gowalk-cicd 1.0.132 → 1.0.134

package/action/.daemux-version

@@ -1 +1 @@
-1.0.132
+1.0.134

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.132
+1.0.134

package/android-action/play-upload/run.cjs

@@ -32,6 +32,21 @@ async function upload(program, env, directory, execute = processRunner.execute,
   }
 }
 
+//: A code reaches the annotation only as a bare token: it is interpolated into
+//: workflow-command syntax, so anything outside this shape is reported as such
+//: rather than trusted.
+function state(code) {
+  return typeof code === 'string' && /^[a-z0-9_]{1,64}$/.test(code) ? code : 'unknown';
+}
+
+function stateAnnotation(receipt) {
+  return `::${receipt.ok === true ? 'notice' : 'error'} title=play_upload_state::`
+    + `gowalk-cicd/play-upload-state.v1 ok=${receipt.ok === true}`
+    + ` code=${state(receipt.code)} review_pending=${receipt.review_pending === true}`
+    + ` attempts=${Number.isSafeInteger(receipt.attempts) ? receipt.attempts : 'unknown'}`;
+}
+
+
 async function main() {
   let directory, receipt;
   try {
@@ -66,10 +81,26 @@ async function main() {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
   }
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
+  // The JSON receipt above does not survive as a READABLE annotation on this job.
+  // `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` is a multi-line JSON secret, so Actions
+  // registers each of its lines as maskable — and its first and last lines are a
+  // bare `{` and `}`. Every brace in this job's output is therefore replaced by
+  // `***`, leaving the payload legible to a person but not parseable by the
+  // panel, which reads typed check-run annotations and is forbidden the log text.
+  // The iOS job emits the same JSON shape unmasked, which is what isolates the
+  // cause to this job's secret rather than to redaction policy in general.
+  //
+  // So the decision-relevant fields also go out brace-free, in the same
+  // key=value shape as `play_upload_diagnostic` — which is emitted from this
+  // very action and arrives unmasked. `review_pending` is the field that
+  // distinguishes an upload from a submission, and losing it is how a green
+  // Android job reads as "Play is done" when the AAB sits unreviewed on a
+  // test track.
+  console.log(stateAnnotation(receipt));
   if (!receipt.ok) process.exitCode = 1;
 }
 
-module.exports = {upload, main};
+module.exports = {upload, main, state, stateAnnotation};
 if (require.main === module) void main().catch(() => {
   process.stderr.write('play_upload_receipt_failed\n'); process.exitCode = 1;
 });

package/android-action/scripts/android_build_diagnostics.py

@@ -1,12 +1,33 @@
-"""Run one Android compiler with bounded private output and fixed failure signals."""
+"""Run one Android compiler with bounded private output and fixed failure signals.
+
+A signal alone does not locate a failure. ``signals":["dependency_resolution",
+"tls_verification"]`` was the WHOLE record of a 15-minute Android build on task
+1183 (run 34362765661): the session could not tell which artifact would not
+resolve or whose certificate was rejected, so its only move was to run the same
+build again. Child output stays unpublished — it carries the store proxy's
+credentials, and GitHub masks only the exact registered secret — so the detail
+is EXTRACTED and SANITIZED instead: bare hostnames and artifact coordinates,
+never a URL, never userinfo, never a free-text line.
+"""
 import argparse
 import json
+import re
 import subprocess
 import sys
 import threading
 import time
 
 LIMIT = 65536
+#: At most this many extracted facts per kind — a bounded record, not a log.
+MAX_DETAILS = 8
+#: A host in a URL, with any ``user:password@`` userinfo dropped by the pattern
+#: itself so a credential can never reach the capture group.
+_URL_HOST = re.compile(r"\bhttps?://(?:[^/@\s]*@)?([A-Za-z0-9.-]+\.[A-Za-z]{2,})")
+#: Gradle/Maven coordinates: group:artifact:version, which carry no secrets.
+_COORDINATE = re.compile(r"\b([A-Za-z][\w.-]*(?::[\w.+-]+){2})\b")
+#: Hosts a certificate complaint names, e.g. "No subject alternative DNS name
+#: matching pub.dev found" or "unable to find valid certification path to <host>".
+_CERT_HOST = re.compile(r"(?:matching|for|to)\s+([a-z0-9-]+(?:\.[a-z0-9-]+)+)", re.I)
 SIGNALS = {
     "tls_verification": ("PKIX path building failed", "CERTIFICATE_VERIFY_FAILED", "certificate verify failed"),
     "dependency_resolution": ("Could not resolve all files", "Could not resolve all artifacts", "Could not GET '"),
@@ -29,6 +50,39 @@ def signals(output: bytes) -> list[str]:
     return sorted(name for name, patterns in SIGNALS.items() if any(pattern in text for pattern in patterns))
 
 
+def _bounded(values) -> list[str]:
+    """Deduplicate, order and cap — a record the session can act on."""
+    seen = []
+    for value in values:
+        if value not in seen:
+            seen.append(value)
+        if len(seen) >= MAX_DETAILS:
+            break
+    return sorted(seen)
+
+
+def details(output: bytes, found: list[str]) -> dict:
+    """Sanitized facts that LOCATE the signals, extracted from the private tail.
+
+    Only pattern captures leave this function: hostnames and dependency
+    coordinates. The raw text, any URL, and anything shaped like userinfo stay
+    in the buffer that is discarded with the process.
+    """
+    text = output.decode("utf-8", errors="replace")
+    out = {}
+    if "dependency_resolution" in found or "tls_verification" in found:
+        hosts = _bounded(_URL_HOST.findall(text))
+        if "tls_verification" in found:
+            hosts = _bounded(hosts + _CERT_HOST.findall(text))
+        if hosts:
+            out["hosts"] = hosts
+    if "dependency_resolution" in found:
+        coordinates = _bounded(_COORDINATE.findall(text))
+        if coordinates:
+            out["artifacts"] = coordinates
+    return out
+
+
 def emit(title: str, level: str, **fields) -> None:
     print(f"::{level} title={title}::" + json.dumps(fields, separators=(",", ":")), flush=True)
 
@@ -60,8 +114,10 @@ def run(phase: str, command: list[str], *, interval: float = 60) -> int:
     if not reader.is_alive():
         child.stdout.close()
     if code:
+        retained = bytes(tail)
+        found = signals(retained)
         emit("android_build_failed", "error", schema="gowalk-cicd/android-build-failed.v1",
-             phase=phase, exit_code=code, signals=signals(bytes(tail)))
+             phase=phase, exit_code=code, signals=found, **details(retained, found))
     return code if code >= 0 else 128 - code
 
 

package/android-action/scripts/test_android_build_diagnostics.py

@@ -103,6 +103,46 @@ class BuildDiagnosticsTests(unittest.TestCase):
         self.assertIn('"signals":["r8_missing_classes"]', result.stdout)
         self.assertNotIn("private-class", result.stdout + result.stderr)
 
+    def test_dependency_failure_names_hosts_and_artifacts_without_credentials(self):
+        """A signal alone cannot be acted on; the record must LOCATE the failure.
+
+        Task 1183's run 34362765661 recorded only the two signal names for a
+        15-minute build, so the session could only run it again.
+        """
+        code, rows, output = self.invoke(
+            "import sys; print(\"Could not resolve all files for configuration ':app:releaseRuntimeClasspath'\");"
+            "print('Could not resolve com.google.firebase:firebase-analytics:21.5.0');"
+            "print(\"Could not GET 'https://proxyuser:sup3rSecret@residential.exit.test:8080/maven2/x.pom'\");"
+            "print('PKIX path building failed: unable to find valid certification path to dl.google.com');"
+            "sys.exit(1)"
+        )
+        self.assertEqual(code, 1)
+        row = rows[0]
+        self.assertEqual(row["signals"], ["dependency_resolution", "tls_verification"])
+        self.assertIn("dl.google.com", row["hosts"])
+        self.assertIn("residential.exit.test", row["hosts"])
+        self.assertIn("com.google.firebase:firebase-analytics:21.5.0", row["artifacts"])
+        for secret in ("sup3rSecret", "proxyuser", "maven2", "x.pom"):
+            self.assertNotIn(secret, output)
+
+    def test_extracted_detail_is_bounded_and_ordered(self):
+        text = "".join(f"Could not GET 'https://host{n}.test/a'\n" for n in range(40)).encode()
+        found = ["dependency_resolution"]
+        hosts = diagnostics.details(text, found)["hosts"]
+        self.assertEqual(len(hosts), diagnostics.MAX_DETAILS)
+        self.assertEqual(hosts, sorted(hosts))
+
+    def test_a_signal_that_needs_no_locating_adds_no_detail(self):
+        code, rows, _ = self.invoke(
+            "import sys; print('Missing classes detected while running R8'); sys.exit(3)")
+        self.assertEqual(code, 3)
+        self.assertEqual(set(rows[0]), {"schema", "phase", "exit_code", "signals"})
+
+    def test_userinfo_never_reaches_the_record_even_without_a_signal_match(self):
+        detail = diagnostics.details(b"Could not GET 'https://u:p@only.test/x'", ["dependency_resolution"])
+        self.assertEqual(detail["hosts"], ["only.test"])
+        self.assertNotIn("p@", json.dumps(detail))
+
 
 if __name__ == "__main__":
     unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.132
+1.0.134

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.132",
+  "version": "1.0.134",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {