gowalk-cicd 1.0.131 → 1.0.133

package/action/.daemux-version

@@ -1 +1 @@
-1.0.131
+1.0.133

package/action/scripts/prepare_crashlytics_build.py

@@ -67,13 +67,17 @@ def commands(script: str) -> list[list[str]] | None:
         current = []
         target = False
         for token in tokens:
-            if target:                      # the file a redirect writes, not a command
+            if target:
                 target = False
                 continue
             if token.startswith("#"):
                 break
             if token and set(token) <= OPERATOR:
-                if set(token) & REDIRECT:   # a redirect belongs to the command it follows
+                if set(token) & REDIRECT:
+                    # Only the deferred uploader's effects belong to the removed operation.
+                    # A redirected builtin/assignment can produce another required build input.
+                    if not uploads_symbols(current):
+                        return None
                     target = True
                     continue
                 if current:

package/action/scripts/test_crashlytics_phase_effects.py

@@ -0,0 +1,30 @@
+"""An upload-only rewrite must preserve commands that also produce other build inputs."""
+import copy
+import unittest
+
+import prepare_crashlytics_build as build
+
+
+class PhaseEffectTests(unittest.TestCase):
+    def test_redirected_builtins_are_build_work_even_without_another_executable(self):
+        for command in ('echo public > Generated.swift', 'echo enabled >> build.env',
+                        ': > generated.config', 'BUILD=release > generated.config'):
+            with self.subTest(command=command):
+                script = command + '\nupload-symbols -gsp app.plist -p ios symbols'
+                self.assertFalse(build.dedicated(script))
+                document = {'objects': {'phase': {'isa': 'PBXShellScriptBuildPhase',
+                            'name': 'Crashlytics and generated input', 'shellScript': script}}}
+                original = copy.deepcopy(document)
+                with self.assertRaisesRegex(ValueError, 'shares the build phase'):
+                    build.rewrite(document)
+                self.assertEqual(document, original)
+
+    def test_supported_generated_guards_remain_upload_only(self):
+        self.assertTrue(build.dedicated(
+            'if [ -f "$PODS_ROOT/FirebaseCrashlytics/upload-symbols" ]; then\n'
+            '"$PODS_ROOT/FirebaseCrashlytics/upload-symbols" -gsp app.plist -p ios symbols\n'
+            'else echo "warning: upload-symbols absent"; fi'))
+
+
+if __name__ == '__main__':
+    unittest.main()

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.131
+1.0.133

package/android-action/scripts/android_build_diagnostics.py

@@ -1,12 +1,33 @@
-"""Run one Android compiler with bounded private output and fixed failure signals."""
+"""Run one Android compiler with bounded private output and fixed failure signals.
+
+A signal alone does not locate a failure. ``signals":["dependency_resolution",
+"tls_verification"]`` was the WHOLE record of a 15-minute Android build on task
+1183 (run 34362765661): the session could not tell which artifact would not
+resolve or whose certificate was rejected, so its only move was to run the same
+build again. Child output stays unpublished — it carries the store proxy's
+credentials, and GitHub masks only the exact registered secret — so the detail
+is EXTRACTED and SANITIZED instead: bare hostnames and artifact coordinates,
+never a URL, never userinfo, never a free-text line.
+"""
 import argparse
 import json
+import re
 import subprocess
 import sys
 import threading
 import time
 
 LIMIT = 65536
+#: At most this many extracted facts per kind — a bounded record, not a log.
+MAX_DETAILS = 8
+#: A host in a URL, with any ``user:password@`` userinfo dropped by the pattern
+#: itself so a credential can never reach the capture group.
+_URL_HOST = re.compile(r"\bhttps?://(?:[^/@\s]*@)?([A-Za-z0-9.-]+\.[A-Za-z]{2,})")
+#: Gradle/Maven coordinates: group:artifact:version, which carry no secrets.
+_COORDINATE = re.compile(r"\b([A-Za-z][\w.-]*(?::[\w.+-]+){2})\b")
+#: Hosts a certificate complaint names, e.g. "No subject alternative DNS name
+#: matching pub.dev found" or "unable to find valid certification path to <host>".
+_CERT_HOST = re.compile(r"(?:matching|for|to)\s+([a-z0-9-]+(?:\.[a-z0-9-]+)+)", re.I)
 SIGNALS = {
     "tls_verification": ("PKIX path building failed", "CERTIFICATE_VERIFY_FAILED", "certificate verify failed"),
     "dependency_resolution": ("Could not resolve all files", "Could not resolve all artifacts", "Could not GET '"),
@@ -29,6 +50,39 @@ def signals(output: bytes) -> list[str]:
     return sorted(name for name, patterns in SIGNALS.items() if any(pattern in text for pattern in patterns))
 
 
+def _bounded(values) -> list[str]:
+    """Deduplicate, order and cap — a record the session can act on."""
+    seen = []
+    for value in values:
+        if value not in seen:
+            seen.append(value)
+        if len(seen) >= MAX_DETAILS:
+            break
+    return sorted(seen)
+
+
+def details(output: bytes, found: list[str]) -> dict:
+    """Sanitized facts that LOCATE the signals, extracted from the private tail.
+
+    Only pattern captures leave this function: hostnames and dependency
+    coordinates. The raw text, any URL, and anything shaped like userinfo stay
+    in the buffer that is discarded with the process.
+    """
+    text = output.decode("utf-8", errors="replace")
+    out = {}
+    if "dependency_resolution" in found or "tls_verification" in found:
+        hosts = _bounded(_URL_HOST.findall(text))
+        if "tls_verification" in found:
+            hosts = _bounded(hosts + _CERT_HOST.findall(text))
+        if hosts:
+            out["hosts"] = hosts
+    if "dependency_resolution" in found:
+        coordinates = _bounded(_COORDINATE.findall(text))
+        if coordinates:
+            out["artifacts"] = coordinates
+    return out
+
+
 def emit(title: str, level: str, **fields) -> None:
     print(f"::{level} title={title}::" + json.dumps(fields, separators=(",", ":")), flush=True)
 
@@ -60,8 +114,10 @@ def run(phase: str, command: list[str], *, interval: float = 60) -> int:
     if not reader.is_alive():
         child.stdout.close()
     if code:
+        retained = bytes(tail)
+        found = signals(retained)
         emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
-             phase=phase, exit_code=code, signals=signals(bytes(tail)))
+             phase=phase, exit_code=code, signals=found, **details(retained, found))
     return code if code >= 0 else 128 - code
 
 

package/android-action/scripts/test_android_build_diagnostics.py

@@ -103,6 +103,46 @@ class BuildDiagnosticsTests(unittest.TestCase):
         self.assertIn('"signals":["r8_missing_classes"]', result.stdout)
         self.assertNotIn("private-class", result.stdout + result.stderr)
 
+    def test_dependency_failure_names_hosts_and_artifacts_without_credentials(self):
+        """A signal alone cannot be acted on; the record must LOCATE the failure.
+
+        Task 1183's run 34362765661 recorded only the two signal names for a
+        15-minute build, so the session could only run it again.
+        """
+        code, rows, output = self.invoke(
+            "import sys; print(\"Could not resolve all files for configuration ':app:releaseRuntimeClasspath'\");"
+            "print('Could not resolve com.google.firebase:firebase-analytics:21.5.0');"
+            "print(\"Could not GET 'https://proxyuser:sup3rSecret@residential.exit.test:8080/maven2/x.pom'\");"
+            "print('PKIX path building failed: unable to find valid certification path to dl.google.com');"
+            "sys.exit(1)"
+        )
+        self.assertEqual(code, 1)
+        row = rows[0]
+        self.assertEqual(row["signals"], ["dependency_resolution", "tls_verification"])
+        self.assertIn("dl.google.com", row["hosts"])
+        self.assertIn("residential.exit.test", row["hosts"])
+        self.assertIn("com.google.firebase:firebase-analytics:21.5.0", row["artifacts"])
+        for secret in ("sup3rSecret", "proxyuser", "maven2", "x.pom"):
+            self.assertNotIn(secret, output)
+
+    def test_extracted_detail_is_bounded_and_ordered(self):
+        text = "".join(f"Could not GET 'https://host{n}.test/a'\n" for n in range(40)).encode()
+        found = ["dependency_resolution"]
+        hosts = diagnostics.details(text, found)["hosts"]
+        self.assertEqual(len(hosts), diagnostics.MAX_DETAILS)
+        self.assertEqual(hosts, sorted(hosts))
+
+    def test_a_signal_that_needs_no_locating_adds_no_detail(self):
+        code, rows, _ = self.invoke(
+            "import sys; print('Missing classes detected while running R8'); sys.exit(3)")
+        self.assertEqual(code, 3)
+        self.assertEqual(set(rows[0]), {"schema", "phase", "exit_code", "signals"})
+
+    def test_userinfo_never_reaches_the_record_even_without_a_signal_match(self):
+        detail = diagnostics.details(b"Could not GET 'https://u:p@only.test/x'", ["dependency_resolution"])
+        self.assertEqual(detail["hosts"], ["only.test"])
+        self.assertNotIn("p@", json.dumps(detail))
+
 
 if __name__ == "__main__":
     unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.131
+1.0.133

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.131",
+  "version": "1.0.133",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {