gowalk-cicd 1.0.162 → 1.0.164

package/action/.daemux-version

@@ -1 +1 @@
-1.0.162
+1.0.164

package/action/scripts/reconcile_apple_upload.cjs

@@ -0,0 +1,119 @@
+/* Close a timed-out iOS upload only after the original owner and Apple both prove completion. */
+'use strict';
+const fs = require('node:fs');
+const crypto = require('node:crypto');
+const github = require('./mobile_release_api.cjs');
+
+const RECEIPT = 'gowalk-cicd/apple-build-upload-receipt.v1';
+const OWNER = 'gowalk-cicd/mobile-upload-owner.v1';
+
+function refuse(code) { throw Error(`apple_upload_reconcile_${code}`); }
+
+function readReceipt(path) {
+  let data;
+  try { data = JSON.parse(fs.readFileSync(path, 'utf8')); } catch { refuse('receipt_unavailable'); }
+  const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
+  if (data?.schema !== RECEIPT || data.stage !== 'processing' ||
+      data.failure?.category !== 'processing_pending' ||
+      !/^\d+$/.test(data.app_id || '') || !id(data.upload_id) || !id(data.file_id) ||
+      !/^[a-z0-9.]+$/.test(data.bundle_id || '') || !/^\d+$/.test(data.cfBundleVersion || '') ||
+      !/^\d+(\.\d+){1,2}$/.test(data.cfBundleShortVersionString || '') ||
+      !/^[a-f0-9]{64}$/.test(data.sha256 || '') || data.fileName !== `${data.sha256}.ipa` ||
+      !Number.isSafeInteger(data.fileSize) || data.fileSize <= 0) refuse('receipt_invalid');
+  return data;
+}
+
+async function verifyOwner(deploymentId, runId, attempt, api = github) {
+  if (!Number.isSafeInteger(deploymentId) || deploymentId <= 0 ||
+      !Number.isSafeInteger(runId) || runId <= 0 ||
+      !Number.isSafeInteger(attempt) || attempt <= 0) refuse('input_invalid');
+  const deployment = await api.request('GET', `/deployments/${deploymentId}`);
+  const owner = deployment.payload || {};
+  if (deployment.id !== deploymentId || deployment.task !== 'mobile-upload' ||
+      !/^mobile-ios-[a-f0-9]{64}$/.test(deployment.environment || '') ||
+      owner.schema !== OWNER || owner.platform !== 'ios' ||
+      owner.fingerprint !== deployment.environment.slice('mobile-ios-'.length) ||
+      owner.run_id !== runId || owner.run_attempt !== attempt ||
+      !/^[a-f0-9]{40}$/.test(owner.source_sha || '') || deployment.sha !== owner.source_sha) {
+    refuse('owner_invalid');
+  }
+  const run = await api.request('GET', `/actions/runs/${runId}/attempts/${attempt}`);
+  if (run.head_sha !== owner.source_sha || run.path !== '.github/workflows/deploy.yml' ||
+      run.event !== 'push' || run.head_branch !== 'main' ||
+      run.status !== 'completed' || run.conclusion !== 'failure') refuse('run_invalid');
+  const statuses = await api.request('GET', `/deployments/${deploymentId}/statuses?per_page=1`);
+  const latest = statuses[0] || {};
+  if (latest.state === 'success' && latest.description === 'uploaded') return 'reused';
+  if (latest.state !== 'in_progress' || latest.description !== 'uploading') refuse('phase_invalid');
+  return 'pending';
+}
+
+async function appleGet(path) {
+  if (!path.startsWith('/') || path.includes('..')) refuse('path_invalid');
+  const now = Math.floor(Date.now() / 1000);
+  const encoded = value => Buffer.from(JSON.stringify(value)).toString('base64url');
+  const header = encoded({alg: 'ES256', kid: process.env.ASC_KEY_ID, typ: 'JWT'});
+  const payload = encoded({iss: process.env.ASC_ISSUER_ID, iat: now, exp: now + 1200,
+    aud: 'appstoreconnect-v1'});
+  let signature;
+  try {
+    signature = crypto.sign('sha256', Buffer.from(`${header}.${payload}`),
+      {key: process.env.ASC_KEY_P8, dsaEncoding: 'ieee-p1363'}).toString('base64url');
+  } catch { refuse('apple_key_invalid'); }
+  const response = await fetch(`https://api.appstoreconnect.apple.com/v1${path}`, {
+    headers: {Authorization: `Bearer ${header}.${payload}.${signature}`, Accept: 'application/json'},
+    signal: AbortSignal.timeout(30000),
+  });
+  if (!response.ok) refuse(`apple_http_${response.status}`);
+  try { return await response.json(); } catch { refuse('apple_response_invalid'); }
+}
+
+async function verifyApple(receipt, get = appleGet) {
+  const upload = (await get(`/buildUploads/${receipt.upload_id}?include=build`)).data;
+  const attributes = upload?.attributes || {};
+  const buildId = upload?.relationships?.build?.data?.id;
+  if (upload?.id !== receipt.upload_id || attributes.state?.state !== 'COMPLETE' ||
+      attributes.cfBundleVersion !== receipt.cfBundleVersion ||
+      attributes.cfBundleShortVersionString !== receipt.cfBundleShortVersionString ||
+      !/^[A-Za-z0-9-]{1,64}$/.test(buildId || '')) refuse('upload_unverified');
+  const file = (await get(`/buildUploadFiles/${receipt.file_id}`)).data;
+  if (file?.id !== receipt.file_id || file.attributes?.assetType !== 'ASSET' ||
+      file.attributes.fileName !== receipt.fileName ||
+      file.attributes.fileSize !== receipt.fileSize ||
+      file.attributes.assetDeliveryState?.state !== 'COMPLETE') refuse('file_unverified');
+  const build = (await get(`/builds/${buildId}`)).data;
+  if (build?.id !== buildId || build.attributes?.processingState !== 'VALID' ||
+      build.attributes?.buildAudienceType !== 'APP_STORE_ELIGIBLE' ||
+      build.attributes?.version !== receipt.cfBundleVersion) refuse('build_unverified');
+  const app = (await get(`/builds/${buildId}/app`)).data;
+  if (app?.id !== receipt.app_id || app.attributes?.bundleId !== receipt.bundle_id) refuse('app_unverified');
+  return {build_id: buildId, app_id: app.id, version: receipt.cfBundleShortVersionString,
+    build: receipt.cfBundleVersion, upload_id: receipt.upload_id};
+}
+
+async function reconcile(deploymentId, runId, attempt, path, api = github, get = appleGet) {
+  const receipt = readReceipt(path);
+  const phase = await verifyOwner(deploymentId, runId, attempt, api);
+  const proof = await verifyApple(receipt, get);
+  if (phase === 'pending') await api.status(deploymentId, 'uploaded', 'success');
+  const statuses = await api.request('GET', `/deployments/${deploymentId}/statuses?per_page=1`);
+  if (statuses[0]?.state !== 'success' || statuses[0]?.description !== 'uploaded') {
+    refuse('write_unconfirmed');
+  }
+  return {schema: 'gowalk-cicd/apple-upload-reconciled.v1', state: phase === 'pending' ? 'landed' : 'reused',
+    deployment_id: deploymentId, ...proof};
+}
+
+async function main() {
+  const [deployment, run, attempt, path] = process.argv.slice(2);
+  const result = await reconcile(Number(deployment), Number(run), Number(attempt), path);
+  console.log(JSON.stringify(result));
+}
+
+if (require.main === module) main().catch(error => {
+  const code = /^apple_upload_reconcile_[a-z0-9_]+$/.test(error.message) ? error.message :
+    'apple_upload_reconcile_unavailable';
+  console.error('::error title=apple_upload_reconcile_refused::' + JSON.stringify({code}));
+  process.exitCode = 1;
+});
+module.exports = {readReceipt, verifyOwner, appleGet, verifyApple, reconcile};

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.162
+1.0.164

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.162
+1.0.164

package/backend-action/ensure_certificate.sh

@@ -111,7 +111,11 @@ certificate_present() {
 
 request_certificate() {
   local domain="$1" email="$2" attempt="$3" account
-  set -- --nginx -d "$domain" --non-interactive --agree-tos --email "$email" --redirect
+  # Certbot tells the CA to validate one second after reloading nginx by default. A host with
+  # hundreds of vhosts and certificates takes longer to load a new configuration, so the CA
+  # reached old workers still serving the token-gated edge and HTTP-01 failed with 403
+  # (2026-09-24). Certbot also stores this wait for renewals of the certificate.
+  set -- --nginx --nginx-sleep-seconds 10 -d "$domain" --non-interactive --agree-tos --email "$email" --redirect
   account="$(select_certbot_account)" || return $?
   if [ -n "$account" ]; then
     log "using an existing Let's Encrypt account"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.162",
+  "version": "1.0.164",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/remedies.json

@@ -1,4 +1,10 @@
 [
+  {
+    "schema": "gowalk-cicd/apple-build-upload-failed.v2",
+    "code": "processing_pending",
+    "fixed_in": "1.0.164",
+    "remedy": "Keep the original IPA and apple-build-upload receipt. If Apple later validates the exact upload, run reconcile_apple_upload.cjs in an authorized GitHub Actions recovery job with the original deployment, run, attempt and artifact receipt. It proves the failed owner, completed file, valid build and matching app before marking the deployment uploaded. Rerun the whole original deploy workflow after the readback; never upload a second binary or hand-edit the deployment receipt."
+  },
   {
     "schema": "gowalk-cicd/mobile-release-refused.v1",
     "code": "mobile_release_phase_owner_mismatch",