gowalk-cicd 1.0.138 → 1.0.140

package/CLAUDE.md

@@ -201,10 +201,16 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   resolve online. Missing or invalid metadata falls back to the required proxied GET; missing
   account transport still refuses even with a warm cache. SDK keys and checksum checks stay unchanged.
 - Gradle caches use checksum-pinned restore/save actions, each optional and bounded to two minutes.
+  Native Pods/Bundler caches use the committed locks and selected Ruby/Xcode/architecture in the existing job.
   Preserve setup-java's complete keys, inputs and absolute paths; restore the same OS/architecture prefix.
   Failed releases save distinct partial keys unless cancelled; completed keys require success. Builds remain required.
   Only pinned cache entrypoints get cache transport; see [cache behavior](docs/GRADLE_CACHE.md) before adoption.
 - GitHub artifact uploads have their own checksum-pinned `artifact_env.cjs` process scope.
+  `mobile-candidate.yml` builds only trusted ready task PRs, using the existing release workflow in
+  candidate mode. Candidate mode cannot publish or mutate a marketing-version slot. Main promotes
+  only verified matching binaries with current credentials and retains the original build/symbol identity;
+  a miss uses the normal build without waiting. Preserve successful sibling artifacts across reruns.
+  See `docs/CANDIDATE_ARTIFACTS.md`; never turn this optimization into a new factory stage or resource reservation.
   It reuses the cache transport's approved HTTPS request guard, then removes inherited proxy
   variables only inside the official `upload-artifact` process. Unknown programs/origins refuse;
   later Apple/Google clients retain their proxies and artifact failures remain job failures.

package/README.md

@@ -26,6 +26,10 @@ are unaffected.
 
 Re-run the same command anytime to pull the latest version.
 
+Ready task PRs build shipping binaries alongside validation; the protected merge promotes matching
+binaries through the existing store upload paths. See [candidate artifact reuse](docs/CANDIDATE_ARTIFACTS.md)
+for identity checks, native dependency caches, version handling and adoption of custom workflows.
+
 Mobile delivery requires an explicit frozen release intent. After source, signing, account transport,
 and integration readiness pass, run on the task branch:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.138
+1.0.140

package/action/action.yml

@@ -15,6 +15,10 @@ description: >
   consumers. App Store provisioning profiles are reconciled at runtime.
 
 inputs:
+  candidate-binary:
+    description: Verified candidate artifact directory supplied by the package workflow
+    required: false
+    default: ''
   project:
     description: "Path to the .xcodeproj (or omit if using workspace)"
     required: false
@@ -218,6 +222,15 @@ runs:
     # that failure could not arrive in the repository that needed it.
     # Preserving here rather than after signing is the same
     # point: a red step later in this run must not take the update with it.
+    - name: Activate verified candidate binary
+      if: ${{ inputs.candidate-binary != '' }}
+      shell: bash
+      env:
+        CANDIDATE_DIRECTORY: ${{ inputs.candidate-binary }}
+      run: |
+        python3 -m pip install --quiet --break-system-packages PyJWT cryptography requests
+        node "$SWIFT_APP_ACTION/scripts/mobile_artifact_inventory.cjs" activate ios "$CANDIDATE_DIRECTORY"
+
     - name: Stage bot-side scripts to runner temp
       if: ${{ (inputs.archive == 'true' || inputs.auto-update == 'true')
             && github.event_name == 'push'
@@ -265,7 +278,42 @@ runs:
         set -euo pipefail
         bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
+    - name: Select latest Xcode
+      if: ${{ inputs.candidate-binary == '' }}
+      shell: bash
+      run: |
+        XCODE_PATH=$(ls -d /Applications/Xcode_26*.app 2>/dev/null | sort -V | tail -1)
+        if [ -z "$XCODE_PATH" ]; then
+          XCODE_PATH=$(ls -d /Applications/Xcode*.app 2>/dev/null | sort -V | tail -1)
+        fi
+        echo "Selecting $XCODE_PATH"
+        sudo xcode-select -s "$XCODE_PATH"
+        xcodebuild -version
+
+    - name: Describe native dependency cache
+      if: ${{ inputs.candidate-binary == '' }}
+      id: native_cache_scope
+      continue-on-error: true
+      shell: bash
+      run: |
+        python3 "$SWIFT_APP_ACTION/scripts/native_cache.py"
+        node "$SWIFT_APP_ACTION/scripts/cache_scope.cjs" --snapshot
+
+    - name: Restore native dependencies
+      id: native_cache
+      if: ${{ steps.native_cache_scope.outputs.key != '' && inputs.candidate-binary == '' }}
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25
+      continue-on-error: true
+      timeout-minutes: 2
+      env:
+        NODE_OPTIONS: --require "${{ steps.native_cache_scope.outputs.preloader }}"
+        SEGMENT_DOWNLOAD_TIMEOUT_MINS: '1'
+      with:
+        key: ${{ steps.native_cache_scope.outputs.key }}
+        path: ${{ steps.native_cache_scope.outputs.paths }}
+
     - name: Resolve credentials + auto-detect Xcode project
+      if: ${{ inputs.candidate-binary == '' }}
       shell: bash
       env:
         INPUT_PROJECT: ${{ inputs.project }}
@@ -312,19 +360,21 @@ runs:
         export INPUT_WORKSPACE
         python3 "$SWIFT_APP_ACTION/scripts/read_config.py"
 
-    - name: Select latest Xcode
-      shell: bash
-      run: |
-        XCODE_PATH=$(ls -d /Applications/Xcode_26*.app 2>/dev/null | sort -V | tail -1)
-        if [ -z "$XCODE_PATH" ]; then
-          XCODE_PATH=$(ls -d /Applications/Xcode*.app 2>/dev/null | sort -V | tail -1)
-        fi
-        echo "Selecting $XCODE_PATH"
-        sudo xcode-select -s "$XCODE_PATH"
-        xcodebuild -version
+    - name: Save native dependencies
+      if: >-
+        ${{ steps.native_cache_scope.outputs.key != '' && steps.native_cache.outputs.cache-hit != 'true'
+            && inputs.candidate-binary == '' }}
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25
+      continue-on-error: true
+      timeout-minutes: 2
+      env:
+        NODE_OPTIONS: --require "${{ steps.native_cache_scope.outputs.preloader }}"
+      with:
+        key: ${{ steps.native_cache_scope.outputs.key }}
+        path: ${{ steps.native_cache_scope.outputs.paths }}
 
     - name: Run simulator tests
-      if: ${{ (inputs.run-tests || env.CFG_RUN_TESTS) == 'true' }}
+      if: ${{ (inputs.run-tests || env.CFG_RUN_TESTS) == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -387,7 +437,7 @@ runs:
         echo "ASC_KEY_PATH=$RUNNER_TEMP/asc/AuthKey.p8" >> "$GITHUB_ENV"
 
     - name: Resolve marketing version (project source of truth)
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -404,7 +454,9 @@ runs:
     - name: Resolve App Store version slot (REUSE or CREATE)
       # A third answer, TESTFLIGHT_ONLY, is handled inside: see the
       # STORE_VERSION_LOCKED branch of the script.
-      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'true' }}
+      if: >-
+        ${{ inputs.archive == 'true'
+            && (inputs.manage-app-store-version == 'true' || env.MOBILE_CANDIDATE_BUILD == 'true') }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -412,7 +464,7 @@ runs:
         # mmv auto-bumps the project file (pbxproj or Info.plist) per this
         # policy and continues. 'none' preserves the historical fail-the-
         # build behavior.
-        MARKETING_VERSION_AUTO_BUMP: ${{ inputs.marketing-version-auto-bump }}
+        MARKETING_VERSION_AUTO_BUMP: ${{ inputs.candidate-binary != '' && 'none' || inputs.marketing-version-auto-bump }}
         # Auto-bump persistence-context inputs. mmv_floor_check refuses to
         # auto-bump unless this run is push-to-default-branch -- the same
         # gate the commit-back step uses. Without this gate,
@@ -429,7 +481,8 @@ runs:
         CONFIGURATION: ${{ inputs.configuration || env.CFG_CONFIGURATION }}
       run: |
         set -o pipefail
-        BUILD_NUMBER=$(python3 "$SWIFT_APP_ACTION/scripts/next_build_number.py")
+        echo "SOURCE_MARKETING_VERSION=${SOURCE_MARKETING_VERSION:-$MARKETING_VERSION}" >> "$GITHUB_ENV"
+        BUILD_NUMBER=${REUSED_BUILD_NUMBER:-$(python3 "$SWIFT_APP_ACTION/scripts/next_build_number.py")}
         DECISION_JSON=$(python3 "$SWIFT_APP_ACTION/scripts/manage_marketing_version.py")
         APP_STORE_VERSION_ID=$(python3 -c \
           "import json,sys; d=json.loads(sys.argv[1]); print(d.get('appStoreVersionId',''))" \
@@ -446,6 +499,20 @@ runs:
         EFFECTIVE_MV=$(python3 -c \
           "import json,sys; d=json.loads(sys.argv[1]); print(d.get('versionString',''))" \
           "$DECISION_JSON")
+        if [ -n "${REUSED_BUILD_NUMBER:-}" ] && [ "$EFFECTIVE_MV" != "$MARKETING_VERSION" ]; then
+          echo '::error::mobile_artifact_store_version_changed'
+          exit 1
+        fi
+        if [ -n "${REUSED_BUILD_NUMBER:-}" ] && [ "$DECISION" != "TESTFLIGHT_ONLY" ] &&
+           [ "$SOURCE_MARKETING_VERSION" != "$MARKETING_VERSION" ]; then
+          python3 - <<'PY_PERSIST_VERSION'
+        import os, sys
+        sys.path.insert(0, os.environ["SWIFT_APP_ACTION"] + "/scripts")
+        from version_utils import write_marketing_version
+        if not write_marketing_version(os.environ["MARKETING_VERSION"]):
+            raise SystemExit("mobile_artifact_version_source_unresolved")
+        PY_PERSIST_VERSION
+        fi
         if [ "$DECISION" = "TESTFLIGHT_ONLY" ]; then
           # An App Store version is under review or awaiting the developer's
           # release: App Store Connect refuses to create or edit ANY version
@@ -472,7 +539,9 @@ runs:
         echo "Using marketing version $MARKETING_VERSION build $BUILD_NUMBER (decision=$DECISION_JSON)"
 
     - name: Resolve TestFlight build number
-      if: ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'false' }}
+      if: >-
+        ${{ inputs.archive == 'true' && inputs.manage-app-store-version == 'false'
+            && env.MOBILE_CANDIDATE_BUILD != 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         APP_STORE_APPLE_ID: ${{ inputs.app-store-apple-id || env.CFG_APP_STORE_APPLE_ID }}
@@ -491,7 +560,7 @@ runs:
              "Profile names are derived per-target as CI-<bundle_id>."
 
     - name: Prepare signing (cert + keychain + per-target profiles + pbxproj)
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -529,14 +598,14 @@ runs:
       run: bash "$BOT_SCRIPTS_DIR/commit_bot_changes.sh"
 
     - name: Re-raise signing preparation failure
-      if: ${{ inputs.archive == 'true' && env.SIGNING_PREP_EXIT != '0' }}
+      if: ${{ inputs.archive == 'true' && env.SIGNING_PREP_EXIT != '0' && inputs.candidate-binary == '' }}
       shell: bash
       run: |
         echo "::error::Signing preparation failed with exit $SIGNING_PREP_EXIT."
         exit "$SIGNING_PREP_EXIT"
 
     - name: Stamp Info.plist versions (CFBundleVersion + CFBundleShortVersionString)
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -562,7 +631,9 @@ runs:
         echo "Stamped CFBundleVersion=$BUILD_NUMBER CFBundleShortVersionString=$MARKETING_VERSION in $INFOPLIST_PATH"
 
     - name: Declare ITSAppUsesNonExemptEncryption in Info.plist
-      if: ${{ inputs.archive == 'true' && (inputs.uses-non-exempt-encryption || env.CFG_USES_NON_EXEMPT) != '' }}
+      if: >-
+        ${{ inputs.archive == 'true' && (inputs.uses-non-exempt-encryption || env.CFG_USES_NON_EXEMPT) != ''
+            && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -587,7 +658,7 @@ runs:
         echo "Set ITSAppUsesNonExemptEncryption=$VALUE in $INFOPLIST_PATH"
 
     - name: Defer native Firebase upload phases to the proxied console
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -597,7 +668,7 @@ runs:
           --search-root "$(dirname "${WORKSPACE:-$PROJECT}")"
 
     - name: Archive
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       env:
         PROJECT: ${{ inputs.project || env.CFG_PROJECT }}
@@ -635,7 +706,7 @@ runs:
           archive
 
     - name: Export IPA
-      if: ${{ inputs.archive == 'true' }}
+      if: ${{ inputs.archive == 'true' && inputs.candidate-binary == '' }}
       shell: bash
       run: |
         set -o pipefail
@@ -696,7 +767,9 @@ runs:
     # cannot lose the exact build's symbols. The autonomous session completes
     # the upload through the proxied Firebase console from this typed artifact.
     - name: Retain dSYMs for the proxied Firebase console
-      if: ${{ inputs.archive == 'true' && inputs.upload == 'true' }}
+      if: >-
+        ${{ inputs.archive == 'true' && (inputs.upload == 'true' || env.MOBILE_CANDIDATE_BUILD == 'true')
+            && inputs.candidate-binary == '' }}
       shell: bash
       env:
         FIREBASE_APP_ID: ${{ inputs.firebase-app-id }}

package/action/scripts/cache_env.cjs

@@ -0,0 +1,10 @@
+// NODE_OPTIONS applies this only to the cache step, including its official post/save action.
+try {
+  const scope = require('./cache_scope.cjs');
+  scope.authorize(process.argv[1], process.env);
+  scope.guardRequests();
+  for (const key of scope.proxyKeys) delete process.env[key];
+} catch {
+  process.stderr.write('github_cache_transport_scope_refused\n');
+  process.exit(1);
+}

package/action/scripts/mmv_decide_create.py

@@ -181,6 +181,11 @@ def decide_create(
         appstore_versions=versions, strict=True,
     )
     stale_id = _stale_editable_id(versions, target_version)
+    from mobile_candidate_context import active
+
+    if active():
+        # Match the shipping version decision without POSTing or renaming a store version before merge.
+        return mmv._result("PREPARE", target_version, "")
     new_id = mmv.create_or_reuse_with_stale(
         app_id, target_version, token, stale_editable_id=stale_id,
     )

package/action/scripts/mmv_floor_check.py

@@ -213,10 +213,13 @@ def maybe_auto_bump(target: str, floor: str) -> str | None:
             file=sys.stderr,
         )
         return None
-    if not _persist_context_ok(policy):
+    from mobile_candidate_context import active
+
+    candidate = active()
+    if not candidate and not _persist_context_ok(policy):
         return None
     new_version = version_utils.compute_next_version(target, floor, policy)
-    if not version_utils.write_marketing_version(new_version):
+    if not candidate and not version_utils.write_marketing_version(new_version):
         print(
             f"::warning::auto-bump could not locate a writable "
             f"MARKETING_VERSION source (pbxproj or Info.plist); "

package/action/scripts/mobile_artifact_files.py

@@ -0,0 +1,187 @@
+"""Retain only release binaries, symbols and bounded non-secret build metadata."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shutil
+import sys
+
+SCHEMA = "gowalk-cicd/mobile-binary.v1"
+IOS_ENV = ("CFG_BUNDLE_ID", "CFG_TEAM_ID", "CFG_APP_STORE_APPLE_ID", "CFG_CONFIGURATION",
+           "CFG_PROJECT", "CFG_WORKSPACE", "CFG_SCHEME", "CFG_LOCALE", "CFG_USES_NON_EXEMPT",
+           "CFG_WHATS_NEW", "MARKETING_VERSION", "BUILD_NUMBER", "SOURCE_MARKETING_VERSION")
+ANDROID_ENV = ("ANDROID_PACKAGE_NAME", "ANDROID_BUILD_NUMBER", "ANDROID_PROJECT_KIND")
+
+
+def digest(path: Path) -> str:
+    with path.open("rb") as handle:
+        return hashlib.file_digest(handle, "sha256").hexdigest()
+
+
+def android_config():
+    root = Path(__file__).resolve().parents[2]
+    folder = root / "android-app/scripts"
+    sys.path.insert(0, str(folder if folder.is_dir() else root / "android-action/scripts"))
+    import android_config as config
+
+    return config
+
+
+def credentials(platform: str) -> dict:
+    root = Path(os.environ["GITHUB_WORKSPACE"]) / "creds"
+    patterns = ("*.p8", "cert.p12", "cert.meta.json", "cert.registry.json") if platform == "ios" else (
+        "*.jks", "*.keystore")
+    paths = {path for pattern in patterns for path in root.glob(pattern)}
+    if platform == "android":
+        for path in root.glob("*.json"):
+            try:
+                if json.loads(path.read_text()).get("type") == "service_account":
+                    paths.add(path)
+            except (OSError, ValueError, AttributeError):
+                continue
+    # Only digests of the app's existing signing/account material travel; never key bytes or passwords.
+    if any(path.is_symlink() or not path.is_file() for path in paths):
+        raise ValueError("mobile_artifact_credential_scope_invalid")
+    result = {path.name: digest(path) for path in sorted(paths)}
+    if platform == "android":
+        signing = android_config().find_signing_config(root.parent)
+        result["selected-keystore"] = digest(signing.keystore_path)
+        result["selected-alias"] = hashlib.sha256(signing.key_alias.encode()).hexdigest()
+    return result
+
+
+def files(root: Path) -> dict:
+    result = {}
+    for path in sorted(root.rglob("*")):
+        if path.is_symlink():
+            raise ValueError("mobile_artifact_symlink")
+        if path.is_file() and path.name != "mobile-binary.json":
+            name = path.relative_to(root).as_posix()
+            if "\n" in name or "\r" in name or len(result) >= 10000:
+                raise ValueError("mobile_artifact_path_invalid")
+            result[name] = digest(path)
+    return result
+
+
+def metadata(platform: str) -> dict:
+    event = json.loads(Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
+    keys = IOS_ENV if platform == "ios" else ANDROID_ENV
+    return {"schema": SCHEMA, "platform": platform, "repository": os.environ["GITHUB_REPOSITORY"],
+            "fingerprint": os.environ["MOBILE_ARTIFACT_FINGERPRINT"],
+            "run_id": int(os.environ["GITHUB_RUN_ID"]), "run_attempt": int(os.environ["GITHUB_RUN_ATTEMPT"]),
+            "source_sha": os.environ["GITHUB_SHA"],
+            "head_sha": event.get("pull_request", {}).get("head", {}).get("sha", os.environ["GITHUB_SHA"]),
+            "credential_fingerprints": credentials(platform),
+            "environment": {key: os.environ.get(key, "") for key in keys}}
+
+
+def pack(platform: str, directory: Path) -> None:
+    temp = Path(os.environ["RUNNER_TEMP"])
+    if any(directory.iterdir()):
+        raise ValueError("mobile_artifact_output_not_empty")
+    if platform == "ios":
+        binaries = list((temp / "export").glob("*.ipa"))
+        if len(binaries) != 1:
+            raise ValueError("mobile_artifact_binary_ambiguous")
+        (directory / "export").mkdir()
+        shutil.copyfile(binaries[0], directory / "export" / "app.ipa")
+        symbols = ["firebase-symbols", "dart-symbols/ios"]
+    else:
+        binary = Path(os.environ["MOBILE_ARTIFACT_BINARY"])
+        if not binary.is_file() or binary.suffix != ".aab" or binary.is_symlink():
+            raise ValueError("mobile_artifact_binary_absent")
+        shutil.copyfile(binary, directory / "app.aab")
+        symbols = ["dart-symbols/android"]
+    for relative in symbols:
+        if (temp / relative).is_dir():
+            shutil.copytree(temp / relative, directory / relative, symlinks=True)
+    value = {**metadata(platform), "files": files(directory)}
+    (directory / "mobile-binary.json").write_text(json.dumps(value, indent=2) + "\n")
+
+
+def verify(platform: str, directory: Path) -> dict:
+    receipt = directory / "mobile-binary.json"
+    if receipt.is_symlink() or receipt.stat().st_size > 2 * 1024 * 1024:
+        raise ValueError("mobile_artifact_receipt_invalid")
+    value = json.loads(receipt.read_text())
+    if (value.get("schema") != SCHEMA or value.get("platform") != platform
+            or value.get("repository") != os.environ["GITHUB_REPOSITORY"]
+            or value.get("fingerprint") != os.environ["MOBILE_ARTIFACT_FINGERPRINT"]
+            or value.get("credential_fingerprints") != credentials(platform)
+            or value.get("files") != files(directory)):
+        raise ValueError("mobile_artifact_inputs_mismatch")
+    expected = set(IOS_ENV if platform == "ios" else ANDROID_ENV)
+    environment = value.get("environment", {})
+    if set(environment) != expected or any(not isinstance(v, str) or len(v) > 16000 for v in environment.values()):
+        raise ValueError("mobile_artifact_environment_invalid")
+    number = environment["BUILD_NUMBER" if platform == "ios" else "ANDROID_BUILD_NUMBER"]
+    if not re.fullmatch(r"[1-9][0-9]{0,17}", number):
+        raise ValueError("mobile_artifact_version_invalid")
+    identifier = environment["CFG_BUNDLE_ID" if platform == "ios" else "ANDROID_PACKAGE_NAME"]
+    if not re.fullmatch(r"[A-Za-z0-9_.-]{3,200}", identifier):
+        raise ValueError("mobile_artifact_application_invalid")
+    if platform == "ios" and (not environment["CFG_APP_STORE_APPLE_ID"].isdigit()
+                              or not re.fullmatch(r"[A-Z0-9]{10}", environment["CFG_TEAM_ID"])):
+        raise ValueError("mobile_artifact_signing_scope_invalid")
+    binary = "export/app.ipa" if platform == "ios" else "app.aab"
+    if binary not in value["files"]:
+        raise ValueError("mobile_artifact_binary_absent")
+    return value
+
+
+def emit(path: Path, name: str, value: str) -> None:
+    # A per-value delimiter keeps multiline What's New text inside a single environment value.
+    delimiter = "MOBILE_VALUE_" + hashlib.sha256(value.encode()).hexdigest()
+    with path.open("a") as handle:
+        handle.write(f"{name}<<{delimiter}\n{value}\n{delimiter}\n")
+
+
+def restore_ios(directory: Path, value: dict) -> None:
+    from read_config import emit_credentials
+
+    temp, env = Path(os.environ["RUNNER_TEMP"]), Path(os.environ["GITHUB_ENV"])
+    emit_credentials(env, Path(os.environ["GITHUB_WORKSPACE"]))
+    for key, text in value["environment"].items():
+        emit(env, key, text)
+    emit(env, "REUSED_BUILD_NUMBER", value["environment"]["BUILD_NUMBER"])
+    notes = temp / "candidate-whats-new.txt"
+    notes.write_text(value["environment"]["CFG_WHATS_NEW"])
+    emit(env, "CFG_WHATS_NEW_FILE", str(notes))
+    for relative in ("export", "firebase-symbols", "dart-symbols/ios"):
+        if (directory / relative).is_dir():
+            shutil.copytree(directory / relative, temp / relative, dirs_exist_ok=True)
+    receipt = temp / "firebase-symbols/firebase-symbols.json"
+    if receipt.is_file():
+        firebase = json.loads(receipt.read_text())
+        name = f"ios-crashlytics-symbols-{os.environ['GITHUB_RUN_ID']}-{os.environ['GITHUB_RUN_ATTEMPT']}"
+        firebase.update(source_sha=os.environ["GITHUB_SHA"], artifact=name)
+        receipt.write_text(json.dumps(firebase, indent=2))
+        print("::notice title=firebase_symbols_pending::" + json.dumps(firebase, separators=(",", ":")))
+
+
+def restore(platform: str, directory: Path) -> None:
+    value = verify(platform, directory)
+    if platform == "ios":
+        restore_ios(directory, value)
+        return
+    # Use the current checkout's account, never a service-account file retained in an artifact.
+    env = value["environment"]
+    values = {"package-name": env["ANDROID_PACKAGE_NAME"], "build-number": env["ANDROID_BUILD_NUMBER"],
+              "project-kind": env["ANDROID_PROJECT_KIND"], "bundle-path": str(directory / "app.aab"),
+              "play-service-account": str(android_config().find_play_service_account(
+                  Path(os.environ["GITHUB_WORKSPACE"])))}
+    for key, text in values.items():
+        emit(Path(os.environ["GITHUB_OUTPUT"]), key, text)
+
+
+if __name__ == "__main__":
+    operation, selected, target = sys.argv[1:]
+    if selected not in {"ios", "android"} or operation not in {"pack", "restore", "verify"}:
+        raise SystemExit("mobile_artifact_command_invalid")
+    try:
+        {"pack": pack, "restore": restore, "verify": verify}[operation](selected, Path(target))
+    except Exception:
+        raise SystemExit("mobile_artifact_files_refused") from None

package/action/scripts/mobile_artifact_inventory.cjs

@@ -0,0 +1,102 @@
+/* Reuse completed candidate artifacts immediately; a miss never reserves or waits for a runner. */
+'use strict';
+const {execFileSync} = require('node:child_process');
+const {mkdirSync, mkdtempSync, readFileSync, appendFileSync} = require('node:fs');
+const {join} = require('node:path');
+const {createHash} = require('node:crypto');
+const inputs = require('./mobile_inputs.cjs');
+const api = require('./mobile_release_api.cjs');
+
+function identity(platform) {
+  const manifest = inputs.read(JSON.parse(process.env.MOBILE_RELEASE_VARIABLES || '{}'));
+  if (!manifest.platforms[platform]) throw Error('mobile_artifact_platform_absent');
+  return createHash('sha256').update(manifest.platforms[platform] + manifest.configuration_sha256).digest('hex');
+}
+
+function output(name, value) {
+  if (/[\r\n]/.test(String(value))) throw Error('mobile_artifact_output_invalid');
+  appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+}
+
+async function candidate(artifact) {
+  if (artifact.expired !== false || !Number.isSafeInteger(artifact.workflow_run?.id)) return null;
+  const run = await api.request('GET', `/actions/runs/${artifact.workflow_run.id}`, undefined, 5000);
+  const repository = process.env.GITHUB_REPOSITORY;
+  if (run.status !== 'completed' || run.conclusion !== 'success' || run.event !== 'pull_request' ||
+      run.path !== '.github/workflows/mobile-candidate.yml' || !run.head_branch?.startsWith('task/') ||
+      run.repository?.full_name !== repository || run.head_repository?.full_name !== repository ||
+      !/^[a-f0-9]{40}$/.test(run.head_sha) || !Number.isSafeInteger(run.run_attempt)) return null;
+  const match = /^mobile-binary-(ios|android)-[a-f0-9]{64}-(\d+)-(\d+)$/.exec(artifact.name);
+  const attempt = Number(match?.[3]);
+  if (!match || Number(match[2]) !== run.id || !Number.isSafeInteger(attempt) ||
+      attempt < 1 || attempt > run.run_attempt) return null;
+  const jobs = await api.request('GET', `/actions/runs/${run.id}/attempts/${attempt}/jobs?per_page=100`, undefined, 5000);
+  const label = match[1] === 'ios' ? 'iOS TestFlight' : 'Android Google Play';
+  const producers = jobs.jobs?.filter(job => job.name === label || job.name?.endsWith(`/ ${label}`)) || [];
+  if (jobs.jobs?.length >= 100 || producers.length !== 1 || producers[0].conclusion !== 'success' ||
+      producers[0].head_sha !== run.head_sha || !producers[0].steps?.some(step =>
+        step.name === 'Retain candidate shipping binary' && step.conclusion === 'success')) return null;
+  // Re-running only a failed sibling retains a successful platform's artifact from its earlier attempt.
+  return {...run, artifact_attempt: attempt};
+}
+
+async function restore(platform) {
+  const deadline = Date.now() + 120000;
+  const fingerprint = identity(platform);
+  const prefix = `mobile-binary-${platform}-${fingerprint}-`;
+  const inventory = await api.request('GET', '/actions/artifacts?per_page=100', undefined, 5000);
+  if (!Array.isArray(inventory.artifacts)) throw Error('mobile_artifact_inventory_invalid');
+  for (const artifact of inventory.artifacts.filter(row => row.name?.startsWith(prefix)).slice(0, 5)) {
+    if (Date.now() >= deadline) break;
+    const run = await candidate(artifact);
+    if (!run || artifact.name !== `${prefix}${run.id}-${run.artifact_attempt}`) continue;
+    const directory = mkdtempSync(join(process.env.RUNNER_TEMP, `mobile-binary-${platform}-`));
+    execFileSync('gh', ['run', 'download', String(run.id), '--repo', process.env.GITHUB_REPOSITORY,
+      '--name', artifact.name, '--dir', directory], {stdio: 'ignore', timeout: Math.max(1, deadline - Date.now())});
+    const receipt = JSON.parse(readFileSync(join(directory, 'mobile-binary.json'), 'utf8'));
+    if (receipt.run_id !== run.id || receipt.run_attempt !== run.artifact_attempt || receipt.head_sha !== run.head_sha) {
+      throw Error('mobile_artifact_run_mismatch');
+    }
+    const operation = platform === 'ios' ? 'verify' : 'restore';
+    execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), operation, platform, directory],
+      {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: fingerprint}});
+    output('directory', directory);
+    output('restored', 'true');
+    console.log(`::notice::Reusing ${platform} binary from candidate run ${run.id}`);
+    return;
+  }
+  output('restored', 'false');
+}
+
+function pack(platform) {
+  const fingerprint = identity(platform);
+  const directory = join(process.env.RUNNER_TEMP, `mobile-binary-${platform}`);
+  mkdirSync(directory, {recursive: true});
+  execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), 'pack', platform, directory],
+    {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: fingerprint}});
+  output('directory', directory);
+  const attempt = `${process.env.GITHUB_RUN_ID}-${process.env.GITHUB_RUN_ATTEMPT}`;
+  output('name', `mobile-binary-${platform}-${fingerprint}-${attempt}`);
+}
+
+async function main([operation, platform, directory]) {
+  if (!['ios', 'android'].includes(platform)) throw Error('mobile_artifact_platform_invalid');
+  if (operation === 'pack') return pack(platform);
+  if (operation === 'activate' && platform === 'ios' && directory) {
+    return execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), 'restore', platform, directory],
+      {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: identity(platform)}});
+  }
+  if (operation !== 'restore') throw Error('mobile_artifact_operation_invalid');
+  try { await restore(platform); }
+  catch {
+    // This is an optional optimization. No provider write has occurred; existing CI can build normally.
+    output('restored', 'false');
+    console.log('::notice::Candidate binary unavailable or mismatched; using the existing release build');
+  }
+}
+
+module.exports = {identity, candidate, restore, pack};
+if (require.main === module) main(process.argv.slice(2)).catch(() => {
+  console.error('::error::mobile_artifact_pack_failed');
+  process.exitCode = 1;
+});

package/action/scripts/mobile_candidate_context.py

@@ -0,0 +1,18 @@
+"""Candidate compilation may read store version state but cannot claim a store upload."""
+import json
+import os
+from pathlib import Path
+
+
+def active() -> bool:
+    if os.environ.get("MOBILE_CANDIDATE_BUILD") != "true":
+        return False
+    event = json.loads(Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
+    pull = event.get("pull_request", {})
+    head, base = pull.get("head", {}), pull.get("base", {})
+    if (os.environ.get("GITHUB_EVENT_NAME") != "pull_request"
+            or head.get("repo", {}).get("full_name") != os.environ.get("GITHUB_REPOSITORY")
+            or not str(head.get("ref", "")).startswith("task/")
+            or base.get("ref") != event.get("repository", {}).get("default_branch")):
+        raise ValueError("mobile_release_candidate_scope_invalid")
+    return True

package/action/scripts/mobile_inputs.cjs

@@ -29,7 +29,21 @@ const BUILD_VARIABLES = [
 ];
 
 function buildVariables(value = {}) {
-  return Object.fromEntries(BUILD_VARIABLES.filter(name => Object.hasOwn(value, name))
+  const names = new Set(BUILD_VARIABLES);
+  for (const path of ['.github/workflows/deploy.yml', '.github/workflows/mobile-candidate.yml']) {
+    let source;
+    try { source = git('show', `HEAD:${path}`); } catch { continue; }
+    const named = /\bvars(?:\.([A-Za-z_][A-Za-z0-9_]*)|\[['"]([A-Za-z_][A-Za-z0-9_]*)['"]\])/g;
+    const consumed = [...source.matchAll(named)].map(match => match[1] || match[2]);
+    // A custom workflow may consume a variable the standard template does not know.
+    // Whole-object/dynamic use has no narrower provable scope, so conservatively include it.
+    const dynamic = /\bvars\[(?!['"])/.test(source) || source.split('\n').some(line =>
+      line.includes('toJSON(vars)') && !line.includes('MOBILE_RELEASE_VARIABLES:'));
+    for (const name of (dynamic ? Object.keys(value) : consumed).sort()) {
+      if (name !== 'APP_ROBOT_PLAY_EDIT_BINDING') names.add(name);
+    }
+  }
+  return Object.fromEntries([...names].filter(name => Object.hasOwn(value, name))
     .map(name => [name, value[name]]));
 }