gowalk-cicd 1.0.143 → 1.0.144

package/action/.daemux-version

@@ -1 +1 @@
-1.0.143
+1.0.144

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.143
+1.0.144

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.143
+1.0.144

package/docs/CONFIGURATION.md

@@ -45,9 +45,12 @@ inferred safe from a custom step name. Candidate misses never wait or reserve a
 
 Separate custom workflows remain app-owned. Recognized native dependency jobs
 receive optional lock/toolchain-keyed cache restore/save inside their existing job.
-A validation workflow already cancelling superseded work may coalesce duplicate
-push/PR runs for the same app branch. Its triggers, job names, commands and custom
-checks remain. Separate platforms and repositories keep their existing parallelism.
+Supported validation workflows use their existing PR trigger for `task/**` branches,
+keeping default-branch push checks and all job names, commands and custom checks.
+This requires a single app-owned validation workflow, a PR trigger covering the
+known default branch, and jobs without event-dependent behavior or custom GitHub scripts. Other workflows retain separate push/PR concurrency
+groups, so neither required check cancels the other. An upgrade also repairs the shared
+group emitted by 1.0.142–143. Separate platforms and repositories keep their existing parallelism.
 
 `.gowalk-cicd.lock.json` records the template and generated-file digests. Commit it
 with the configuration and rendered workflows. It is migration state, not a CI job.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.143",
+  "version": "1.0.144",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/scripts/lib/checks.mjs

@@ -10,7 +10,7 @@ export async function checkCandidate(github, repo, options) {
   const runs = await github.pages(`repos/${repo.name}/actions/runs?head_sha=${repo.head}`, 'workflow_runs');
   const latest = new Map();
   for (const run of runs.filter(run => ['push', 'pull_request'].includes(run.event))) {
-    const key = run.workflow_id;
+    const key = `${run.workflow_id}:${run.event}`;
     if (!latest.has(key) || latest.get(key).id < run.id) latest.set(key, run);
   }
   const current = [...latest.values()];

package/src/config/validation-events.mjs

@@ -0,0 +1,56 @@
+// Keep required push/PR checks independent; avoid duplicate factory pushes only for supported PR validation.
+import { execFileSync } from 'node:child_process';
+const REF = '${{ github.ref }}';
+const COALESCED = '${{ github.event.pull_request.head.repo.full_name == github.repository'
+  + ' && github.event.pull_request.head.ref || github.ref_name }}';
+
+export function defaultBranch(root) {
+  try {
+    return execFileSync('git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'],
+      { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .trim().replace(/^refs\/remotes\/origin\//, '');
+  } catch { return ''; }
+}
+
+function coversCandidates(event, branch, jobs) {
+  if (!branch || (event !== null && (typeof event !== 'object' || Array.isArray(event)))) return false;
+  const filters = event || {};
+  if (Object.keys(filters).some(key => !['branches', 'types'].includes(key))) return false;
+  if (filters.types && (!Array.isArray(filters.types)
+      || !['opened', 'synchronize', 'reopened'].every(type => filters.types.includes(type)))) return false;
+  if (filters.branches && (!Array.isArray(filters.branches) || !filters.branches.includes(branch)
+      || filters.branches.some(value => typeof value !== 'string' || /[!*?\[\]+]/.test(value)))) return false;
+  // Event-dependent app commands and job conditions need their own reviewed migration.
+  return !/github\.(event|ref)|GITHUB_(EVENT|REF)|actions\/github-script@/.test(JSON.stringify(jobs));
+}
+
+function excludeFactoryPush(doc, push) {
+  if (push !== null && (typeof push !== 'object' || Array.isArray(push))) return false;
+  const filters = push || {};
+  const field = Object.hasOwn(filters, 'branches') ? 'branches' : 'branches-ignore';
+  if (!Object.hasOwn(filters, field) && ('tags' in filters || 'tags-ignore' in filters)) return false;
+  const values = filters[field] || [];
+  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return false;
+  if ('branches' in filters && 'branches-ignore' in filters) return false;
+  const exclusion = field === 'branches' ? '!task/**' : 'task/**';
+  if (values.at(-1) === exclusion) return false;
+  doc.setIn(['on', 'push'], doc.createNode({ ...filters, [field]: [...values, exclusion] }));
+  return true;
+}
+
+export function upgradeEvents(doc, value, branch) {
+  const events = value.on;
+  const concurrency = value.concurrency;
+  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
+      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
+  const original = concurrency.group;
+  const group = original.replace(COALESCED, REF);
+  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
+  if (!group.includes(REF) || !recognized) return false;
+  let changed = group !== original;
+  if (changed) doc.setIn(['concurrency', 'group'], group);
+  if (coversCandidates(events.pull_request, branch, value.jobs)) {
+    changed = excludeFactoryPush(doc, events.push) || changed;
+  }
+  return changed;
+}

package/src/config/validation.mjs

@@ -1,8 +1,9 @@
-// Upgrade supported app-owned validation in place; preserve jobs, triggers, checks and custom commands.
+// Upgrade supported app-owned validation in place; preserve jobs, checks and custom commands.
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readYaml, MigrationRepair } from './yaml.mjs';
 import { upgradeReuse } from './validation-reuse.mjs';
+import { defaultBranch, upgradeEvents } from './validation-events.mjs';
 const CACHE = 'caa296126883cff596d87d8935842f9db880ef25';
 const PREFIX = '.github/actions/swift-app/scripts/';
 
@@ -48,32 +49,20 @@ function upgradeCaches(doc, value, file) {
   return changed;
 }
 
-function coalesceValidation(doc, value) {
-  const events = value.on;
-  const concurrency = value.concurrency;
-  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
-      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
-  const group = concurrency.group;
-  if (!group.includes('${{ github.ref }}')) return false;
-  if (!group.includes('${{ github.workflow }}') && group !== 'flutter-ci-${{ github.ref }}') return false;
-  const identity = '${{ github.event.pull_request.head.repo.full_name == github.repository'
-    + ' && github.event.pull_request.head.ref || github.ref_name }}';
-  doc.setIn(['concurrency', 'group'], group.replace('${{ github.ref }}', identity));
-  return true;
-}
-
 export function planValidation(root, managed) {
   const directory = join(root, '.github/workflows');
   if (!existsSync(directory)) return [];
   const writes = [];
-  for (const file of readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file))) {
+  const files = readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file));
+  // Another app-owned workflow may depend on this workflow's push evidence.
+  const branch = files.length === 1 ? defaultBranch(root) : '';
+  for (const file of files) {
     const source = readFileSync(join(directory, file), 'utf8');
     const { doc, value } = readYaml(source, file);
-    const coalesced = coalesceValidation(doc, value);
-    const compatibleGroup = coalesced || value.concurrency?.group?.includes('github.event.pull_request.head.ref');
-    const reused = compatibleGroup && upgradeReuse(doc, value, file);
+    const events = upgradeEvents(doc, value, branch);
+    const reused = upgradeReuse(doc, value, file);
     const cached = upgradeCaches(doc, doc.toJS({ maxAliasCount: 100 }), file);
-    if (cached || coalesced || reused) {
+    if (cached || events || reused) {
       writes.push({ file: `.github/workflows/${file}`, content: doc.toString({ lineWidth: 120 }) });
     }
   }