gowalk-cicd 1.0.168 → 1.0.170

package/README.md

@@ -23,6 +23,14 @@ Writes three core things into your repo:
 - `.github/actions/android-app/` — Android build/sign action (Flutter or Gradle)
 - `.github/workflows/deploy.yml` — workflow that builds and deploys both platforms
 
+It also writes:
+
+- `.github/workflows/mobile-candidate.yml` — shipping binaries for ready task PRs
+  (dispatch-only while candidate artifacts are off)
+- `.github/workflows/warm-android-cache.yml` — only while Android candidates are enabled: after this
+  app's successful default-branch release that includes Android, compiles the Android bundle once,
+  unsigned, when main has no Gradle cache for it ([Gradle dependency retention](docs/GRADLE_CACHE.md))
+
 The installer no longer adds `.github/workflows/deploy-web.yml`. On re-adoption it
 removes a `deploy-web.yml` that is still byte-for-byte the generated file and has no
 overrides in `.gowalk-cicd.yml`; a customized one keeps upgrading (see
@@ -183,10 +191,6 @@ in App Store Connect; see [First-time app setup](#first-time-app-setup).
 
 ## Backend deploy (Python + Postgres, Docker)
 
-New ordinary Compose projects receive small isolated networks inside Docker's verified existing pools.
-Existing/custom/external networks and authored IPAM retain their contracts. Read-only
-`network-diagnostics` uses the same deployment identity; see [capacity and diagnosis](docs/BACKEND_NETWORKS.md).
-
 When a repo carries a Dockerized backend, the installer also vendors a backend deploy path:
 `.github/actions/backend-app/` and `.github/workflows/deploy-backend.yml`. A
 mobile-only repo is unaffected (the backend path is not installed).
@@ -231,14 +235,21 @@ and a domain deploy fails unless its public HTTPS certificate and health route v
 Changing a container's published port preserves its existing HTTPS configuration; nginx must accept
 the change, or the previous vhost is restored and the deploy fails.
 When the domain's vhost has exactly one `ssl_certificate`, and that file exists, stays valid for more
-than a day and lists `DNS:<domain>` in its subjectAltName, the deploy runs neither Certbot nor an nginx
-reload and logs `certificate state=current`. Otherwise an existing certificate is installed for the
-domain (repairing older HTTP-only vhosts too) or a new one is issued, both with `certbot --nginx`.
-Every Certbot call runs under `flock -w 900 /run/gowalk-certbot.lock`, so deploys on one host take
-turns; when the host's renew timer holds Certbot's own lock, the call retries every 10 s for up to
-10 minutes. Vhost writes with their nginx test and reload, and the host port reservation, run under
-the host nginx lock `/run/app-robot-nginx.lock` (`flock -w 120`), which the panel's domain applier also
-takes. After a healthy deploy the replaced build's images are pruned
+than a day and lists `DNS:<domain>` in its subjectAltName, the deploy runs no Certbot, only follows the
+published port, and logs `certificate state=current`. Otherwise the name is issued by webroot: the vhost
+serves `/.well-known/acme-challenge/` from `/var/lib/gowalk-acme` on port 80 (and proxies the API there
+until HTTPS exists); the deploy waits up to 20 s for this host's nginx to serve a probe file under the
+domain's name; `certbot certonly --webroot --cert-name <domain> --keep-until-expiring` issues it (a lineage
+of that name that is not due is kept); then the vhost is rendered with HTTPS: port 80 answers challenges
+and redirects, port 443 proxies with `/etc/letsencrypt/live/<domain>/`. Certbot saves the webroot and a
+deploy hook that reloads nginx under the host nginx lock, so the host's renew timer renews the lineage.
+Vhosts that older releases configured with `certbot --nginx` keep their TLS directives; only their
+upstream port changes. Every Certbot call runs under `flock -w 900 /run/gowalk-certbot.lock`, so deploys
+on one host take turns; when the host's renew timer holds Certbot's own lock, the call retries every
+10 s for up to 10 minutes. Vhost writes with their nginx test and reload, and the host port reservation,
+run under the host nginx lock `/run/app-robot-nginx.lock` (`flock -w 120`), which the panel's domain
+applier also takes. New Compose networks come from Docker's own address pools; the deploy hosts'
+`default-address-pools` hand out `/24`s. After a healthy deploy the replaced build's images are pruned
 (`docker image prune -f --filter label=com.docker.compose.project=<app>`); a refusal because another
 prune is running defers it to the next deploy.
 
@@ -851,7 +862,8 @@ is required. A completed CI run does not mean this deferred upload is complete.
 
 ### iOS delivery
 
-The iOS composite action runs on `macos-15` and:
+The iOS composite action runs on `macos-15`; promoting a verified candidate IPA runs its first
+attempt on `ubuntu-24.04` (see [Candidate artifacts](docs/CANDIDATE_ARTIFACTS.md)). It:
 
 GitHub Actions reaches Apple and Google **directly**. No store proxy is configured, read
 or inherited here: the account-pinned residential exit belongs to the panel and the runner

package/action/scripts/mobile_artifact_files.py

@@ -10,9 +10,12 @@ import shutil
 import sys
 
 SCHEMA = "gowalk-cicd/mobile-binary.v1"
+# The source Info.plist travels checkout-relative, so a promotion on Linux (no xcodebuild) can
+# persist a planned version into it. Receipts packed before it existed stay valid without it.
+SOURCE_PLIST = "SWIFT_APP_SOURCE_INFOPLIST"
 IOS_ENV = ("CFG_BUNDLE_ID", "CFG_TEAM_ID", "CFG_APP_STORE_APPLE_ID", "CFG_CONFIGURATION",
            "CFG_PROJECT", "CFG_WORKSPACE", "CFG_SCHEME", "CFG_LOCALE", "CFG_USES_NON_EXEMPT",
-           "CFG_WHATS_NEW", "MARKETING_VERSION", "BUILD_NUMBER", "SOURCE_MARKETING_VERSION")
+           "CFG_WHATS_NEW", "MARKETING_VERSION", "BUILD_NUMBER", "SOURCE_MARKETING_VERSION", SOURCE_PLIST)
 ANDROID_ENV = ("ANDROID_PACKAGE_NAME", "ANDROID_BUILD_NUMBER", "ANDROID_PROJECT_KIND")
 
 
@@ -69,13 +72,17 @@ def files(root: Path) -> dict:
 def metadata(platform: str) -> dict:
     event = json.loads(Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
     keys = IOS_ENV if platform == "ios" else ANDROID_ENV
+    environment = {key: os.environ.get(key, "") for key in keys}
+    if environment.get(SOURCE_PLIST):
+        environment[SOURCE_PLIST] = os.path.relpath(Path(environment[SOURCE_PLIST]).resolve(),
+                                                    Path(os.environ["GITHUB_WORKSPACE"]).resolve())
     return {"schema": SCHEMA, "platform": platform, "repository": os.environ["GITHUB_REPOSITORY"],
             "fingerprint": os.environ["MOBILE_ARTIFACT_FINGERPRINT"],
             "run_id": int(os.environ["GITHUB_RUN_ID"]), "run_attempt": int(os.environ["GITHUB_RUN_ATTEMPT"]),
             "source_sha": os.environ["GITHUB_SHA"],
             "head_sha": event.get("pull_request", {}).get("head", {}).get("sha", os.environ["GITHUB_SHA"]),
             "credential_fingerprints": credentials(platform),
-            "environment": {key: os.environ.get(key, "") for key in keys}}
+            "environment": environment}
 
 
 def pack(platform: str, directory: Path) -> None:
@@ -115,7 +122,11 @@ def verify(platform: str, directory: Path) -> dict:
         raise ValueError("mobile_artifact_inputs_mismatch")
     expected = set(IOS_ENV if platform == "ios" else ANDROID_ENV)
     environment = value.get("environment", {})
-    if set(environment) != expected or any(not isinstance(v, str) or len(v) > 16000 for v in environment.values()):
+    if set(environment) not in (expected, expected - {SOURCE_PLIST}) or any(
+            not isinstance(v, str) or len(v) > 16000 for v in environment.values()):
+        raise ValueError("mobile_artifact_environment_invalid")
+    plist = Path(environment.get(SOURCE_PLIST, ""))
+    if plist.is_absolute() or ".." in plist.parts:
         raise ValueError("mobile_artifact_environment_invalid")
     number = environment["BUILD_NUMBER" if platform == "ios" else "ANDROID_BUILD_NUMBER"]
     if not re.fullmatch(r"[1-9][0-9]{0,17}", number):

package/action/scripts/mobile_artifact_inventory.cjs

@@ -40,8 +40,8 @@ async function candidate(artifact) {
   return {...run, artifact_attempt: attempt};
 }
 
-async function restore(platform) {
-  const deadline = Date.now() + 120000;
+// The newest reusable candidate for this platform's current inputs, or null; reads only.
+async function find(platform, deadline) {
   const fingerprint = identity(platform);
   const prefix = `mobile-binary-${platform}-${fingerprint}-`;
   const inventory = await api.request('GET', '/actions/artifacts?per_page=100', undefined, 5000);
@@ -49,23 +49,29 @@ async function restore(platform) {
   for (const artifact of inventory.artifacts.filter(row => row.name?.startsWith(prefix)).slice(0, 5)) {
     if (Date.now() >= deadline) break;
     const run = await candidate(artifact);
-    if (!run || artifact.name !== `${prefix}${run.id}-${run.artifact_attempt}`) continue;
-    const directory = mkdtempSync(join(process.env.RUNNER_TEMP, `mobile-binary-${platform}-`));
-    execFileSync('gh', ['run', 'download', String(run.id), '--repo', process.env.GITHUB_REPOSITORY,
-      '--name', artifact.name, '--dir', directory], {stdio: 'ignore', timeout: Math.max(1, deadline - Date.now())});
-    const receipt = JSON.parse(readFileSync(join(directory, 'mobile-binary.json'), 'utf8'));
-    if (receipt.run_id !== run.id || receipt.run_attempt !== run.artifact_attempt || receipt.head_sha !== run.head_sha) {
-      throw Error('mobile_artifact_run_mismatch');
-    }
-    const operation = platform === 'ios' ? 'verify' : 'restore';
-    execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), operation, platform, directory],
-      {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: fingerprint}});
-    output('directory', directory);
-    output('restored', 'true');
-    console.log(`::notice::Reusing ${platform} binary from candidate run ${run.id}`);
-    return;
+    if (run && artifact.name === `${prefix}${run.id}-${run.artifact_attempt}`) return {artifact, run, fingerprint};
+  }
+  return null;
+}
+
+async function restore(platform) {
+  const deadline = Date.now() + 120000;
+  const found = await find(platform, deadline);
+  if (!found) return output('restored', 'false');
+  const {artifact, run, fingerprint} = found;
+  const directory = mkdtempSync(join(process.env.RUNNER_TEMP, `mobile-binary-${platform}-`));
+  execFileSync('gh', ['run', 'download', String(run.id), '--repo', process.env.GITHUB_REPOSITORY,
+    '--name', artifact.name, '--dir', directory], {stdio: 'ignore', timeout: Math.max(1, deadline - Date.now())});
+  const receipt = JSON.parse(readFileSync(join(directory, 'mobile-binary.json'), 'utf8'));
+  if (receipt.run_id !== run.id || receipt.run_attempt !== run.artifact_attempt || receipt.head_sha !== run.head_sha) {
+    throw Error('mobile_artifact_run_mismatch');
   }
-  output('restored', 'false');
+  const operation = platform === 'ios' ? 'verify' : 'restore';
+  execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), operation, platform, directory],
+    {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: fingerprint}});
+  output('directory', directory);
+  output('restored', 'true');
+  console.log(`::notice::Reusing ${platform} binary from candidate run ${run.id}`);
 }
 
 function pack(platform) {
@@ -86,6 +92,13 @@ async function main([operation, platform, directory]) {
     return execFileSync('python3', [join(__dirname, 'mobile_artifact_files.py'), 'restore', platform, directory],
       {stdio: ['ignore', 'inherit', 'pipe'], env: {...process.env, MOBILE_ARTIFACT_FINGERPRINT: identity(platform)}});
   }
+  if (operation === 'lookup') {
+    // Admission picks the iOS runner from this answer; any doubt keeps the macOS build path.
+    let found = null;
+    try { found = await find(platform, Date.now() + 30000); } catch { /* optional optimization */ }
+    console.log(found ? `Candidate ${platform} binary in run ${found.run.id}` : `No candidate ${platform} binary`);
+    return output('found', found ? 'true' : 'false');
+  }
   if (operation !== 'restore') throw Error('mobile_artifact_operation_invalid');
   try { await restore(platform); }
   catch {
@@ -95,7 +108,7 @@ async function main([operation, platform, directory]) {
   }
 }
 
-module.exports = {identity, candidate, restore, pack};
+module.exports = {identity, candidate, find, restore, pack, main};
 if (require.main === module) main(process.argv.slice(2)).catch(() => {
   console.error('::error::mobile_artifact_pack_failed');
   process.exitCode = 1;

package/action/scripts/version_utils.py

@@ -295,10 +295,13 @@ _INFOPLIST_FILE_RE = re.compile(
 )
 
 
-def _write_infoplist_short_version(new_version: str) -> bool:
-    """Fallback: stamp CFBundleShortVersionString into the project's
-    resolved Info.plist. Returns True on success, False when no plist
-    resolves."""
+def _infoplist_candidates() -> list[Path]:
+    """The application's source Info.plist. A promotion carries it from the
+    candidate build (checkout-relative; empty when Xcode generates the plist),
+    so it never needs xcodebuild, which a Linux runner does not have."""
+    known = os.environ.get("SWIFT_APP_SOURCE_INFOPLIST")
+    if known is not None:
+        return [Path(known)] if known.strip() else []
     proj_args, base = _xcodebuild_args()
     scheme = os.environ.get("SCHEME", "").strip()
     config = os.environ.get("CONFIGURATION", "").strip() or "Release"
@@ -309,12 +312,19 @@ def _write_infoplist_short_version(new_version: str) -> bool:
             cmd, check=False, capture_output=True, text=True, timeout=120,
         )
     except (OSError, subprocess.SubprocessError):
-        return False
+        return []
     m = _INFOPLIST_FILE_RE.search(out.stdout or "")
     if not m:
-        return False
+        return []
     rel = m.group(1).strip()
-    for path in (base / rel, Path(rel)):
+    return [base / rel, Path(rel)]
+
+
+def _write_infoplist_short_version(new_version: str) -> bool:
+    """Fallback: stamp CFBundleShortVersionString into the project's
+    resolved Info.plist. Returns True on success, False when no plist
+    resolves."""
+    for path in _infoplist_candidates():
         if not path.is_file():
             continue
         try:

package/android-action/scripts/android_config.py

@@ -264,6 +264,21 @@ def detect_package_name(workspace: Path, build_file: Path | None = None) -> str:
     raise ConfigError(f"cannot detect Android applicationId from {gradle_files[0].parent}")
 
 
+def build_inputs(workspace: Path) -> dict[str, str]:
+    """What the release build compiles, read from the checkout alone.
+
+    The default branch's Gradle cache warm-up (`templates/warm-android-cache.yml`) compiles
+    what a candidate compiles without creds/, a Play read or a version write, so it never runs
+    resolve_android.py (a Play edit). Raises ConfigError when there is no Android project.
+    """
+    if project_kind(workspace) == "flutter":
+        if not _first_existing(workspace / "android", SETTINGS_FILES):
+            raise ConfigError("no Android project: android/settings.gradle(.kts) is missing")
+        return {"project_kind": "flutter", "gradle_root": "", "gradle_module": ""}
+    project = find_gradle_project(workspace)
+    return {"project_kind": "gradle", "gradle_root": str(project.root), "gradle_module": project.module}
+
+
 def detect_bundle(workspace: Path, search_root: Path | None = None) -> Path:
     # Flutter collects every module's outputs under build/app/; a plain Gradle
     # build leaves them in the module's own build/outputs/bundle/.
@@ -304,3 +319,25 @@ def set_gradle_version(
     if patched != original:
         build_file.write_text(patched)
     return {"version_code": bool(code_hits), "version_name": bool(name_hits)}
+
+
+if __name__ == "__main__":
+    import os
+    import sys
+
+    root = Path(os.environ.get("GITHUB_WORKSPACE", ".")).resolve()
+    if sys.argv[1:] == ["--flutter-toolchain"]:
+        import gradle_wrapper
+
+        # The same toolchain repair resolve_android.py applies before a Flutter release build.
+        for line in gradle_wrapper.ensure_toolchain(root, Path(os.environ["FLUTTER_ROOT"])):
+            print(line)
+        sys.exit(0)
+    try:
+        values = build_inputs(root)
+    except ConfigError as exc:
+        # Nothing to warm; an empty kind skips the rest without failing anything.
+        print(f"Nothing to compile: {exc}")
+        values = {"project_kind": "", "gradle_root": "", "gradle_module": ""}
+    with open(os.environ["GITHUB_OUTPUT"], "a") as output:
+        output.writelines(f"{name}={value}\n" for name, value in values.items())

package/backend-action/action.yml

@@ -7,7 +7,7 @@ description: >
 
 inputs:
   operation:
-    description: deploy (default), identity-diagnostics, or read-only network-diagnostics.
+    description: deploy (default) or identity-diagnostics.
     required: false
     default: deploy
   diagnostic-service:
@@ -19,7 +19,7 @@ inputs:
     required: false
     default: ""
   diagnostic-provider:
-    description: Optional fixed metadata source for network-diagnostics (none or digitalocean).
+    description: Ignored; network-diagnostics was removed with the network allocator.
     required: false
     default: none
   host:
@@ -105,7 +105,7 @@ runs:
         OPERATION: ${{ inputs.operation }}
         API_DOMAIN: ${{ inputs.api-domain }}
       run: |
-        case "$OPERATION" in deploy|identity-diagnostics|network-diagnostics) ;; *) exit 1;; esac
+        case "$OPERATION" in deploy|identity-diagnostics) ;; *) exit 1;; esac
         # Only a repository with a bound origin holds the deploy key; the panel sets the domain when it binds one.
         if [ "$OPERATION" = deploy ] && [ -z "$API_DOMAIN" ]; then
           echo "::notice title=backend_origin_unbound::No api-domain: the backend origin is not bound yet, nothing deployed"
@@ -208,14 +208,6 @@ runs:
           "${{ github.action_path }}/runtime_env_parse.py" \
           "${{ github.action_path }}/edge_vhost.py" \
           "${{ github.action_path }}/edge_health.py" \
-          "${{ github.action_path }}/identity_diagnostics.py" \
-          "${{ github.action_path }}/network_runtime.py" \
-          "${{ github.action_path }}/network_contract.py" \
-          "${{ github.action_path }}/network_inventory.py" \
-          "${{ github.action_path }}/network_owned_inventory.py" \
-          "${{ github.action_path }}/network_readback.py" \
-          "${{ github.action_path }}/network_pools.py" \
-          "${{ github.action_path }}/network_prepare.py" \
           "${{ github.action_path }}/deploy_evidence.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
@@ -279,33 +271,6 @@ runs:
         path: ${{ steps.identity_diagnostics.outputs.result }}
         if-no-files-found: error
 
-    - name: Read backend network diagnostics
-      id: network_diagnostics
-      if: inputs.operation == 'network-diagnostics'
-      shell: bash
-      env:
-        DIAGNOSTIC_APP: ${{ inputs.app-name }}
-        DIAGNOSTIC_HOST: ${{ inputs.host }}
-        DIAGNOSTIC_USER: ${{ inputs.ssh-user }}
-        DIAGNOSTIC_PROVIDER: ${{ inputs.diagnostic-provider }}
-      run: |
-        RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-network-diagnostics.XXXXXX")"
-        echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
-        python3 "${{ github.action_path }}/network_diagnostics.py" \
-          --app "$DIAGNOSTIC_APP" --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" \
-          --provider "$DIAGNOSTIC_PROVIDER" \
-          --output "$RESULT_DIR/result.json"
-
-    - name: Retain backend network diagnostics
-      if: always() && inputs.operation == 'network-diagnostics'
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
-      env:
-        NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
-      with:
-        name: backend-network-diagnostics-${{ github.job }}-${{ github.run_attempt }}
-        path: ${{ steps.network_diagnostics.outputs.result }}
-        if-no-files-found: error
-
     - name: Cleanup key
       if: always()
       shell: bash

package/backend-action/configure_vhost.py

@@ -1,4 +1,4 @@
-"""Update managed nginx transport without discarding Certbot's HTTPS configuration."""
+"""Render the managed nginx vhost, or update its upstream without discarding Certbot's older HTTPS edits."""
 import hashlib
 import os
 from pathlib import Path
@@ -8,6 +8,10 @@ import subprocess
 import sys
 import tempfile
 
+# Certbot's webroot for every managed name: first issuance and the host's renew timer answer HTTP-01 from here.
+ACME_ROOT = "/var/lib/gowalk-acme"
+STAGES = ("update", "acme", "tls")
+
 
 class NginxRejected(Exception):
     """nginx refused the updated vhost; the previous file is back in place."""
@@ -36,22 +40,10 @@ def transport(text, domain):
     return mapping + result
 
 
-def content(previous, domain, port):
-    if not re.fullmatch(r"[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?", domain) or not 0 < port < 65536:
-        raise ValueError("invalid domain or port")
-    if previous:
-        names = re.findall(r"(?m)^\s*server_name\s+([^;]+);", previous)
-        if not names or any(name.strip() != domain for name in names):
-            raise ValueError("vhost belongs to another domain")
-        pattern = r"(?m)^(\s*proxy_pass\s+http://127\.0\.0\.1:)\d+(;[^\n]*$)"
-        result, count = re.subn(pattern, lambda match: f"{match[1]}{port}{match[2]}", previous)
-        if count != 1:
-            raise ValueError("managed upstream is not unique")
-        return transport(result, domain)
-    return transport(f"""server {{
-    listen 80;
-    server_name {domain};
-    client_max_body_size 100m;
+def render(domain, port, tls):
+    """Port 80 always answers ACME challenges. Before the certificate exists it proxies too; once it exists,
+    port 80 redirects and port 443 proxies with the lineage Certbot keeps at the domain's own name."""
+    proxy = f"""    client_max_body_size 100m;
     location / {{
         proxy_pass http://127.0.0.1:{port};
         proxy_set_header Host $host;
@@ -61,7 +53,33 @@ def content(previous, domain, port):
         proxy_read_timeout 120s;
     }}
 }}
-""", domain)
+"""
+    http = (f"server {{\n    listen 80;\n    server_name {domain};\n"
+            f"    location ^~ /.well-known/acme-challenge/ {{ root {ACME_ROOT}; }}\n")
+    if not tls:
+        return http + proxy
+    # One-line redirect: edge_vhost adds its ingress guard to the only multi-line `location / {`, the proxy.
+    live = f"/etc/letsencrypt/live/{domain}"
+    return (http + "    location / { return 301 https://$host$request_uri; }\n}\n\n"
+            f"server {{\n    listen 443 ssl;\n    server_name {domain};\n"
+            f"    ssl_certificate {live}/fullchain.pem;\n    ssl_certificate_key {live}/privkey.pem;\n" + proxy)
+
+
+def content(previous, domain, port, stage="update"):
+    """`update` changes only the upstream port of an existing vhost; `acme` and `tls` render it afresh."""
+    if not re.fullmatch(r"[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?", domain) or not 0 < port < 65536 or stage not in STAGES:
+        raise ValueError("invalid domain, port or stage")
+    if previous:
+        names = re.findall(r"(?m)^\s*server_name\s+([^;]+);", previous)
+        if not names or any(name.strip() != domain for name in names):
+            raise ValueError("vhost belongs to another domain")
+    if stage != "update" or not previous:
+        return transport(render(domain, port, stage == "tls"), domain)
+    pattern = r"(?m)^(\s*proxy_pass\s+http://127\.0\.0\.1:)\d+(;[^\n]*$)"
+    result, count = re.subn(pattern, lambda match: f"{match[1]}{port}{match[2]}", previous)
+    if count != 1:
+        raise ValueError("managed upstream is not unique")
+    return transport(result, domain)
 
 
 def replace(path, data, mode):
@@ -77,7 +95,7 @@ def replace(path, data, mode):
         Path(temporary).unlink(missing_ok=True)
 
 
-def configure(path, domain, port, run=subprocess.run):
+def configure(path, domain, port, run=subprocess.run, stage="update"):
     """Write the vhost, then test and reload nginx; on any failure restore the previous file, as edge does.
 
     A change nginx refuses must not stay on disk: every later `nginx -t` on the host, this deploy's own
@@ -88,7 +106,7 @@ def configure(path, domain, port, run=subprocess.run):
     if path.is_symlink():
         raise ValueError("managed vhost must not be a symlink")
     previous = path.read_text() if path.exists() else ""
-    updated = content(previous, domain, port)
+    updated = content(previous, domain, port, stage)
     if previous == updated:
         return "unchanged"
     saved = path.read_bytes() if path.exists() else None
@@ -108,7 +126,7 @@ def configure(path, domain, port, run=subprocess.run):
 
 if __name__ == "__main__":
     try:
-        print(configure(Path(sys.argv[1]), sys.argv[2], int(sys.argv[3])))
+        print(configure(Path(sys.argv[1]), sys.argv[2], int(sys.argv[3]), stage=(sys.argv[4:5] or ["update"])[0]))
     except NginxRejected:
         sys.exit("nginx rejected the managed vhost update; the previous vhost is restored")
     except (OSError, ValueError):

package/backend-action/edge_vhost.py

@@ -53,8 +53,8 @@ def validate(config, app, domain, nginx_dir=NGINX_DIR):
     return value
 
 
-def edge_content(text, domain, port, include):
-    updated = content(text, domain, port)
+def edge_content(text, domain, port, include, stage="update"):
+    updated = content(text, domain, port, stage)
     directive = f"        include {include};\n"
     if re.search(r"[\s;{}]", str(include)):
         raise ValueError("backend_ingress_path_invalid")
@@ -69,7 +69,7 @@ def edge_content(text, domain, port, include):
     return updated
 
 
-def planned(config, app, domain, port, nginx_dir=NGINX_DIR):
+def planned(config, app, domain, port, nginx_dir=NGINX_DIR, stage="update"):
     value = validate(config, app, domain, nginx_dir)
     if value["ingress_required"] != "true":
         raise ValueError("backend_ingress_configuration_required")
@@ -78,7 +78,7 @@ def planned(config, app, domain, port, nginx_dir=NGINX_DIR):
     guard = (f'if ($http_x_app_robot_backend_token != "{token}") {{ return 403; }}\n'
              'proxy_set_header X-App-Robot-Backend-Token "";\n')
     files = {include: (guard.encode(), 0o600),
-             edge: (edge_content(previous(edge), domain, port, include).encode(), 0o644)}
+             edge: (edge_content(previous(edge), domain, port, include, stage).encode(), 0o644)}
     old_domain = recorded_domain(legacy)
     if old_domain:
         files[legacy] = (content(previous(legacy), old_domain, port).encode(),
@@ -86,8 +86,8 @@ def planned(config, app, domain, port, nginx_dir=NGINX_DIR):
     return files
 
 
-def configure(config, app, domain, port, nginx_dir=NGINX_DIR, run=subprocess.run):
-    files = planned(config, app, domain, port, nginx_dir)
+def configure(config, app, domain, port, nginx_dir=NGINX_DIR, run=subprocess.run, stage="update"):
+    files = planned(config, app, domain, port, nginx_dir, stage)
     saved = {path: ((path.read_bytes(), stat.S_IMODE(path.stat().st_mode)) if path.exists() else None)
              for path in files}
     changes = {path: value for path, value in files.items() if saved[path] != value}
@@ -113,7 +113,7 @@ def main():
     if operation == "validate":
         validate(config, app, domain)
     elif operation == "configure":
-        print(configure(config, app, domain, int(sys.argv[5])))
+        print(configure(config, app, domain, int(sys.argv[5]), stage=(sys.argv[6:7] or ["update"])[0]))
     else:
         raise ValueError("backend_edge_operation_invalid")