gowalk-cicd 1.0.142 → 1.0.144

package/action/.daemux-version

@@ -1 +1 @@
-1.0.142
+1.0.144

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.142
+1.0.144

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.142
+1.0.144

package/docs/CONFIGURATION.md

@@ -45,9 +45,12 @@ inferred safe from a custom step name. Candidate misses never wait or reserve a
 
 Separate custom workflows remain app-owned. Recognized native dependency jobs
 receive optional lock/toolchain-keyed cache restore/save inside their existing job.
-A validation workflow already cancelling superseded work may coalesce duplicate
-push/PR runs for the same app branch. Its triggers, job names, commands and custom
-checks remain. Separate platforms and repositories keep their existing parallelism.
+Supported validation workflows use their existing PR trigger for `task/**` branches,
+keeping default-branch push checks and all job names, commands and custom checks.
+This requires a single app-owned validation workflow, a PR trigger covering the
+known default branch, and jobs without event-dependent behavior or custom GitHub scripts. Other workflows retain separate push/PR concurrency
+groups, so neither required check cancels the other. An upgrade also repairs the shared
+group emitted by 1.0.142–143. Separate platforms and repositories keep their existing parallelism.
 
 `.gowalk-cicd.lock.json` records the template and generated-file digests. Commit it
 with the configuration and rendered workflows. It is migration state, not a CI job.
@@ -62,7 +65,7 @@ in the same repository; unrelated repositories can continue upgrading.
 
 # Organization rollout
 
-Use the script from the exact released package being installed:
+Use a released organization script and the reviewed installer package:
 
 ```sh
 node /path/to/package/scripts/upgrade-org.mjs \
@@ -75,8 +78,10 @@ It paginates the organization, discovers actual installed actions, and uses one
 independent repositories concurrently. Existing CI remains authoritative; each
 successful candidate merges independently, and any resulting push workflows are
 followed before branch/checkout cleanup. No factory task or Mac reservation is
-created. API throttling and queued CI limit new migration PR publication while
-other local preparation and completed candidates continue.
+created. API throttling and `--max-active` bound publication. One repository’s queued CI
+never stops unrelated PRs; GitHub schedules each platform against its available runners.
+Existing checks must finish successfully, and GitHub enforces its required checks and reviews
+for the exact candidate. A repository without candidate checks gains no new CI requirement.
 
 The state file records repository heads, PR/run URLs, failures and cleanup.
 Restart with the same file and package to resume. `--retry-unresolved` retries
@@ -84,3 +89,8 @@ recorded exceptions after their cause is repaired; `--dry-run` prepares local
 changes without pushing, opening PRs or merging. Use a separate state file for a
 new target version. The final status counts distinguish updated, already-current,
 not-installed and unresolved repositories; an unresolved result exits nonzero.
+
+`--installer-dir /path/to/reviewed/package` selects a retained installer independently of
+the organization script release. Its package version owns the existing state, branches and
+installed files. This lets an orchestration-only repair resume a rollout without reinstalling
+another package version or replacing its PRs. Omitting it installs the script’s own package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.142",
+  "version": "1.0.144",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/scripts/lib/checks.mjs

@@ -10,7 +10,7 @@ export async function checkCandidate(github, repo, options) {
   const runs = await github.pages(`repos/${repo.name}/actions/runs?head_sha=${repo.head}`, 'workflow_runs');
   const latest = new Map();
   for (const run of runs.filter(run => ['push', 'pull_request'].includes(run.event))) {
-    const key = run.workflow_id;
+    const key = `${run.workflow_id}:${run.event}`;
     if (!latest.has(key) || latest.get(key).id < run.id) latest.set(key, run);
   }
   const current = [...latest.values()];
@@ -22,13 +22,13 @@ export async function checkCandidate(github, repo, options) {
     repo.nextAt = Date.now() + 30000;
     return;
   }
-  if (!current.length) throw new RolloutError('candidate_ci_missing');
   if (current.some(run => !['success', 'skipped'].includes(run.conclusion))) {
     throw new RolloutError('candidate_ci_failed');
   }
   // GitHub enforces existing required checks and reviews; no admin bypass or new gate is installed.
   await (github.command || command)('gh', ['pr', 'merge', String(repo.pr), '--repo', repo.name, '--squash',
     '--match-head-commit', repo.head]);
+  repo.validation = current.length ? 'existing_ci' : 'github_merge_policy';
   repo.status = 'deploy';
 }
 

package/scripts/lib/coordination.mjs

@@ -0,0 +1,39 @@
+import { readFileSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { RolloutError } from './github.mjs';
+
+export function options(args, packageDir) {
+  const result = { packageDir, org: 'gowalk-public', workers: 8, maxActive: 8, ciTimeout: 3600000 };
+  const names = { '--org': 'org', '--state': 'statePath', '--workers': 'workers',
+    '--max-active': 'maxActive', '--installer-dir': 'packageDir' };
+  for (let index = 0; index < args.length; index++) {
+    if (args[index] === '--dry-run') { result.dryRun = true; continue; }
+    if (args[index] === '--retry-unresolved') { result.retryUnresolved = true; continue; }
+    const name = names[args[index]];
+    if (!name || !args[index + 1]) throw new RolloutError('invalid_rollout_arguments');
+    result[name] = ['workers', 'maxActive'].includes(name) ? Number(args[++index]) : args[++index];
+  }
+  if (!result.statePath || !/^[\w-]+$/.test(result.org)
+      || ![result.workers, result.maxActive].every(value => Number.isInteger(value) && value > 0 && value <= 32)) {
+    throw new RolloutError('invalid_rollout_arguments');
+  }
+  result.packageDir = resolve(result.packageDir);
+  const target = JSON.parse(readFileSync(join(result.packageDir, 'package.json'), 'utf8'));
+  if (target.name !== 'gowalk-cicd' || !/^\d+\.\d+\.\d+$/.test(target.version)) {
+    throw new RolloutError('invalid_installer_package');
+  }
+  result.version = target.version;
+  result.statePath = resolve(result.statePath);
+  result.workDir = join(dirname(result.statePath), 'checkouts');
+  return result;
+}
+
+export function eligible(repo, repositories, opts) {
+  if ((repo.nextAt || 0) > Date.now()) return false;
+  if (repo.status === 'publish') {
+    const active = repositories.filter(row => ['ci', 'deploy', 'cleanup'].includes(row.status));
+    return active.length + (opts.publishing || 0) < opts.maxActive;
+  }
+  return ['inspect', 'prepare', 'ci', 'deploy', 'cleanup', 'update-base'].includes(repo.status);
+}
+

package/scripts/upgrade-org.mjs

@@ -1,44 +1,14 @@
 #!/usr/bin/env node
-// Run from one exact published package. Local workers never claim or reserve factory Macs.
-import { readFileSync } from 'node:fs';
-import { resolve, dirname, join } from 'node:path';
+// Use a released coordinator and reviewed installer. Workers never claim or reserve factory Macs.
+import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { GitHub, RolloutError, delay } from './lib/github.mjs';
 import { openState, summary } from './lib/state.mjs';
+import { options, eligible } from './lib/coordination.mjs';
 import { discover, inspect } from './lib/discovery.mjs';
 import { prepare, publish, incorporateBase } from './lib/repository.mjs';
 import { checkCandidate, checkDeploy, cleanup } from './lib/checks.mjs';
 
-function options(args) {
-  const packageDir = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-  const version = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8')).version;
-  const result = { packageDir, version, org: 'gowalk-public', workers: 8, maxActive: 8, ciTimeout: 3600000 };
-  const names = { '--org': 'org', '--state': 'statePath', '--workers': 'workers', '--max-active': 'maxActive' };
-  for (let index = 0; index < args.length; index++) {
-    if (args[index] === '--dry-run') { result.dryRun = true; continue; }
-    if (args[index] === '--retry-unresolved') { result.retryUnresolved = true; continue; }
-    const name = names[args[index]];
-    if (!name || !args[index + 1]) throw new RolloutError('invalid_rollout_arguments');
-    result[name] = ['workers', 'maxActive'].includes(name) ? Number(args[++index]) : args[++index];
-  }
-  if (!result.statePath || !/^[\w-]+$/.test(result.org)
-      || ![result.workers, result.maxActive].every(value => Number.isInteger(value) && value > 0 && value <= 32)) {
-    throw new RolloutError('invalid_rollout_arguments');
-  }
-  result.statePath = resolve(result.statePath);
-  result.workDir = join(dirname(result.statePath), 'checkouts');
-  return result;
-}
-
-function eligible(repo, repositories, opts) {
-  if ((repo.nextAt || 0) > Date.now()) return false;
-  if (repo.status === 'publish') {
-    const active = repositories.filter(row => ['ci', 'deploy', 'cleanup'].includes(row.status));
-    return active.length + (opts.publishing || 0) < opts.maxActive && !active.some(row => row.queued > 0);
-  }
-  return ['inspect', 'prepare', 'ci', 'deploy', 'cleanup', 'update-base'].includes(repo.status);
-}
-
 async function advance(github, repo, opts) {
   const handlers = { inspect, prepare, publish, ci: checkCandidate, deploy: checkDeploy, cleanup };
   if (repo.status === 'update-base') return incorporateBase(repo);
@@ -99,7 +69,7 @@ async function run(opts, state) {
 
 let state;
 try {
-  const opts = options(process.argv.slice(2));
+  const opts = options(process.argv.slice(2), resolve(dirname(fileURLToPath(import.meta.url)), '..'));
   state = openState(opts.statePath, opts.org, opts.version);
   await run(opts, state);
   state.save();

package/src/config/validation-events.mjs

@@ -0,0 +1,56 @@
+// Keep required push/PR checks independent; avoid duplicate factory pushes only for supported PR validation.
+import { execFileSync } from 'node:child_process';
+const REF = '${{ github.ref }}';
+const COALESCED = '${{ github.event.pull_request.head.repo.full_name == github.repository'
+  + ' && github.event.pull_request.head.ref || github.ref_name }}';
+
+export function defaultBranch(root) {
+  try {
+    return execFileSync('git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'],
+      { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .trim().replace(/^refs\/remotes\/origin\//, '');
+  } catch { return ''; }
+}
+
+function coversCandidates(event, branch, jobs) {
+  if (!branch || (event !== null && (typeof event !== 'object' || Array.isArray(event)))) return false;
+  const filters = event || {};
+  if (Object.keys(filters).some(key => !['branches', 'types'].includes(key))) return false;
+  if (filters.types && (!Array.isArray(filters.types)
+      || !['opened', 'synchronize', 'reopened'].every(type => filters.types.includes(type)))) return false;
+  if (filters.branches && (!Array.isArray(filters.branches) || !filters.branches.includes(branch)
+      || filters.branches.some(value => typeof value !== 'string' || /[!*?\[\]+]/.test(value)))) return false;
+  // Event-dependent app commands and job conditions need their own reviewed migration.
+  return !/github\.(event|ref)|GITHUB_(EVENT|REF)|actions\/github-script@/.test(JSON.stringify(jobs));
+}
+
+function excludeFactoryPush(doc, push) {
+  if (push !== null && (typeof push !== 'object' || Array.isArray(push))) return false;
+  const filters = push || {};
+  const field = Object.hasOwn(filters, 'branches') ? 'branches' : 'branches-ignore';
+  if (!Object.hasOwn(filters, field) && ('tags' in filters || 'tags-ignore' in filters)) return false;
+  const values = filters[field] || [];
+  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return false;
+  if ('branches' in filters && 'branches-ignore' in filters) return false;
+  const exclusion = field === 'branches' ? '!task/**' : 'task/**';
+  if (values.at(-1) === exclusion) return false;
+  doc.setIn(['on', 'push'], doc.createNode({ ...filters, [field]: [...values, exclusion] }));
+  return true;
+}
+
+export function upgradeEvents(doc, value, branch) {
+  const events = value.on;
+  const concurrency = value.concurrency;
+  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
+      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
+  const original = concurrency.group;
+  const group = original.replace(COALESCED, REF);
+  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
+  if (!group.includes(REF) || !recognized) return false;
+  let changed = group !== original;
+  if (changed) doc.setIn(['concurrency', 'group'], group);
+  if (coversCandidates(events.pull_request, branch, value.jobs)) {
+    changed = excludeFactoryPush(doc, events.push) || changed;
+  }
+  return changed;
+}

package/src/config/validation.mjs

@@ -1,8 +1,9 @@
-// Upgrade supported app-owned validation in place; preserve jobs, triggers, checks and custom commands.
+// Upgrade supported app-owned validation in place; preserve jobs, checks and custom commands.
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readYaml, MigrationRepair } from './yaml.mjs';
 import { upgradeReuse } from './validation-reuse.mjs';
+import { defaultBranch, upgradeEvents } from './validation-events.mjs';
 const CACHE = 'caa296126883cff596d87d8935842f9db880ef25';
 const PREFIX = '.github/actions/swift-app/scripts/';
 
@@ -48,32 +49,20 @@ function upgradeCaches(doc, value, file) {
   return changed;
 }
 
-function coalesceValidation(doc, value) {
-  const events = value.on;
-  const concurrency = value.concurrency;
-  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
-      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
-  const group = concurrency.group;
-  if (!group.includes('${{ github.ref }}')) return false;
-  if (!group.includes('${{ github.workflow }}') && group !== 'flutter-ci-${{ github.ref }}') return false;
-  const identity = '${{ github.event.pull_request.head.repo.full_name == github.repository'
-    + ' && github.event.pull_request.head.ref || github.ref_name }}';
-  doc.setIn(['concurrency', 'group'], group.replace('${{ github.ref }}', identity));
-  return true;
-}
-
 export function planValidation(root, managed) {
   const directory = join(root, '.github/workflows');
   if (!existsSync(directory)) return [];
   const writes = [];
-  for (const file of readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file))) {
+  const files = readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file));
+  // Another app-owned workflow may depend on this workflow's push evidence.
+  const branch = files.length === 1 ? defaultBranch(root) : '';
+  for (const file of files) {
     const source = readFileSync(join(directory, file), 'utf8');
     const { doc, value } = readYaml(source, file);
-    const coalesced = coalesceValidation(doc, value);
-    const compatibleGroup = coalesced || value.concurrency?.group?.includes('github.event.pull_request.head.ref');
-    const reused = compatibleGroup && upgradeReuse(doc, value, file);
+    const events = upgradeEvents(doc, value, branch);
+    const reused = upgradeReuse(doc, value, file);
     const cached = upgradeCaches(doc, doc.toJS({ maxAliasCount: 100 }), file);
-    if (cached || coalesced || reused) {
+    if (cached || events || reused) {
       writes.push({ file: `.github/workflows/${file}`, content: doc.toString({ lineWidth: 120 }) });
     }
   }