gowalk-cicd 1.0.13 → 1.0.14

package/README.md

@@ -66,6 +66,36 @@ workflow reads these files from the checkout, so they must be available to
 GitHub Actions (this package's zero-config convention is to track them only in
 a private repository).
 
+### Choosing which stores a repo ships to
+
+`deploy.yml` runs iOS and Android in parallel. Set the repository variable
+`DEPLOY_PLATFORMS` when one of them is intentionally out of scope, so an
+unrelated failure on the platform you do not care about cannot block the
+release you do:
+
+| `DEPLOY_PLATFORMS` | Result |
+|---|---|
+| unset / `both` | iOS + Android (default) |
+| `android` | Android only — the iOS job is skipped |
+| `ios` | iOS only — the Android job is skipped |
+
+```bash
+gh variable set DEPLOY_PLATFORMS --body android
+```
+
+### Track, status and staged rollout
+
+| Variable | Default | Purpose |
+|---|---|---|
+| `GOOGLE_PLAY_TRACK` | `internal` | `internal`, `alpha`, `beta`, `production`, or a custom track name |
+| `GOOGLE_PLAY_STATUS` | `completed` | `completed` (full rollout) or `inProgress` (staged) |
+| `GOOGLE_PLAY_USER_FRACTION` | `0.2` | Audience share, **only** read when the status is `inProgress` |
+
+Play rejects an `inProgress` release that does not declare its audience share,
+and rejects a `completed` one that does. The workflow sends `userFraction` only
+in the mode that accepts it, so setting the fraction while leaving the status at
+`completed` is harmless rather than a failed upload.
+
 Google Play requires the first AAB to be uploaded through Play Console. The
 first CI run still succeeds and retains the signed AAB as an
 `android-<package>-<versionCode>` workflow artifact. Upload that artifact once

package/action/.daemux-version

@@ -1 +1 @@
-1.0.13
+1.0.14

package/action/scripts/pbxproj_editor.py

@@ -72,20 +72,49 @@ def _bundle_id_from_configs(objects: dict, config_ids: list[str]) -> str:
     return ""
 
 
-def _entitlements_from_configs(objects: dict, config_ids: list[str]) -> str:
+def _expand_entitlements_refs(value: str, target_name: str) -> str:
+    """Expand the build-setting references we can resolve without xcodebuild.
+
+    ``$(TARGET_NAME)`` is the idiom every xcodegen target template uses for a
+    per-target entitlements path, and ``$(SRCROOT)``/``$(PROJECT_DIR)`` both
+    name the directory the path is already relative to. Those three are
+    unambiguous from the pbxproj alone; anything else is left in place so the
+    caller can reject the value.
+    """
+    for reference in (f"$(TARGET_NAME)", "${TARGET_NAME}"):
+        value = value.replace(reference, target_name)
+    for name in ("SRCROOT", "PROJECT_DIR"):
+        value = value.replace(f"$({name})/", "").replace(f"${{{name}}}/", "")
+    return value
+
+
+def _entitlements_from_configs(
+    objects: dict, config_ids: list[str], target_name: str = "", base: Path | None = None
+) -> str:
     """First CODE_SIGN_ENTITLEMENTS path across the given configs.
 
     Needed to reconcile the App ID's capabilities with what the app declares —
-    a profile only carries capabilities enabled on its App ID. Build-setting
-    references are skipped rather than half-expanded; a missed entitlements
-    file costs a clearer error, a wrong one costs a wrong App ID edit.
+    a profile only carries capabilities enabled on its App ID.
+
+    A literal path is returned as-is (the caller warns when it does not exist).
+    A path built from build settings is expanded only for the references we can
+    resolve exactly, and then only accepted when the resulting file is really
+    there — a missed entitlements file costs a clearer error, a wrong one costs
+    a wrong App ID edit.
     """
     for cid in config_ids:
         cfg = objects.get(cid) or {}
         settings = cfg.get("buildSettings") or {}
         value = (settings.get("CODE_SIGN_ENTITLEMENTS") or "").strip().strip('"')
-        if value and "$(" not in value and "${" not in value:
+        if not value:
+            continue
+        if "$(" not in value and "${" not in value:
             return value
+        expanded = _expand_entitlements_refs(value, target_name)
+        if "$(" in expanded or "${" in expanded:
+            continue
+        if base is None or (base / expanded).is_file():
+            return expanded
     return ""
 
 
@@ -102,6 +131,7 @@ def discover_signable_targets(project_path: str) -> list[dict]:
     """
     pbx = _load_pbxproj(project_path)
     objects = pbx["objects"]
+    base = Path(project_path).parent
     targets: list[dict] = []
     for obj in objects.values():
         if obj.get("isa") != "PBXNativeTarget":
@@ -120,7 +150,9 @@ def discover_signable_targets(project_path: str) -> list[dict]:
                 "name": name,
                 "bundle_id": bundle_id,
                 "config_ids": config_ids,
-                "entitlements": _entitlements_from_configs(objects, config_ids),
+                "entitlements": _entitlements_from_configs(
+                    objects, config_ids, target_name=name, base=base
+                ),
             }
         )
     if not targets:

package/action/scripts/test_pbxproj_editor.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""Entitlements-path resolution in pbxproj_editor."""
+
+import unittest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from pbxproj_editor import _entitlements_from_configs, _expand_entitlements_refs
+
+
+def _objects(value):
+    return {"cfg": {"buildSettings": {"CODE_SIGN_ENTITLEMENTS": value}}}
+
+
+class ExpandEntitlementsRefsTest(unittest.TestCase):
+    def test_expands_target_name_both_spellings(self):
+        self.assertEqual(
+            _expand_entitlements_refs("$(TARGET_NAME)/$(TARGET_NAME).entitlements", "Blocker"),
+            "Blocker/Blocker.entitlements",
+        )
+        self.assertEqual(
+            _expand_entitlements_refs("${TARGET_NAME}/App.entitlements", "Blocker"),
+            "Blocker/App.entitlements",
+        )
+
+    def test_srcroot_prefix_drops_out(self):
+        self.assertEqual(
+            _expand_entitlements_refs("$(SRCROOT)/App/App.entitlements", "App"),
+            "App/App.entitlements",
+        )
+
+    def test_unknown_reference_is_left_alone(self):
+        self.assertIn("$(CONFIGURATION)", _expand_entitlements_refs(
+            "$(CONFIGURATION)/App.entitlements", "App"))
+
+
+class EntitlementsFromConfigsTest(unittest.TestCase):
+    def test_literal_path_is_returned_without_touching_disk(self):
+        self.assertEqual(
+            _entitlements_from_configs(_objects("App/App.entitlements"), ["cfg"],
+                                       target_name="App", base=Path("/nonexistent")),
+            "App/App.entitlements",
+        )
+
+    def test_target_name_reference_resolves_when_the_file_exists(self):
+        with TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "Blocker").mkdir()
+            (root / "Blocker" / "Blocker.entitlements").write_text("<plist/>")
+            self.assertEqual(
+                _entitlements_from_configs(
+                    _objects("$(TARGET_NAME)/$(TARGET_NAME).entitlements"), ["cfg"],
+                    target_name="Blocker", base=root),
+                "Blocker/Blocker.entitlements",
+            )
+
+    def test_expanded_path_that_does_not_exist_is_rejected(self):
+        with TemporaryDirectory() as tmp:
+            self.assertEqual(
+                _entitlements_from_configs(
+                    _objects("$(TARGET_NAME)/$(TARGET_NAME).entitlements"), ["cfg"],
+                    target_name="Ghost", base=Path(tmp)),
+                "",
+            )
+
+    def test_unresolvable_reference_is_skipped(self):
+        self.assertEqual(
+            _entitlements_from_configs(
+                _objects("$(CONFIGURATION)/App.entitlements"), ["cfg"],
+                target_name="App", base=Path("/tmp")),
+            "",
+        )
+
+    def test_missing_setting_yields_empty(self):
+        self.assertEqual(
+            _entitlements_from_configs({"cfg": {"buildSettings": {}}}, ["cfg"]), "")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.13
+1.0.14

package/bin/cli.mjs

@@ -3,13 +3,22 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import updateNotifier from 'update-notifier';
-
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 
-const notifier = updateNotifier({ pkg });
+// The update nag is a nicety, not a dependency of installing. Running the CLI
+// straight out of a source checkout (`node ../gowalk-cicd/bin/cli.mjs`, the
+// documented local-development path) has no node_modules, and a hard import
+// would take the whole installer down with it.
+async function loadNotifier() {
+  try {
+    const { default: updateNotifier } = await import('update-notifier');
+    return updateNotifier({ pkg });
+  } catch {
+    return { notify() {} };
+  }
+}
 
 const args = process.argv.slice(2);
 let dryRun = false;
@@ -60,4 +69,5 @@ After install:
 const { runInstall } = await import('../src/install.mjs');
 await runInstall({ dryRun });
 
+const notifier = await loadNotifier();
 notifier.notify();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -19,8 +19,15 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Repository variable DEPLOY_PLATFORMS selects which stores this repo ships to:
+  #   unset / 'both' — iOS and Android (the default)
+  #   'android'      — Android only; skip the iOS job entirely
+  #   'ios'          — iOS only; skip the Android job entirely
+  # Use it when one platform is intentionally out of scope for a repo, so an
+  # unrelated failure on the other platform cannot block the release you want.
   ios:
     name: iOS TestFlight
+    if: ${{ vars.DEPLOY_PLATFORMS != 'android' }}
     runs-on: macos-15
     timeout-minutes: 60
     steps:
@@ -78,6 +85,7 @@ jobs:
 
   android:
     name: Android Google Play
+    if: ${{ vars.DEPLOY_PLATFORMS != 'ios' }}
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     steps:
@@ -187,6 +195,10 @@ jobs:
           releaseFiles: ${{ steps.android.outputs.bundle-path }}
           tracks: ${{ vars.GOOGLE_PLAY_TRACK || 'internal' }}
           status: ${{ vars.GOOGLE_PLAY_STATUS || 'completed' }}
+          # Play rejects an 'inProgress' release that does not declare how much of
+          # the audience it reaches. Only send the fraction in that mode: passing it
+          # alongside status 'completed' is an error rather than a no-op.
+          userFraction: ${{ vars.GOOGLE_PLAY_STATUS == 'inProgress' && (vars.GOOGLE_PLAY_USER_FRACTION || '0.2') || '' }}
           # Localized release notes: commit distribution/whatsnew/whatsnew-<bcp47>
           # files (e.g. whatsnew-en-US, whatsnew-de-DE) and they ship with every
           # release. Empty when the directory is absent — the action skips it.