gowalk-cicd 1.0.160 → 1.0.162

package/action/.daemux-version

@@ -1 +1 @@
-1.0.160
+1.0.162

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.160
+1.0.162

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.160
+1.0.162

package/backend-action/ensure_certificate.sh

@@ -6,6 +6,37 @@ certbot_lock_busy() {
     "$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"
 }
 
+# Fixed cause codes for a failed Certbot command. Certbot's own text stays private: only these
+# tokens and a three-digit HTTP status from the CA's validation report reach the log.
+certbot_failure_causes() {
+  local causes="" code pattern http=""
+  while IFS='|' read -r code pattern; do
+    if grep -Eiq -- "$pattern" "$CERTBOT_WORK/stdout" "$CERTBOT_WORK/stderr"; then
+      causes="${causes:+$causes,}$code"
+    fi
+  done <<'CAUSES'
+rate_limited|rateLimited|too many (certificates|new orders|failed authorizations|registrations)
+rejected_identifier|rejectedIdentifier|forbidden by policy
+caa|CAA record
+dns|Type: +dns|acme:error:dns|DNS problem
+connection|Type: +connection|acme:error:connection|Timeout during (connect|read)|Connection refused
+unauthorized|Type: +unauthorized|acme:error:unauthorized
+incorrect_response|Invalid response from|incorrectResponse
+secondary_validation|During secondary validation
+tls|Type: +tls|acme:error:tls
+account|accountDoesNotExist|Account (is not valid|does not exist)
+ca_unavailable|serverInternal|Service busy|down for maintenance
+nginx_restart|nginx restart failed|Error while running nginx
+nginx_vhost|Could not automatically find a matching server block
+nginx_parse|Could not parse file
+nginx_plugin|nginx plugin is not working|Could not find a usable .nginx. binary
+CAUSES
+  http="$(grep -Eoh -- 'Invalid response from [^ ]+( \[[^]]+\])?: [1-5][0-9]{2}' "$CERTBOT_WORK/stdout" \
+    "$CERTBOT_WORK/stderr" | grep -Eo '[1-5][0-9]{2}$' | head -1)" || http=""
+  [ -z "$http" ] || causes="${causes:+$causes,}http_$http"
+  printf '%s' "${causes:-unclassified}"
+}
+
 certbot_attempt() {
   local phase="$1" attempt="$2" status
   shift 2
@@ -18,7 +49,7 @@ certbot_attempt() {
   if certbot_lock_busy; then
     log "certificate phase=$phase attempt=$attempt state=lock_busy exit=$status"
   else
-    log "certificate phase=$phase attempt=$attempt state=error exit=$status"
+    log "certificate phase=$phase attempt=$attempt state=error exit=$status cause=$(certbot_failure_causes)"
   fi
   return "$status"
 }

package/docs/CONFIGURATION.md

@@ -76,12 +76,14 @@ inferred safe from a custom step name. Candidate misses never wait or reserve a
 
 Separate custom workflows remain app-owned. Recognized native dependency jobs
 receive optional lock/toolchain-keyed cache restore/save inside their existing job.
-Supported validation workflows use their existing PR trigger for `task/**` branches,
-keeping default-branch push checks and all job names, commands and custom checks.
-This requires a single app-owned validation workflow, a PR trigger covering the
-known default branch, and jobs without event-dependent behavior or custom GitHub scripts. Other workflows retain separate push/PR concurrency
-groups, so neither required check cancels the other. An upgrade also repairs the shared
-group emitted by 1.0.142–143. Separate platforms and repositories keep their existing parallelism.
+An app-owned workflow whose push trigger is a plain `branches` list admitting `task/**`
+validates each candidate on that push, which runs on the exact head: the installer deletes its
+duplicate `pull_request` trigger, and a trailing `!task/**` written by earlier releases, in one
+write. Job names, commands and custom checks are unchanged. A push with `branches-ignore`,
+`paths` or `paths-ignore`, or one that does not admit `task/**`, is left as it is; such
+workflows retain separate push/PR concurrency groups, so neither check cancels the other.
+An upgrade also repairs the shared group emitted by 1.0.142–143. Separate platforms and
+repositories keep their existing parallelism.
 
 `.gowalk-cicd.lock.json` records the template and generated-file digests. Commit it
 with the configuration and rendered workflows. It is migration state, not a CI job.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.160",
+  "version": "1.0.162",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/validation-events.mjs

@@ -1,56 +1,38 @@
-// Keep required push/PR checks independent; avoid duplicate factory pushes only for supported PR validation.
-import { execFileSync } from 'node:child_process';
+// A task/** push already validates the exact candidate head, so a duplicate PR trigger is deleted.
 const REF = '${{ github.ref }}';
 const COALESCED = '${{ github.event.pull_request.head.repo.full_name == github.repository'
   + ' && github.event.pull_request.head.ref || github.ref_name }}';
+const FACTORY_EXCLUSION = '!task/**';
 
-export function defaultBranch(root) {
-  try {
-    return execFileSync('git', ['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'],
-      { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
-      .trim().replace(/^refs\/remotes\/origin\//, '');
-  } catch { return ''; }
+// Repair the shared push/PR group emitted by 1.0.142–143.
+function normalizeGroup(doc, concurrency) {
+  if (concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
+  const group = concurrency.group.replace(COALESCED, REF);
+  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
+  if (group === concurrency.group || !group.includes(REF) || !recognized) return false;
+  doc.setIn(['concurrency', 'group'], group);
+  return true;
 }
 
-function coversCandidates(event, branch, jobs) {
-  if (!branch || (event !== null && (typeof event !== 'object' || Array.isArray(event)))) return false;
-  const filters = event || {};
-  if (Object.keys(filters).some(key => !['branches', 'types'].includes(key))) return false;
-  if (filters.types && (!Array.isArray(filters.types)
-      || !['opened', 'synchronize', 'reopened'].every(type => filters.types.includes(type)))) return false;
-  if (filters.branches && (!Array.isArray(filters.branches) || !filters.branches.includes(branch)
-      || filters.branches.some(value => typeof value !== 'string' || /[!*?\[\]+]/.test(value)))) return false;
-  // Event-dependent app commands and job conditions need their own reviewed migration.
-  return !/github\.(event|ref)|GITHUB_(EVENT|REF)|actions\/github-script@/.test(JSON.stringify(jobs));
+// Only a plain branch list whose last pattern for task refs admits them all; anything else is left alone.
+function candidateBranches(push) {
+  if (!push || typeof push !== 'object' || Array.isArray(push)) return null;
+  if (['branches-ignore', 'paths', 'paths-ignore'].some(key => Object.hasOwn(push, key))) return null;
+  const values = push.branches;
+  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return null;
+  const branches = values.at(-1) === FACTORY_EXCLUSION ? values.slice(0, -1) : values;
+  const admitted = branches.findLastIndex(value => value === 'task/**' || value === '**');
+  if (admitted < 0 || branches.slice(admitted + 1).some(value => value.startsWith('!'))) return null;
+  return branches;
 }
 
-function excludeFactoryPush(doc, push) {
-  if (push !== null && (typeof push !== 'object' || Array.isArray(push))) return false;
-  const filters = push || {};
-  const field = Object.hasOwn(filters, 'branches') ? 'branches' : 'branches-ignore';
-  if (!Object.hasOwn(filters, field) && ('tags' in filters || 'tags-ignore' in filters)) return false;
-  const values = filters[field] || [];
-  if (!Array.isArray(values) || values.some(value => typeof value !== 'string')) return false;
-  if ('branches' in filters && 'branches-ignore' in filters) return false;
-  const exclusion = field === 'branches' ? '!task/**' : 'task/**';
-  if (values.at(-1) === exclusion) return false;
-  doc.setIn(['on', 'push'], doc.createNode({ ...filters, [field]: [...values, exclusion] }));
-  return true;
-}
-
-export function upgradeEvents(doc, value, branch) {
+export function upgradeEvents(doc, value) {
   const events = value.on;
-  const concurrency = value.concurrency;
-  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')
-      || concurrency?.['cancel-in-progress'] !== true || typeof concurrency.group !== 'string') return false;
-  const original = concurrency.group;
-  const group = original.replace(COALESCED, REF);
-  const recognized = group.includes('${{ github.workflow }}') || group === `flutter-ci-${REF}`;
-  if (!group.includes(REF) || !recognized) return false;
-  let changed = group !== original;
-  if (changed) doc.setIn(['concurrency', 'group'], group);
-  if (coversCandidates(events.pull_request, branch, value.jobs)) {
-    changed = excludeFactoryPush(doc, events.push) || changed;
-  }
-  return changed;
+  if (!events || !Object.hasOwn(events, 'push') || !Object.hasOwn(events, 'pull_request')) return false;
+  const grouped = normalizeGroup(doc, value.concurrency);
+  const branches = candidateBranches(events.push);
+  if (!branches) return grouped;
+  if (branches.length < events.push.branches.length) doc.deleteIn(['on', 'push', 'branches', branches.length]);
+  doc.deleteIn(['on', 'pull_request']);
+  return true;
 }

package/src/config/validation.mjs

@@ -3,7 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { readYaml, MigrationRepair } from './yaml.mjs';
 import { upgradeReuse } from './validation-reuse.mjs';
-import { defaultBranch, upgradeEvents } from './validation-events.mjs';
+import { upgradeEvents } from './validation-events.mjs';
 const CACHE = 'caa296126883cff596d87d8935842f9db880ef25';
 const PREFIX = '.github/actions/swift-app/scripts/';
 
@@ -54,12 +54,10 @@ export function planValidation(root, managed) {
   if (!existsSync(directory)) return [];
   const writes = [];
   const files = readdirSync(directory).filter(file => /\.ya?ml$/.test(file) && !managed.includes(file));
-  // Another app-owned workflow may depend on this workflow's push evidence.
-  const branch = files.length === 1 ? defaultBranch(root) : '';
   for (const file of files) {
     const source = readFileSync(join(directory, file), 'utf8');
     const { doc, value } = readYaml(source, file);
-    const events = upgradeEvents(doc, value, branch);
+    const events = upgradeEvents(doc, value);
     const reused = upgradeReuse(doc, value, file);
     const cached = upgradeCaches(doc, doc.toJS({ maxAliasCount: 100 }), file);
     if (cached || events || reused) {