 
     - name: Read fixed backend identity diagnostics
+      id: identity_diagnostics
       if: inputs.operation == 'identity-diagnostics'
       shell: bash
       env:
@@ -191,9 +192,22 @@ runs:
         DIAGNOSTIC_HOST: ${{ inputs.host }}
         DIAGNOSTIC_USER: ${{ inputs.ssh-user }}
       run: |
+        RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-identity-diagnostics.XXXXXX")"
+        echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/identity_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --since "$DIAGNOSTIC_SINCE" \
-          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER"
+          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" \
+          --output "$RESULT_DIR/result.json"
+
+    - name: Retain fixed backend identity result
+      if: always() && inputs.operation == 'identity-diagnostics'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      env:
+        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
+      with:
+        name: backend-identity-diagnostics-${{ github.job }}-${{ github.run_attempt }}
+        path: ${{ steps.identity_diagnostics.outputs.result }}
+        if-no-files-found: error
 
     - name: Cleanup key
       if: always()

package/backend-action/identity_diagnostics.py

@@ -30,6 +30,7 @@ FAILURES = frozenset({
     'unclassified', 'invalid_scope', 'invalid_window', 'invalid_destination',
     'container_ambiguous_or_absent', 'container_scope_mismatch', 'command_timeout',
     'output_limit', 'command_failed', 'transport_failure', 'remote_invalid',
+    'artifact_write_failed',
 })
 
 
@@ -178,6 +179,17 @@ def decode_remote(status, raw):
     return result
 
 
+def retain_result(path, result):
+    """Retain only the already validated public envelope, never captured host output."""
+    try:
+        target = Path(path)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        with target.open('x', encoding='utf-8') as output:
+            output.write(json.dumps(result, separators=(',', ':')) + '\n')
+    except OSError:
+        raise ReaderFailure('artifact_write_failed') from None
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--remote', action='store_true')
@@ -186,16 +198,27 @@ def main():
     parser.add_argument('--since', required=True)
     parser.add_argument('--host')
     parser.add_argument('--user', default='root')
+    parser.add_argument('--output', help='Exclusive local file for the closed diagnostic envelope')
     args = parser.parse_args()
+    status = 0
     try:
+        if args.remote and args.output:
+            raise ReaderFailure('invalid_destination')
         result = remote(args.app, args.service, args.since) if args.remote else local(args)
+        result = decode_remote(0, json.dumps(result).encode())
     except Exception as error:
         # Only our closed vocabulary survives; provider and parser exceptions remain unclassified.
         code = error.code if isinstance(error, ReaderFailure) else 'unclassified'
-        print(json.dumps({'schema': SCHEMA, 'ok': False, 'failure': code, 'records': []}))
-        return 1
+        result = {'schema': SCHEMA, 'ok': False, 'failure': code, 'records': []}
+        status = 1
+    if args.output and not args.remote:
+        try:
+            retain_result(args.output, result)
+        except ReaderFailure as error:
+            result = {'schema': SCHEMA, 'ok': False, 'failure': error.code, 'records': []}
+            status = 1
     print(json.dumps(result, separators=(',', ':')))
-    return 0
+    return status
 
 
 if __name__ == '__main__':

package/backend-action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/backend-action/scripts/cache_scope.cjs

@@ -0,0 +1,83 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/backend-action/test_identity_artifact.py

@@ -0,0 +1,77 @@
+"""The dedicated artifact carries the complete closed result independently of log masking."""
+from contextlib import redirect_stdout
+import hashlib
+import io
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+from test_identity_diagnostics import READER, SINCE
+
+
+class IdentityArtifact(unittest.TestCase):
+    def invoke(self, path, *, result=None, error=None, remote=False):
+        argv = ['reader', '--app', 'fixture', '--service', 'api', '--since', SINCE, '--output', str(path)]
+        if remote:
+            argv.append('--remote')
+        output = io.StringIO()
+        with patch.object(sys, 'argv', argv), patch.object(READER, 'local', return_value=result,
+                side_effect=error), redirect_stdout(output):
+            status = READER.main()
+        return status, output.getvalue()
+
+    def test_success_file_survives_structural_log_redaction_byte_for_byte(self):
+        result = {'schema': READER.SCHEMA, 'ok': True, 'failure': '',
+                  'records': [{'stage': 'auth_signature', 'reason': 'token_invalid'}]}
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            status, log = self.invoke(path, result=result)
+            data = path.read_bytes()
+            self.assertEqual(status, 0)
+            self.assertEqual(json.loads(data), result)
+            self.assertNotEqual(log.replace('{', '***').replace('}', '***'), data.decode())
+            self.assertEqual(hashlib.sha256(data).digest(), hashlib.sha256(log.encode()).digest())
+
+    def test_classified_and_unknown_failures_are_retained_without_exception_data(self):
+        for failure, expected in [(READER.ReaderFailure('container_scope_mismatch'), 'container_scope_mismatch'),
+                                  (RuntimeError('PRIVATE_SENTINEL'), 'unclassified')]:
+            with self.subTest(expected=expected), tempfile.TemporaryDirectory() as folder:
+                path = Path(folder) / 'result.json'
+                status, log = self.invoke(path, error=failure)
+                self.assertEqual(status, 1)
+                self.assertEqual(json.loads(path.read_bytes()), {
+                    'schema': READER.SCHEMA, 'ok': False, 'failure': expected, 'records': []})
+                self.assertNotIn('PRIVATE_SENTINEL', log + path.read_text())
+
+    def test_unvalidated_fields_never_reach_artifact(self):
+        invalid = {'schema': READER.SCHEMA, 'ok': True, 'failure': '', 'records': [], 'raw': 'PRIVATE_SENTINEL'}
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            status, log = self.invoke(path, result=invalid)
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(path.read_text())['failure'], 'remote_invalid')
+            self.assertNotIn('PRIVATE_SENTINEL', log + path.read_text())
+
+    def test_existing_file_is_preserved_and_write_failure_is_closed(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'; path.write_text('existing')
+            status, log = self.invoke(path, error=READER.ReaderFailure('invalid_scope'))
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(log)['failure'], 'artifact_write_failed')
+            self.assertEqual(path.read_text(), 'existing')
+
+    def test_remote_mode_cannot_create_output_files(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            with patch.object(READER, 'remote') as remote:
+                status, log = self.invoke(path, remote=True)
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(log)['failure'], 'invalid_destination')
+            self.assertFalse(path.exists())
+            remote.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.128",
+  "version": "1.0.130",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {