gowalk-cicd 1.0.133 → 1.0.134

package/action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.134

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.134

package/android-action/play-upload/run.cjs

@@ -32,6 +32,21 @@ async function upload(program, env, directory, execute = processRunner.execute,
   }
 }
 
+//: A code reaches the annotation only as a bare token: it is interpolated into
+//: workflow-command syntax, so anything outside this shape is reported as such
+//: rather than trusted.
+function state(code) {
+  return typeof code === 'string' && /^[a-z0-9_]{1,64}$/.test(code) ? code : 'unknown';
+}
+
+function stateAnnotation(receipt) {
+  return `::${receipt.ok === true ? 'notice' : 'error'} title=play_upload_state::`
+    + `gowalk-cicd/play-upload-state.v1 ok=${receipt.ok === true}`
+    + ` code=${state(receipt.code)} review_pending=${receipt.review_pending === true}`
+    + ` attempts=${Number.isSafeInteger(receipt.attempts) ? receipt.attempts : 'unknown'}`;
+}
+
+
 async function main() {
   let directory, receipt;
   try {
@@ -66,10 +81,26 @@ async function main() {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
   }
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
+  // The JSON receipt above does not survive as a READABLE annotation on this job.
+  // `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` is a multi-line JSON secret, so Actions
+  // registers each of its lines as maskable — and its first and last lines are a
+  // bare `{` and `}`. Every brace in this job's output is therefore replaced by
+  // `***`, leaving the payload legible to a person but not parseable by the
+  // panel, which reads typed check-run annotations and is forbidden the log text.
+  // The iOS job emits the same JSON shape unmasked, which is what isolates the
+  // cause to this job's secret rather than to redaction policy in general.
+  //
+  // So the decision-relevant fields also go out brace-free, in the same
+  // key=value shape as `play_upload_diagnostic` — which is emitted from this
+  // very action and arrives unmasked. `review_pending` is the field that
+  // distinguishes an upload from a submission, and losing it is how a green
+  // Android job reads as "Play is done" when the AAB sits unreviewed on a
+  // test track.
+  console.log(stateAnnotation(receipt));
   if (!receipt.ok) process.exitCode = 1;
 }
 
-module.exports = {upload, main};
+module.exports = {upload, main, state, stateAnnotation};
 if (require.main === module) void main().catch(() => {
   process.stderr.write('play_upload_receipt_failed\n'); process.exitCode = 1;
 });

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.134

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.133",
+  "version": "1.0.134",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {