gowalk-cicd 1.0.136 → 1.0.138

package/CLAUDE.md

@@ -415,7 +415,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   change the Google account proxy. Update workflow wiring as well as action directories.
 
 - Mobile Deploy watches `.factory/releases/mobile.json`, produced from committed task source and
-  repository variables. Unknown inputs and embedded editors remain in its source proof; native trees
+  the named build-variable allow-list shared by freeze and runtime in `mobile_inputs.cjs`.
+  The list follows `templates/deploy.yml`; rotating Play ownership leases stay excluded.
+  Unknown inputs and embedded editors remain in its source proof; native trees
   are platform-scoped. Backend/web deployments remain independent. Confirmed store uploads are
   recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
   An uncertain upload never starts another binary automatically. Preserve its signed artifact,

package/action/.daemux-version

@@ -1 +1 @@
-1.0.136
+1.0.138

package/action/scripts/mobile_inputs.cjs

@@ -19,8 +19,22 @@ function input(name, platform) {
   return true;
 }
 
+// Named vars read by templates/deploy.yml, except the rotating Play ownership
+// lease: it authorizes provider access but never changes a build. Keep the list
+// checked against the template, and share the projection with the freeze CLI.
+const BUILD_VARIABLES = [
+  'BACKEND_API_DOMAIN', 'BACKEND_APP_NAME', 'BACKEND_DEPLOY_HOST', 'BACKEND_HEALTH_PATH',
+  'DEPLOY_PLATFORMS', 'FIREBASE_APP_ID', 'GOOGLE_PLAY_STATUS', 'GOOGLE_PLAY_TRACK',
+  'GOOGLE_PLAY_USER_FRACTION', 'JAVA_VERSION', 'ONBOARDING_PUBLIC_ORIGIN',
+];
+
+function buildVariables(value = {}) {
+  return Object.fromEntries(BUILD_VARIABLES.filter(name => Object.hasOwn(value, name))
+    .map(name => [name, value[name]]));
+}
+
 function configuration(value = {}) {
-  return digest(JSON.stringify(Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)))));
+  return digest(JSON.stringify(buildVariables(value)));
 }
 
 function fingerprint(platform, ref = 'HEAD') {
@@ -78,4 +92,4 @@ function read(variables = {}) {
   }
   return manifest;
 }
-module.exports = {INTENT, SCHEMA, input, fingerprint, create, read, configuration};
+module.exports = {INTENT, SCHEMA, BUILD_VARIABLES, buildVariables, input, fingerprint, create, read, configuration};

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.136
+1.0.138

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.136
+1.0.138

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.136",
+  "version": "1.0.138",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/release.mjs

@@ -12,17 +12,17 @@ export function variables(repository, execute) {
   for (const scope of scopes) {
     const pages = JSON.parse(execute('gh', ['api', `repos/${repository}/actions/${scope}?per_page=100`,
       '--paginate', '--slurp']));
-    if (!Array.isArray(pages) || pages.some(page => !Array.isArray(page.variables))) {
+    if (!Array.isArray(pages) || !pages.length || pages.some(page => !Array.isArray(page?.variables))) {
       throw Error('mobile_release_configuration_unverified');
     }
     for (const row of pages.flatMap(page => page.variables)) {
-      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(row.name) || typeof row.value !== 'string') {
+      if (!row || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(row.name) || typeof row.value !== 'string') {
         throw Error('mobile_release_configuration_unverified');
       }
       result[row.name] = row.value;
     }
   }
-  return result;
+  return inputs.buildVariables(result);
 }
 
 export function release(platform) {