gowalk-cicd 1.0.155 → 1.0.156

package/action/.daemux-version

@@ -1 +1 @@
-1.0.155
+1.0.156

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.155
+1.0.156

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.155
+1.0.156

package/backend-action/network_prepare.py

@@ -122,7 +122,8 @@ def prepare(config, app, *, reader=collect, owner_reader=ownership_inventory, co
                 inventory = reader(command, require_pools=False)
                 if inventory.get('pool_failure'):
                     raise NetworkFailure(inventory['pool_failure'])
-                if not re.fullmatch(r'v?2\.\d+\.\d+', inventory['compose_version']):
+                # Compose 2 and 5 reuse a project network that carries no config-hash label (docs/BACKEND_NETWORKS.md).
+                if not re.fullmatch(r'v?(?:2|5)\.\d+\.\d+', inventory['compose_version']):
                     raise NetworkFailure('compose_version_unsupported')
                 rows.append(create_one(plan, inventory, reader, command))
                 inventory = reader(command, require_pools=False)

package/backend-action/network_test_fixture.py

@@ -28,9 +28,10 @@ class Host:
         self.calls = []
         self.pool_failure = ''
         self.lose_reply = False
+        self.compose_version = '2.39.4'
 
     def inventory(self, command, require_pools=True):
-        return {'docker_version': '28.0.4', 'compose_version': '2.39.4', 'observed_at': '2026-09-15T00:00:00Z',
+        return {'docker_version': '28.0.4', 'compose_version': self.compose_version, 'observed_at': '2026-09-15T00:00:00Z',
                 'python_version': '3.8.20', 'pool_source': 'fixture', 'pool_failure': self.pool_failure,
                 'pools': [{'base': '172.28.0.0/22', 'size': 16}], 'networks': copy.deepcopy(self.networks),
                 'host_excluded': [], 'host_records': [],

package/backend-action/test_network_prepare.py

@@ -85,6 +85,27 @@ class PreparationTests(unittest.TestCase):
         self.assertEqual(set(values), {'172.28.1.0/24', '172.28.2.0/24'})
         self.assertEqual(len(host.calls), 2)
 
+    def test_reviewed_compose_majors_allocate_and_others_refuse_before_create(self):
+        for version in ('2.39.4', 'v2.40.3', '5.0.0', '5.3.1', 'v5.5.1'):
+            host = Host()
+            host.compose_version = version
+            result = prepare(config('first'), 'first', **host.arguments())
+            self.assertTrue(result['ok'])
+            self.assertEqual(result['compose_version'], version)
+            self.assertEqual(host.networks[-1]['Labels']['com.docker.compose.version'], version)
+            self.assertNotIn('com.docker.compose.config-hash', host.networks[-1]['Labels'])
+            self.assertEqual(len(host.calls), 1)
+        for version in ('1.29.2', '3.0.0', '4.1.0', '6.0.0', '5.3', '25.0.0'):
+            host = Host()
+            host.compose_version = version
+            with self.assertRaisesRegex(NetworkFailure, 'compose_version_unsupported'):
+                prepare(config('first'), 'first', **host.arguments())
+            self.assertEqual(host.calls, [])
+            host.networks.append(network('existing', '172.29.0.0/16'))
+            preserved = prepare(config('existing'), 'existing', **host.arguments())
+            self.assertEqual(preserved['networks'][0]['state'], 'preserved')
+            self.assertEqual(host.calls, [])
+
     def test_full_effective_pool_and_unknown_provenance_refuse_expansion(self):
         for unknown in (False, True):
             host = Host()

package/docs/BACKEND_NETWORKS.md

@@ -28,10 +28,21 @@ fingerprint. A later change to its network contract refuses before Compose rathe
 ignoring authored IPAM or replacing a network that may carry active workloads. An app requiring a
 different network must implement that deliberate migration in its own deployment.
 
-The helper intentionally does not manufacture `com.docker.compose.config-hash`. Compose 2 accepts a
-network with the correct project/network labels and no hash. A wrong hash can trigger replacement.
-Its own fingerprint protects replay, including configuration changes. Other Compose major versions
-require compatibility review before new-network preparation is admitted.
+The helper intentionally does not manufacture `com.docker.compose.config-hash`. Compose 2 and Compose 5
+accept a network with the correct project/network labels and no hash. A wrong hash can trigger
+replacement. Its own fingerprint protects replay, including configuration changes. New-network
+preparation admits Compose 2.x and 5.x; any other major version refuses with
+`compose_version_unsupported` until it has been reviewed. Existing selected networks are preserved
+under every Compose version because preservation never allocates.
+
+Compose 5 review (2026-09-17, docker/compose tags v5.0.0, v5.3.1 and v5.5.1 against v2.40.3):
+`resolveOrCreateNetwork` in `pkg/compose/create.go` at v5.0.0 and v5.3.1 returns the inspected
+network when its `com.docker.compose.network` label matches and its config-hash label is empty or
+equal (`hash == "" || hash == expected`), the same branch as v2.40.3; the remaining differences are
+Docker client types, IPAM parsing and event emission. v5.5.1 moved reuse into `reconcileNetworks`
+in `pkg/compose/reconcile.go`, whose observed state is scoped by the project label and which leaves a
+network with no recorded hash untouched (`observed.ConfigHash == ""`). docker/compose carries no v3 or
+v4 tags, and Compose 1 (`docker-compose`) stays unreviewed.
 
 ## Address-space proof
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.155",
+  "version": "1.0.156",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {