gowalk-cicd 1.0.129 → 1.0.131

package/CLAUDE.md

@@ -417,6 +417,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
   An uncertain upload never starts another binary automatically. Preserve its signed artifact,
   complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
+  The local Android workflow supplies `mobileReleaseIntentScript` to the upload wrapper instead
+  of marking `uploading` before acquiring Play ownership. A refused owner leaves the release
+  record at `building`; the wrapper records intent inside its acquired lease before provider
+  dispatch. Adopt both the action and workflow wiring; action-only updates preserve older
+  workflows' intent handling. Never clear an existing `uploading` marker on an owner refusal.
   Actions without `MOBILE_RELEASE_DEPLOYMENT_ID` preserve legacy consumer behavior. All new
   receipt helper reads are fixed-origin GitHub requests; Apple/Google still use their assigned exits.
 
@@ -434,3 +439,9 @@ workflow after a protected package release/adoption; never run hand-SSH or expos
 The diagnostic reader accepts the product-independent standard WARNING logger envelope, discards its
 logger name and rejects trailing fields. Structured remote failure codes survive exit1; SSH transport,
 read bounds and scope refusals have a closed vocabulary. Unknown exceptions remain unclassified.
+
+The same validated envelope is retained in the dedicated `backend-identity-diagnostics-<job>-<attempt>`
+artifact on success and classified reader failure. Download `result.json` from that exact run;
+GitHub secret masking can alter structural braces in logs. The artifact contains only schema,
+ok, fixed failure and fixed stage/reason records. Raw host output, configuration and identities
+never enter it. Its pinned upload uses the same process-scoped artifact transport as mobile actions.

package/README.md

@@ -1229,6 +1229,12 @@ it does not prove authentication succeeded. Match the bounded observation window
 
 Reader failures retain only: `invalid_scope`, `invalid_window`, `invalid_destination`,
 `container_ambiguous_or_absent`, `container_scope_mismatch`, `command_timeout`, `output_limit`,
-`command_failed`, `transport_failure`, `remote_invalid`, or `unclassified`. Structured remote refusals
+`command_failed`, `transport_failure`, `remote_invalid`, `artifact_write_failed`, or `unclassified`. Structured remote refusals
 survive a remote exit1. SSH transport failures remain distinct. Unknown exceptions never contribute text.
 The optional standard `WARNING:<logger>:` prefix is discarded; logger names and trailing fields are never returned.
+
+Download the dedicated `backend-identity-diagnostics-<job>-<attempt>` artifact from that exact run.
+Its `result.json` contains the validated envelope on success and classified failure, without raw logs,
+headers, environment values, provider exceptions or identities. Normal GitHub artifact integrity checks
+apply. The console copy is supplementary: secret masking can replace JSON punctuation in logs.
+Each invocation uses a fresh local directory so a failed reader cannot publish a prior result.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.129
+1.0.131

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.129
+1.0.131

package/android-action/play-upload/action.yml

@@ -23,6 +23,9 @@ inputs:
   inAppUpdatePriority:
     description: In-app update priority.
     default: '0'
+  mobileReleaseIntentScript:
+    description: Committed mobile_release.cjs path, invoked after acquiring the package owner and before upload.
+    default: ''
 outputs:
   review-pending:
     description: True only after a successful explicitly requested review-hold retry.

package/android-action/play-upload/release_intent.cjs

@@ -0,0 +1,21 @@
+// The workflow supplies its committed release helper; Play ownership precedes the write marker.
+const {spawn} = require('node:child_process');
+
+function begin(env) {
+  const script = env.INPUT_MOBILERELEASEINTENTSCRIPT;
+  // Older workflows record their own intent. Unwired consumers retain that behavior.
+  if (!script || !env.MOBILE_RELEASE_DEPLOYMENT_ID) return;
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, [script, 'begin-upload', 'android'], {env, stdio: 'ignore'});
+    // Keep the owner cancellation handler responsive while its bounded marker write settles.
+    const timer = setTimeout(() => child.kill('SIGKILL'), 120000);
+    child.once('error', () => { clearTimeout(timer); reject(Error('mobile_release_intent_unconfirmed')); });
+    child.once('close', (code, signal) => {
+      clearTimeout(timer);
+      if (code !== 0 || signal) reject(Error('mobile_release_intent_unconfirmed'));
+      else resolve();
+    });
+  });
+}
+
+module.exports = {begin};

package/android-action/play-upload/run.cjs

@@ -5,6 +5,7 @@ const source = require('./source.cjs');
 const processRunner = require('./process.cjs');
 const owner = require('./owner.cjs');
 const diagnostics = require('./diagnostics.cjs');
+const releaseIntent = require('./release_intent.cjs');
 
 async function upload(program, env, directory, execute = processRunner.execute, timeout = 3600000,
   cancelled = () => false, report = () => {}) {
@@ -40,14 +41,17 @@ async function main() {
     if (!env.RUNNER_TEMP || !env.GITHUB_OUTPUT) throw new Error('runner_context_required');
     directory = mkdtempSync(join(env.RUNNER_TEMP, 'gowalk-play-upload-'));
     const program = await source.prepare(directory);
-    receipt = await owner.withOwner(env, env.INPUT_PACKAGENAME, cancelled =>
-      upload(program, env, directory, processRunner.execute, 3600000, cancelled,
-        (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
+    receipt = await owner.withOwner(env, env.INPUT_PACKAGENAME, async cancelled => {
+      if (cancelled()) return {ok: false, code: 'upload_cancelled', attempts: 0, review_pending: false};
+      await releaseIntent.begin(env);
+      return upload(program, env, directory, processRunner.execute, 3600000, cancelled,
+        (attempt, result) => console.log(diagnostics.annotation(attempt, result)));
+    });
   } catch (error) {
     if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message, undefined,
       error.detail || (typeof error.releaseUnverified === 'string' ? error.releaseUnverified : undefined)));
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
-      'uploader_source_unavailable', ...owner.codes];
+      'uploader_source_unavailable', 'mobile_release_intent_unconfirmed', ...owner.codes];
     receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',
       attempts: 0, review_pending: false};
     if (owner.codes.includes(error.message) && error.operationResult) {

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.129
+1.0.131

package/backend-action/action.yml

@@ -182,6 +182,7 @@ runs:
              '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 
     - name: Read fixed backend identity diagnostics
+      id: identity_diagnostics
       if: inputs.operation == 'identity-diagnostics'
       shell: bash
       env:
@@ -191,9 +192,22 @@ runs:
         DIAGNOSTIC_HOST: ${{ inputs.host }}
         DIAGNOSTIC_USER: ${{ inputs.ssh-user }}
       run: |
+        RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-identity-diagnostics.XXXXXX")"
+        echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/identity_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --since "$DIAGNOSTIC_SINCE" \
-          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER"
+          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" \
+          --output "$RESULT_DIR/result.json"
+
+    - name: Retain fixed backend identity result
+      if: always() && inputs.operation == 'identity-diagnostics'
+      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+      env:
+        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
+      with:
+        name: backend-identity-diagnostics-${{ github.job }}-${{ github.run_attempt }}
+        path: ${{ steps.identity_diagnostics.outputs.result }}
+        if-no-files-found: error
 
     - name: Cleanup key
       if: always()

package/backend-action/identity_diagnostics.py

@@ -30,6 +30,7 @@ FAILURES = frozenset({
     'unclassified', 'invalid_scope', 'invalid_window', 'invalid_destination',
     'container_ambiguous_or_absent', 'container_scope_mismatch', 'command_timeout',
     'output_limit', 'command_failed', 'transport_failure', 'remote_invalid',
+    'artifact_write_failed',
 })
 
 
@@ -178,6 +179,17 @@ def decode_remote(status, raw):
     return result
 
 
+def retain_result(path, result):
+    """Retain only the already validated public envelope, never captured host output."""
+    try:
+        target = Path(path)
+        target.parent.mkdir(parents=True, exist_ok=True)
+        with target.open('x', encoding='utf-8') as output:
+            output.write(json.dumps(result, separators=(',', ':')) + '\n')
+    except OSError:
+        raise ReaderFailure('artifact_write_failed') from None
+
+
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--remote', action='store_true')
@@ -186,16 +198,27 @@ def main():
     parser.add_argument('--since', required=True)
     parser.add_argument('--host')
     parser.add_argument('--user', default='root')
+    parser.add_argument('--output', help='Exclusive local file for the closed diagnostic envelope')
     args = parser.parse_args()
+    status = 0
     try:
+        if args.remote and args.output:
+            raise ReaderFailure('invalid_destination')
         result = remote(args.app, args.service, args.since) if args.remote else local(args)
+        result = decode_remote(0, json.dumps(result).encode())
     except Exception as error:
         # Only our closed vocabulary survives; provider and parser exceptions remain unclassified.
         code = error.code if isinstance(error, ReaderFailure) else 'unclassified'
-        print(json.dumps({'schema': SCHEMA, 'ok': False, 'failure': code, 'records': []}))
-        return 1
+        result = {'schema': SCHEMA, 'ok': False, 'failure': code, 'records': []}
+        status = 1
+    if args.output and not args.remote:
+        try:
+            retain_result(args.output, result)
+        except ReaderFailure as error:
+            result = {'schema': SCHEMA, 'ok': False, 'failure': error.code, 'records': []}
+            status = 1
     print(json.dumps(result, separators=(',', ':')))
-    return 0
+    return status
 
 
 if __name__ == '__main__':

package/backend-action/scripts/artifact_env.cjs

@@ -0,0 +1,10 @@
+// Only the exact pinned upload-artifact process receives this GitHub-specific transport.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env, 'artifact');
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_artifact_transport_scope_refused\n');
+  process.exit(1);
+}

package/backend-action/scripts/cache_scope.cjs

@@ -0,0 +1,83 @@
+// Direct routing belongs only to pinned first-party Actions programs and approved HTTPS origins.
+const {readFileSync, copyFileSync, mkdtempSync, appendFileSync} = require('node:fs');
+const {createHash} = require('node:crypto');
+const {basename, dirname, join} = require('node:path');
+const hashes = new Map([
+  ['restore', 'a49301428b4c5477522c00f6464566457ed327d64ae5f80f8c12e762fb2ea9a2'],
+  ['save', 'b969065795aaf5c6d20ba158e910be5d353eefb02eb2785263eb32e13090c066'],
+  ['restore-only', '6255afaa3956351b8cfefc1e82f026b4db418a10678a8eaddf3d6c55f81744de'],
+  ['save-only', '7fb63f90f06ce6a10f39d40a113f99791bffdedad5394cdad5b4dfaa644559cb'],
+]);
+const artifactHash = '168c44946cba03564808c19b83a72601e6d1d6f57081dbd2d6e2ea1cedc522f5';
+const proxyKeys = ['HTTP_PROXY', 'HTTPS_PROXY', 'http_proxy', 'https_proxy', 'ALL_PROXY', 'all_proxy'];
+const refusal = () => new Error('github_cache_transport_scope_refused');
+
+function allowedHost(host) {
+  return host === 'api.github.com'
+    || /^[a-z0-9.-]+\.actions\.githubusercontent\.com$/.test(host)
+    || /^[a-z0-9]{3,24}\.blob\.core\.windows\.net$/.test(host);
+}
+
+function requireOrigin(value, service = false) {
+  let url;
+  try { url = new URL(value); } catch { throw refusal(); }
+  if (url.protocol !== 'https:' || url.port || url.username || url.password || !allowedHost(url.hostname)
+      || (service && !url.hostname.endsWith('.actions.githubusercontent.com'))) throw refusal();
+  return url;
+}
+
+function authorize(entrypoint, env, kind = 'cache') {
+  if (!entrypoint || basename(entrypoint) !== 'index.js' || basename(dirname(dirname(entrypoint))) !== 'dist') {
+    throw refusal();
+  }
+  if (!['cache', 'artifact'].includes(kind)) throw refusal();
+  const program = basename(dirname(entrypoint));
+  const expected = kind === 'artifact' ? (program === 'upload' && artifactHash) : hashes.get(program);
+  if (!expected || createHash('sha256').update(readFileSync(entrypoint)).digest('hex') !== expected) throw refusal();
+  const origins = (kind === 'artifact' ? [env.ACTIONS_RESULTS_URL]
+    : [env.ACTIONS_RESULTS_URL, env.ACTIONS_CACHE_URL]).filter(Boolean);
+  if (!origins.length) throw refusal();
+  for (const origin of origins) requireOrigin(origin, true);
+}
+
+function requireRequest(args, protocol) {
+  const [input, extra] = args;
+  const options = typeof input === 'string' || input instanceof URL
+    ? {protocol, ...require('node:url').urlToHttpOptions(requireOrigin(input)),
+      ...(typeof extra === 'object' ? extra : {})}
+    : {...input};
+  if (!options || options.socketPath || (options.protocol || protocol) !== 'https:') throw refusal();
+  for (const host of [options.hostname, options.host].filter(Boolean)) {
+    requireOrigin(`https://${host}${options.port ? ':' + options.port : ''}`);
+  }
+  if (!options.hostname && !options.host) throw refusal();
+}
+
+function guardRequests() {
+  for (const [name, protocol] of [['node:http', 'http:'], ['node:https', 'https:']]) {
+    const client = require(name);
+    for (const verb of ['request', 'get']) {
+      const original = client[verb];
+      client[verb] = function (...args) { requireRequest(args, protocol); return original.apply(this, args); };
+    }
+  }
+  if (globalThis.fetch) {
+    const original = globalThis.fetch;
+    globalThis.fetch = function (input, init) {
+      requireOrigin(typeof input === 'string' || input instanceof URL ? input : input.url);
+      return original.call(this, input, {...init, redirect: 'error'});
+    };
+  }
+}
+
+function snapshot() {
+  const target = mkdtempSync(join(process.env.RUNNER_TEMP, 'gowalk-cache-scope-'));
+  for (const file of ['cache_env.cjs', 'cache_scope.cjs']) copyFileSync(join(__dirname, file), join(target, file));
+  appendFileSync(process.env.GITHUB_OUTPUT, `preloader=${join(target, 'cache_env.cjs')}\n`);
+}
+
+module.exports = {authorize, guardRequests, proxyKeys, requireOrigin};
+if (require.main === module) {
+  try { if (process.argv[2] !== '--snapshot') throw refusal(); snapshot(); }
+  catch { process.stderr.write('github_cache_scope_snapshot_failed\n'); process.exitCode = 1; }
+}

package/backend-action/test_identity_artifact.py

@@ -0,0 +1,77 @@
+"""The dedicated artifact carries the complete closed result independently of log masking."""
+from contextlib import redirect_stdout
+import hashlib
+import io
+import json
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+from test_identity_diagnostics import READER, SINCE
+
+
+class IdentityArtifact(unittest.TestCase):
+    def invoke(self, path, *, result=None, error=None, remote=False):
+        argv = ['reader', '--app', 'fixture', '--service', 'api', '--since', SINCE, '--output', str(path)]
+        if remote:
+            argv.append('--remote')
+        output = io.StringIO()
+        with patch.object(sys, 'argv', argv), patch.object(READER, 'local', return_value=result,
+                side_effect=error), redirect_stdout(output):
+            status = READER.main()
+        return status, output.getvalue()
+
+    def test_success_file_survives_structural_log_redaction_byte_for_byte(self):
+        result = {'schema': READER.SCHEMA, 'ok': True, 'failure': '',
+                  'records': [{'stage': 'auth_signature', 'reason': 'token_invalid'}]}
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            status, log = self.invoke(path, result=result)
+            data = path.read_bytes()
+            self.assertEqual(status, 0)
+            self.assertEqual(json.loads(data), result)
+            self.assertNotEqual(log.replace('{', '***').replace('}', '***'), data.decode())
+            self.assertEqual(hashlib.sha256(data).digest(), hashlib.sha256(log.encode()).digest())
+
+    def test_classified_and_unknown_failures_are_retained_without_exception_data(self):
+        for failure, expected in [(READER.ReaderFailure('container_scope_mismatch'), 'container_scope_mismatch'),
+                                  (RuntimeError('PRIVATE_SENTINEL'), 'unclassified')]:
+            with self.subTest(expected=expected), tempfile.TemporaryDirectory() as folder:
+                path = Path(folder) / 'result.json'
+                status, log = self.invoke(path, error=failure)
+                self.assertEqual(status, 1)
+                self.assertEqual(json.loads(path.read_bytes()), {
+                    'schema': READER.SCHEMA, 'ok': False, 'failure': expected, 'records': []})
+                self.assertNotIn('PRIVATE_SENTINEL', log + path.read_text())
+
+    def test_unvalidated_fields_never_reach_artifact(self):
+        invalid = {'schema': READER.SCHEMA, 'ok': True, 'failure': '', 'records': [], 'raw': 'PRIVATE_SENTINEL'}
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            status, log = self.invoke(path, result=invalid)
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(path.read_text())['failure'], 'remote_invalid')
+            self.assertNotIn('PRIVATE_SENTINEL', log + path.read_text())
+
+    def test_existing_file_is_preserved_and_write_failure_is_closed(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'; path.write_text('existing')
+            status, log = self.invoke(path, error=READER.ReaderFailure('invalid_scope'))
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(log)['failure'], 'artifact_write_failed')
+            self.assertEqual(path.read_text(), 'existing')
+
+    def test_remote_mode_cannot_create_output_files(self):
+        with tempfile.TemporaryDirectory() as folder:
+            path = Path(folder) / 'result.json'
+            with patch.object(READER, 'remote') as remote:
+                status, log = self.invoke(path, remote=True)
+            self.assertEqual(status, 1)
+            self.assertEqual(json.loads(log)['failure'], 'invalid_destination')
+            self.assertFalse(path.exists())
+            remote.assert_not_called()
+
+
+if __name__ == '__main__':
+    unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.129",
+  "version": "1.0.131",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -550,9 +550,6 @@ jobs:
       # The wrapper verifies the unchanged pinned official uploader and classifies
       # its immediate result. Only explicit expired/deleted edits retry normally;
       # only Play's explicit review-hold refusal changes the review flag.
-      - name: Record Android upload intent
-        if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
-        run: node .github/actions/swift-app/scripts/mobile_release.cjs begin-upload android
       - name: Upload Android release to Google Play
         id: play-upload
         if: ${{ steps.mode.outputs.mode == 'local' && steps.play.outputs.ready == 'true' }}
@@ -561,6 +558,7 @@ jobs:
           GOOGLE_STORE_PROXY_URL: ${{ secrets.GOOGLE_STORE_PROXY_URL }}
           GITHUB_TOKEN: ${{ github.token }}
         with:
+          mobileReleaseIntentScript: ${{ github.workspace }}/.github/actions/swift-app/scripts/mobile_release.cjs
           serviceAccountJson: ${{ steps.android.outputs.play-service-account }}
           packageName: ${{ steps.android.outputs.package-name }}
           releaseFiles: ${{ steps.android.outputs.bundle-path }}