gowalk-cicd 1.0.16 → 1.0.18

package/README.md

@@ -103,6 +103,33 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Private git dependencies (Flutter)
+
+A Flutter app can depend on private git packages:
+
+```yaml
+dependencies:
+  my_package:
+    git: https://github.com/my-org/my_package.git
+```
+
+The runner has no credentials for those, so `flutter pub get` fails with
+`could not read Username for 'https://github.com'`. Embedding a PAT in the URL
+works but publishes the token into your source and into every copy of the
+lockfile.
+
+Set the repository **secret** `GIT_PRIVATE_TOKEN` instead — a PAT with `repo`
+read access — and the workflow rewrites `https://github.com/` to an
+authenticated remote for the duration of the job. Plain URLs keep working and
+the token lives in one revocable place:
+
+```bash
+gh secret set GIT_PRIVATE_TOKEN --repo my-org/my-app
+```
+
+Without the secret the step is skipped, so repos that do not need it are
+unaffected.
+
 ### Localized release notes
 
 Both stores pick up per-locale release notes from committed files:

package/action/.daemux-version

@@ -1 +1 @@
-1.0.16
+1.0.18

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.16
+1.0.18

package/android-action/scripts/test_gradle_wrapper.py

@@ -203,3 +203,59 @@ class ToolchainTest(unittest.TestCase):
     def test_an_unreadable_sdk_warns_per_tool(self):
         messages = gw.ensure_toolchain(self.workspace, self.workspace / "nope")
         self.assertEqual(sum("::warning::" in m for m in messages), 3)
+
+
+SETTINGS_KTS = """
+plugins {
+    id("dev.flutter.flutter-plugin-loader") version "1.0.0"
+    id("com.android.application") version "8.9.1" apply false
+    id("org.jetbrains.kotlin.android") version "2.1.0" apply false
+}
+include(":app")
+"""
+
+
+class KotlinDslTest(unittest.TestCase):
+    """The Kotlin DSL spells a plugin id `id("x") version "y"`, Groovy spells it
+    `id "x" version "y"`. A matcher written against only one silently no-ops on
+    the other — and a no-op here means shipping an app whose AGP is still below
+    Flutter's floor while the log claims it was raised."""
+
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.workspace = Path(self.tmp.name)
+        android = self.workspace / "android"
+        android.mkdir()
+        self.settings = android / "settings.gradle.kts"
+        self.settings.write_text(SETTINGS_KTS, encoding="utf-8")
+        properties = gw.wrapper_properties(self.workspace)
+        properties.parent.mkdir(parents=True)
+        properties.write_text(WRAPPER, encoding="utf-8")
+        self.flutter = self.workspace / "flutter"
+        checker = self.flutter / gw._CHECKER
+        checker.parent.mkdir(parents=True)
+        checker.write_text(CHECKER_WITH_ALL_FLOORS, encoding="utf-8")
+        self.addCleanup(self.tmp.cleanup)
+
+    def test_finds_settings_gradle_kts(self):
+        self.assertIn("settings.gradle.kts", [f.name for f in gw.toolchain_files(self.workspace)])
+
+    def test_reads_both_plugin_ids_from_the_kotlin_dsl(self):
+        files = gw.toolchain_files(self.workspace)
+        self.assertEqual(gw.read_declared(files, "agp")[1], (8, 9, 1))
+        self.assertEqual(gw.read_declared(files, "kgp")[1], (2, 1, 0))
+
+    def test_actually_rewrites_the_kotlin_dsl(self):
+        gw.ensure_toolchain(self.workspace, self.flutter)
+        text = self.settings.read_text()
+        self.assertIn('id("com.android.application") version "8.11.1"', text)
+        # Untouched: 2.1.0 already meets the 2.0.0 floor.
+        self.assertIn('id("org.jetbrains.kotlin.android") version "2.1.0"', text)
+        # The loader's own version must not be caught by the AGP matcher.
+        self.assertIn('id("dev.flutter.flutter-plugin-loader") version "1.0.0"', text)
+
+    def test_reports_the_raise_only_when_the_file_really_changed(self):
+        messages = gw.ensure_toolchain(self.workspace, self.flutter)
+        raised = [m for m in messages if "Android Gradle Plugin 8.9.1 is below" in m]
+        self.assertEqual(len(raised), 1)
+        self.assertIn("8.11.1", self.settings.read_text())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/templates/deploy.yml

@@ -143,6 +143,21 @@ jobs:
         with:
           channel: stable
           cache: true
+      # Flutter apps can depend on private git packages. Most repos in this fleet
+      # embed a PAT directly in the pubspec URL, which publishes the token into
+      # source and into every fork of the lockfile. Setting the optional
+      # GIT_PRIVATE_TOKEN secret instead lets plain
+      # https://github.com/<org>/<repo>.git URLs resolve on the runner, so the
+      # token lives in one revocable place. No secret, no step — repos that do
+      # not need it are unaffected.
+      - name: Authenticate private git dependencies
+        if: ${{ steps.mode.outputs.mode == 'local' && steps.flutter.outputs.enabled == 'true' && secrets.GIT_PRIVATE_TOKEN != '' }}
+        shell: bash
+        env:
+          GIT_PRIVATE_TOKEN: ${{ secrets.GIT_PRIVATE_TOKEN }}
+        run: |
+          git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
+          echo "::add-mask::$GIT_PRIVATE_TOKEN"
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations