gowalk-cicd 1.0.146 → 1.0.147

package/CLAUDE.md

@@ -413,6 +413,11 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   recorded immediately in repository deployment receipts; retries reuse their prior-run evidence.
   An uncertain upload never starts another binary automatically. Preserve its signed artifact,
   complete exact provider readback/recovery through scoped tooling, then reconcile its receipt.
+  `action/scripts/recover_upload_intent.cjs owner/repo deployment-id plan|live` repairs only
+  an iOS intent whose exact terminal run has one failed HTTP 500 intent step and an explicitly
+  skipped uploader in the complete GitHub job log. It refuses later run attempts and changed
+  evidence, appends a read-back building receipt, and never uploads or calls Apple. Retry the
+  original failed job afterward; preserve the recovery proof separately.
   The local Android workflow supplies `mobileReleaseIntentScript` to the upload wrapper instead
   of marking `uploading` before acquiring Play ownership. A refused owner leaves the release
   record at `building`; the wrapper records intent inside its acquired lease before provider

package/action/.daemux-version

@@ -1 +1 @@
-1.0.146
+1.0.147

package/action/scripts/mobile_release_api.cjs

@@ -1,6 +1,8 @@
 /* Repository-local GitHub deployment receipts; never a store credential or transport. */
 'use strict';
 const https = require('node:https');
+const {randomUUID} = require('node:crypto');
+const {setTimeout: delay} = require('node:timers/promises');
 
 function request(method, path, body, timeoutMs = 30000) {
   const repo = process.env.GITHUB_REPOSITORY;
@@ -29,10 +31,43 @@ function request(method, path, body, timeoutMs = 30000) {
   });
 }
 
+function uncertain(error) {
+  return /^mobile_release_(http_5\d\d|receipt_(read_unavailable|invalid|transport_unconfirmed|unconfirmed))$/
+    .test(error.message);
+}
+
+function confirmed(result, expected) {
+  return Number.isSafeInteger(result?.id) && result.id > 0 && result.state === expected.state &&
+    result.description === expected.description && result.log_url === expected.log_url;
+}
+
+async function readStatus(id, expected) {
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (attempt) await delay(attempt * 1000);
+    try {
+      const rows = await request('GET', `/deployments/${id}/statuses?per_page=1`, undefined, 10000);
+      if (Array.isArray(rows) && confirmed(rows[0], expected)) return rows[0];
+    } catch (error) {
+      if (!uncertain(error)) break;
+    }
+  }
+  return null;
+}
+
 async function status(id, phase, state = 'in_progress') {
-  const result = await request('POST', `/deployments/${id}/statuses`, {state, description: phase, auto_inactive: false,
-    log_url: `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`});
-  if (result.state !== state || result.description !== phase) throw Error('mobile_release_receipt_unconfirmed');
-  return result;
+  const run = `https://github.com/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
+  const expected = {state, description: phase, auto_inactive: false,
+    log_url: `${run}/attempts/${process.env.GITHUB_RUN_ATTEMPT}#mobile-receipt-${randomUUID()}`};
+  try {
+    const result = await request('POST', `/deployments/${id}/statuses`, expected);
+    if (!confirmed(result, expected)) throw Error('mobile_release_receipt_unconfirmed');
+    return result;
+  } catch (error) {
+    if (!uncertain(error)) throw error;
+    // Reconcile this invocation's one write. Never replay the POST or infer an upload from another receipt.
+    const result = await readStatus(id, expected);
+    if (result) return result;
+    throw error;
+  }
 }
 module.exports = {request, status};

package/action/scripts/recover_upload_intent.cjs

@@ -0,0 +1,125 @@
+/* Recover only a GitHub upload-intent write whose iOS uploader provably never ran. */
+'use strict';
+const {execFileSync} = require('node:child_process');
+const {createHash} = require('node:crypto');
+const SCHEMA = 'gowalk-cicd/mobile-upload-owner.v1';
+
+function gh(repo, path, body, raw = false) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo) || !path.startsWith('/') || path.includes('..')) {
+    throw Error('mobile_recovery_scope_invalid');
+  }
+  const args = ['api', `repos/${repo}${path}`];
+  if (raw) args.push('--allow-escape-sequences'); // Captured privately; raw logs never reach the terminal.
+  if (body) args.push('--method', 'POST', '--input', '-');
+  let text;
+  try {
+    text = execFileSync('gh', args, {encoding: 'utf8', timeout: 45000, maxBuffer: 8 * 1024 * 1024,
+      input: body ? JSON.stringify(body) : undefined, stdio: ['pipe', 'pipe', 'pipe']});
+  } catch { throw Error('mobile_recovery_github_unavailable'); }
+  if (raw) return text;
+  try { return JSON.parse(text); } catch { throw Error('mobile_recovery_response_invalid'); }
+}
+
+function verifyOwner(record, run) {
+  const p = record.payload;
+  if (p?.schema !== SCHEMA || p.platform !== 'ios' || !/^[a-f0-9]{64}$/.test(p.fingerprint) ||
+      !/^[a-f0-9]{40}$/.test(p.source_sha) || record.sha !== p.source_sha ||
+      record.environment !== `mobile-ios-${p.fingerprint}` || record.task !== 'mobile-upload' ||
+      !Number.isSafeInteger(p.run_id) || !Number.isSafeInteger(p.run_attempt) || p.run_attempt < 1 ||
+      run.id !== p.run_id || run.run_attempt !== p.run_attempt || run.head_sha !== p.source_sha ||
+      run.path !== '.github/workflows/deploy.yml' || run.head_branch !== 'main' ||
+      run.event !== 'push' || run.status !== 'completed' || run.conclusion !== 'failure') {
+    throw Error('mobile_recovery_owner_unverified');
+  }
+}
+
+function verifyJob(jobs, run) {
+  if (!Array.isArray(jobs.jobs) || jobs.total_count !== jobs.jobs.length || jobs.jobs.length >= 100) {
+    throw Error('mobile_recovery_jobs_incomplete');
+  }
+  const found = jobs.jobs.filter(j => j.name === 'iOS TestFlight');
+  if (found.length !== 1) throw Error('mobile_recovery_job_unverified');
+  const job = found[0];
+  const steps = job.steps?.filter(s => s.name === 'Run ./.github/actions/swift-app');
+  if (!Number.isSafeInteger(job.id) || job.run_id !== run.id || job.head_sha !== run.head_sha ||
+      job.status !== 'completed' || job.conclusion !== 'failure' || steps?.length !== 1 ||
+      steps[0].status !== 'completed' || steps[0].conclusion !== 'failure') {
+    throw Error('mobile_recovery_job_unverified');
+  }
+  return job;
+}
+
+function verifyLog(log) {
+  const starts = [...log.matchAll(/##\[start-action display=Record iOS upload intent;id=(ios\.\w+)\]/g)];
+  const uploads = [...log.matchAll(/##\[start-action display=Upload to TestFlight;id=ios\.upload\]/g)];
+  if (starts.length !== 1 || uploads.length !== 1 || starts[0].index >= uploads[0].index) {
+    throw Error('mobile_recovery_log_unverified');
+  }
+  const section = log.slice(starts[0].index, uploads[0].index);
+  const id = starts[0][1].replace('.', '\\.');
+  const failure = new RegExp(`##\\[end-action id=${id};outcome=failure;conclusion=failure;duration_ms=\\d+\\]`);
+  const errors = [...section.matchAll(/##\[error\]([^\r\n]+)/g)].map(m => m[1].trim());
+  const ends = [...log.matchAll(/##\[end-action id=ios\.upload;outcome=([^;]+);conclusion=([^;]+);/g)];
+  if (!failure.test(section) || errors.length !== 2 ||
+      errors[0] !== 'mobile_release_http_500' || errors[1] !== 'Process completed with exit code 1.' ||
+      ends.length !== 1 || ends[0].index <= uploads[0].index ||
+      ends[0][1] !== 'skipped' || ends[0][2] !== 'skipped') {
+    throw Error('mobile_recovery_upload_not_proven_skipped');
+  }
+  return createHash('sha256').update(log).digest('hex');
+}
+
+async function inspect(repo, id, request = gh) {
+  const record = await request(repo, `/deployments/${id}`);
+  if (record.id !== id || !Number.isSafeInteger(record.payload?.run_id)) {
+    throw Error('mobile_recovery_owner_unverified');
+  }
+  const run = await request(repo, `/actions/runs/${record.payload.run_id}`);
+  verifyOwner(record, run);
+  const jobs = await request(repo, `/actions/runs/${run.id}/attempts/${run.run_attempt}/jobs?per_page=100`);
+  const job = verifyJob(jobs, run);
+  const log = await request(repo, `/actions/jobs/${job.id}/logs`, undefined, true);
+  const logSha = verifyLog(log);
+  const statuses = await request(repo, `/deployments/${id}/statuses?per_page=1`);
+  const last = statuses[0], logUrl = `https://github.com/${repo}/actions/runs/${run.id}`;
+  const marker = `${logUrl}/attempts/${run.run_attempt}#mobile-receipt-`;
+  const marked = typeof last?.log_url === 'string' && last.log_url.startsWith(marker) &&
+    /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/.test(last.log_url.slice(marker.length));
+  if (!Number.isSafeInteger(last?.id) || last.state !== 'in_progress' ||
+      last.description !== 'uploading' || (last.log_url !== logUrl && !marked)) {
+    throw Error('mobile_recovery_receipt_changed');
+  }
+  return {schema: 'gowalk-cicd/undispatched-ios-upload.v1', repo, deployment_id: id, status_id: last.id,
+    source_sha: record.sha, run_id: run.id, run_attempt: run.run_attempt, job_id: job.id,
+    job_log_sha256: logSha, uploader_skipped: true, log_url: last.log_url};
+}
+
+async function recover(repo, id, live = false, request = gh) {
+  const proof = await inspect(repo, id, request);
+  if (!live) return {ok: true, planned: true, proof};
+  // Re-read the complete provider proof immediately before changing only this receipt.
+  const current = await inspect(repo, id, request);
+  if (JSON.stringify(current) !== JSON.stringify(proof)) throw Error('mobile_recovery_evidence_changed');
+  const body = {state: 'in_progress', description: 'building', auto_inactive: false, log_url: proof.log_url};
+  try { await request(repo, `/deployments/${id}/statuses`, body); }
+  catch { /* A lost POST response is resolved by the same exact readback below, never a second POST. */ }
+  const readback = (await request(repo, `/deployments/${id}/statuses?per_page=1`))[0];
+  if (!Number.isSafeInteger(readback?.id) || readback.id === proof.status_id ||
+      readback.state !== body.state || readback.description !== body.description ||
+      readback.log_url !== body.log_url) throw Error('mobile_recovery_write_unconfirmed');
+  return {ok: true, recovered: true, proof, readback_status_id: readback.id,
+    next: 'Retry the original failed iOS job; Apple upload remains unperformed.'};
+}
+
+if (require.main === module) {
+  const [repo, value, mode] = process.argv.slice(2), id = Number(value);
+  if (!repo || !Number.isSafeInteger(id) || id < 1 || !['plan', 'live'].includes(mode)) {
+    process.stderr.write('Usage: node recover_upload_intent.cjs owner/repo deployment-id plan|live\n');
+    process.exitCode = 2;
+  } else recover(repo, id, mode === 'live').then(result => console.log(JSON.stringify(result))).catch(error => {
+    console.error(JSON.stringify({ok: false, code: /^mobile_recovery_\w+$/.test(error.message)
+      ? error.message : 'mobile_recovery_unavailable'}));
+    process.exitCode = 1;
+  });
+}
+module.exports = {verifyOwner, verifyJob, verifyLog, inspect, recover};

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.146
+1.0.147

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.146
+1.0.147

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.146",
+  "version": "1.0.147",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {