gowalk-cicd 1.0.133 → 1.0.135

package/CLAUDE.md

@@ -142,6 +142,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   and HTTPS_PROXY variables also name the credential-free loopback relay because
   Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
+  Java bypasses the relay only for exact `localhost`, `127.0.0.1` and `[::1]`
+  targets so owned HTTP test fixtures remain local. Never widen that host list;
+  external requests and environment-first clients retain the assigned relay.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
   The relay's idle deadline covers the whole tunnel: traffic in either direction
   keeps downloads/uploads alive. An idle direction alone must never end a transfer.

package/README.md

@@ -517,6 +517,10 @@ The relay authenticates to that exit without putting credentials in JVM options;
 HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
 and the relay shuts down with its child command. Gradle daemons are disabled for
 these commands so they cannot retain an expired relay port.
+Java requests to exact `localhost`, `127.0.0.1` and `[::1]` targets stay local for
+HTTP test fixtures. All other Java hosts, including lookalike names such as
+`localhost.example.com`, retain the assigned proxy; environment-first clients
+continue to use the relay.
 
 ### Private git dependencies (Flutter)
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.135

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.135

package/android-action/play-upload/run.cjs

@@ -32,6 +32,21 @@ async function upload(program, env, directory, execute = processRunner.execute,
   }
 }
 
+//: A code reaches the annotation only as a bare token: it is interpolated into
+//: workflow-command syntax, so anything outside this shape is reported as such
+//: rather than trusted.
+function state(code) {
+  return typeof code === 'string' && /^[a-z0-9_]{1,64}$/.test(code) ? code : 'unknown';
+}
+
+function stateAnnotation(receipt) {
+  return `::${receipt.ok === true ? 'notice' : 'error'} title=play_upload_state::`
+    + `gowalk-cicd/play-upload-state.v1 ok=${receipt.ok === true}`
+    + ` code=${state(receipt.code)} review_pending=${receipt.review_pending === true}`
+    + ` attempts=${Number.isSafeInteger(receipt.attempts) ? receipt.attempts : 'unknown'}`;
+}
+
+
 async function main() {
   let directory, receipt;
   try {
@@ -66,10 +81,26 @@ async function main() {
     appendFileSync(process.env.GITHUB_OUTPUT, `review-pending=${receipt.review_pending}\nreceipt=${encoded}\n`);
   }
   console.log(`::${receipt.ok ? 'notice' : 'error'} title=play_upload_result::${encoded}`);
+  // The JSON receipt above does not survive as a READABLE annotation on this job.
+  // `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON` is a multi-line JSON secret, so Actions
+  // registers each of its lines as maskable — and its first and last lines are a
+  // bare `{` and `}`. Every brace in this job's output is therefore replaced by
+  // `***`, leaving the payload legible to a person but not parseable by the
+  // panel, which reads typed check-run annotations and is forbidden the log text.
+  // The iOS job emits the same JSON shape unmasked, which is what isolates the
+  // cause to this job's secret rather than to redaction policy in general.
+  //
+  // So the decision-relevant fields also go out brace-free, in the same
+  // key=value shape as `play_upload_diagnostic` — which is emitted from this
+  // very action and arrives unmasked. `review_pending` is the field that
+  // distinguishes an upload from a submission, and losing it is how a green
+  // Android job reads as "Play is done" when the AAB sits unreviewed on a
+  // test track.
+  console.log(stateAnnotation(receipt));
   if (!receipt.ok) process.exitCode = 1;
 }
 
-module.exports = {upload, main};
+module.exports = {upload, main, state, stateAnnotation};
 if (require.main === module) void main().catch(() => {
   process.stderr.write('play_upload_receipt_failed\n'); process.exitCode = 1;
 });

package/android-action/scripts/jvm_proxy_relay.py

@@ -149,7 +149,7 @@ def running(proxy: str):
 
 def environment(env: dict, port: int) -> dict:
     # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
-    # with userinfo. All child clients use the same owned relay; authentication
+    # with userinfo. External child requests use the same owned relay; authentication
     # is added only on its connection to the configured account exit.
     local = f"http://127.0.0.1:{port}"
     for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
@@ -157,7 +157,8 @@ def environment(env: dict, port: int) -> dict:
     env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
-               "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")
+               "-Dhttp.nonProxyHosts=localhost|127.0.0.1|[::1] "
+               "-Dhttps.nonProxyHosts=localhost|127.0.0.1|[::1] -Djava.net.useSystemProxies=false")
     # Java prints these options at startup; they contain no proxy credentials.
     for name in ("JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "_JAVA_OPTIONS", "GRADLE_OPTS"):
         env[name] = (env.get(name, "") + " " + options).strip()

package/android-action/scripts/test_jvm_proxy_loopback.py

@@ -0,0 +1,91 @@
+"""Local HTTP fixtures stay local while every external Java request keeps the assigned relay."""
+from contextlib import contextmanager
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import tempfile
+import threading
+import unittest
+
+import jvm_proxy_relay as relay
+from test_jvm_proxy_relay import upstream
+
+
+@contextmanager
+def fixture(ipv6=False):
+    seen = []
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            seen.append(self.path)
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"owned local fixture")
+
+        def log_message(self, *_):
+            pass
+
+    class Server(ThreadingHTTPServer):
+        address_family = socket.AF_INET6 if ipv6 else socket.AF_INET
+
+    server = Server(("::1" if ipv6 else "127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server.server_port, seen
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+def java_probe(port, urls):
+    source = '''import java.net.*;
+public class Probe {
+  public static void main(String[] args) throws Exception {
+    for (var url : args) {
+      var connection = URI.create(url).toURL().openConnection();
+      connection.setConnectTimeout(3000); connection.setReadTimeout(3000);
+      System.out.println(new String(connection.getInputStream().readAllBytes()));
+    }
+  }
+}'''
+    with tempfile.TemporaryDirectory() as directory:
+        path = Path(directory) / "Probe.java"
+        path.write_text(source)
+        env = relay.environment({**os.environ, "JAVA_TOOL_OPTIONS": "-Dhttp.nonProxyHosts=*"}, port)
+        return subprocess.run(["java", str(path), *urls], env=env, capture_output=True, text=True, timeout=20)
+
+
+@unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+class LoopbackTests(unittest.TestCase):
+    def test_ipv4_and_localhost_fixtures_bypass_only_the_owned_relay(self):
+        with fixture() as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+            result = java_probe(port, [f"http://127.0.0.1:{local}/literal", f"http://localhost:{local}/hostname",
+                                       "http://unresolvable.invalid/provider", "http://localhost.invalid/provider"])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "owned local fixture",
+                                                      "through pinned proxy", "through pinned proxy"])
+        self.assertEqual(requests, ["/literal", "/hostname"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider",
+                                                   "http://localhost.invalid/provider"])
+        self.assertTrue(all(row[2].startswith("Basic ") for row in seen))
+        self.assertNotIn("fixture-pass", result.stderr)
+
+    def test_ipv6_loopback_fixture_remains_local(self):
+        try:
+            with fixture(ipv6=True) as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+                result = java_probe(port, [f"http://[::1]:{local}/ipv6", "http://unresolvable.invalid/provider"])
+        except OSError as exc:
+            self.skipTest(f"IPv6 fixture unavailable: {exc.errno}")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "through pinned proxy"])
+        self.assertEqual(requests, ["/ipv6"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.133
+1.0.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.133",
+  "version": "1.0.135",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {