gowalk-cicd 1.0.14 → 1.0.16

package/README.md

@@ -205,6 +205,33 @@ committed back. If the module computes its `versionCode` instead of declaring a
 literal, the action emits a `::warning::` and leaves the project's own value
 alone.
 
+### Build toolchain floors (Flutter apps)
+
+The Flutter Gradle plugin refuses to apply to a project whose wrapper is older
+than the SDK's floor:
+
+```
+Your project's Gradle version (8.11.1) is lower than Flutter's minimum
+supported version of 8.14.0.
+```
+
+CI installs the current `stable` Flutter, so that floor rises on Flutter's
+release cadence rather than the app's — every app in a fleet breaks on the same
+day, long after the last commit that could have anticipated it. Before building,
+the action reads the floor out of the runner's Flutter SDK and, when the
+project's `gradle-wrapper.properties` is below it, rewrites `distributionUrl`
+**in the checkout** with a `::warning::`. The Android Gradle Plugin and Kotlin
+Gradle Plugin versions declared in `android/settings.gradle` (or the older
+`buildscript { classpath ... }` / `ext.kotlin_version` form) are raised the same
+way against Flutter's `errorAGPVersion` / `errorKGPVersion`. Same policy as the
+versionCode rewrite: the edits are never committed back, so the project keeps
+whatever versions its authors chose. Commit the bumps yourself to silence the
+warnings.
+
+(The rewritten name is verified against `services.gradle.org` because Gradle's
+own naming is inconsistent across majors — `gradle-8.14-all.zip` but
+`gradle-9.0.0-all.zip`.)
+
 ### iOS delivery
 
 The iOS composite action runs on `macos-15` and:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.14
+1.0.16

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.14
+1.0.16

package/android-action/scripts/gradle_wrapper.py

@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+"""Raise a Flutter app's build toolchain to the versions its Flutter SDK requires.
+
+The Flutter Gradle plugin refuses to apply when the project's wrapper is older
+than the SDK's floor:
+
+    Your project's Gradle version (8.11.1) is lower than Flutter's minimum
+    supported version of 8.14.0.
+
+CI installs the current `stable` Flutter, so that floor rises on Flutter's
+release cadence, not the app's. Every app in a fleet then breaks on the same
+day — long after the last commit that could have anticipated it.
+
+This raises the wrapper inside the CI checkout, the same way the action already
+rewrites versionCode there. The edit is never committed back; the project keeps
+whatever version its authors chose, and the build stops depending on the
+project having been touched since the last Flutter release.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+# `stable` moves the floor over time, so read it from the SDK rather than
+# hardcoding a number this file would have to chase.
+_CHECKER = Path("packages/flutter_tools/gradle/src/main/kotlin/DependencyVersionChecker.kt")
+# The same file declares a floor for each of the three: Gradle, the Android
+# Gradle Plugin and the Kotlin Gradle Plugin. All three are hard errors, and
+# all three move with `stable`.
+_FLOORS = {
+    "gradle": r"errorGradleVersion\s*:\s*Version\s*=\s*Version\((\d+),\s*(\d+),\s*(\d+)\)",
+    "agp": r"errorAGPVersion\s*:\s*AndroidPluginVersion\s*=\s*AndroidPluginVersion\((\d+),\s*(\d+),\s*(\d+)\)",
+    "kgp": r"errorKGPVersion\s*:\s*Version\s*=\s*Version\((\d+),\s*(\d+),\s*(\d+)\)",
+}
+_ERROR_VERSION = re.compile(_FLOORS["gradle"])
+_DISTRIBUTION = re.compile(r"^(distributionUrl=.*gradle-)([0-9]+(?:\.[0-9]+)*)(-(?:all|bin)\.zip)$", re.M)
+
+Version = tuple[int, ...]
+
+
+def parse_version(text: str) -> Version | None:
+    if not re.fullmatch(r"[0-9]+(\.[0-9]+)*", text or ""):
+        return None
+    return tuple(int(part) for part in text.split("."))
+
+
+def _render(version: Version) -> str:
+    return ".".join(str(part) for part in version)
+
+
+def _stripped(version: Version) -> str:
+    parts = list(version)
+    while len(parts) > 2 and parts[-1] == 0:
+        parts.pop()
+    return _render(tuple(parts))
+
+
+def candidates(version: Version) -> list[str]:
+    """Distribution names to try, best guess first.
+
+    Gradle's naming is not consistent across majors: 8.x drops a trailing zero
+    patch (`gradle-8.14-all.zip`; `gradle-8.14.0-all.zip` is a 404) while 9.x
+    keeps it (`gradle-9.0.0-all.zip`; `gradle-9.0-all.zip` is a 404). Getting
+    this wrong swaps the error being fixed for a download failure that does not
+    look like our doing, so order by the observed rule and keep the other form
+    as a fallback.
+    """
+    stripped, full = _stripped(version), _render(version)
+    order = [full, stripped] if version and version[0] >= 9 else [stripped, full]
+    return list(dict.fromkeys(order))
+
+
+def _exists(name: str) -> bool | None:
+    """True/False if the distribution could be checked, None if we could not."""
+    import urllib.error
+    import urllib.request
+
+    url = f"https://services.gradle.org/distributions/gradle-{name}-all.zip"
+    request = urllib.request.Request(url, method="HEAD")
+    try:
+        with urllib.request.urlopen(request, timeout=15) as response:
+            return response.status == 200
+    except urllib.error.HTTPError as exc:
+        return exc.code == 200
+    except OSError:
+        return None
+
+
+def normalize(version: Version, probe=_exists) -> str:
+    """The distribution name to write into distributionUrl.
+
+    Probes services.gradle.org so a future naming change corrects itself; falls
+    back to the ordering in `candidates` when the network is unavailable, which
+    is no worse than not probing at all.
+    """
+    options = candidates(version)
+    for name in options:
+        if probe(name) is True:
+            return name
+    return options[0]
+
+
+def flutter_minimum(flutter_root: Path, tool: str) -> Version | None:
+    """The oldest `tool` (gradle | agp | kgp) this Flutter SDK will build against."""
+    checker = flutter_root / _CHECKER
+    try:
+        text = checker.read_text(encoding="utf-8")
+    except OSError:
+        return None
+    match = re.search(_FLOORS[tool], text)
+    if not match:
+        return None
+    return tuple(int(group) for group in match.groups())
+
+
+def flutter_minimum_gradle(flutter_root: Path) -> Version | None:
+    """The oldest Gradle this Flutter SDK will apply its plugin against."""
+    return flutter_minimum(flutter_root, "gradle")
+
+
+def wrapper_properties(workspace: Path, gradle_root: Path | None = None) -> Path:
+    root = gradle_root or (workspace / "android")
+    return root / "gradle" / "wrapper" / "gradle-wrapper.properties"
+
+
+def read_wrapper_version(properties: Path) -> Version | None:
+    try:
+        match = _DISTRIBUTION.search(properties.read_text(encoding="utf-8"))
+    except OSError:
+        return None
+    return parse_version(match.group(2)) if match else None
+
+
+def set_wrapper_version(properties: Path, version: Version) -> bool:
+    try:
+        text = properties.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    replaced, count = _DISTRIBUTION.subn(
+        lambda m: f"{m.group(1)}{normalize(version)}{m.group(3)}", text
+    )
+    if not count:
+        return False
+    properties.write_text(replaced, encoding="utf-8")
+    return True
+
+
+def ensure_minimum(workspace: Path, flutter_root: Path, gradle_root: Path | None = None) -> str:
+    """Raise the wrapper to Flutter's floor. Returns a line for the build log."""
+    properties = wrapper_properties(workspace, gradle_root)
+    if not properties.is_file():
+        return ""
+    minimum = flutter_minimum_gradle(flutter_root)
+    if minimum is None:
+        return (
+            "::warning::Could not read Flutter's minimum Gradle version from "
+            f"{flutter_root}; leaving the wrapper alone"
+        )
+    current = read_wrapper_version(properties)
+    if current is None:
+        return f"::warning::No Gradle distributionUrl found in {properties}; leaving it alone"
+    if current >= minimum:
+        return f"Gradle wrapper {normalize(current)} meets Flutter's minimum {normalize(minimum)}"
+    if not set_wrapper_version(properties, minimum):
+        return f"::warning::Failed to rewrite the Gradle distributionUrl in {properties}"
+    return (
+        f"::warning::Gradle wrapper {normalize(current)} is below Flutter's minimum "
+        f"{normalize(minimum)}; raised it to {normalize(minimum)} for this build only. "
+        f"Commit the bump in {properties.name} to make it permanent."
+    )
+
+
+# --- Android Gradle Plugin and Kotlin Gradle Plugin -------------------------
+#
+# Both are declared in `android/settings.gradle(.kts)` in the modern Flutter
+# template and in the top-level `android/build.gradle` in the older one. Flutter
+# floors both, and both floors move with `stable`, so an app that built fine
+# last month stops building without a single line of it having changed.
+
+_PLUGIN_BLOCK = {
+    "agp": re.compile(
+        r"""(id\s*\(?\s*["']com\.android\.application["']\s*\)?\s*version\s*["'])([0-9][0-9.]*)(["'])"""
+    ),
+    "kgp": re.compile(
+        r"""(id\s*\(?\s*["']org\.jetbrains\.kotlin\.android["']\s*\)?\s*version\s*["'])([0-9][0-9.]*)(["'])"""
+    ),
+}
+_LEGACY = {
+    "agp": re.compile(r"""(["']com\.android\.tools\.build:gradle:)([0-9][0-9.]*)(["'])"""),
+    "kgp": re.compile(r"""(ext\.kotlin_version\s*=\s*["'])([0-9][0-9.]*)(["'])"""),
+}
+
+_LABEL = {"agp": "Android Gradle Plugin", "kgp": "Kotlin Gradle Plugin"}
+
+
+def toolchain_files(workspace: Path, gradle_root: Path | None = None) -> list[Path]:
+    root = gradle_root or (workspace / "android")
+    names = ("settings.gradle", "settings.gradle.kts", "build.gradle", "build.gradle.kts")
+    return [root / name for name in names if (root / name).is_file()]
+
+
+def read_declared(files: list[Path], tool: str) -> tuple[Path, Version] | None:
+    """First declaration of `tool` across the candidate build files."""
+    for path in files:
+        try:
+            text = path.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        for pattern in (_PLUGIN_BLOCK[tool], _LEGACY[tool]):
+            match = pattern.search(text)
+            if match:
+                version = parse_version(match.group(2))
+                if version is not None:
+                    return path, version
+    return None
+
+
+def set_declared(path: Path, tool: str, version: Version) -> bool:
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    total = 0
+    for pattern in (_PLUGIN_BLOCK[tool], _LEGACY[tool]):
+        text, count = pattern.subn(lambda m: f"{m.group(1)}{_render(version)}{m.group(3)}", text)
+        total += count
+    if not total:
+        return False
+    path.write_text(text, encoding="utf-8")
+    return True
+
+
+def ensure_toolchain(
+    workspace: Path, flutter_root: Path, gradle_root: Path | None = None
+) -> list[str]:
+    """Raise Gradle, AGP and KGP to this Flutter SDK's floors. Returns log lines."""
+    messages = []
+    gradle = ensure_minimum(workspace, flutter_root, gradle_root)
+    if gradle:
+        messages.append(gradle)
+    files = toolchain_files(workspace, gradle_root)
+    if not files:
+        return messages
+    for tool in ("agp", "kgp"):
+        minimum = flutter_minimum(flutter_root, tool)
+        if minimum is None:
+            messages.append(
+                f"::warning::Could not read Flutter's minimum {_LABEL[tool]} version; leaving it alone"
+            )
+            continue
+        found = read_declared(files, tool)
+        if found is None:
+            # Plenty of valid projects inherit these from elsewhere; that is not
+            # something to fail a deploy over.
+            continue
+        path, current = found
+        if current >= minimum:
+            messages.append(
+                f"{_LABEL[tool]} {_render(current)} meets Flutter's minimum {_render(minimum)}"
+            )
+            continue
+        if not set_declared(path, tool, minimum):
+            messages.append(f"::warning::Failed to raise the {_LABEL[tool]} version in {path}")
+            continue
+        messages.append(
+            f"::warning::{_LABEL[tool]} {_render(current)} is below Flutter's minimum "
+            f"{_render(minimum)}; raised it to {_render(minimum)} in {path.name} for this build "
+            f"only. Commit the bump to make it permanent."
+        )
+    return messages

package/android-action/scripts/resolve_android.py

@@ -4,9 +4,11 @@
 from __future__ import annotations
 
 import os
+import shutil
 import sys
 from pathlib import Path
 
+import gradle_wrapper
 from android_config import (
     ConfigError,
     detect_package_name,
@@ -126,6 +128,22 @@ def apply_gradle_version(project, build_number: int, build_name: str) -> None:
         )
 
 
+def flutter_root() -> Path | None:
+    """Where the runner's Flutter SDK lives.
+
+    flutter-action exports FLUTTER_ROOT; a self-hosted runner with Flutter
+    merely on PATH does not, so fall back to walking up from the binary
+    (<root>/bin/flutter).
+    """
+    declared = os.environ.get("FLUTTER_ROOT")
+    if declared:
+        return Path(declared)
+    binary = shutil.which("flutter")
+    if not binary:
+        return None
+    return Path(binary).resolve().parent.parent
+
+
 def main() -> None:
     workspace = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
     env_path = Path(os.environ["GITHUB_ENV"])
@@ -151,6 +169,18 @@ def main() -> None:
             apply_gradle_version(
                 project, build_number, os.environ.get("INPUT_BUILD_NAME") or ""
             )
+        else:
+            # Flutter refuses to apply its Gradle plugin when the project's
+            # Gradle, AGP or Kotlin plugin is older than the SDK's floor, and CI
+            # tracks `stable`, so those floors rise without the app changing.
+            # Raise them in the checkout rather than letting every app in the
+            # fleet break on Flutter's release day.
+            root = flutter_root()
+            if root is None:
+                print("::warning::Flutter SDK not found; skipping the build toolchain check")
+            else:
+                for message in gradle_wrapper.ensure_toolchain(workspace, root):
+                    print(message)
     except (ConfigError, KeyError, OSError) as exc:
         print(f"::error::{exc}")
         raise SystemExit(1) from exc

package/android-action/scripts/test_gradle_wrapper.py

@@ -0,0 +1,205 @@
+#!/usr/bin/env python3
+"""Tests for raising a Flutter app's Gradle wrapper to the SDK's floor."""
+
+from __future__ import annotations
+
+import tempfile
+import unittest
+from pathlib import Path
+
+import gradle_wrapper as gw
+
+CHECKER_SOURCE = """
+package com.flutter.gradle
+object DependencyVersionChecker {
+    internal val warnGradleVersion: Version = Version(8, 7, 0)
+    internal val errorGradleVersion: Version = Version(8, 14, 0)
+}
+"""
+
+WRAPPER = (
+    "distributionBase=GRADLE_USER_HOME\n"
+    "distributionPath=wrapper/dists\n"
+    "distributionUrl=https\\://services.gradle.org/distributions/gradle-8.11.1-all.zip\n"
+)
+
+
+def never(_name: str) -> bool:
+    """Probe stub for tests: the network is never consulted."""
+    return False
+
+
+class RenderTest(unittest.TestCase):
+    def test_eight_x_drops_a_trailing_zero_patch(self):
+        self.assertEqual(gw.candidates((8, 14, 0))[0], "8.14")
+
+    def test_nine_x_keeps_a_trailing_zero_patch(self):
+        # gradle-9.0-all.zip is a 404; gradle-9.0.0-all.zip is the real name.
+        self.assertEqual(gw.candidates((9, 0, 0))[0], "9.0.0")
+
+    def test_a_real_patch_is_never_stripped(self):
+        self.assertEqual(gw.candidates((8, 14, 3)), ["8.14.3"])
+
+    def test_the_other_spelling_stays_available_as_a_fallback(self):
+        self.assertIn("8.14.0", gw.candidates((8, 14, 0)))
+
+    def test_falls_back_to_the_first_candidate_without_network(self):
+        self.assertEqual(gw.normalize((8, 14, 0), probe=never), "8.14")
+
+    def test_a_successful_probe_wins_over_the_ordering(self):
+        self.assertEqual(
+            gw.normalize((8, 14, 0), probe=lambda name: name == "8.14.0"), "8.14.0"
+        )
+
+
+class WrapperFileTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.tmp.name)
+        self.properties = gw.wrapper_properties(self.workspace)
+        self.properties.parent.mkdir(parents=True)
+        self.properties.write_text(WRAPPER, encoding="utf-8")
+        self.flutter = self.workspace / "flutter"
+        checker = self.flutter / gw._CHECKER
+        checker.parent.mkdir(parents=True)
+        checker.write_text(CHECKER_SOURCE, encoding="utf-8")
+        self.addCleanup(self.tmp.cleanup)
+
+    def test_reads_the_declared_version(self):
+        self.assertEqual(gw.read_wrapper_version(self.properties), (8, 11, 1))
+
+    def test_reads_the_sdk_floor(self):
+        self.assertEqual(gw.flutter_minimum_gradle(self.flutter), (8, 14, 0))
+
+    def test_raises_a_wrapper_below_the_floor(self):
+        gw.set_wrapper_version(self.properties, (8, 14, 0))
+        self.assertEqual(gw.read_wrapper_version(self.properties), (8, 14,))
+        self.assertIn("gradle-8.14-all.zip", self.properties.read_text())
+
+    def test_preserves_a_bin_distribution(self):
+        self.properties.write_text(
+            WRAPPER.replace("-all.zip", "-bin.zip"), encoding="utf-8"
+        )
+        gw.set_wrapper_version(self.properties, (8, 14, 0))
+        self.assertIn("gradle-8.14-bin.zip", self.properties.read_text())
+
+    def test_leaves_a_wrapper_already_at_the_floor_alone(self):
+        self.properties.write_text(
+            WRAPPER.replace("8.11.1", "8.14.3"), encoding="utf-8"
+        )
+        message = gw.ensure_minimum(self.workspace, self.flutter)
+        self.assertIn("meets Flutter's minimum", message)
+        self.assertIn("gradle-8.14.3-all.zip", self.properties.read_text())
+
+    def test_warns_and_raises_when_below_the_floor(self):
+        message = gw.ensure_minimum(self.workspace, self.flutter)
+        self.assertTrue(message.startswith("::warning::"))
+        self.assertIn("8.11.1", message)
+        self.assertIn("gradle-8.14", self.properties.read_text())
+
+    def test_no_wrapper_is_not_an_error(self):
+        self.properties.unlink()
+        self.assertEqual(gw.ensure_minimum(self.workspace, self.flutter), "")
+
+    def test_unreadable_sdk_leaves_the_wrapper_untouched(self):
+        message = gw.ensure_minimum(self.workspace, self.workspace / "nope")
+        self.assertTrue(message.startswith("::warning::"))
+        self.assertIn("gradle-8.11.1-all.zip", self.properties.read_text())
+
+    def test_a_wrapper_without_a_distribution_url_is_left_alone(self):
+        self.properties.write_text("distributionBase=GRADLE_USER_HOME\n", encoding="utf-8")
+        message = gw.ensure_minimum(self.workspace, self.flutter)
+        self.assertIn("No Gradle distributionUrl", message)
+
+    def test_honours_an_explicit_gradle_root(self):
+        root = self.workspace / "nested"
+        properties = gw.wrapper_properties(self.workspace, root)
+        properties.parent.mkdir(parents=True)
+        properties.write_text(WRAPPER, encoding="utf-8")
+        gw.ensure_minimum(self.workspace, self.flutter, gradle_root=root)
+        self.assertIn("gradle-8.14", properties.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()
+
+
+SETTINGS = """
+pluginManagement { includeBuild("../flutter/packages/flutter_tools/gradle") }
+plugins {
+    id "dev.flutter.flutter-plugin-loader" version "1.0.0"
+    id "com.android.application" version "8.9.1" apply false
+    id "org.jetbrains.kotlin.android" version "2.1.0" apply false
+}
+include ":app"
+"""
+
+LEGACY_BUILD = """
+buildscript {
+    ext.kotlin_version = '1.7.10'
+    dependencies { classpath 'com.android.tools.build:gradle:7.4.2' }
+}
+"""
+
+CHECKER_WITH_ALL_FLOORS = """
+    internal val errorGradleVersion: Version = Version(8, 14, 0)
+    internal val errorAGPVersion: AndroidPluginVersion = AndroidPluginVersion(8, 11, 1)
+    internal val errorKGPVersion: Version = Version(2, 0, 0)
+"""
+
+
+class ToolchainTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.tmp.name)
+        android = self.workspace / "android"
+        android.mkdir()
+        (android / "settings.gradle").write_text(SETTINGS, encoding="utf-8")
+        properties = gw.wrapper_properties(self.workspace)
+        properties.parent.mkdir(parents=True)
+        properties.write_text(WRAPPER, encoding="utf-8")
+        self.settings = android / "settings.gradle"
+        self.flutter = self.workspace / "flutter"
+        checker = self.flutter / gw._CHECKER
+        checker.parent.mkdir(parents=True)
+        checker.write_text(CHECKER_WITH_ALL_FLOORS, encoding="utf-8")
+        self.addCleanup(self.tmp.cleanup)
+
+    def test_reads_each_floor_from_the_sdk(self):
+        self.assertEqual(gw.flutter_minimum(self.flutter, "gradle"), (8, 14, 0))
+        self.assertEqual(gw.flutter_minimum(self.flutter, "agp"), (8, 11, 1))
+        self.assertEqual(gw.flutter_minimum(self.flutter, "kgp"), (2, 0, 0))
+
+    def test_reads_the_plugins_block(self):
+        files = gw.toolchain_files(self.workspace)
+        self.assertEqual(gw.read_declared(files, "agp")[1], (8, 9, 1))
+        self.assertEqual(gw.read_declared(files, "kgp")[1], (2, 1, 0))
+
+    def test_raises_agp_but_leaves_a_compliant_kgp(self):
+        messages = gw.ensure_toolchain(self.workspace, self.flutter)
+        text = self.settings.read_text()
+        self.assertIn('"com.android.application" version "8.11.1"', text)
+        self.assertIn('"org.jetbrains.kotlin.android" version "2.1.0"', text)
+        self.assertTrue(any("Android Gradle Plugin 8.9.1 is below" in m for m in messages))
+        self.assertTrue(any("Kotlin Gradle Plugin 2.1.0 meets" in m for m in messages))
+
+    def test_raises_the_wrapper_in_the_same_pass(self):
+        gw.ensure_toolchain(self.workspace, self.flutter)
+        self.assertIn("gradle-8.14-all.zip", gw.wrapper_properties(self.workspace).read_text())
+
+    def test_handles_the_legacy_buildscript_form(self):
+        self.settings.unlink()
+        (self.workspace / "android" / "build.gradle").write_text(LEGACY_BUILD, encoding="utf-8")
+        gw.ensure_toolchain(self.workspace, self.flutter)
+        text = (self.workspace / "android" / "build.gradle").read_text()
+        self.assertIn("com.android.tools.build:gradle:8.11.1", text)
+        self.assertIn("ext.kotlin_version = '2.0.0'", text)
+
+    def test_a_project_declaring_neither_is_left_alone(self):
+        self.settings.write_text("include ':app'\n", encoding="utf-8")
+        messages = gw.ensure_toolchain(self.workspace, self.flutter)
+        self.assertFalse(any("Android Gradle Plugin" in m for m in messages))
+
+    def test_an_unreadable_sdk_warns_per_tool(self):
+        messages = gw.ensure_toolchain(self.workspace, self.workspace / "nope")
+        self.assertEqual(sum("::warning::" in m for m in messages), 3)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {