gowalk-cicd 1.0.135 → 1.0.136

package/action/.daemux-version

@@ -1 +1 @@
-1.0.135
+1.0.136

package/action/scripts/native_bundle.py

@@ -18,6 +18,27 @@ import native_pods_process
 from native_prepare_evidence import report
 
 
+# The Ruby bundle is only one of the things this script can refuse over, but every
+# refusal used to carry the lockfile remediation below. printer-ai run 34374868740
+# failed because CocoaPods could not clone a dependency from github.com, and the
+# receipt told the session to "reconcile dependency locks locally" — locks that were
+# never wrong. A configuration command that fails inside its own child publishes its
+# own receipt and signals; point the reader at those instead (2026-09-09).
+BUNDLE_REMEDIATION = ("Use the app's committed Gemfile and Gemfile.lock with a compatible Ruby/Bundler "
+                      "runtime; reconcile dependency locks locally and retain deployment guards.")
+COMMAND_REMEDIATION = ("The configuration command failed inside its own child, not in the Ruby bundle. "
+                       "Read that child's own receipt and native_prepare_failed signals for the cause, "
+                       "and repair what they name.")
+BUNDLE_CODES = frozenset({
+    "native_gemfile_required", "native_gemfile_commit_required", "native_gemfile_lock_required",
+    "native_gemfile_lock_commit_required", "native_bundle_install_failed", "native_bundle_inputs_changed",
+})
+
+
+def remediation(code: str) -> str:
+    return BUNDLE_REMEDIATION if code in BUNDLE_CODES else COMMAND_REMEDIATION
+
+
 def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
         return native_pods_process.command(argv, cwd, log, timeout=timeout)
@@ -101,8 +122,7 @@ def main(argv: list[str]) -> int:
         answer = run(args.root, args.folder, args.proxy_helper, command_args)
     except (guard.Refused, OSError, subprocess.SubprocessError) as exc:
         code = str(exc) if isinstance(exc, guard.Refused) else "native_bundle_operation_unverified"
-        answer = {"ok": False, "code": code, "next": "Use the app's committed Gemfile and Gemfile.lock with a "
-                  "compatible Ruby/Bundler runtime; reconcile dependency locks locally and retain deployment guards."}
+        answer = {"ok": False, "code": code, "next": remediation(code)}
         if getattr(exc, "diagnostic", ""):
             answer["diagnostic"] = exc.diagnostic
     report(answer, "bundle")

package/action/scripts/native_pods_retry.py

@@ -19,6 +19,15 @@ PARTIAL = re.compile(r"\bcurl(?:\s+18\b|:\s*\(18\))", re.I)
 # downloaded: <url> Response: Timeout was reached". A timeout leaves the successfully
 # fetched specs cached, so the second attempt resumes rather than starting over.
 TIMED_OUT = re.compile(r"Response:\s*Timeout was reached|\bcurl(?:\s+28\b|:\s*\(28\))", re.I)
+# A handshake that dies mid-negotiation names no curl code and no verdict about the
+# peer, so neither pattern above can see it: printer-ai run 34374868740 lost the iOS
+# build to `LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to github.com:443`
+# while CocoaPods cloned a dependency, and 2phone-ios run 34374984763 lost the same
+# step to bundler's `SSL_connect returned=1 ... unexpected eof while reading`
+# (2026-09-09). Both are a connection the exit dropped before either side spoke, which
+# the next attempt usually completes. A CERTIFICATE verdict is a different fact and
+# stays permanent above: TERMINAL still vetoes this class whenever it appears.
+HANDSHAKE = re.compile(r"SSL_ERROR_SYSCALL|unexpected eof while reading", re.I)
 
 
 def interrupted_transfer(body: str) -> bool:
@@ -30,11 +39,17 @@ def timed_out(body: str) -> bool:
     return bool(TIMED_OUT.search(body) and not TERMINAL.search(body))
 
 
+def handshake_reset(body: str) -> bool:
+    return bool(HANDSHAKE.search(body) and not TERMINAL.search(body))
+
+
 def retryable(body: str) -> str:
     """Name the transient class this failure belongs to, or "" when it is not one."""
     if interrupted_transfer(body):
         return "partial_transfer"
-    return "transient_timeout" if timed_out(body) else ""
+    if timed_out(body):
+        return "transient_timeout"
+    return "handshake_reset" if handshake_reset(body) else ""
 
 
 def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 900) -> tuple[int, int]:

package/action/scripts/native_prepare_evidence.py

@@ -10,6 +10,12 @@ SIGNALS = {
     "bundler_version_missing": ("Could not find 'bundler'",),
     "tls_verification": ("certificate verify failed", "CERTIFICATE_VERIFY_FAILED"),
     "connection_timeout": ("Connection timed out", "execution expired", "Read timed out"),
+    # Distinct from tls_verification above: the peer never returned a verdict about its
+    # certificate, the connection died mid-handshake. printer-ai run 34374868740
+    # published signals=[] for `SSL_ERROR_SYSCALL in connection to github.com:443`
+    # (2026-09-09), so the session read an unclassified failure and repaired the wrong
+    # thing. Neither token appears in a certificate verdict.
+    "tls_handshake_reset": ("SSL_ERROR_SYSCALL", "unexpected eof while reading"),
     "dns_resolution": ("Could not resolve host", "getaddrinfo"),
     "partial_transfer": ("curl 18", "curl: (18)"),
     "disk_full": ("No space left on device",),

package/action/scripts/test_native_pods_retry.py

@@ -16,6 +16,16 @@ PARTIAL = "error: RPC failed; curl 18 transfer closed with outstanding read data
 # redaction — the form `retryable` actually sees.
 TIMEOUT = "\n".join(["CDN: trunk URL couldn't be downloaded: [URL redacted] "
                      "Response: Timeout was reached"] * 30)
+# Verbatim from printer-ai Mobile Deploy 34374868740, after the diagnostic's own URL
+# redaction: CocoaPods cloning a dependency when the exit dropped the connection.
+HANDSHAKE = ("Cloning into '[long value redacted]'...\n"
+             "fatal: unable to access '[URL redacted]': LibreSSL SSL_connect: "
+             "SSL_ERROR_SYSCALL in connection to github.com:443")
+# The same fault one layer earlier, from 2phone-ios run 34374984763: bundler fetching
+# specs. It names no curl code and no SSL_ERROR_SYSCALL, only the truncated read.
+BUNDLER_EOF = ("Retrying fetcher due to error (2/2): Bundler::HTTPError Could not fetch specs "
+               "due to underlying error <SSL_connect returned=1 errno=0 state=error: "
+               "unexpected eof while reading>")
 
 
 class RetryTests(unittest.TestCase):
@@ -121,6 +131,43 @@ class RetryTests(unittest.TestCase):
             with self.subTest(body=body):
                 self.assertEqual(native_pods_retry.retryable(body), "")
 
+    def test_dropped_handshake_recovers_within_the_same_deadline(self):
+        for failure in (HANDSHAKE, BUNDLER_EOF):
+            with self.subTest(failure=failure.splitlines()[-1][:40]):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([failure])
+                code, result = self.fixture.run_cli()
+                self.assertEqual((code, result["pod_attempts"]), (0, 2))
+                attempts = json.loads((self.root / "attempts.json").read_text())
+                self.assertEqual(len(attempts), 2)
+                for attempt in attempts:
+                    self.assertEqual(attempt["argv"], ["install", "--deployment", "--no-repo-update"])
+                    self.assertTrue(attempt["proxy"].startswith("http://127.0.0.1:"))
+                self.assertEqual((self.root / "Podfile.lock").read_text(), "fixture-lock")
+
+    def test_repeat_dropped_handshake_stops_after_second_attempt(self):
+        self.script([HANDSHAKE, HANDSHAKE, HANDSHAKE])
+        code, result = self.fixture.run_cli()
+        self.assertEqual((code, result["code"]), (1, "native_pods_install_failed"))
+        self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 2)
+
+    def test_a_certificate_verdict_beside_a_dropped_handshake_stays_permanent(self):
+        for failure in ("certificate verify failed", "SSL peer shut down incorrectly",
+                        "The requested URL returned error: 403", "curl: (60) unknown trust failure"):
+            with self.subTest(failure=failure):
+                (self.root / "attempts.json").unlink(missing_ok=True)
+                self.script([HANDSHAKE + "\n" + failure])
+                self.assertEqual(self.fixture.run_cli()[0], 1)
+                self.assertEqual(len(json.loads((self.root / "attempts.json").read_text())), 1)
+
+    def test_a_dropped_handshake_is_its_own_named_class(self):
+        self.assertEqual(native_pods_retry.retryable(HANDSHAKE), "handshake_reset")
+        self.assertEqual(native_pods_retry.retryable(BUNDLER_EOF), "handshake_reset")
+        for body in ("the peer read the file", "eof while reading the manifest",
+                     "connection established", "SSL is configured"):
+            with self.subTest(body=body):
+                self.assertEqual(native_pods_retry.retryable(body), "")
+
     def test_one_deadline_and_no_guess_from_generic_eof(self):
         for body in ("fatal: early EOF", "curl 180 failure", "unknown network error"):
             self.assertFalse(native_pods_retry.interrupted_transfer(body))

package/action/scripts/test_native_prepare_evidence.py

@@ -30,6 +30,32 @@ class EvidenceTests(unittest.TestCase):
                 self.assertEqual(receipt["phase"], phase)
                 self.assertEqual(receipt["signals"], ["pod_version_conflict"])
 
+    def test_a_dropped_handshake_is_named_and_is_not_a_certificate_verdict(self):
+        for diagnostic, expected in [
+            ("fatal: unable to access '[URL redacted]': LibreSSL SSL_connect: "
+             "SSL_ERROR_SYSCALL in connection to github.com:443", ["tls_handshake_reset"]),
+            ("Bundler::HTTPError Could not fetch specs due to underlying error "
+             "<SSL_connect returned=1 errno=0 state=error: unexpected eof while reading>",
+             ["tls_handshake_reset"]),
+            ("SSL_connect returned=1 errno=0 state=error: certificate verify failed",
+             ["tls_verification"]),
+        ]:
+            err = io.StringIO()
+            with self.subTest(diagnostic=diagnostic[:40]), contextlib.redirect_stderr(err):
+                report({"ok": False, "code": "native_pods_install_failed", "diagnostic": diagnostic}, "pods")
+            self.assertEqual(json.loads(err.getvalue().strip().split("::", 2)[2])["signals"], expected)
+
+    def test_a_failed_child_command_is_not_reported_as_a_ruby_bundle_fault(self):
+        self.assertEqual(native_bundle.remediation("native_gemfile_lock_commit_required"),
+                         native_bundle.BUNDLE_REMEDIATION)
+        self.assertEqual(native_bundle.remediation("native_bundle_install_failed"),
+                         native_bundle.BUNDLE_REMEDIATION)
+        for code in ("native_configuration_failed", "native_pods_operation_interrupted",
+                     "native_bundle_operation_unverified", "native_google_proxy_required"):
+            with self.subTest(code=code):
+                self.assertEqual(native_bundle.remediation(code), native_bundle.COMMAND_REMEDIATION)
+                self.assertNotIn("Gemfile", native_bundle.remediation(code))
+
     def test_success_is_silent_and_unknown_failures_cannot_inject_annotations(self):
         err = io.StringIO()
         with contextlib.redirect_stderr(err):

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.135
+1.0.136

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.135
+1.0.136

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.135",
+  "version": "1.0.136",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {